- baseband-devel - lists.osmocom.org

Re: imm ass packages
by g.roelant＠telenet.be 14 Dec '12

14 Dec '12

sorry, i made a type in wireshark i see 31 06 3f in documentation is see 2d 06 3f now you tell me that only the 3f is responsible for detecting a imm ass packet. if i wanted to detect (grep) for imm ass., shall i look for 31 06 3f or 2d 06 3f? ----- Oorspronkelijk e-mail ----- Van: "oxccoxcc oxccoxcc" <oxccoxcc(a)yandex.ru> Aan: "g roelant" <g.roelant(a)telenet.be>, "osmocomBB" <baseband-devel(a)lists.osmocom.org> Verzonden: Vrijdag 14 december 2012 16:03:34 Onderwerp: Re: imm ass packages wireshark processing of imm ass packets seems normally. Looks like a bug with partial release complete messages. But wireshark has a signature for it: http://anonsvn.wireshark.org/wireshark/trunk/epan/dissectors/packet-gsm_a_r… Try to write in the wireshark forum. 14.12.2012, 14:22, "g.roelant(a)telenet.be" <g.roelant(a)telenet.be>: > In wireshark i see immediate assignment packages... > they are like 31 06 0f > but in the documentation they are like 2d 06 3f > what am i doing wrong? > i'm listening to a belgium operator called proximus. > kind regards

2 1

stupid question
by g.roelant＠telenet.be 14 Dec '12

14 Dec '12

Are the bursts captured with ccch_scan in burst_ind branch the same as the bursts captured with usrp2? do they result in the same file? i guess not... kind regards

2 1

imm ass packages
by g.roelant＠telenet.be 14 Dec '12

14 Dec '12

In wireshark i see immediate assignment packages... they are like 31 06 0f but in the documentation they are like 2d 06 3f what am i doing wrong? i'm listening to a belgium operator called proximus. kind regards

1 0

bursts dat files
by g.roelant＠telenet.be 10 Dec '12

10 Dec '12

Hi, I'm using the sylvain/burst_ind branch and ccch_scan. this produces bursts files. with which application can i view them? what is the format of these dat files? i cannot open them with wireshark... any hints? kind regards

4 5

another newbie question
by g.roelant＠telenet.be 10 Dec '12

10 Dec '12

I want to try to alter the mobile app (in gsm48_rr.c) to listen to all tmsi's. i changed the code and altered all if statements where in the else part was the log 'Not for us' i'm hoping the phone will start following the conversation with the immediate assignment packages... this way i can start logging the beginning of the encryption.... am i doing stupid things? or is there already an app that does this? thanks

4 4

AW: Re: AW: Re: beginners question
by Denis Simonet 08 Dec '12

08 Dec '12

For example. (reply-to doesn't seem to be set correctly in the list, btw?) Von Samsung Mobile gesendetg.roelant(a)telenet.be hat geschrieben:and than write the file with wireshark? i'm already using the mobile app with succes. Van: "Denis Simonet" <denis.simonet(a)bluewin.ch> Aan: "g roelant" <g.roelant(a)telenet.be> Verzonden: Zaterdag 8 december 2012 18:26:19 Onderwerp: AW: Re: beginners question You probably want to use the -i switch with a layer23 app and capture gsmtap with Wireshark. Best regards Denis Von Samsung Mobile gesendet g.roelant(a)telenet.be hat geschrieben: I want to write the raw data to a file. is that possible with a command? tune the gsm to a channel (for inst. 67) and capture all raw data into a file. ----- Oorspronkelijk e-mail ----- Van: "Alexander Huemer" <alexander.huemer(a)xx.vu> Aan: baseband-devel(a)lists.osmocom.org Verzonden: Vrijdag 7 december 2012 22:54:46 Onderwerp: Re: beginners question Hi g, On Fri, Dec 07, 2012 at 10:09:06PM +0100, g.roelant(a)telenet.be wrote: > How can i write the burst frames? Your question is very unspecific and therefore unlikely to be answered. You may want to rethink what exactly you want to know. Then, rephrase your question. Kind regards, -Alexander Huemer

2 1

beginners question
by g.roelant＠telenet.be 08 Dec '12

08 Dec '12

Hi, How can i write the burst frames? thanks

2 2

[PATCH] Add a5/3 support.
by ☎ 08 Dec '12

08 Dec '12

Hello. Attached patch will bring a5/3 support to osmo_a5. The implementatin is done based on spec, results are compared to reference implementation from standard and test vectors. Unfortunately there are several deficiencies: - it doesn't work with real phonein test network yet - no tests included - code is probably suboptimal here and there Anyway I would love to read your comments. It would be especially great if someone will manage to test it against real phones in actual network. -- best regards, Max, http://fairwaves.ru

5 11

Possible bug in "gsm48_decode_lai" code
by Bhaskar11 06 Dec '12

06 Dec '12

While running Cell-Log application, I found that the main branch of OsmocomBB gives wrong value of MCC/MNC in hex (but correct one in decimal), but the Sylvain testing branch gives correct value. In practice this means compiling Cell-Log in testing branch gives the name of the country, but the compiling it in main branch does not recognise the country. Other side-effects are unknown to me at present. Tracing through the source leads to the "gsm48_decode_lai" as the culprit. The code seems correct in the testing branch, but has not been updated in the main. Moreover, the code is shifted out from gsm48.c to sysinfo.c in the testing branch. Testing branch decodes MCC/MNC to hex: *mcc = ((lai->digits[0] & 0x0f) << 8) | (lai->digits[0] & 0xf0) | (lai->digits[1] & 0x0f); But main branch decodes MCC/MNC to decimal: *mcc = (lai->digits[0] & 0x0f) * 100 + (lai->digits[0] >> 4) * 10 + (lai->digits[1] & 0x0f); The comment in main branch states that "/* Attention: this function retunrs true integers, not hex! */". There is no such comment in the testing branch. So is this a problem because Cell_Log wrongly uses gsm48_decode_lai? Or does gsm48_decode_lai need to be updated in the main branch? B.

4 4

[PATCH 3/3] Add A5/3 support.
by Max Suraev 06 Dec '12

06 Dec '12

--- src/gsm/a5.c | 43 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) diff --git a/src/gsm/a5.c b/src/gsm/a5.c index 93b22c7..5815aa7 100644 --- a/src/gsm/a5.c +++ b/src/gsm/a5.c @@ -39,6 +39,7 @@ #include <string.h> #include <osmocom/core/bits.h> #include <osmocom/gsm/a5.h> +#include <osmocom/gsm/kasumi.h> /*! \brief Main method to generate a A5/x cipher stream * \param[in] n Which A5/x method to use @@ -71,6 +72,10 @@ osmo_a5(int n, const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul) osmo_a5_2(key, fn, dl, ul); break; + case 3: + osmo_a5_3(key, fn, dl, ul); + break; + default: /* a5/[4..7] not supported here/yet */ return -ENOTSUP; @@ -368,4 +373,42 @@ osmo_a5_2(const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul) } } +/* ------------------------------------------------------------------------ */ +/* A5/3 */ +/* ------------------------------------------------------------------------ */ + +/*! \brief Generate a GSM A5/3 cipher stream + * \param[in] key 8 byte array for the key (as received from the SIM) + * \param[in] fn Frame number + * \param[out] dl Pointer to array of ubits to return Downlink cipher stream + * \param[out] ul Pointer to array of ubits to return Uplink cipher stream + * + * Either (or both) of dl/ul should be NULL if not needed. + * + * Implementation based on specifications from 3GPP TS 55.216, 3GPP TR 55.919 and ETSI TS 135 202 + * with slight simplifications (CE hardcoded to 0). + */ +void +osmo_a5_3(const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul) +{ + /* internal function require 128 bit key so we expand by concatenating supplied 64 bit key */ + uint8_t i, ck[16], gamma[32], _key[8]; + memcpy(_key, key, 8); + osmo_revbytes_buf(_key, 8); /* reverse key byte order to match the way it's stored in SIM */ + memcpy(ck, _key, 8); + memcpy(ck + 8, _key, 8); + + uint32_t fn_count = osmo_a5_fn_count(fn); /* Frame count load */ + if (dl) { + kgcore(0xF, 0, fn_count, 0, ck, gamma, 114); + osmo_pbit2ubit(dl, gamma, 114); + } + if (ul) { + kgcore(0xF, 0, fn_count, 0, ck, gamma, 228); + uint8_t uplink[15]; + for(i = 0; i < 15; i++) uplink[i] = (gamma[i + 14] << 2) + (gamma[i + 15] >> 6); + osmo_pbit2ubit(ul, uplink, 114); + } +} + /*! @} */ -- 1.7.10.4 --------------000004050908040808070403--

1 0

[PATCH 2/3] Add Kasumi implementation.
by Max Suraev 06 Dec '12

06 Dec '12

--- include/Makefile.am | 1 + include/osmocom/gsm/kasumi.h | 25 ++++++ src/gsm/Makefile.am | 2 +- src/gsm/kasumi.c | 192 ++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 219 insertions(+), 1 deletion(-) create mode 100644 include/osmocom/gsm/kasumi.h create mode 100644 src/gsm/kasumi.c diff --git a/include/Makefile.am b/include/Makefile.am index 60b9ea9..d6f262d 100644 --- a/include/Makefile.am +++ b/include/Makefile.am @@ -38,6 +38,7 @@ nobase_include_HEADERS = \ osmocom/gprs/protocol/gsm_08_16.h \ osmocom/gprs/protocol/gsm_08_18.h \ osmocom/gsm/a5.h \ + osmocom/gsm/kasumi.h \ osmocom/gsm/abis_nm.h \ osmocom/gsm/comp128.h \ osmocom/gsm/gan.h \ diff --git a/include/osmocom/gsm/kasumi.h b/include/osmocom/gsm/kasumi.h new file mode 100644 index 0000000..39d8b8a --- /dev/null +++ b/include/osmocom/gsm/kasumi.h @@ -0,0 +1,25 @@ +/* + * COMP128 header + * + * See comp128.c for details + */ + +#ifndef __KASUMI_H__ +#define __KASUMI_H__ + +#include <stdint.h> + +/* + * Implementation of the KGCORE algorithm (used by A3/5, GEA3 and ECSD) + * + * CA : uint8_t + * cb : uint8_t + * cc : uint32_t + * cd : uint8_t + * ck : uint8_t [8] + * co : uint8_t [output, cl-dependent] + * cl : uint16_t + */ +void kgcore(uint8_t CA, uint8_t cb, uint32_t cc, uint8_t cd, uint8_t *ck, uint8_t *co, uint16_t cl); +#endif /* __KASUMI_H__ */ + diff --git a/src/gsm/Makefile.am b/src/gsm/Makefile.am index 0544e0a..c30a70c 100644 --- a/src/gsm/Makefile.am +++ b/src/gsm/Makefile.am @@ -12,7 +12,7 @@ noinst_HEADERS = milenage/aes.h milenage/aes_i.h milenage/aes_wrap.h \ lib_LTLIBRARIES = libosmogsm.la -libosmogsm_la_SOURCES = a5.c rxlev_stat.c tlv_parser.c comp128.c gsm_utils.c \ +libosmogsm_la_SOURCES = a5.c kasumi.c rxlev_stat.c tlv_parser.c comp128.c gsm_utils.c \ rsl.c gsm48.c gsm48_ie.c gsm0808.c sysinfo.c \ gprs_cipher_core.c gsm0480.c abis_nm.c gsm0502.c \ gsm0411_utils.c gsm0411_smc.c gsm0411_smr.c \ diff --git a/src/gsm/kasumi.c b/src/gsm/kasumi.c new file mode 100644 index 0000000..27015f8 --- /dev/null +++ b/src/gsm/kasumi.c @@ -0,0 +1,192 @@ +/* Kasumi cipher and KGcore functions */ + +/* (C) 2012 by Max.Suraev(a)fairwaves.ru <Max.Suraev(a)fairwaves.ru> + * + * All Rights Reserved + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License along + * with this program; if not, write to the Free Software Foundation, Inc., + * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + * + */ + +#include <stdint.h> +#include <osmocom/core/bits.h> + +static uint16_t +_kasumi_FI(uint16_t I, uint16_t skey) +{ + static uint16_t S7[] = { + 54, 50, 62, 56, 22, 34, 94, 96, 38, 6, 63, 93, 2, 18, 123, 33, + 55, 113, 39, 114, 21, 67, 65, 12, 47, 73, 46, 27, 25, 111, 124, 81, + 53, 9, 121, 79, 52, 60, 58, 48, 101, 127, 40, 120, 104, 70, 71, 43, + 20, 122, 72, 61, 23, 109, 13, 100, 77, 1, 16, 7, 82, 10, 105, 98, + 117, 116, 76, 11, 89, 106, 0,125,118, 99, 86, 69, 30, 57, 126, 87, + 112, 51, 17, 5, 95, 14, 90, 84, 91, 8, 35,103, 32, 97, 28, 66, + 102, 31, 26, 45, 75, 4, 85, 92, 37, 74, 80, 49, 68, 29, 115, 44, + 64, 107, 108, 24, 110, 83, 36, 78, 42, 19, 15, 41, 88, 119, 59, 3 + }; + static uint16_t S9[] = { + 167, 239, 161, 379, 391, 334, 9, 338, 38, 226, 48, 358, 452, 385, 90, 397, + 183, 253, 147, 331, 415, 340, 51, 362, 306, 500, 262, 82, 216, 159, 356, 177, + 175, 241, 489, 37, 206, 17, 0, 333, 44, 254, 378, 58, 143, 220, 81, 400, + 95, 3, 315, 245, 54, 235, 218, 405, 472, 264, 172, 494, 371, 290, 399, 76, + 165, 197, 395, 121, 257, 480, 423, 212, 240, 28, 462, 176, 406, 507, 288, 223, + 501, 407, 249, 265, 89, 186, 221, 428,164, 74, 440, 196, 458, 421, 350, 163, + 232, 158, 134, 354, 13, 250, 491, 142,191, 69, 193, 425, 152, 227, 366, 135, + 344, 300, 276, 242, 437, 320, 113, 278, 11, 243, 87, 317, 36, 93, 496, 27, + 487, 446, 482, 41, 68, 156, 457, 131, 326, 403, 339, 20, 39, 115, 442, 124, + 475, 384, 508, 53, 112, 170, 479, 151, 126, 169, 73, 268, 279, 321, 168, 364, + 363, 292, 46, 499, 393, 327, 324, 24, 456, 267, 157, 460, 488, 426, 309, 229, + 439, 506, 208, 271, 349, 401, 434, 236, 16, 209, 359, 52, 56, 120, 199, 277, + 465, 416, 252, 287, 246, 6, 83, 305, 420, 345, 153,502, 65, 61, 244, 282, + 173, 222, 418, 67, 386, 368, 261, 101, 476, 291, 195,430, 49, 79, 166, 330, + 280, 383, 373, 128, 382, 408, 155, 495, 367, 388, 274, 107, 459, 417, 62, 454, + 132, 225, 203, 316, 234, 14, 301, 91, 503, 286, 424, 211, 347, 307, 140, 374, + 35, 103, 125, 427, 19, 214, 453, 146, 498, 314, 444, 230, 256, 329, 198, 285, + 50, 116, 78, 410, 10, 205, 510, 171, 231, 45, 139, 467, 29, 86, 505, 32, + 72, 26, 342, 150, 313, 490, 431, 238, 411, 325, 149, 473, 40, 119, 174, 355, + 185, 233, 389, 71, 448, 273, 372, 55, 110, 178, 322, 12, 469, 392, 369, 190, + 1, 109, 375, 137, 181, 88, 75, 308, 260, 484, 98, 272, 370, 275, 412, 111, + 336, 318, 4, 504, 492, 259, 304, 77, 337, 435, 21, 357, 303, 332, 483, 18, + 47, 85, 25, 497, 474, 289, 100, 269, 296, 478, 270, 106, 31, 104, 433, 84, + 414, 486, 394, 96, 99, 154, 511, 148, 413, 361, 409, 255, 162, 215, 302, 201, + 266, 351, 343, 144, 441, 365, 108, 298, 251, 34, 182, 509, 138, 210, 335, 133, + 311, 352, 328, 141, 396, 346, 123, 319, 450, 281, 429, 228, 443, 481, 92, 404, + 485, 422, 248, 297, 23, 213, 130, 466, 22, 217, 283, 70, 294, 360, 419, 127, + 312, 377, 7, 468, 194, 2, 117, 295, 463, 258, 224, 447, 247, 187, 80, 398, + 284, 353, 105, 390, 299, 471, 470, 184, 57, 200, 348, 63, 204, 188, 33, 451, + 97, 30, 310, 219, 94, 160, 129, 493, 64, 179, 263, 102, 189, 207, 114, 402, + 438, 477, 387, 122, 192, 42, 381, 5, 145, 118, 180, 449, 293, 323, 136, 380, + 43, 66, 60, 455, 341, 445, 202, 432, 8, 237, 15, 376, 436, 464, 59, 461 + }; + uint16_t L, R; + + /* Split 16 bit input into two unequal halves: 9 and 7 bits, same for subkey */ + L = I >> 7; /* take 9 bits */ + R = I & 0x7F; /* take 7 bits */ + + L = S9[L] ^ R; + R = S7[R] ^ (L & 0x7F); + + L ^= (skey & 0x1FF); + R ^= (skey >> 9); + + L = S9[L] ^ R; + R = S7[R] ^ (L & 0x7F); + + return (R << 9) + L; +} + +static uint32_t +_kasumi_FO(uint32_t I, uint16_t *KOi1, uint16_t *KOi2, uint16_t *KOi3, uint16_t *KIi1, uint16_t *KIi2, uint16_t *KIi3, unsigned i) +{ + uint16_t L = I >> 16, R = I; /* Split 32 bit input into Left and Right parts */ + + L ^= KOi1[i]; + L = _kasumi_FI(L, KIi1[i]); + L ^= R; + + R ^= KOi2[i]; + R = _kasumi_FI(R, KIi2[i]); + R ^= L; + + L ^= KOi3[i]; + L = _kasumi_FI(L, KIi3[i]); + L ^= R; + + return (((uint32_t)R) << 16) + L; +} + +static uint32_t +_kasumi_FL(uint32_t I, uint16_t *KLi1, uint16_t *KLi2, unsigned i) +{ + uint16_t L = I >> 16, R = I, tmp; /* Split 32 bit input into Left and Right parts */ + + tmp = L & KLi1[i]; + R ^= rol16(tmp, 1); + + tmp = R | KLi2[i]; + L ^= rol16(tmp, 1); + + return (((uint32_t)L) << 16) + R; +} + +static uint64_t +_kasumi(uint64_t P, uint16_t *KLi1, uint16_t *KLi2, uint16_t *KOi1, uint16_t *KOi2, uint16_t *KOi3, uint16_t *KIi1, uint16_t *KIi2, uint16_t *KIi3) +{ + uint32_t i, L = P >> 32, R = P; /* Split 64 bit input into Left and Right parts */ + + for (i = 0; i < 8; i++) + { + R ^= _kasumi_FO(_kasumi_FL(L, KLi1, KLi2, i), KOi1, KOi2, KOi3, KIi1, KIi2, KIi3, i); /* odd round */ + i++; + L ^= _kasumi_FL(_kasumi_FO(R, KOi1, KOi2, KOi3, KIi1, KIi2, KIi3, i), KLi1, KLi2, i); /* even round */ + } + return (((uint64_t)L) << 32) + R; /* Concatenate Left and Right 32 bits into 64 bit ciphertext */ +} + +/*! \brief Expand key into set of subkeys + * \param[in] key (128 bits) as array of bytes + * \param[out] arrays of round-specific subkeys - see TS 135 202 for details + */ +static void +_kasumi_key_expand(uint8_t *key, uint16_t *KLi1, uint16_t *KLi2, uint16_t *KOi1, uint16_t *KOi2, uint16_t *KOi3, uint16_t *KIi1, uint16_t *KIi2, uint16_t *KIi3) +{ + uint16_t i, C[] = { 0x0123, 0x4567, 0x89AB, 0xCDEF, 0xFEDC, 0xBA98, 0x7654, 0x3210 }; + + for (i = 0; i < 8; i++) /* Work with 16 bit subkeys and create prime subkeys */ + { + C[i] ^= osmo_get2bytes(key + i * 2); + } + /* C[] now stores K-prime[] */ + for (i = 0; i < 8; i++) /* Create round-specific subkeys */ + { + KLi1[i] = rol16(osmo_get2bytes(key + i * 2), 1); + KLi2[i] = C[(i + 2) & 0x7]; + + KOi1[i] = rol16(osmo_get2bytes(key + ((2 * (i + 1)) & 0xE)), 5); + KOi2[i] = rol16(osmo_get2bytes(key + ((2 * (i + 5)) & 0xE)), 8); + KOi3[i] = rol16(osmo_get2bytes(key + ((2 * (i + 6)) & 0xE)), 13); + + KIi1[i] = C[(i + 4) & 0x7]; + KIi2[i] = C[(i + 3) & 0x7]; + KIi3[i] = C[(i + 7) & 0x7]; + } +} + +void +kgcore(uint8_t CA, uint8_t cb, uint32_t cc, uint8_t cd, uint8_t *ck, uint8_t *co, uint16_t cl) +{ + uint16_t KLi1[8], KLi2[8], KOi1[8], KOi2[8], KOi3[8], KIi1[8], KIi2[8], KIi3[8], i; + uint64_t A = ((uint64_t)cc) << 32, BLK = 0, _ca = ((uint64_t)CA << 16) ; + A |= _ca; + _ca = (uint64_t)((cb << 3) | (cd << 2)) << 24; + A |= _ca; + /* Register loading complete: see TR 55.919 8.2 and TS 55.216 3.2 */ + + uint8_t ck_km[16]; + for (i = 0; i < 16; i++) ck_km[i] = ck[i] ^ 0x55; /* Modified key established */ + + /* preliminary round with modified key */ + _kasumi_key_expand(ck_km, KLi1, KLi2, KOi1, KOi2, KOi3, KIi1, KIi2, KIi3); + A = _kasumi(A, KLi1, KLi2, KOi1, KOi2, KOi3, KIi1, KIi2, KIi3); + + /* Run Kasumi in OFB to obtain enough data for gamma. */ + _kasumi_key_expand(ck, KLi1, KLi2, KOi1, KOi2, KOi3, KIi1, KIi2, KIi3); + for (i = 0; i < cl / 64 + 1; i++) /* i is a block counter */ + { + BLK = _kasumi(A ^ i ^ BLK, KLi1, KLi2, KOi1, KOi2, KOi3, KIi1, KIi2, KIi3); + osmo_64pack2pbit(BLK, co + (i * 8)); + } +} -- 1.7.10.4 --------------000004050908040808070403 Content-Type: text/x-patch; name="0003-Add-A5-3-support.patch" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="0003-Add-A5-3-support.patch"

1 0

[PATCH 1/3] Add helper functions for a5/3.
by Max Suraev 06 Dec '12

06 Dec '12

--- include/osmocom/core/bits.h | 14 +++++++++++++- src/bits.c | 33 +++++++++++++++++++++++++++++++++ 2 files changed, 46 insertions(+), 1 deletion(-) diff --git a/include/osmocom/core/bits.h b/include/osmocom/core/bits.h index 4c68532..29a99ff 100644 --- a/include/osmocom/core/bits.h +++ b/include/osmocom/core/bits.h @@ -2,7 +2,7 @@ #define _OSMO_BITS_H #include <stdint.h> - +#include <stddef.h> /*! \defgroup bits soft, unpacked and packed bits * @{ */ @@ -73,6 +73,18 @@ uint32_t osmo_revbytebits_8(uint8_t x); /* \brief reverse the bits of each byte in a given buffer */ void osmo_revbytebits_buf(uint8_t *buf, int len); +/* \brief reverse the order of the bytes in a given buffer */ +void osmo_revbytes_buf(uint8_t *buf, size_t len); + +/* \brief left circular shift */ +uint16_t rol16(uint16_t in, unsigned shift); + +/* return 2 bytes from a given array glued into single uint16_t */ +uint16_t osmo_get2bytes(uint8_t *a); + +/* convert uint64_t into array of 8 bytes in out */ +void osmo_64pack2pbit(uint64_t in, pbit_t *out); + /*! @} */ #endif /* _OSMO_BITS_H */ diff --git a/src/bits.c b/src/bits.c index 4c67bdd..1df332b 100644 --- a/src/bits.c +++ b/src/bits.c @@ -185,4 +185,37 @@ void osmo_revbytebits_buf(uint8_t *buf, int len) } } +void osmo_revbytes_buf(uint8_t *buf, size_t len) +{ + uint8_t *end = buf + len - 1, tmp; + + while (buf < end) { + tmp = *buf; + *buf++ = *end; + *end-- = tmp; + } +} + +/* left circular shift */ +uint16_t rol16(uint16_t in, unsigned shift) +{ + return (in << shift) | (in >> (16 - shift)); +} + +/* return 2 bytes from a given array glued into single uint16_t */ +uint16_t osmo_get2bytes(uint8_t *a) +{ /* UNSAFE! Do NOT use unless you know what you are doing! */ + return (uint16_t)((((uint16_t)a[0]) << 8) + (uint16_t)a[1]); +} + +/* convert uint64_t into array of 8 bytes in out */ +void osmo_64pack2pbit(uint64_t in, pbit_t *out) +{ + int i; + for (i = 7; i >=0; i--) { + out[i] = in & 0xFF; + in >>= 8; + } +} + /*! @} */ -- 1.7.10.4 --------------000004050908040808070403 Content-Type: text/x-patch; name="0002-Add-Kasumi-implementation.patch" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="0002-Add-Kasumi-implementation.patch"

1 0

Is airprobe still being developed?
by Philip Peter 04 Dec '12

04 Dec '12

The last changes in the airprobe svn seem to be 17 months ago. I was wondering whether airprobe is assumed to be stable, without need for further development, has been superseded by a different toolkit or if it has been abandonded.

3 4

Simulator
by Akib Sayyed 02 Dec '12

02 Dec '12

Guys i want to test my code for errors. i want to know is there any simulator for calypso please let me know -- Akib Sayyed Matrix-Shell akibsayyed(a)gmail.com akibsayyed(a)matrixshell.com Mob:- +91-966-514-2243

1 0

[PATCH] Add return value to indicate unsopported cipher
by ☎ 30 Nov '12

30 Nov '12

Hello. Right now there's no way for user of osmo_a5(..) to understand if particular cipher (a5/3 for example) is supported or not. Attached patch adds simple return value to osmo_a5 to fix that. Of course I would rather see a5/3 included into mainline but in a meantime this patch might be useful too :) -- best regards, Max, http://fairwaves.ru

2 3

[PATCH] Add return value to indicate unsopported cipher.
by Max 29 Nov '12

29 Nov '12

--- include/osmocom/gsm/a5.h | 2 +- src/gsm/a5.c | 8 ++++++-- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/include/osmocom/gsm/a5.h b/include/osmocom/gsm/a5.h index 649dbab..f237c42 100644 --- a/include/osmocom/gsm/a5.h +++ b/include/osmocom/gsm/a5.h @@ -54,7 +54,7 @@ osmo_a5_fn_count(uint32_t fn) * - fn is the _real_ GSM frame number. * (converted internally to fn_count) */ -void osmo_a5(int n, const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul); +unsigned osmo_a5(int n, const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul); void osmo_a5_1(const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul); void osmo_a5_2(const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul); diff --git a/src/gsm/a5.c b/src/gsm/a5.c index 356060a..68d703a 100644 --- a/src/gsm/a5.c +++ b/src/gsm/a5.c @@ -45,10 +45,10 @@ * \param[out] dl Pointer to array of ubits to return Downlink cipher stream * \param[out] ul Pointer to array of ubits to return Uplink cipher stream * - * Currently A5/[0-2] are supported. + * Currently A5/[0-2] are supported: 0 returned in this case, 1 s returned otherwise. * Either (or both) of dl/ul can be NULL if not needed. */ -void +unsigned osmo_a5(int n, const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul) { switch (n) @@ -58,18 +58,22 @@ osmo_a5(int n, const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul) memset(dl, 0x00, 114); if (ul) memset(ul, 0x00, 114); + return 1; break; case 1: osmo_a5_1(key, fn, dl, ul); + return 1; break; case 2: osmo_a5_2(key, fn, dl, ul); + return 1; break; default: /* a5/[3..7] not supported here/yet */ + return 0; break; } } -- 1.7.10.4 --------------090904030806030201060909--

1 0

[PATCH] Add A5/3 support.
by Max 29 Nov '12

29 Nov '12

--- include/osmocom/gsm/a5.h | 4 +- src/gsm/a5.c | 246 ++++++++++++++++++++++++++++++++++++++++++++-- 2 files changed, 239 insertions(+), 11 deletions(-) diff --git a/include/osmocom/gsm/a5.h b/include/osmocom/gsm/a5.h index 649dbab..46cf4fb 100644 --- a/include/osmocom/gsm/a5.h +++ b/include/osmocom/gsm/a5.h @@ -54,10 +54,10 @@ osmo_a5_fn_count(uint32_t fn) * - fn is the _real_ GSM frame number. * (converted internally to fn_count) */ -void osmo_a5(int n, const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul); +int osmo_a5(int n, const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul); void osmo_a5_1(const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul); void osmo_a5_2(const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul); - +void osmo_a5_3(const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul); /*! @} */ #endif /* __OSMO_A5_H__ */ diff --git a/src/gsm/a5.c b/src/gsm/a5.c index 356060a..d95283e 100644 --- a/src/gsm/a5.c +++ b/src/gsm/a5.c @@ -33,9 +33,10 @@ /*! \file gsm/a5.c * \brief Osmocom GSM A5 ciphering algorithm implementation */ - +#include <stdio.h> #include <string.h> - +#include <errno.h> +#include <osmocom/core/bits.h> #include <osmocom/gsm/a5.h> /*! \brief Main method to generate a A5/x cipher stream @@ -45,10 +46,10 @@ * \param[out] dl Pointer to array of ubits to return Downlink cipher stream * \param[out] ul Pointer to array of ubits to return Uplink cipher stream * - * Currently A5/[0-2] are supported. + * Currently A5/[0-2] are supported: -ENOTSUP returned in this case, 0 returned for supported ciphers. * Either (or both) of dl/ul can be NULL if not needed. */ -void +int osmo_a5(int n, const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul) { switch (n) @@ -58,20 +59,25 @@ osmo_a5(int n, const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul) memset(dl, 0x00, 114); if (ul) memset(ul, 0x00, 114); - break; + return 0; case 1: osmo_a5_1(key, fn, dl, ul); - break; + return 0; case 2: osmo_a5_2(key, fn, dl, ul); - break; + return 0; + + case 3: + osmo_a5_3(key, fn, dl, ul); + return 0; default: - /* a5/[3..7] not supported here/yet */ - break; + /* a5/[4..7] not supported here/yet */ + return -ENOTSUP; } + return -ENOTSUP; /* make compiler happy */ } @@ -364,4 +370,226 @@ osmo_a5_2(const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul) } } +/* ------------------------------------------------------------------------ */ +/* A5/3 */ +/* ------------------------------------------------------------------------ */ + +uint16_t _rol16(uint16_t in, unsigned shift) +{ + return (in << shift) | (in >> (16 - shift)); +} + +uint16_t osmo_get2bytes(uint8_t *a) +{ /* UNSAFE! Do NOT use unless you know what you are doing! */ + return (uint16_t)((((uint16_t)a[0]) << 8) + (uint16_t)a[1]); +} + +void osmo_64pack2pbit(uint64_t in, pbit_t *out) +{ + int i; + for (i = 7; i >=0; i--) { + out[i] = in & 0xFF; + in >>= 8; + } +} + +uint16_t +_a5_3_kasumi_FI(uint16_t I, uint16_t skey) +{ + static uint16_t S7[] = { + 54, 50, 62, 56, 22, 34, 94, 96, 38, 6, 63, 93, 2, 18, 123, 33, + 55, 113, 39, 114, 21, 67, 65, 12, 47, 73, 46, 27, 25, 111, 124, 81, + 53, 9, 121, 79, 52, 60, 58, 48, 101, 127, 40, 120, 104, 70, 71, 43, + 20, 122, 72, 61, 23, 109, 13, 100, 77, 1, 16, 7, 82, 10, 105, 98, + 117, 116, 76, 11, 89, 106, 0,125,118, 99, 86, 69, 30, 57, 126, 87, + 112, 51, 17, 5, 95, 14, 90, 84, 91, 8, 35,103, 32, 97, 28, 66, + 102, 31, 26, 45, 75, 4, 85, 92, 37, 74, 80, 49, 68, 29, 115, 44, + 64, 107, 108, 24, 110, 83, 36, 78, 42, 19, 15, 41, 88, 119, 59, 3 + }; + static uint16_t S9[] = { + 167, 239, 161, 379, 391, 334, 9, 338, 38, 226, 48, 358, 452, 385, 90, 397, + 183, 253, 147, 331, 415, 340, 51, 362, 306, 500, 262, 82, 216, 159, 356, 177, + 175, 241, 489, 37, 206, 17, 0, 333, 44, 254, 378, 58, 143, 220, 81, 400, + 95, 3, 315, 245, 54, 235, 218, 405, 472, 264, 172, 494, 371, 290, 399, 76, + 165, 197, 395, 121, 257, 480, 423, 212, 240, 28, 462, 176, 406, 507, 288, 223, + 501, 407, 249, 265, 89, 186, 221, 428,164, 74, 440, 196, 458, 421, 350, 163, + 232, 158, 134, 354, 13, 250, 491, 142,191, 69, 193, 425, 152, 227, 366, 135, + 344, 300, 276, 242, 437, 320, 113, 278, 11, 243, 87, 317, 36, 93, 496, 27, + 487, 446, 482, 41, 68, 156, 457, 131, 326, 403, 339, 20, 39, 115, 442, 124, + 475, 384, 508, 53, 112, 170, 479, 151, 126, 169, 73, 268, 279, 321, 168, 364, + 363, 292, 46, 499, 393, 327, 324, 24, 456, 267, 157, 460, 488, 426, 309, 229, + 439, 506, 208, 271, 349, 401, 434, 236, 16, 209, 359, 52, 56, 120, 199, 277, + 465, 416, 252, 287, 246, 6, 83, 305, 420, 345, 153,502, 65, 61, 244, 282, + 173, 222, 418, 67, 386, 368, 261, 101, 476, 291, 195,430, 49, 79, 166, 330, + 280, 383, 373, 128, 382, 408, 155, 495, 367, 388, 274, 107, 459, 417, 62, 454, + 132, 225, 203, 316, 234, 14, 301, 91, 503, 286, 424, 211, 347, 307, 140, 374, + 35, 103, 125, 427, 19, 214, 453, 146, 498, 314, 444, 230, 256, 329, 198, 285, + 50, 116, 78, 410, 10, 205, 510, 171, 231, 45, 139, 467, 29, 86, 505, 32, + 72, 26, 342, 150, 313, 490, 431, 238, 411, 325, 149, 473, 40, 119, 174, 355, + 185, 233, 389, 71, 448, 273, 372, 55, 110, 178, 322, 12, 469, 392, 369, 190, + 1, 109, 375, 137, 181, 88, 75, 308, 260, 484, 98, 272, 370, 275, 412, 111, + 336, 318, 4, 504, 492, 259, 304, 77, 337, 435, 21, 357, 303, 332, 483, 18, + 47, 85, 25, 497, 474, 289, 100, 269, 296, 478, 270, 106, 31, 104, 433, 84, + 414, 486, 394, 96, 99, 154, 511, 148, 413, 361, 409, 255, 162, 215, 302, 201, + 266, 351, 343, 144, 441, 365, 108, 298, 251, 34, 182, 509, 138, 210, 335, 133, + 311, 352, 328, 141, 396, 346, 123, 319, 450, 281, 429, 228, 443, 481, 92, 404, + 485, 422, 248, 297, 23, 213, 130, 466, 22, 217, 283, 70, 294, 360, 419, 127, + 312, 377, 7, 468, 194, 2, 117, 295, 463, 258, 224, 447, 247, 187, 80, 398, + 284, 353, 105, 390, 299, 471, 470, 184, 57, 200, 348, 63, 204, 188, 33, 451, + 97, 30, 310, 219, 94, 160, 129, 493, 64, 179, 263, 102, 189, 207, 114, 402, + 438, 477, 387, 122, 192, 42, 381, 5, 145, 118, 180, 449, 293, 323, 136, 380, + 43, 66, 60, 455, 341, 445, 202, 432, 8, 237, 15, 376, 436, 464, 59, 461 + }; + uint16_t L, R; + + /* Split 16 bit input into two unequal halves: 9 and 7 bits, same for subkey */ + L = I >> 7; /* take 9 bits */ + R = I & 0x7F; /* take 7 bits */ + + L = S9[L] ^ R; + R = S7[R] ^ (L & 0x7F); + + L ^= (skey & 0x1FF); + R ^= (skey >> 9); + + L = S9[L] ^ R; + R = S7[R] ^ (L & 0x7F); + + return (R << 9) + L; +} + +uint32_t +_a5_3_kasumi_FO(uint32_t I, uint16_t *KOi1, uint16_t *KOi2, uint16_t *KOi3, uint16_t *KIi1, uint16_t *KIi2, uint16_t *KIi3, unsigned i) +{ + uint16_t L = I >> 16, R = I; /* Split 32 bit input into Left and Right parts */ + + L ^= KOi1[i]; + L = _a5_3_kasumi_FI(L, KIi1[i]); + L ^= R; + + R ^= KOi2[i]; + R =_a5_3_kasumi_FI(R, KIi2[i]); + R ^= L; + + L ^= KOi3[i]; + L = _a5_3_kasumi_FI(L, KIi3[i]); + L ^= R; + + return (((uint32_t)R) << 16) + L; +} + +uint32_t +_a5_3_kasumi_FL(uint32_t I, uint16_t *KLi1, uint16_t *KLi2, unsigned i) +{ + uint16_t L = I >> 16, R = I, tmp; /* Split 32 bit input into Left and Right parts */ + + tmp = L & KLi1[i]; + R ^= _rol16(tmp, 1); + + tmp = R | KLi2[i]; + L ^= _rol16(tmp, 1); + + return (((uint32_t)L) << 16) + R; +} + +uint64_t +_a5_3_kasumi(uint64_t P, uint16_t *KLi1, uint16_t *KLi2, uint16_t *KOi1, uint16_t *KOi2, uint16_t *KOi3, uint16_t *KIi1, uint16_t *KIi2, uint16_t *KIi3) +{ + uint32_t i, L = P >> 32, R = P; /* Split 64 bit input into Left and Right parts */ + + for (i = 0; i < 8; i++) + { + R ^= _a5_3_kasumi_FO(_a5_3_kasumi_FL(L, KLi1, KLi2, i), KOi1, KOi2, KOi3, KIi1, KIi2, KIi3, i); /* odd round */ + i++; + L ^= _a5_3_kasumi_FL(_a5_3_kasumi_FO(R, KOi1, KOi2, KOi3, KIi1, KIi2, KIi3, i), KLi1, KLi2, i); /* even round */ + } + return (((uint64_t)L) << 32) + R; /* Concatenate Left and Right 32 bits into 64 bit ciphertext */ +} + +/*! \brief Expand key into set of subkeys + * \param[in] key (128 bits) as array of bytes + * \param[out] arrays of round-specific subkeys - see TS 135 202 for details + */ +void +_a5_3_key_expand(uint8_t *key, uint16_t *KLi1, uint16_t *KLi2, uint16_t *KOi1, uint16_t *KOi2, uint16_t *KOi3, uint16_t *KIi1, uint16_t *KIi2, uint16_t *KIi3) +{ + uint16_t i, C[] = { 0x0123, 0x4567, 0x89AB, 0xCDEF, 0xFEDC, 0xBA98, 0x7654, 0x3210 }; + + for (i = 0; i < 8; i++) /* Work with 16 bit subkeys and create prime subkeys */ + { + C[i] ^= osmo_get2bytes(key + i * 2); + } + /* C[] now stores K-prime[] */ + for (i = 0; i < 8; i++) /* Create round-specific subkeys */ + { + KLi1[i] = _rol16(osmo_get2bytes(key + i * 2), 1); + KLi2[i] = C[(i + 2) & 0x7]; + + KOi1[i] = _rol16(osmo_get2bytes(key + ((2 * (i + 1)) & 0xE)), 5); + KOi2[i] = _rol16(osmo_get2bytes(key + ((2 * (i + 5)) & 0xE)), 8); + KOi3[i] = _rol16(osmo_get2bytes(key + ((2 * (i + 6)) & 0xE)), 13); + + KIi1[i] = C[(i + 4) & 0x7]; + KIi2[i] = C[(i + 3) & 0x7]; + KIi3[i] = C[(i + 7) & 0x7]; + } +} + +void +_a5_3_kgcore_gsm(uint8_t CA, uint8_t cb, uint32_t cc, uint8_t cd, uint8_t *ck, uint8_t *co, uint16_t cl) +{ + uint16_t KLi1[8], KLi2[8], KOi1[8], KOi2[8], KOi3[8], KIi1[8], KIi2[8], KIi3[8], i; + uint64_t A = ((uint64_t)cc) << 32, BLK = 0, _ca = ((uint64_t)CA << 16) ; + A |= _ca; + _ca = (uint64_t)((cb << 3) | (cd << 2)) << 24; + A |= _ca; + /* Register loading complete: see TR 55.919 8.2 and TS 55.216 3.2 */ + + uint8_t ck_km[16]; + for (i = 0; i < 16; i++) ck_km[i] = ck[i] ^ 0x55; /* Modified key established */ + + /* preliminary round with modified key */ + _a5_3_key_expand(ck_km, KLi1, KLi2, KOi1, KOi2, KOi3, KIi1, KIi2, KIi3); + A = _a5_3_kasumi(A, KLi1, KLi2, KOi1, KOi2, KOi3, KIi1, KIi2, KIi3); + + /* Run Kasumi in OFB to obtain enough data for gamma. */ + _a5_3_key_expand(ck, KLi1, KLi2, KOi1, KOi2, KOi3, KIi1, KIi2, KIi3); + for (i = 0; i < cl / 64 + 1; i++) /* i is a block counter */ + { + BLK = _a5_3_kasumi(A ^ i ^ BLK, KLi1, KLi2, KOi1, KOi2, KOi3, KIi1, KIi2, KIi3); + osmo_64pack2pbit(BLK, co + (i * 8)); + } +} + +/*! \brief Generate a GSM A5/3 cipher stream + * \param[in] key 8 byte array for the key (as received from the SIM) + * \param[in] fn Frame number + * \param[out] dl Pointer to array of ubits to return Downlink cipher stream + * \param[out] ul Pointer to array of ubits to return Uplink cipher stream + * + * Either (or both) of dl/ul should be NULL if not needed. + * + * Implementation based on specifications from 3GPP TS 55.216, 3GPP TR 55.919 and ETSI TS 135 202 + * with slight simplifications (CE hardcoded to 0). + */ +void +osmo_a5_3(const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul) +{ + /* internal function require 128 bit key so we expand by concatenating supplied 64 bit key */ + uint8_t i, ck[16], gamma[32]; + memcpy(ck, key, 8); + memcpy(ck + 8, key, 8); + uint32_t fn_count = osmo_a5_fn_count(fn); /* Frame count load */ + if (dl) { + _a5_3_kgcore_gsm(0xF, 0, fn_count, 0, ck, gamma, 114); + osmo_pbit2ubit(dl, gamma, 114); + } + if (ul) { + _a5_3_kgcore_gsm(0xF, 0, fn_count, 0, ck, gamma, 228); + uint8_t uplink[15]; + for(i = 0; i < 15; i++) uplink[i] = (gamma[i + 14] << 2) + (gamma[i + 15] >> 6); + osmo_pbit2ubit(ul, uplink, 114); + } +} + /*! @} */ -- 1.7.10.4 --------------080507080909000101000702--

1 0

Re: Programming SIM card RAND?
by Dieter Spaar 28 Nov '12

28 Nov '12

Hello Andrew, On Sat, 24 Nov 2012 10:42:00 +0000, "Andrew Back" <andrew(a)carrierdetect.com> wrote: > > I bought one of those generic test SIMs from eBay that claim to work > with HP8922 etc. testers. Now this is probably another stupid > question, but how do I determine the IMSI and Ki? Or maybe set them > (pySim-prog.py doesn't seem to work with it). For the IMSI you can read the appropriate EF of the SIM (the phone does the same to get the IMSI). Ki usually cannot be read back but because A3/A8 for a Test SIM is GSM XOR you can calculate Ki from the SIM response to the RUN GSM ALGORITHM command. OpenBSC contains code for the GSM XOR algorithm, this should give enough hints for how the calculation is done. For setting IMSI and Ki you most certainly have to contact the seller of the SIM card and hope that he can/will tell you the details. Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

2 1

Re: osmocom-commitlog Digest, Vol 557, Issue 1
by Andreas Eversberg 27 Nov '12

27 Nov '12

osmocom-commitlog-request(a)lists.osmocom.org wrote: > The branch, zecke/work-with-nitb has been created > at 2076448d458ce1271dcd4d584fe276a8b8857e35 (commit) > > - Log ----------------------------------------------------------------- > http://cgit.osmocom.org/cgit/osmocom-bb/commit/?id=2076448d458ce1271dcd4d58… > > commit 2076448d458ce1271dcd4d584fe276a8b8857e35 > Author: Holger Hans Peter Freyther<zecke(a)selfish.org> > Date: Mon Nov 26 17:15:07 2012 +0100 > > mobile: Do the LU with a IMSI... to deal with changing NITBs.. > > NITB will not ask for the IMSI if the TMSI is not known... work around > and do the LU with the IMSI.. hi holger, i saw your patch, but i did not like it. i just breaks the way location updating is done by standard. it is a workaround and not committed to master, but i think this should be an option for a baseband stack that is designed to test an play with. therefore i made a patch to configure this option via vty. it is not tested, but it obviously should work. regards, andreas

2 2

[PATCH] Add option to force location updating with IMSI, event if TMSI is valid
by Andreas Eversberg 27 Nov '12

27 Nov '12

To set this option, enter VTY: enable conf t ms 1 location-updating imsi-only write --- .../layer23/include/osmocom/bb/mobile/settings.h | 1 + src/host/layer23/src/mobile/gsm48_mm.c | 2 +- src/host/layer23/src/mobile/vty_interface.c | 33 ++++++++++++++++++- 3 files changed, 33 insertions(+), 3 deletions(-) diff --git a/src/host/layer23/include/osmocom/bb/mobile/settings.h b/src/host/layer23/include/osmocom/bb/mobile/settings.h index fae1220..6ff8b12 100644 --- a/src/host/layer23/include/osmocom/bb/mobile/settings.h +++ b/src/host/layer23/include/osmocom/bb/mobile/settings.h @@ -51,6 +51,7 @@ struct gsm_settings { uint16_t stick_arfcn; uint8_t skip_max_per_band; uint8_t no_lupd; + uint8_t lupd_imsi; uint8_t no_neighbour; /* supported by configuration */ diff --git a/src/host/layer23/src/mobile/gsm48_mm.c b/src/host/layer23/src/mobile/gsm48_mm.c index 0598768..06f6629 100644 --- a/src/host/layer23/src/mobile/gsm48_mm.c +++ b/src/host/layer23/src/mobile/gsm48_mm.c @@ -2358,7 +2358,7 @@ static int gsm48_mm_tx_loc_upd_req(struct osmocom_ms *ms) gsm48_encode_classmark1(&nlu->classmark1, sup->rev_lev, sup->es_ind, set->a5_1, pwr_lev); /* MI */ - if (0 && subscr->tmsi != 0xffffffff) { /* have TMSI ? */ + if (!set->lupd_imsi && subscr->tmsi != 0xffffffff) { /* have TMSI ? */ gsm48_encode_mi(buf, NULL, ms, GSM_MI_TYPE_TMSI); LOGP(DMM, LOGL_INFO, " using TMSI 0x%08x\n", subscr->tmsi); } else { diff --git a/src/host/layer23/src/mobile/vty_interface.c b/src/host/layer23/src/mobile/vty_interface.c index 4d7f6a2..e6add60 100644 --- a/src/host/layer23/src/mobile/vty_interface.c +++ b/src/host/layer23/src/mobile/vty_interface.c @@ -1334,6 +1334,9 @@ static void config_write_ms(struct vty *vty, struct osmocom_ms *ms) if (!hide_default || set->no_lupd) vty_out(vty, " %slocation-updating%s", (set->no_lupd) ? "no " : "", VTY_NEWLINE); + if (!hide_default || set->lupd_imsi) + vty_out(vty, " %slocation-updating imsi-only%s", + (set->lupd_imsi) ? "" : "no ", VTY_NEWLINE); if (!hide_default || set->no_neighbour) vty_out(vty, " %sneighbour-measurement%s", (set->no_neighbour) ? "no " : "", VTY_NEWLINE); @@ -1893,7 +1896,7 @@ DEFUN(cfg_ms_no_stick, cfg_ms_no_stick_cmd, "no stick", } DEFUN(cfg_ms_lupd, cfg_ms_lupd_cmd, "location-updating", - "Allow location updating") + "Do location updating") { struct osmocom_ms *ms = vty->index; struct gsm_settings *set = &ms->settings; @@ -1904,7 +1907,7 @@ DEFUN(cfg_ms_lupd, cfg_ms_lupd_cmd, "location-updating", } DEFUN(cfg_ms_no_lupd, cfg_ms_no_lupd_cmd, "no location-updating", - NO_STR "Do not allow location updating") + NO_STR "Do not perform location updating") { struct osmocom_ms *ms = vty->index; struct gsm_settings *set = &ms->settings; @@ -1914,6 +1917,30 @@ DEFUN(cfg_ms_no_lupd, cfg_ms_no_lupd_cmd, "no location-updating", return CMD_SUCCESS; } +DEFUN(cfg_ms_lupd_imsi, cfg_ms_lupd_imsi_cmd, "location-updating imsi-only", + "Do location updating\nAlways use IMSI to perform location updating") +{ + struct osmocom_ms *ms = vty->index; + struct gsm_settings *set = &ms->settings; + + set->lupd_imsi = 1; + + return CMD_SUCCESS; +} + +DEFUN(cfg_ms_no__imsilupd, cfg_ms_no_lupd_imsi_cmd, + "no location-updating imsi-only", + NO_STR "Do not perform location updating\n" + "Do not force location updating with IMSI, if TMSI is valid") +{ + struct osmocom_ms *ms = vty->index; + struct gsm_settings *set = &ms->settings; + + set->lupd_imsi = 0; + + return CMD_SUCCESS; +} + DEFUN(cfg_codec_full, cfg_ms_codec_full_cmd, "codec full-speed", "Enable codec\nFull speed speech codec") { @@ -2821,6 +2848,8 @@ int ms_vty_init(void) install_element(MS_NODE, &cfg_ms_no_stick_cmd); install_element(MS_NODE, &cfg_ms_lupd_cmd); install_element(MS_NODE, &cfg_ms_no_lupd_cmd); + install_element(MS_NODE, &cfg_ms_lupd_imsi_cmd); + install_element(MS_NODE, &cfg_ms_no_lupd_imsi_cmd); install_element(MS_NODE, &cfg_ms_codec_full_cmd); install_element(MS_NODE, &cfg_ms_codec_full_pref_cmd); install_element(MS_NODE, &cfg_ms_codec_half_cmd); -- 1.7.3.4 --------------030505010406090507000203--

1 0

Re: baseband-devel Digest, Vol 34, Issue 17
by Christian Inci 27 Nov '12

27 Nov '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I'd the same problem. Now, my C118 is bricked. :-( I'm now waiting for my Bus Pirate in order to unbrick it. Does anybody knows a fast way to do it? Should I use the test points (maybe those who are accessible from the battery compartment) or even directly to the nor flash? Many thanks in advance! - -Chris On 11/27/2012 12:00 PM, baseband-devel-request(a)lists.osmocom.org wrote: > Send baseband-devel mailing list submissions to > baseband-devel(a)lists.osmocom.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.osmocom.org/mailman/listinfo/baseband-devel or, via > email, send a message with subject or body 'help' to > baseband-devel-request(a)lists.osmocom.org > > You can reach the person managing the list at > baseband-devel-owner(a)lists.osmocom.org > > When replying, please edit your Subject line so it is more > specific than "Re: Contents of baseband-devel digest..." > > > Today's Topics: > > 1. Unable to flash firmware (Akib Sayyed) 2. Re: Unable to flash > firmware (Alexander Huemer) 3. Re: Unable to flash firmware (Akib > Sayyed) 4. Re: Unable to flash firmware (Akib Sayyed) > > > ---------------------------------------------------------------------- > > Message: 1 Date: Tue, 27 Nov 2012 12:30:30 +0300 From: Akib Sayyed > <akibsayyed(a)gmail.com> To: baseband-devel(a)lists.osmocom.org > Subject: Unable to flash firmware Message-ID: > <CAMG-S93etEd9b_zo-YiwXWdRwBZiXzx=fa8SWjJzZVqxz486Dw(a)mail.gmail.com> > > Content-Type: text/plain; charset="utf-8" > > Dear all i am unable to flash firmware of C118 with RSSI.bin > > i am using 64bit Ubuntu.and 64bit gnu toolchain > -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (GNU/Linux) Comment: Using GnuPG with undefined - http://www.enigmail.net/ iQIcBAEBAgAGBQJQtK0BAAoJEDfL/pqB6n6N3dAQAJLpkD+4MVJbzfBHDt6mepN6 OcXyX/EbgZkN7zZY4ulRadlqyMvq7MH7pN9zv1sRk+2oMWRTEOwHeT1xG8Lfoukp J4GMTY21bv6Ov0QLQOisxydRH4TQ7riJGfSbATPA6VBUMQWuxrws140BFDslXaPk 8Vk9o5a2G9kQTbLdJp/tqxjKnlLZ3m22qSgph0O1uV7w4e82tc45rOX8FiAps7f2 cCjGfbphjpb+GVx/OT5mSTaKseYAPyLsm2n1CvTbFYm0OVlJ9d8Pp/iVluQdrPdQ pBLpF/MFPdqw7swUTXTSjL5PFjhBnwz1b0hImdoFBG/uHRGrU8l8sG4ll553DWtw OnPEo1lEDkPdoRY0vpqYWVhrf6t1b54k5cc+ISKVvLweRoscMjkU7DBdzwuSyIQv FVLk9cLatp33ogCqpzinebEBNl6eQpa869c+MC2ii/Y+A82QRiyhSs6JMmYOCYRg jMiw/0lZIZcUEzHfGm75X7LnyfEyPDaG39MWl8m/xU/1aQhZHN4p23sKrqEAaZQp z439nICJoCybsPsPDZiz1XEqcD4lNVVWvba6Ofd+cNKNzSJb3Y8IjUFFPwPyCCw6 dlkgqo52xBnQvb3PzAv+JTUkFesdGqyvcSOMsnFxB8zZGl3pkRn0XPnX+0TsLZdC B701/yHCM9CXYeckOYft =Rsu7 -----END PGP SIGNATURE-----

2 3

Unable to flash firmware
by Akib Sayyed 27 Nov '12

27 Nov '12

Dear all i am unable to flash firmware of C118 with RSSI.bin i am using 64bit Ubuntu.and 64bit gnu toolchain -- Akib Sayyed Matrix-Shell akibsayyed(a)gmail.com akibsayyed(a)matrixshell.com Mob:- +91-966-514-2243

2 3

Re: Programming SIM card RAND?
by Dieter Spaar 26 Nov '12

26 Nov '12

Hello Andrew, On Mon, 12 Nov 2012 10:25:19 +0000, "Andrew Back" <andrew(a)carrierdetect.com> wrote: > > I'm trying to get some MS test equipment working and have programmed a > SIM with pysim-prog.py, but the tester has a configuration field for > RAND and I cannot see how to set this on the SIM. In fact this has > confused me as I thought the network always supplied this... Most certainly the RAND value of your MS tester is the value which is sent during authentication. All MS testers I have seen so far allow to configure this value, either use random data or set it to a fixed value. > I have the IMSI, Ki, MCC and MNC set the same on the tester and SIM, > but tests don't get very far and fail with "incorrect SRES". I would expect that you need a SIM card which supports XOR for A3/A8. This algorithm is the only one I have seen on nearly all MS tests sets I have access to. Those test sets usually don't support COMP128 and its variants (I guess your SIM card only supports this algorithm), so you need a SIM card which uses the same algorithm as the MS test set. However if you can set a fixed RAND value on the MS test set you can check what your SIM card will return with this RAND and set Kc and SRES on the test set to those values. Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

3 3

Re: Using 900/1800 C118 on 1900
by Akib Sayyed 24 Nov '12

24 Nov '12

i ordered stuff to modify phones. just waiting for them to be delivered On Sat, Nov 24, 2012 at 3:48 PM, Marten Christophe <technosabby(a)gmail.com>wrote: > Hello Akib, > > > Have you able to sniff TCH channel or intercept other phone calls by > OsmocomBB > > Regards, > dev > > On Tue, Nov 20, 2012 at 7:37 AM, Akib Sayyed <akibsayyed(a)gmail.com> wrote: > > phone with filter rework will work right and i also will be able to sniff > > traffic on 1900mhz witnh burst_ind.but my issue is how to tell code of > > app_ccch to sniff 1900 mhz instead of 1800 as they share same arfcn no?? > > > > > > > > On Tue, Nov 20, 2012 at 10:33 AM, Harald Welte <laforge(a)gnumonks.org> > wrote: > >> > >> On Mon, Nov 19, 2012 at 07:24:45AM +0300, Akib Sayyed wrote: > >> > Guys is wanted to know if there is any tweak that can allow me to use > >> > 900/1800 C118 phone on 1900 band. > >> > >> you have to remove the shielding cover and replace the 1800 band filters > >> with footprint-compatible 1900 MHz filters. It's possible, but requires > >> good SMD soldering skills and access to the right parts. > >> > >> You can also remove the filters completely. This will hovever > >> significantly degrade receiver performance in the presence of > >> out-of-band interferers. > >> > >> -- > >> - Harald Welte <laforge(a)gnumonks.org> > >> http://laforge.gnumonks.org/ > >> > >> > ============================================================================ > >> "Privacy in residential applications is a desirable marketing option." > >> (ETSI EN 300 175-7 Ch. > >> A6) > > > > > > > > > > -- > > Akib Sayyed > > Matrix-Shell > > akibsayyed(a)gmail.com > > akibsayyed(a)matrixshell.com > > Mob:- +91-966-514-2243 > > > > > -- Akib Sayyed Matrix-Shell akibsayyed(a)gmail.com akibsayyed(a)matrixshell.com Mob:- +91-966-514-2243

1 0

is my decode for efr decode right?
by bob 23 Nov '12

23 Nov '12

Hi, list I write a decode for efr decode for TCH,but there some bug, and I have not a debug device, Can someone help me find the problem, Thanks! static void process_tch_efr(struct osmocom_ms *ms,struct l1ctl_burst_ind *bi) { int16_t rx_dbm; uint16_t arfcn; uint32_t fn,B; uint8_t cbits, tn, lch_idx; int ul, bid, i, k, length; sbit_t *bursts, mC[456]; ubit_t steal_bit[2], bt[114],convu[189],convd[189],tch_raw[260],TCHW[260],EFRBits[244],EFRAMR[8 + 244]; pbit_t voice[33]; /* Get params (Only for SDCCH and SACCH/{4,8,F,H}) */ arfcn = ntohs(bi->band_arfcn); rx_dbm = rxlev2dbm(bi->rx_level); fn = ntohl(bi->frame_nr); ul = !!(arfcn & ARFCN_UPLINK); cbits = bi->chan_nr >> 3; tn = bi->chan_nr & 7; B = -1; if((fn%13)%4 == 0) flag= 1; if(!flag) return; //B = count_tch % 8; B = (fn % 13) % 8; printf("fn % 26 = %d, fn % 13 = %d,B = %d\n",fn%26 ,fn%13 ,B); if (B == -1) return; /* Unpack (ignore hu/hl) */ osmo_pbit2ubit_ext(bt, 0, bi->bits, 0, 57, 0); osmo_pbit2ubit_ext(bt, 57, bi->bits, 57, 57, 0); //osmo_pbit2ubit_ext(steal_bit, 0 , bi->bits, 114 , 2 , 0); //printf("steal_bit %x , %x\n",steal_bit[0],steal_bit[1]); /* save stealing flags */ hl[B] = !!(bi->bits[14] & 0x10); // hl 57 hu[B] = !!(bi->bits[14] & 0x20); // hu 58 printf("steal_bit %x , %x\n", hl[B],hu[B]); /* Convert to softbits */ for (i=0; i<114; i++) app_state.mI[B][i] = bt[i] ? - (bi->snr >> 1) : (bi->snr >> 1); count_tch++; // Deinterleave according to the diagonal "phase" of B. // See GSM 05.03 3.1.3. // Deinterleaves i[] to c[] if((B % 4 ==3)&&(count_tch >= 7)){ if(B == 3) { if(!hl[0] && !hl[1] && !hl[2] && !hl[3] && !hu[4] && !hu[5] && !hu[6] && !hu[7]) { tch_deinterleave(mC, 4); } else if(hl[0] && hl[1] && hl[2] && hl[3] && hu[4] && hu[5] && hu[6] && hu[7]) { printf(" may be FACCH.\n"); return; }else{ printf("not a speech frame.\n"); return; } }else{ if(!hl[4] && !hl[5] && !hl[6] && !hl[7] && !hu[0] && !hu[1] && !hu[2] && !hu[3]) { tch_deinterleave(mC,0); } else if(hl[4] && hl[5] && hl[6] && hl[7] && hu[0] && hu[1] && hu[2] && hu[3]) { printf(" may be FACCH.\n"); return; }else{ printf("not a speech frame.\n"); return; } } //mC is soft bit, and must convert to ubit type for (k = 0; k < 78; k++) { if(mC[378 + k] < 0){ tch_raw[182 + k] = 1; }else{ tch_raw[182 + k] = 0; } } osmo_conv_decode(&conv_tch_afs_12_2, mC, convu); // 3.1.2.1 // copy class 1 bits u[] to d[] for (k = 0; k <= 90; k++) { convd[2*k] = convu[k]; convd[2*k+1] = convu[184-k]; } memcpy(tch_raw,convd,182); // the last 78 bit has been stored! //now only process EFR or AMR 12_2, fix me! tch_unmap(gsm660_bitorder, 260, TCHW, tch_raw); // Remove repeating bits and CRC to get raw EFR frame (244 bits) for (k=0; k<71; k++) EFRBits[k] = TCHW[k]; for (k=73; k<123; k++) EFRBits[k-2] = TCHW[k]; for (k=125; k<178; k++) EFRBits[k-4] = TCHW[k]; for (k=180; k<230; k++) EFRBits[k-6] = TCHW[k]; for (k=232; k<252; k++) EFRBits[k-8] = TCHW[k]; // Map bits as AMR 12.2k tch_map(gsm690_12_2_bitorder, 244, EFRAMR + 8,EFRBits); fillField(EFRAMR, 0, 0x3c, 8); length = osmo_ubit2pbit_ext(voice, 0, EFRAMR, 0, 8 + gsm690_12_2_len, 0); fwrite(voice, 1, length, d_speech_file); } } -- View this message in context: http://baseband-devel.722152.n3.nabble.com/is-my-decode-for-efr-decode-righ… Sent from the baseband-devel mailing list archive at Nabble.com.

2 1

Re: osmocom-commitlog Digest, Vol 551, Issue 1
by Andreas Eversberg 22 Nov '12

22 Nov '12

osmocom-commitlog-request(a)lists.osmocom.org wrote: > commit 73a809e57b8a531b9b8a33b6841ed3df2ea22620 > Author: Harald Welte<laforge(a)gnumonks.org> > Date: Tue Nov 20 10:13:44 2012 +0100 > > Tell L1CTL_FBSB_REQ the expected received signal level > hi harald, please note that cell_log.c and mobile (gsm322.c) use signed uint8_t for real rx-level (dbm). i think you should use dbm2rxlev() before handing it to l1ctl_tx_fbsb_req(). regards, andreas

3 2

gsm322.c:arfcn2index patch
by Joshua Lackey 20 Nov '12

20 Nov '12

(This is a patch against the latest, as of last night, git master.) If you enable PCS, you'll never make it out of power-measurement without this patch: (This should be applied by everyone.) ---8<--- diff --git a/src/host/layer23/src/mobile/gsm322.c b/src/host/layer23/src/mobile/gsm322.c index ce5e1e1..ffecfc3 100644 --- a/src/host/layer23/src/mobile/gsm322.c +++ b/src/host/layer23/src/mobile/gsm322.c @@ -300,11 +300,14 @@ uint16_t index2arfcn(int index) int arfcn2index(uint16_t arfcn) { - if ((arfcn & ARFCN_PCS) && arfcn >= 512 && arfcn <= 810) + int is_pcs = arfcn & ARFCN_PCS; + arfcn &= ~ARFCN_FLAG_MASK; + if ((is_pcs) && (arfcn >= 512) && (arfcn <= 810)) return (arfcn & 1023)-512+1024; return arfcn & 1023; } + static char *bargraph(int value, int min, int max) { static char bar[128]; ---8<--- If you enable PCS, you'll never receive packets without this patch: (which I only include for e88 and e86 but it should work for others) (This should be applied if you don't use DCS in your area.) ---8<--- diff --git a/src/target/firmware/board/compal/rffe_dualband.c b/src/target/firmware/board/compal/rffe_dualband.c index f4b7361..5df1dfc 100644 --- a/src/target/firmware/board/compal/rffe_dualband.c +++ b/src/target/firmware/board/compal/rffe_dualband.c @@ -47,7 +47,8 @@ void rffe_mode(enum gsm_band band, int tx) /* Returns RF wiring */ uint32_t rffe_get_rx_ports(void) { - return (1 << PORT_LO) | (1 << PORT_DCS1800); + // return (1 << PORT_LO) | (1 << PORT_DCS1800); + return (1 << PORT_LO) | (1 << PORT_PCS1900); } uint32_t rffe_get_tx_ports(void) diff --git a/src/target/firmware/board/compal_e86/rffe_dualband_e86.c b/src/target/firmware/board/compal_e86/rffe_dualband_e86.c index 25bb099..10459d9 100644 --- a/src/target/firmware/board/compal_e86/rffe_dualband_e86.c +++ b/src/target/firmware/board/compal_e86/rffe_dualband_e86.c @@ -51,7 +51,8 @@ void rffe_mode(enum gsm_band band, int tx) /* Returns RF wiring */ uint32_t rffe_get_rx_ports(void) { - return (1 << PORT_LO) | (1 << PORT_DCS1800); + // return (1 << PORT_LO) | (1 << PORT_DCS1800); + return (1 << PORT_LO) | (1 << PORT_PCS1900); } uint32_t rffe_get_tx_ports(void) ---8<---

5 7

Using 900/1800 C118 on 1900
by Akib Sayyed 20 Nov '12

20 Nov '12

Guys is wanted to know if there is any tweak that can allow me to use 900/1800 C118 phone on 1900 band. please let me know. -- Akib Sayyed Matrix-Shell akibsayyed(a)gmail.com akibsayyed(a)matrixshell.com Mob:- +91-966-514-2243

3 3

[PATCH] Fix wrong printing of end freq in powerscan
by Pavel Baturko 16 Nov '12

16 Nov '12

Hi All, This is small patch that fixes wrong printing of scanning frequencies due powerscan: <0003> gsm322.c:2794 Scanning power for all frequencies. <0003> gsm322.c:2855 Scanning frequencies. (0..0) .. <0003> gsm322.c:2855 Scanning frequencies. (512(DCS)..512(DCS)) .. <0003> gsm322.c:2855 Scanning frequencies. (955..955) with this fix: <0003> gsm322.c:2797 Scanning power for all frequencies. <0003> gsm322.c:2860 Scanning frequencies. (0..124) .. <0003> gsm322.c:2860 Scanning frequencies. (512(DCS)..885(DCS)) .. <0003> gsm322.c:2860 Scanning frequencies. (955..1023) Thanks, Pavel

2 1

Programming SIM card RAND?
by Andrew Back 12 Nov '12

12 Nov '12

Hello, I'm trying to get some MS test equipment working and have programmed a SIM with pysim-prog.py, but the tester has a configuration field for RAND and I cannot see how to set this on the SIM. In fact this has confused me as I thought the network always supplied this... I have the IMSI, Ki, MCC and MNC set the same on the tester and SIM, but tests don't get very far and fail with "incorrect SRES". Any ideas? Regards, Andrew -- Andrew Back http://carrierdetect.com

2 1

Presentations at upcoming CCC?
by Bhaskar11 06 Nov '12

06 Nov '12

Are any presentations planned on Osmocom-BB and A51 at the upcoming CCC? B.

2 1

[PATCH] Print decimal MCC and MNC unless format is incorrect.
by ☎ 30 Oct '12

30 Oct '12

Hello. Right now MCC and MNC value in ./mobile app are printed as hex but without 0x - this is confusing and inconsistent. Attached patch fix that although I'm still puzzled why value printed by "show subscriber 1" looks like hex representation - see example below (with patch applied). Note that 0x385 == 901 and 0x046 == 70 I suspect misuse of gsm48_decode_lai()\gsm48_encode_lai() but unable to pinpoint location yet. show subscriber 1 Mobile Subscriber of MS '1': IMSI: 901701282457741 ICCID: 8901901702282374810 Service Provider Name: Magic SMS Service Center Address: 0015555 Status: U1_UPDATED IMSI detached LAI: MCC 385 MNC 046 LAC 0x03e8 (385, 046) Key: sequence 0 31 64 7e 4c e1 dc 48 00 Registered PLMN: MCC 385 MNC 046 (385, 046) Access barred cells: no Access classes: C0 C1 C2 C3 C4 C5 C6 C7 C8 C9 C10 C11 C12 C13 C14 C15 List of preferred PLMNs: MCC |MNC -------+------- 901 |070 (901, 070) List of forbidden PLMNs: MCC |MNC |cause -------+-------+------- 106 |003 |#255 (106, 003) 106 |007 |#255 (106, 007) -- best regards, Max, http://fairwaves.ru

2 1

None
by Stefan Richter 30 Oct '12

30 Oct '12

http://toshimaya-ds.com/wp-content/plugins/lifenews.php?mighty208.png

1 0

[PATCH 1/1] Print decimal MCC and MNC unless format is incorrect.
by Max 27 Oct '12

27 Oct '12

--- src/host/layer23/src/common/networks.c | 6 +++--- src/host/layer23/src/mobile/subscriber.c | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/src/host/layer23/src/common/networks.c b/src/host/layer23/src/common/networks.c index 40b70a1..ad2caa6 100644 --- a/src/host/layer23/src/common/networks.c +++ b/src/host/layer23/src/common/networks.c @@ -1824,7 +1824,7 @@ const char *gsm_print_mcc(uint16_t mcc) { static char string[5] = "000"; - snprintf(string, 4, "%03x", mcc); + snprintf(string, 4, "%03d", mcc); return string; } @@ -1843,12 +1843,12 @@ const char *gsm_print_mnc(uint16_t mnc) /* two digits */ if ((mnc & 0x000f) == 0x000f) { - snprintf(string, 6, "%02x", mnc >> 4); + snprintf(string, 6, "%02d", mnc >> 4); return string; } /* three digits */ - snprintf(string, 6, "%03x", mnc); + snprintf(string, 6, "%03d", mnc); return string; } diff --git a/src/host/layer23/src/mobile/subscriber.c b/src/host/layer23/src/mobile/subscriber.c index 8ebb173..2438637 100644 --- a/src/host/layer23/src/mobile/subscriber.c +++ b/src/host/layer23/src/mobile/subscriber.c @@ -256,7 +256,7 @@ static int subscr_sim_imsi(struct osmocom_ms *ms, uint8_t *data, /* decode IMSI, skip first digit (parity) */ imsi = sim_decode_bcd(data + 1, length); if (strlen(imsi) - 1 > GSM_IMSI_LENGTH - 1 || strlen(imsi) - 1 < 6) { - LOGP(DMM, LOGL_NOTICE, "IMSI invalid length = %d\n", + LOGP(DMM, LOGL_NOTICE, "IMSI invalid length = %zu\n", strlen(imsi) - 1); return -EINVAL; } -- 1.7.10.4 --------------010606030203030402080109--

1 0

Need NanoBTS
by Akib Sayyed 24 Oct '12

24 Oct '12

Is there anyone who is selling Nano BTS of Ip Access please let me know. -- Akib Sayyed Matrix-Shell akibsayyed(a)gmail.com akibsayyed(a)matrixshell.com Mob:- +91-966-514-2243

1 0

proof of concept bts
by Erich Dachleger 22 Oct '12

22 Oct '12

Hi list, Regarding the interesting video from Russia(Positive hacking days 2012) where Sylvain demonstrates av proof of concept bts, is it a dsp patch of the osmocombb firmware before one uploads to the c123 phones that one has to do? The tasks then are modified in this patch or also elsewhere? And then one removes and replaces a tranceiver-code in openbts sourcecode? [I have tried the tacooper version of osmo-bts but that that code-approach is for the sysmo-bts, althoug the osmocombb phone proof of concept bts is mentioned in the tacooper thesis online] Regards Erich

2 1

Re: Help please！~?tracelog?of?different providers needed
by Holger Hans Peter Freyther 21 Oct '12

21 Oct '12

On Sun, Oct 21, 2012 at 10:02:40PM +0800, xuewenyao wrote: > hi, Hi again, > i didn't realize the difference, not because i'm on the take side, but because i never thought about holding the data as my own asset. it should not be that complicated. My point is, if you ask people to do things for you you need to give them a reason of why they should help you. E.g. if you have a survey you might say that a randomly selected participant will win a 25 Euro voucher from Amazon. Now I don't ask you to buy things from Anazon but to think about why people should help you. One of the reason (non monetary) is to create a "database" that will be available to the community. A good example is the "terminal-profile"[1] initiative started by Kevin. He created a script (forkable) to query the terminal profile, there are clear instructions how to use it and it automatically uploads the data to a database. The database is publicly accessible and the whole content can be downloaded. Do you notice the difference? With Kevin's approach the whole community will benefit, with your request only you will benefit. > > i'm newbie here, but i do try to contribut if i can, and will continune to do so. it is not fare to judge me like that! Well, time will tell and I am happy to correct myself in case you make any contribution (detailed bug report, work in the wiki, bug fixes in the source). cheers holger [1] https://terminal-profile.osmocom.org/

1 0

Re: Help please！~ tracelog?of?different providers needed
by Holger Hans Peter Freyther 21 Oct '12

21 Oct '12

On Sun, Oct 21, 2012 at 08:35:42PM +0800, xuewenyao wrote: Hi, well this is a community and it works by everyone giving a little and the track record of academics is heavily on the taking side. And your request sounds like another 'academic' that wants to take without providing any benefit to the project and as you notice I am not very happy with that. > i'm not sure what you mean by license. the result won't be a software, so gpl is not suitable. i think all thesis are open to public. Well, your thesis can have a copyright as well (you could even decide to not publish it at all). You can also decide to publish the raw data you collect on the way. Given the fact that you didn't consider this means that you are more on the take side. > i'm a student in bremen. i just thought it will help me to gain some extra points. but i guess it's not a good idea to do so.

2 1

Re: Help please！~ tracelog of?different providers needed
by Holger Hans Peter Freyther 21 Oct '12

21 Oct '12

On Sun, Oct 21, 2012 at 05:18:06PM +0800, xuewenyao wrote: > hi, > > it will be part of my thesis. if you are interested, i will of course upload it when it's finished This only answers one question. What is the license? How will you reward people that help you? How does this benefit the osmocomBB project? What is the name of your thesis? Where are you enrolled? Who is your advisor? holger

1 0

Help please！~ tracelog of different providers needed
by xuewenyao 21 Oct '12

21 Oct '12

Hi all, I try to study the GSM core network setups of different providers. Therefore, tracelog of gsm providers from different countries is needed. I’m seeking your help for sending me some tracelog with two actions: making a phone call (MO) and sending a sms (MO). It should take no more than 2,3 minintes. Please tell me the provider and the country when you are sending me the tracelog. Thanks,

2 1

failed to read sim card
by g.roelant＠telenet.be 20 Oct '12

20 Oct '12

Hi, i'm trying to use osmocom-bb to send sms and make phone call with real sim of provider. i succeeded once in recognizing my pay-and-go sim card. but now i'm not lucky anymore here is wat is on screen: <000f> sim.c:1223 init SIM client <0006> gsm48_cc.c:63 init Call Control <0007> gsm480_ss.c:231 init SS <0017> gsm411_sms.c:63 init SMS <0001> gsm48_rr.c:5479 init Radio Ressource process <0005> gsm48_mm.c:1315 init Mobility Management process <0005> gsm48_mm.c:1037 Selecting PLMN SEARCH state, because no SIM. <0002> gsm322.c:5025 init PLMN process <0003> gsm322.c:5026 init Cell Selection process <0003> gsm322.c:5083 Read stored BA list (mcc=0ce mnc=001 0ce, 001) <0003> gsm322.c:5083 Read stored BA list (mcc=0ce mnc=014 0ce, 014) <0003> gsm322.c:5083 Read stored BA list (mcc=0ce mnc=0x00a 0ce, 0x00a) Mobile '1' initialized, please start phone now! VTY available on port 4247. <0005> subscriber.c:601 Requesting SIM file 0x2fe2 <000f> sim.c:209 got new job: SIM_JOB_READ_BINARY (handle=00000004) <000f> sim.c:697 go MF <000f> sim.c:241 SELECT (file=0x3f00) <000f> sim.c:187 sending APDU (class 0xa0, ins 0xa4) <000f> sim.c:876 received APDU (len=0 sw1=0x00 sw2=0x00) <000f> sim.c:952 command failed <000f> sim.c:151 sending result to callback function (type=1) <0005> subscriber.c:657 SIM reading failed <0005> gsm48_mm.c:4379 (ms 1) Received 'MMR_NREG_REQ' event <0005> gsm48_mm.c:4311 (ms 1) Received 'MM_EVENT_IMSI_DETACH' event in state MM IDLE, PLMN search <0005> gsm48_mm.c:1839 IMSI has been detached. <0005> gsm48_mm.c:1088 Not camping, wait for CS process to camp, it sends us CELL_SELECTED then. <0002> gsm322.c:3917 (ms 1) Event 'EVENT_SIM_REMOVE' for manual PLMN selection in state 'M0 null' <000e> gsm322.c:1614 SIM is removed <0002> gsm322.c:1615 Switch on without SIM. <0002> gsm322.c:814 new state 'M0 null' -> 'M5 no SIM inserted' <0003> gsm322.c:4037 (ms 1) Event 'EVENT_SIM_REMOVE' for Cell selection in state 'C0 null' <0003> gsm322.c:823 new state 'C0 null' -> 'C6 any cell selection' can anyone help?

1 0

Fwd: Open-source telecom T-shirts
by Alexander Chemeris 19 Oct '12

19 Oct '12

Sorry to those who receive this message twice. I hope Osmocom community finds this small effort interesting as well. ---------- Forwarded message ---------- From: Alexander Chemeris <alexander.chemeris(a)gmail.com> Date: Fri, Oct 19, 2012 at 5:15 PM Subject: Open-source telecom T-shirts To: umtrx <umtrx(a)lists.osmocom.org>, openbts-discuss(a)lists.sourceforge.net Hi all, We're thinking about making T-shirts with open-source telecom. I've posted a call for ideas in my OpenBTS blog - please contribute. Telecom needs more openness and you could help us promote this! http://openbts.chemeris.ru/2012/10/reklama-open-source-telecom/ We plan to give them for free to the first 10-20 UmTRX buyers. Then you'll be able to buy them from our web-shop or from one of our friends and distributors. If you proposal gets printed, you'll get a free T-shirt as well. PS If you know a good online T-shirt printing service in US or Europe - drop me a line. I've never done this in US/Europe before. -- Regards, Alexander Chemeris. CEO, Fairwaves LLC / ООО УмРадио http://fairwaves.ru -- Regards, Alexander Chemeris. CEO, Fairwaves LLC / ООО УмРадио http://fairwaves.ru

1 0

modulo and frame number in mframe_sched.c
by ☎ 19 Oct '12

19 Oct '12

Hi. In "struct mframe_sched_item" in target/firmware/layer1/mframe_sched.c both 'modulo' and 'frame_nr' defined as uint16_t. This seems like big space waste considering tight memory environment we're working in. On irc it was suggested that the reason for this is either data alignment or safety concerns. Does structure alignment matters in this case? If so - how exactly? Is it possible for 'modulo' to be bigger than 255? Is it possible for 'frame_nr' to be bigger than 255? -- best regards, Max, http://fairwaves.ru

4 7

Bounce action notification
by mailman＠lists.osmocom.org 18 Oct '12

18 Oct '12

This is a Mailman mailing list bounce action notice: List: baseband-devel Member: tianxing(a)timelink.com.hk Action: Subscription disabled. Reason: Excessive or fatal bounces. The triggering bounce notice is attached below. Questions? Contact the Mailman site administrator at mailman(a)lists.osmocom.org.

1 0

SIM900D
by Peter Zotov 17 Oct '12

17 Oct '12

Hello folks. I have this GSM module called SIM900D. It has several interesting capabilites. 1. It has builtin commands AT+SIMEI (guess what it does) and AT*CELLLOCK (ARFCN lock). 2. It, as far as I know, does not check firmware signature. 3. It has an API (called "Embedded AT") which can be called from the customer's module running on the same CPU (ARM926EJS). 4. Non-stripped firmware ELFs are available, together with the descriptions of public API. Here is a (Russian) page with all of the relevant datasheets collected. Datasheets are in English. http://www.mt-system.ru/catalog/dokumentacija-na-gsm-modemy-simcom See also: http://www.geekonfire.com/wiki/index.php?title=GPRS_Shield%EF%BC%88SIM900%E… ftp://ftp.macrogroup.ru/Support/SimCom/Firmware/Sim900/Sim900D -- WBR, Peter Zotov.

1 0

the sync of multiple ccch_scan in burst_ind branch
by bob 13 Oct '12

13 Oct '12

Hello List I am studying to start multiple ccch_scan simultaneously,but I meet some problem. I do as following: 1.I have two C118, caonnect them to the same computer 2.dump the sniffer rom ./osmocon -p /dev/ttyUSB0 -s /tmp/osmocom_l2_0 -m c123xor ./sniffer.bin ./osmocon -p /dev/ttyUSB1 -s /tmp/osmocom_l2_1 -m c123xor ./sniffer.bin 3.start the ccch_scan of burst_ind ./ccch_scan -s /tmp/osmocom_l2_0 -a *** -i 127.0.0.1 ./ccch_scan -s /tmp/osmocom_l2_0 -a *** -i 127.0.0.1 but there is always one ccch_scan give the following output after some time. <0001> app_ccch_scan.c:296 GSM48 IMM ASS (ra=0x99, chan_nr=0x40, HSN=47, MAIO=4, TS=0, SS=0, TSC=2) Unknown SI Unknown SI Unknown SI Unknown SI Unknown SI Unknown SI Unknown SI Unknown SI Unknown SI Unknown SI Unknown SI Unknown SI Unknown SI Unknown SI Unknown SI Unknown SI Unknown SI Unknown SI Unknown SI Unknown SI Unknown SI Unknown SI Unknown SI I think it is an syn problem, maybe caused by the usb bus. does anyone have the idea? thanks! -- View this message in context: http://baseband-devel.722152.n3.nabble.com/the-sync-of-multiple-ccch-scan-i… Sent from the baseband-devel mailing list archive at Nabble.com.

2 2

Oct 3, 8pm / Osmocom Berlin User Group meeting?
by Nico Golde 09 Oct '12

09 Oct '12

Hi all! I *think* Harald is pretty busy and also unlikely to attend prospective meeting tomorrow. Also there is bank holiday tomorrow in Germany and at least I personally will use that to stay away from technology for a bit, so I won't come. Nevertheless, I thought I'd write this email to remind people that in theory there is a meeting tomorrow and discuss if other people attend. I personally would propose to shift the meeting to next week (for purely selfish reasons ;). As far as I know, there is no formal presentation tomorrow. Anyway, will anyone attend tomorrow or is everyone in favor of shifting a week? In case it takes place, for the people who did not attend so far, the usual snippet from Harald's mails: Oct 3, 8pm @ CCC Berlin, Marienstr. 11, 10113 Berlin If you are interested to show up, feel free to do so. There is no registration required. The meeting is free as in "free beer", despite no actual free beer being around. Cheers Nico

6 6

Re: GSM test sets (HP 8922M, for instance..)
by Dieter Spaar 08 Oct '12

08 Oct '12

On Mon, 8 Oct 2012 06:54:06 +0000 (UTC), "John Case" <case(a)SDF.ORG> wrote: > > What about the HP8922P ? Does that also have the spectrum analyzer built > in ? I don't know the various variants of the HP8922. But the sepctrum analyzer is an optional hardware in the unit, it is called "Option 006" for the HP8922M (on my units the option is printed on the serial number label on the back). Best regards, DIeter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

1 0

Re: GSM test sets (HP 8922M, for instance..)
by Dieter Spaar 08 Oct '12

08 Oct '12

Hello John, On Mon, 8 Oct 2012 05:59:07 +0000 (UTC), "John Case" <case(a)SDF.ORG> wrote: > > So do I understand that by itself, the unit handles 900 and 850, and the > add-on gives it 1800 and 1900 ? The HP8922M can't simulate a GSM-850 network, only GSM-900 (E-GSM is also possible). The optional extension unit adds GSM-1800 and GSM-1900. However it is possible to generate various GSM test signals on the whole frequency range the HP8922M supports (10 MHz to 1000 MHz for the HP8922M alone) which includes GSM-850. This is uselful for Layer-1 development like it was done for OsmocomBB. And as hint: look for a HP8922M which has the optional spectrum analyzer built in, it can be very usefull sometimes. Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

2 1

GSM test sets (HP 8922M, for instance..)
by John Case 08 Oct '12

08 Oct '12

There are a lot of HP/Agilent 8922M units for sale very cheap (less than US $500). I know that these devices can simulate a GSM base station, but does that simulation occur over the air, or do I need to connect my handset I am testing to the 8922M with a cable ? I know I need to get a 8322A expansion for the unit - any other details I should look out for ? Also, what is an equivalent test unit for WCDMA (3g) base station simulation (I know these will be more expensive). Thanks.

2 3

rssi chainload
by ☎ 07 Oct '12

07 Oct '12

Hello. I'm trying to load RSSI firmware into my c123 phone. It's too big to be loaded directly so it should be chainloaded. Unfortunately chainloading is almost undocumented (or I failed to locate the documentation :) As far as I understood it we use chainloader (small one) so it would load actual payload (big one). I've disabled size check in src/host/osmocon/osmocon.c:270 and recompiled latest git. After that I've tried following: ./osmocom-bb/src/host/osmocon/osmocon -p /dev/ttyUSB0 -m c123xor -c ./osmocom-bb/src/target/firmware/board/compal_e88/rssi.highram.bin ./osmocom-bb/src/target/firmware/board/compal_e88/chainload.compalram.bin but got only eternal stream of "Sending Calypso romloader beacon..." Could you help me to figure out proper image names? What's the meaning of -c option: the file to be loaded (big one)? And as a last argument we supply actual chainloader (small one)? -- best regards, Max, http://fairwaves.ru

3 3

[PATCH] build: Fix make rule for building crc%gen.h
by Maciej Grela 07 Oct '12

07 Oct '12

The current rule for building a directory for crc%gen.h uses $(notdir $@) causing a build error: make[3]: Entering directory `/home/enki/devel/tst/osmocom-bb/src/shared/libosmocore/build-target/include' /usr/bin/mkdir -p crc16gen.h sed -e's/XX/16/g' ../../include/osmocom/core/crcXXgen.h.tpl > osmocom/core/crc16gen.h Changed to use $(dir $@) which makes more sense when calling mkdir. Signed-off-by: Maciej Grela <maciej.grela(a)gmail.com> --- src/shared/libosmocore/include/Makefile.am | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/shared/libosmocore/include/Makefile.am b/src/shared/libosmocore/include/Makefile.am index dec8eac..2c5fb3e 100644 --- a/src/shared/libosmocore/include/Makefile.am +++ b/src/shared/libosmocore/include/Makefile.am @@ -99,5 +99,5 @@ endif noinst_HEADERS = osmocom/core/timer_compat.h osmocom/core/crc%gen.h: osmocom/core/crcXXgen.h.tpl - $(AM_V_GEN)$(MKDIR_P) $(notdir $@) + $(AM_V_GEN)$(MKDIR_P) $(dir $@) $(AM_V_GEN)sed -e's/XX/$*/g' $< > $@ -- 1.7.12

5 5

Compiling Osmocom for Windows
by Bhaskar11 07 Oct '12

07 Oct '12

Enthused by the successes of Dieter and Eisencah I have been trying to compile Osmocom under Windows XP using Cygwin and arm-elf-gcc4.6.3 dbsed on the website instructions. Osmocom compiles ok until the last portion. Then it gives some errors (as in TXT file attached). Can anyone please indicate what I am doing wrong. I am writing here after long experimenting to ensure that all dependencies have been included, etc. Can I also request Dieter and Eisencah to share their tips for the rest of us who wish to work on the Windows platform. Thanks in advance. B. ================================= eisencah eisenach Reply | Threaded Nov 06, 2010; 7:50pm Re: osmocom on windows 25 posts Hello everybody. Managed to compile the osmocom program under windows. Could anyone send me the image for the "Hello word" program so I could try to download it into the phone (haven't got to the part where I compile the firmware bit I would want to see osmocom work). Cheers, Mihai. er SpaarReply | Threaded | More Oct 07, 2010; 3:51pmRe: osmocom on windows 36 posts In reply to this post by eisencah eisenach Hello Peter, On Thu, 7 Oct 2010 11:54:28 +0200, "Peter Stuge" <[hidden email]> wrote: > > Does e.g. the CodeSourcery toolchain really need Cygwin? That would > suck. I don't know CodeSourcery, I use GNU ARM directly from www.gnuarm.com. According to the CodeSourcery FAQ, they do not require Cygwin. Are there any benefit using CodeSourcery ? I had issues in the past with the firmware using a different GNU ARM version, so I switched back to 4.0.2 which seems to be the same other use on Linux and so far it works OK. You don't seem to like Cygwin, my experience with it is not that bad, OpenBSC (not with GPRS yet due to the need for the TUN device), OsmocomBB, GNUradio and Airprobe run with minor adjustments (just to name GSM related stuff I use under Cygwin). Best regards, Dieter -- Dieter Spaar, Germany

2 1

Subject tagging of this mailing list
by Fabio Pietrosanti (naif) 06 Oct '12

06 Oct '12

Hi, i'd like to suggest to introduce "Subject" tagging for the osmocom mailing lists. Almost all ml i'm subscribed are Subject tagged with [MailingListName] prepended to the subject. Hope can be considered a nice suggestion, to improve the usability of mlist. -naif

3 2

2G / 3G / LTE differences and similarities at layer 1 ...
by John Case 05 Oct '12

05 Oct '12

Where can I find some documentation about how different (and similar) 2G / 3G and LTE are at the layer 1 level ? Thanks.

4 4

Testing (or even type approval).
by Andrew Back 05 Oct '12

05 Oct '12

Hello, I've picked up what appears to be most of a Rohde & Schwarz TS8916B GSM Type Approval system (CRTC02 equipment, a Sofimation SOFI05 radio channel/fading simulator and various RF switching) and wondered if it may be of use in testing the baseband. Or can everything we would want to test be done using simple MS test equipment and/or a BTS with OpenBSC? I did also wonder whether it would be possible to use this to try and achieve type approval, but realise that even if the rest of the hardware could be gathered together it would be a huge learning curve and even then maybe you have to be accredited/authorised for TA (or other challenges would prevent this). In any case, I thought it worth asking the question before it is split up. Regards, Andrew PS. Some photos are at: http://www.flickr.com/photos/carrierdetect/sets/72157631692365280/with/8054… The digital units are PCs running DOS and tests are written in C and compiled to run on DSP boards (2x TX + 2x RX per CRTC02 digital unit) which drive the attached analogue units. GPIB is used for control between these and to also control the SOFI, RF switches and other equipment that is missing (a signal generator and a second SOFI at least). -- Andrew Back http://carrierdetect.com

2 2

Why not a nexus chipset ?
by John Case 05 Oct '12

05 Oct '12

Usually a reference platform is something for developers and is not widely distributed. With android, the reference platform is a mass market device in the hands of millions of people worldwide. So, if there is a goal of a completely open phone - FaiF all the way through - why isn't one of the nexus phones a natural target for reverse engineering and spec-leaking ? One of the issues with the calypso chipset that I have seen discussed here is what OS to run on the upper layers of the phone - and this is a non-issue, since the nexus phones have been designed from the ground up to run linux. Even if you decline to put android specifically on it, you could run any other variant you like. I am not trivializing the work that has gone into calypso, and I realize that different nexus variants may have totally different baseband components, so you would have to choose one specific nexus model ... but isn't the real difficulty simply the secrecy of the specs of the chipset, and leaked specs solve the problem whether it is a 2G calypso or a 4G OMAP ?

8 18

Re: How much protection does an add-on GSM modem give me vs. built into phone ?
by Peter Zotov 04 Oct '12

04 Oct '12

Denis 'GNUtoo' Carikli писал 04.10.2012 15:07: > On Thu, 04 Oct 2012 14:53:08 +0400 > Peter Zotov <whitequark(a)whitequark.org> wrote: > > Did you check what the modem transport was(shared memory, high speed > serial etc...)? > > Denis. Sorry for the second letter. I just verified the GPS issue with grindars. He says that BP does not communicate with GPS chip directly; both UART and GPIO of the GPS chip are connected to AP. The only thing that will not work with BP off is GSM A-GPS, which is trivially replaced if you have WiFi connectivity or cellular data. -- WBR, Peter Zotov.

1 0

Re: How much protection does an add-on GSM modem give me vs. built into phone ?
by Peter Zotov 04 Oct '12

04 Oct '12

Denis 'GNUtoo' Carikli писал 04.10.2012 15:07: > On Thu, 04 Oct 2012 14:53:08 +0400 > Peter Zotov <whitequark(a)whitequark.org> wrote: > >> Denis 'GNUtoo' Carikli писал 04.10.2012 14:26: >> > On Thu, 4 Oct 2012 00:32:48 +0200 >> > Peter Stuge <peter(a)stuge.se> wrote: >> > >> >> John Case wrote: >> >> > the real trick I am interested is isolating (or at least >> >> > controlling) the interaction between the baseband processor and >> >> the >> >> > application processor. Using a computer with a USB dongle >> gives >> >> me >> >> > that control ... would I have that same level of control if we >> >> > had free software running on the baseband processor, or is >> there >> >> > still additional bleeding possible simpy by virtue of being >> >> > built into the computer ? >> >> >> >> In a smartphone it's almost not possible to distinguish the >> >> "computer" from the "GSM modem" anymore, because of how the >> >> hardware is constructed, so yes. >> > In some yes, in some no... it depend on how the smartphone was >> > designed: >> > >> > On one end some smartphones (openmoko GTA02,golden delicious >> > GTA04), the >> > baseband is isolated(tough on GTA04 it has access to a GPS with no >> > antenna(so it can't work)) . And on the other end there are >> > smartphones >> > with qualcomm System on a chip...where the modem and the CPU are >> in >> > a single chip: >> > The modem part has the audio DSP connected to it, the GPS. >> > And the baseband uses shared RAM memory and shared NAND(if I >> > remember well)... >> > And I'm not sure but maybe the baseband is even needed for booting >> > the >> > main CPU... >> > >> > There are also systems in between like the galaxy S/Neuxs S that >> > uses shared memory but do not have other problems... >> >> In addition to the above, there are some phones where baseband is >> completely >> submissive to the AP, namely Galaxy SII. Basically it's exactly the >> same >> as the USB dongle situation, but the dongle is integrated on the >> phone's >> PCB. > Did you check what the modem transport was(shared memory, high speed > serial etc...)? > > Denis. HSIC. It's basically USB but with a slightly altered physical layer to acommodate the unusual topology. http://www.synopsys.com/dw/dwtb/hsic_usb2_device/hsic_usb2_device.html There is no shared memory or, in fact, any other connections between BP and interfaces of the phone. Audio is transferred via the same USB, for example. GPS technically has some relation with the BP, I'm not absolutely sure which precisely, but you can a) upload reference SiRF firmware to the GPS, thus rendering any changes Samsung put to the latter void and b) AP controls !RESET pins of both GPS and BP. It's trivial to not allow both to run simultaneously. -- WBR, Peter Zotov.

1 0

Re: How much protection does an add-on GSM modem give me vs. built into phone ?
by Peter Zotov 04 Oct '12

04 Oct '12

Denis 'GNUtoo' Carikli писал 04.10.2012 14:26: > On Thu, 4 Oct 2012 00:32:48 +0200 > Peter Stuge <peter(a)stuge.se> wrote: > >> John Case wrote: >> > the real trick I am interested is isolating (or at least >> > controlling) the interaction between the baseband processor and >> the >> > application processor. Using a computer with a USB dongle gives >> me >> > that control ... would I have that same level of control if we had >> > free software running on the baseband processor, or is there still >> > additional bleeding possible simpy by virtue of being built into >> > the computer ? >> >> In a smartphone it's almost not possible to distinguish the >> "computer" from the "GSM modem" anymore, because of how the >> hardware is constructed, so yes. > In some yes, in some no... it depend on how the smartphone was > designed: > > On one end some smartphones (openmoko GTA02,golden delicious GTA04), > the > baseband is isolated(tough on GTA04 it has access to a GPS with no > antenna(so it can't work)) . And on the other end there are > smartphones > with qualcomm System on a chip...where the modem and the CPU are in a > single chip: > The modem part has the audio DSP connected to it, the GPS. > And the baseband uses shared RAM memory and shared NAND(if I remember > well)... > And I'm not sure but maybe the baseband is even needed for booting > the > main CPU... > > There are also systems in between like the galaxy S/Neuxs S that uses > shared memory but do not have other problems... In addition to the above, there are some phones where baseband is completely submissive to the AP, namely Galaxy SII. Basically it's exactly the same as the USB dongle situation, but the dongle is integrated on the phone's PCB. > > Denis. -- WBR, Peter Zotov.

1 0

Re: How much protection does an add-on GSM modem give me vs. built into phone ?
by John Case 04 Oct '12

04 Oct '12

> First, stay away from Qualcomm-based phones. In them the baseband controls > all physical memory, as documented in the Replicant project, and thus has > control over the application processor (the "unix computer"). Ok. So what I am shooting for is a firewall between the baseband processor and the application processor, and I was indeed correct that in a "real" mobile phone there is a lot of bleeding between the two. > Second, even Infineon-based phones are not completely safe, however you can > use Replicant on the Nexus S, and thus there is no proprietary binaries (on > the Unix side) and less risk of meddling from a third party. However, this > won't prevent a baseband exploit from doing evil stuff. In addition there > are Android vulnerabilities constantly appearing, last one as you may have > heard concerned the SGS3's NFC stack. Well, that is why I said "unix computer" and not specifically android - if I am running a computer (like a samsung galaxy player) then I could do something besides android, and perhaps gain quite a bit of control. > Finally, the scenario you suggest (connecting a 3G USB modem) to a computer > seems very impractical although it adds a layer of safety since the > microphone will be fully under the control of the system you trust. However > battery life will probably be very, very short as compared to your current > 2G phone. Yes, ok. Battery life is bad, as well as the physical logistics of connecting a full sized USB dongle to a micro-USB port, etc. > By the way, as documented in presentations at CCC, Blackhat, etc. GSM > networks are not safe, there are multiple vulnerabilities ranging from > offline decryption of comms to active mitm attacks. 3G networks use > stronger, mutual authentication and do not suffer from this. In several > phones, such as the Nexus S, you can force the network mode to 3G only and > therefore have a better level of security. Yes, but the real trick I am interested is isolating (or at least controlling) the interaction between the baseband processor and the application processor. Using a computer with a USB dongle gives me that control ... would I have that same level of control if we had free software running on the baseband processor, or is there still additional bleeding possible simpy by virtue of being built into the computer ? Also, just for my own notes, what is the industry term for "making changes to application processor side of customers handset?" I have heard of some regular examples of how carriers update things and enforce changes to phones in this way (or relock them ?) but what is the term for that behavior ? Thanks.

3 2

How much protection does an add-on GSM modem give me vs. built into phone ?
by John Case 03 Oct '12

03 Oct '12

I use an old 2G dumbphone. I would like to switch and begin carrying a unix computer with me, but two things bother me: 1. When cellular device is added to computer, and integrated in a deep way (as it is in an android phone) there seem to me a lot of instances where the computer is subservient to the cellular partsof the phone. I am thinking about things like carrier published updates to applications and carrier updates to SIM data, etc. - I want to participate on the mobile phone network, but I do not want the carrier to have any access to my unix computer. It seems to me that they have a lot of access, though, when I use something like an android phone. 2. Exploits ... baseband exploits, mobie network exploits, forced dialing, speaker/mic toggling, root exploits like I saw described from rogue cellsites at defcon 2 years ago ... I want nothing to do with this. So my current thought is to not buy a phone at all, but instead buy a unix computer - perhaps the samsung galaxy player ? It is a near-clone of Samsung i9000, but without any phone hrdware (but it does have speaker and mic, so you could use it as a very nice SIP device). And my idea is that when I do not have WIFI access, I could connect a USB GSM modem to this unix computer and use the GSM modem ONLY for data, and connect SIP calls that way. My questions: 1. Am I correct that embedding the mobile components into the computer (like in a mobile phone) give my carrier many more vectors for accessing the computer side of things, and ive "mallory" many more vectors for attack ? I spoke very generally above about those methods - what are the actual names for these behaviors ? 2. Am I correct that if I connect a external GSM modem to my unix computer, I am nullifying most of these, and I am not giving my carrier any abiity to update/examine/alter/access my unix computer .... and am also avoiding things like secretly enabling the microphone, baseband exploits, etc. ? Any additional thoughts on using a computer instead of a phone, and then adding a GSM modem when that is the only way to get SIP connectivity ? Thanks.

1 0

Re: Why not a nexus chipset ?
by Peter Zotov 03 Oct '12

03 Oct '12

Maciej Grela писал 02.10.2012 02:00: >> My colleague/friend Sergey Gridassov[1] has been developing a >> replacement >> RIL[2] >> for SGS2 and found everything of the above. He probably won't be >> posting to >> this list because he's not a native English speaker, but if there is >> enough >> interest (and it seems that there is), I could prepare and post the >> relevant >> instructions. It's pretty trivial actually. >> > > Please do publish them. This is pretty cool. > > Regards, > Maciej Grela Assuming you know C, consider this code: https://github.com/grindars/android_hardware_samsung_freeril/blob/jellybean… The boot process is IROM->PSI->EBL->SecureImage. Authenticity of PSI is not checked. He has verified this by changing the magic constant 0xDEADDEAD and booting PSI. Speaking about 0xDEADDEAD, it's a command ID which makes the PSI make a complete RAM dump. So, then he has sent the modified command and successfully obtained a dump. The rest should be obvious from the source. -- WBR, Peter Zotov.

1 0

cppcheck/pyflakes results for osmocom-bb
by Paul Wise 01 Oct '12

01 Oct '12

Hi all, I noticed that cppcheck and pyflakes are detecting some possible issues in the osmocom-bb codebase on the master branch: ./src/target_dsp/calypso/dump2coff.py:3: 'namedtuple' imported but unused ./src/host/fb_tools/bdf_to_c.py:30: 'string' imported but unused [src/host/layer23/src/common/main.c:146]: (error) Possible null pointer dereference: app_opp [src/host/gsmmap/gsmmap.c:379] -> [src/host/gsmmap/gsmmap.c:384]: (error) Possible null pointer dereference: meas - otherwise it is redundant to check it against null. [src/shared/libosmocore/src/gb/gprs_bssgp.c:1076] -> [src/shared/libosmocore/src/gb/gprs_bssgp.c:1041]: (error) Possible null pointer dereference: dup - otherwise it is redundant to check it against null. [src/shared/libosmocore/src/gb/gprs_bssgp.c:1087] -> [src/shared/libosmocore/src/gb/gprs_bssgp.c:1041]: (error) Possible null pointer dereference: dup - otherwise it is redundant to check it against null. [src/shared/libosmocore/src/gb/gprs_bssgp.c:1088] -> [src/shared/libosmocore/src/gb/gprs_bssgp.c:1041]: (error) Possible null pointer dereference: dup - otherwise it is redundant to check it against null. [src/shared/libosmocore/src/gsm/lapd_core.c:1936] -> [src/shared/libosmocore/src/gsm/lapd_core.c:1948]: (error) Possible null pointer dereference: msg - otherwise it is redundant to check it against null. [src/target/firmware/apps/chainload/main.c:39]: (error) Possible null pointer dereference: entry [src/target/firmware/apps/loader/main.c:92]: (error) Possible null pointer dereference: entry [src/target/firmware/apps/loader_mtk/main.c:87]: (error) Possible null pointer dereference: entry [src/target/ui-experiment/png2tiny.c:20]: (error) printf format string has 1 parameters but only 0 are given. [src/target/firmware/rf/mt6139.c:138]: (error) Uninitialized variable: pga_gain -- bye, pabs http://bonedaddy.net/pabs3/

3 3

[PATCH] gsm_utils.c: cleanup + do not use dynamic memory when decoding 7bit messages
by Nico Golde 21 Sep '12

21 Sep '12

Hi, attached is a patch that cleans up gsm_7bit_decode_hdr() a little and removes the need for calloc/free. This way, this function can be used on systems that do not have the required allocation routines (e.g. a layer1 firmware). This is a bit selfish, as I personally need it :) Cheers Nico

4 7

[PATCH] gsm_utils.c: in 7bit decoding, first check if the last character was an extension character before doing anything else
by Nico Golde 20 Sep '12

20 Sep '12

--- src/gsm/gsm_utils.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/gsm/gsm_utils.c b/src/gsm/gsm_utils.c index 6af0a5f..8b1fae0 100644 --- a/src/gsm/gsm_utils.c +++ b/src/gsm/gsm_utils.c @@ -146,15 +146,15 @@ int gsm_7bit_decode_hdr(char *text, const uint8_t *user_data, uint8_t septet_l, (user_data[((i + shift) * 7) >> 3] >> (((i + shift) * 7) & 7))) & 0x7f; - if (c == 0x1b && i + 1 < septet_l) { - next_is_ext = 1; - continue; - } - /* this is an extension character */ if (next_is_ext) { next_is_ext = 0; *(text++) = gsm_7bit_alphabet[0x7f + c]; + continue; + } + + if (c == 0x1b && i + 1 < septet_l) { + next_is_ext = 1; } else { *(text++) = gsm_septet_lookup(c); } -- 1.7.10.4 --4Ckj6UjgE2iN1+kY--

1 0

[PATCH] Decoding UCS2 USSD
by Pavel Baturko 20 Sep '12

20 Sep '12

Hi, I create patch with added decoding of UCS2 USSD messages. Text in UCS2 is printed on 'mobile' console and status is sent to vty since there is no support of wide characters in vty. Added constants to decode GSM 7bit text when DCS is specified as 0x00, 0x01. I tested it with Russian language with several providers and all works ok. Thanks, Pavel

4 9

Sept 19, 8pm / Osmocom Berlin User Group meeting
by Harald Welte 19 Sep '12

19 Sep '12

Hi all! This is the announcement for the next Osmocom Berlin meeting. Sept 19, 8pm @ CCC Berlin, Marienstr. 11, 10113 Berlin There is no formal presentation scheduled for this meeting. If you are interested to show up, feel free to do so. There is no registration required. The meeting is free as in "free beer", despite no actual free beer being around. Regards, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

2 1

[PATCH] build: fix directory creation for core headers, introduced by d471a219
by Nico Golde 18 Sep '12

18 Sep '12

Attached is a patch for libosmocore that fixes the error mentioned in CABvrX2XCNRP+qhdW+b8eiWzCDJGVeC5vEaHfO3tOTsjaUg96Lw(a)mail.gmail.com. I guess this should be fixed in libosmocore and not osmocom-bb and the included shared library should be updated. Cheers Nico

1 0

[PATCH] build: fix directory creation for core headers, introduced by d471a219.
by Nico Golde 18 Sep '12

18 Sep '12

--- include/Makefile.am | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/Makefile.am b/include/Makefile.am index 61ab67d..60b9ea9 100644 --- a/include/Makefile.am +++ b/include/Makefile.am @@ -100,5 +100,5 @@ endif noinst_HEADERS = osmocom/core/timer_compat.h osmocom/core/crc%gen.h: osmocom/core/crcXXgen.h.tpl - $(AM_V_GEN)$(MKDIR_P) $(notdir $@) + $(AM_V_GEN)$(MKDIR_P) $(dir $@) $(AM_V_GEN)sed -e's/XX/$*/g' $< > $@ -- 1.7.10.4 --jRHKVT23PllUwdXP--

1 0

[PATCH] gsm_utils.c: cleanup + do not use dynamic memory when decoding 7bit messages
by Nico Golde 18 Sep '12

18 Sep '12

--- src/gsm/gsm_utils.c | 27 +++++++++++++-------------- 1 file changed, 13 insertions(+), 14 deletions(-) diff --git a/src/gsm/gsm_utils.c b/src/gsm/gsm_utils.c index 3f3a73f..f51cf1b 100644 --- a/src/gsm/gsm_utils.c +++ b/src/gsm/gsm_utils.c @@ -2,7 +2,7 @@ * (C) 2008 by Daniel Willmann <daniel(a)totalueberwachung.de> * (C) 2009 by Holger Hans Peter Freyther <zecke(a)selfish.org> * (C) 2009-2010 by Harald Welte <laforge(a)gnumonks.org> - * (C) 2010 by Nico Golde <nico(a)ngolde.de> + * (C) 2010-2012 by Nico Golde <nico(a)ngolde.de> * * All Rights Reserved * @@ -127,9 +127,8 @@ int gsm_7bit_decode_hdr(char *text, const uint8_t *user_data, uint8_t septet_l, { int i = 0; int shift = 0; - - uint8_t *rtext = calloc(septet_l, sizeof(uint8_t)); - uint8_t tmp; + uint8_t c; + uint8_t next_is_ext = 0; /* skip the user data header */ if (ud_hdr_ind) { @@ -141,29 +140,29 @@ int gsm_7bit_decode_hdr(char *text, const uint8_t *user_data, uint8_t septet_l, } for (i = 0; i < septet_l; i++) { - rtext[i] = + c = ((user_data[((i + shift) * 7 + 7) >> 3] << (7 - (((i + shift) * 7 + 7) & 7))) | (user_data[((i + shift) * 7) >> 3] >> (((i + shift) * 7) & 7))) & 0x7f; - } - for (i = 0; i < septet_l; i++) { - /* this is an extension character */ - if(rtext[i] == 0x1b && i + 1 < septet_l){ - tmp = rtext[i+1]; - *(text++) = gsm_7bit_alphabet[0x7f + tmp]; - i++; + if(c == 0x1b && i + 1 < septet_l){ + next_is_ext = 1; continue; } - *(text++) = gsm_septet_lookup(rtext[i]); + /* this is an extension character */ + if(next_is_ext){ + next_is_ext = 0; + *(text++) = gsm_7bit_alphabet[0x7f + c]; + } else { + *(text++) = gsm_septet_lookup(c); + } } if (ud_hdr_ind) i += shift; *text = '\0'; - free(rtext); return i; } -- 1.7.10.4 --6TrnltStXW4iwmi0--

1 0

[PATCH] gsm_utils.c: cleanup + do not use dynamic memory when decoding 7bit messages
by Nico Golde 18 Sep '12

18 Sep '12

--- src/gsm/gsm_utils.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/src/gsm/gsm_utils.c b/src/gsm/gsm_utils.c index 3f3a73f..08932d1 100644 --- a/src/gsm/gsm_utils.c +++ b/src/gsm/gsm_utils.c @@ -2,7 +2,7 @@ * (C) 2008 by Daniel Willmann <daniel(a)totalueberwachung.de> * (C) 2009 by Holger Hans Peter Freyther <zecke(a)selfish.org> * (C) 2009-2010 by Harald Welte <laforge(a)gnumonks.org> - * (C) 2010 by Nico Golde <nico(a)ngolde.de> + * (C) 2010-2012 by Nico Golde <nico(a)ngolde.de> * * All Rights Reserved * @@ -65,6 +65,7 @@ //#include <openbsc/gsm_data.h> #include <osmocom/core/utils.h> #include <osmocom/gsm/gsm_utils.h> +#include <osmocom/core/logging.h> #include <stdlib.h> #include <stdint.h> @@ -128,8 +129,8 @@ int gsm_7bit_decode_hdr(char *text, const uint8_t *user_data, uint8_t septet_l, int i = 0; int shift = 0; - uint8_t *rtext = calloc(septet_l, sizeof(uint8_t)); - uint8_t tmp; + uint8_t data[160]; + uint8_t ext_septet; /* skip the user data header */ if (ud_hdr_ind) { @@ -140,8 +141,13 @@ int gsm_7bit_decode_hdr(char *text, const uint8_t *user_data, uint8_t septet_l, septet_l = septet_l - shift; } + if(septet_l >= sizeof(data)){ + LOGP(DLSMS, LOGL_ERROR, + "Message User-Data too long\n"); + return -EINVAL; + } for (i = 0; i < septet_l; i++) { - rtext[i] = + data[i] = ((user_data[((i + shift) * 7 + 7) >> 3] << (7 - (((i + shift) * 7 + 7) & 7))) | (user_data[((i + shift) * 7) >> 3] >> @@ -150,20 +156,19 @@ int gsm_7bit_decode_hdr(char *text, const uint8_t *user_data, uint8_t septet_l, for (i = 0; i < septet_l; i++) { /* this is an extension character */ - if(rtext[i] == 0x1b && i + 1 < septet_l){ - tmp = rtext[i+1]; - *(text++) = gsm_7bit_alphabet[0x7f + tmp]; + if(data[i] == 0x1b && i + 1 < septet_l){ + ext_septet = data[i+1]; + *(text++) = gsm_7bit_alphabet[0x7f + ext_septet]; i++; continue; } - *(text++) = gsm_septet_lookup(rtext[i]); + *(text++) = gsm_septet_lookup(data[i]); } if (ud_hdr_ind) i += shift; *text = '\0'; - free(rtext); return i; } -- 1.7.10.4 --r5Pyd7+fXNt84Ff3--

1 0

[PATCH] gsm_utils.c: cleanup + do not use dynamic memory when decoding 7bit messages
by Nico Golde 17 Sep '12

17 Sep '12

--- src/gsm/gsm_utils.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/src/gsm/gsm_utils.c b/src/gsm/gsm_utils.c index 3f3a73f..cf1cc2b 100644 --- a/src/gsm/gsm_utils.c +++ b/src/gsm/gsm_utils.c @@ -128,8 +128,8 @@ int gsm_7bit_decode_hdr(char *text, const uint8_t *user_data, uint8_t septet_l, int i = 0; int shift = 0; - uint8_t *rtext = calloc(septet_l, sizeof(uint8_t)); - uint8_t tmp; + uint8_t data[160]; + uint8_t ext_septet; /* skip the user data header */ if (ud_hdr_ind) { @@ -140,30 +140,29 @@ int gsm_7bit_decode_hdr(char *text, const uint8_t *user_data, uint8_t septet_l, septet_l = septet_l - shift; } - for (i = 0; i < septet_l; i++) { - rtext[i] = + for (i = 0; i < septet_l && i < sizeof(data); i++) { + data[i] = ((user_data[((i + shift) * 7 + 7) >> 3] << (7 - (((i + shift) * 7 + 7) & 7))) | (user_data[((i + shift) * 7) >> 3] >> (((i + shift) * 7) & 7))) & 0x7f; } - for (i = 0; i < septet_l; i++) { + for (i = 0; i < septet_l && i < sizeof(data); i++) { /* this is an extension character */ - if(rtext[i] == 0x1b && i + 1 < septet_l){ - tmp = rtext[i+1]; - *(text++) = gsm_7bit_alphabet[0x7f + tmp]; + if(data[i] == 0x1b && i + 1 < septet_l){ + ext_septet = data[i+1]; + *(text++) = gsm_7bit_alphabet[0x7f + ext_septet]; i++; continue; } - *(text++) = gsm_septet_lookup(rtext[i]); + *(text++) = gsm_septet_lookup(data[i]); } if (ud_hdr_ind) i += shift; *text = '\0'; - free(rtext); return i; } -- 1.7.10.4 --r5Pyd7+fXNt84Ff3--

1 0

libgps fix for layer23
by Kevin Redon 17 Sep '12

17 Sep '12

[PATCH] Fix linking with GNU ld 2.22 and libgps Error: gcc -Wall -I/home/kevredon/osmocom-bb/src/shared/libosmocore/include -I/home/kevredon/osmocom-bb/src/shared/libosmocore/include -g -O2 -D_HAVE_GPSD -lgps -o cell_log main.o app_cell_log.o cell_log.o geo.o ../common/liblayer23.a /home/kevredon/osmocom-bb/src/shared/libosmocore/build-host/src/.libs/libosmocore.a /home/kevredon/osmocom-bb/src/shared/libosmocore/build-host/src/gsm/.libs/libosmogsm.a /home/kevredon/osmocom-bb/src/shared/libosmocore/build-host/src/codec/.libs/libosmocodec.a -lm ../common/liblayer23.a(gps.o): In function `osmo_gpsd_cb': /home/kevredon/osmocom-bb/src/host/layer23/src/common/gps.c:79: undefined reference to `gps_waiting' Fix: Holger told me to do so (he knows better then me about autoconf) - set CFLAGS and LIBS for LIBGPS in layer23 - add libgps CFLAGS and LIBS in Makefile.am for common, misc, mobile I would have done the following (which also works): -AC_CHECK_LIB(gps, gps_waiting, CFLAGS+=" -D_HAVE_GPSD" LDFLAGS+=" -lgps",,) +AC_CHECK_LIB(gps, gps_waiting, CFLAGS+=" -D_HAVE_GPSD" LDFLAGS+=" -lgps" LIBS+=" -lgps",,) --- src/host/layer23/configure.ac | 5 ++++- src/host/layer23/src/common/Makefile.am | 2 +- src/host/layer23/src/misc/Makefile.am | 4 ++-- src/host/layer23/src/mobile/Makefile.am | 4 ++-- 4 files changed, 9 insertions(+), 6 deletions(-) diff --git a/src/host/layer23/configure.ac b/src/host/layer23/configure.ac index b50868a..9335e66 100644 --- a/src/host/layer23/configure.ac +++ b/src/host/layer23/configure.ac @@ -17,7 +17,10 @@ PKG_CHECK_MODULES(LIBOSMOCORE, libosmocore) PKG_CHECK_MODULES(LIBOSMOVTY, libosmovty) PKG_CHECK_MODULES(LIBOSMOGSM, libosmogsm) PKG_CHECK_MODULES(LIBOSMOCODEC, libosmocodec) -AC_CHECK_LIB(gps, gps_waiting, CFLAGS+=" -D_HAVE_GPSD" LDFLAGS+=" -lgps",,) +AC_CHECK_LIB(gps, gps_waiting, LIBGPS_CFLAGS=" -D_HAVE_GPSD" LIBGPS_LIBS=" -lgps ",,) +AC_SUBST([LIBGPS_CFLAGS]) +AC_SUBST([LIBGPS_LIBS]) + dnl checks for header files AC_HEADER_STDC diff --git a/src/host/layer23/src/common/Makefile.am b/src/host/layer23/src/common/Makefile.am index 73a0fc9..8d96ed2 100644 --- a/src/host/layer23/src/common/Makefile.am +++ b/src/host/layer23/src/common/Makefile.am @@ -1,5 +1,5 @@ INCLUDES = $(all_includes) -I$(top_srcdir)/include -AM_CFLAGS = -Wall $(LIBOSMOCORE_CFLAGS) $(LIBOSMOGSM_CFLAGS) +AM_CFLAGS = -Wall $(LIBOSMOCORE_CFLAGS) $(LIBOSMOGSM_CFLAGS) $(LIBGPS_CFLAGS) noinst_LIBRARIES = liblayer23.a liblayer23_a_SOURCES = l1ctl.c l1l2_interface.c sap_interface.c \ diff --git a/src/host/layer23/src/misc/Makefile.am b/src/host/layer23/src/misc/Makefile.am index 0b59f38..d8fb322 100644 --- a/src/host/layer23/src/misc/Makefile.am +++ b/src/host/layer23/src/misc/Makefile.am @@ -1,6 +1,6 @@ INCLUDES = $(all_includes) -I$(top_srcdir)/include -AM_CFLAGS = -Wall $(LIBOSMOCORE_CFLAGS) $(LIBOSMOGSM_CFLAGS) -LDADD = ../common/liblayer23.a $(LIBOSMOCORE_LIBS) $(LIBOSMOGSM_LIBS) $(LIBOSMOCODEC_LIBS) +AM_CFLAGS = -Wall $(LIBOSMOCORE_CFLAGS) $(LIBOSMOGSM_CFLAGS) $(LIBGPS_CFLAGS) +LDADD = ../common/liblayer23.a $(LIBOSMOCORE_LIBS) $(LIBOSMOGSM_LIBS) $(LIBOSMOCODEC_LIBS) $(LIBGPS_LIBS) bin_PROGRAMS = bcch_scan ccch_scan echo_test cell_log cbch_sniff diff --git a/src/host/layer23/src/mobile/Makefile.am b/src/host/layer23/src/mobile/Makefile.am index f3365af..8920c54 100644 --- a/src/host/layer23/src/mobile/Makefile.am +++ b/src/host/layer23/src/mobile/Makefile.am @@ -1,6 +1,6 @@ INCLUDES = $(all_includes) -I$(top_srcdir)/include -AM_CFLAGS = -Wall $(LIBOSMOCORE_CFLAGS) $(LIBOSMOGSM_CFLAGS) -LDADD = ../common/liblayer23.a $(LIBOSMOCORE_LIBS) $(LIBOSMOVTY_LIBS) $(LIBOSMOGSM_LIBS) $(LIBOSMOCODEC_LIBS) +AM_CFLAGS = -Wall $(LIBOSMOCORE_CFLAGS) $(LIBOSMOGSM_CFLAGS) $(LIBGPS_CFLAGS) +LDADD = ../common/liblayer23.a $(LIBOSMOCORE_LIBS) $(LIBOSMOVTY_LIBS) $(LIBOSMOGSM_LIBS) $(LIBOSMOCODEC_LIBS) $(LIBGPS_LIBS) noinst_LIBRARIES = libmobile.a libmobile_a_SOURCES = gsm322.c gsm480_ss.c gsm411_sms.c gsm48_cc.c gsm48_mm.c \ -- 1.7.9.5

2 1

[PATCH] fix libosmocore build with dpkg-buildpackage
by ☎ 17 Sep '12

17 Sep '12

Hello. Attached is a trivial patch to make dpkg-buildpackage -rfakeroot -uc -us work out of the box. Tested on ubuntu 12.04 x86_64 but should work on any debian-based distro. -- best regards, Max, http://fairwaves.ru

2 1

[PATCH] Fix build with dpkg-buildpackage.
by Max 11 Sep '12

11 Sep '12

--- .gitignore | 10 ++++++++++ debian/libosmocore.install | 1 + 2 files changed, 11 insertions(+) diff --git a/.gitignore b/.gitignore index 0bc78eb..3dc916b 100644 --- a/.gitignore +++ b/.gitignore @@ -31,6 +31,16 @@ Doxyfile.gsm Doxyfile.vty Doxyfile.codec +debian/autoreconf.after +debian/autoreconf.before +debian/files +debian/libosmocore-dev/ +debian/libosmocore*.log +debian/tmp/ +debian/libosmocore*.substvars +debian/libosmocore/ +debian/libosmocore.post*.debhelper + .tarball-version .version diff --git a/debian/libosmocore.install b/debian/libosmocore.install index d0dbfd1..9330260 100644 --- a/debian/libosmocore.install +++ b/debian/libosmocore.install @@ -1 +1,2 @@ usr/lib/lib*.so.* +usr/share/doc/libosmocore/* -- 1.7.9.5 --------------010904040907040604020505--

1 0

PNLM list overwritten
by Dario Lombardo 10 Sep '12

10 Sep '12

Hil list Today I've observed a strange behaviour when modifying the PNLM of some real networks expired sims (to be used with osmocom and openbts). I've put 001 01 on the top of the list. I've ejected and reinsterted the sim in the reader many times, and I'm sure that the value has been wrtitten. When trying to connect to my test operator I get the message "your sim card doesn't allow the connection to this network operator" from my android phone. Reading again the pnlm I see that the original list has been restored. This astonishes me... Is is possible that the SIM overwrites the list by itselt? Or is it the phone that does it? The android has an original, not branded, operating system. Thanks everybody for your help. Dario

3 6

Sept 5, 8pm / Osmocom Berlin User Group meeting
by Harald Welte 05 Sep '12

05 Sep '12

Hi all! This is the announcement for the next Osmocom Berlin meeting. Sept 05, 8pm @ CCC Berlin, Marienstr. 11, 10113 Berlin There is no formal presentation scheduled for this meeting. If you are interested to show up, feel free to do so. There is no registration required. The meeting is free as in "free beer", despite no actual free beer being around. Regards, Harald [p.s.: I myself will not be able to attend tonight, but I'm sure you will be able to do just fine (or even better?)] -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

1 0

LTE support
by Pierre Pronchery 04 Sep '12

04 Sep '12

Hi guys, Fabrice Bellard strikes again: http://bellard.org/lte/ It looks like he hasn't released the source code though :( Cheers, -- khorben

3 2

Re: Sagem OT-290 trace phone / GSMTAP integration
by Thomas Bertani 03 Sep '12

03 Sep '12

Hi list, I'm an information engineering student interested in working on embedded systems and tlc (especially I would like to get deep into firmware coding and dsp). In the last years I have been an active member of the italian openmoko community so I'm familiar with gta0X phones (I owned a gta02, now I have only a gta01). Two years ago I've worked at the Trento's research center on the n900 while today I'm working at a tlc company in Padua. Even if it's not what I'm working on at the moment, I'd like to spend some of my time by working on the GSMTAP integration of the Sagem OT-290. Is there any news about that? Since the last message on this thread was posted more than 2 months ago I wanted to know whether anyone was already working on it. Thanks, Thomas Bertani

3 4

How to flash the original fireware of C118?
by bresai 30 Aug '12

30 Aug '12

Hi, I flashed the rssi application into my C118. The app is really great. But now I want to flash the original fireware back. I saved the orignal loader by host/osmocon/osmoload memdump 0x000000 0x20000 compal_loader_orignal.bin But when I tried to flash this loader back using host/osmocon/osmoload fprogram 0 0x000000 compal_loader_orignal.bin, The phone can't power on. What did I do wrong? regards, wenyao -- View this message in context: http://baseband-devel.722152.n3.nabble.com/How-to-flash-the-original-firewa… Sent from the baseband-devel mailing list archive at Nabble.com.

2 1

Re: Any interest for Osmocom meetings in Bavaria ?
by Dieter Spaar 29 Aug '12

29 Aug '12

As already mentioned, the Osmocom Meeting will take place this Saturday, 1.9.2012 at 10:00. Three people have confirmed that they will come, I have send them an email with the location details. Harald is not yet sure if he can attend. A few suggestions for the meeting: - I will run a GSM-1800 network with my test license so you can try out OsmocomBB. If you are interested to do so please bring your Osmocom phone plus Laptop with the already installed OsmocomBB software. - We can do some experiments with SIMtrace if there is any interest. - There should still be enough time for other things, we can decide what to do during the meeting. Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

1 0

Re: Any interest for Osmocom meetings in Bavaria ?
by Dieter Spaar 22 Aug '12

22 Aug '12

I have now selected the day for the meeting which should match for all who have send me their preferred days. The first Osmocom meeting in Bavaria near Pfarrkirchen will be held on: Saturday, 1. September, starting at 10:00 If you are going to come, please let me know until next Wednesday (29. August). I will then send you a private email with the details of the location. The agenda is not yet set, but it seems that at least those who send me their areas of interest are mainly targeted towards GMS (OpenBSC/OsmocomBB). We can of course also talk about other stuff, e.g. RTL-SDR, but for this it would be nice if one of the RTL-SDR experts would join us (here you have the chance to receive a nearly clean/empty spectrum without much noise from other sources ;-). Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

1 0

Aug 22, 8pm / Osmocom Berlin User Group meeting
by Harald Welte 21 Aug '12

21 Aug '12

Hi all! This is the announcement for the next Osmocom Berlin meeting. Aug 22, 8pm @ CCC Berlin, Marienstr. 11, 10113 Berlin There is no formal presentation scheduled for this meeting. However, updates will be provided on various current developments, such as * Progress on the CC32RS512 smart card (osmo-cos) * Possibly: Status of current attempts to get CSD implemented in OpenBSC If you are interested to show up, feel free to do so. There is no registration required. The meeting is free as in "free beer", despite no actual free beer being around. Regards, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

1 0

Re: Any interest for Osmocom meetings in Bavaria ?
by Harald Welte 21 Aug '12

21 Aug '12

Dear Ellen, On Mon, Aug 20, 2012 at 04:26:04PM +0200, Ellen Apolinar wrote: > btw. where is the location when it is 630 km away from Berlin? As Dieter wrote in his original post: > at my place in the south-east of Bavaria near Pfarrkirchen So if you just type "Pfarrkirchen, Germany" into your favorite internet map service, you should get a pretty clear idea. As there seems to be frequent misconception: This is _not_ a developer conference or anything like that. Just an informal user group meeting, like those we have in Berlin every two weeks. Regards, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

1 0

Custom calypso board
by Harald Welte 18 Aug '12

18 Aug '12

Hi all! There are some signs that the supply of Motola C1xx phones is not endless, after all. As such, sysmocom has decided to manufacture some custom boards with the typical TI Calypso/Iota/Rita design. The RF PA will be RFMD RF3166, and the combined NOR + SRAM will be a Samsung K5A3281. All parts are still available from the surplus market. Schematics will be published in PDF form only, Gerber/PCB files will not be released (so basically the same like the OsmoSDR situation). All software used is already available as OsmocomBB under a *GPL license. Any help and input from the community will of course be appreciated. The design will be more or less a standard tri-band calypso phone design (900/1800/1900), with possibly a placement option for having 850/1800/1900. We'll be targetting a modem as opposed to a phone design, so no built-in keypad / display / battery, but external connections. At one edge there should be a PCB edge connector, possibly with mechanical form-factor of PCIe (sinc they're cheap). This connector should allow the module to be plugged into a back-plane with a number of other modems. I've crated an initial Wiki page about the possible / intended modifications from a classic phoned design at http://bb.osmocom.org/trac/wiki/Custom_Calypso_Board : * expose JTAG * board-edge connector for plugging many boards into one backplane * external clock input / buffered clock output * RF connector standard u.fl or SMA or optionally separate Rx/Tx? * I2C/SPI and both UARTs available on headers * on-board EEPROM for storing persistent data, even beyond NOR flashing * SIM card slot, SIM interface also present on header * additional / unused TPU ports * header for TSP / TPU and all data/control interfaces between iota/rita/calypso * RTC crystal and footprint for lithium backup battery * version of the board with uplink / downlink filters switched Feel free to discuss other extensions/modifications you may have in mind. Please note that fundamentally we are still heading for a calypso based design, so this will not be a board that just contains the Iota/Rita and some FPGA or general purpose DSP, as some people have proposed in the past. However, it may be possible to have connector footprints for the TSP / BSP interfaces and make some boarde that don't contain the calypso/ram/nor parts. Pricing will definitely not be anywhere near to the price of current phones. You cannot even source all the components for the price of those refurbished phones, let alone the fairly complex 6-layer PCB. Also, the quantities will be low, we may be manufacturing something like 100 units a batch only. This is a low-effort / side project, so I'm conservative with any estimates and would say that we're happy to have boards shipping by the end of this year. Regards, Harald (waiting for the e-mail flood) -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

9 24

Moving to TCH without doing a BCCH again when using app_ccch_scan
by Altaf 16 Aug '12

16 Aug '12

Hello everyone In one of the ML I have read that, BCCH-SDCCH-BCCH-TCH is required for listen to the TCH. In my case(Test N/w) I receive an IMM ASS, go to (SDCCH/4 + SACCH/4) TS:0 subchannel 2. As soon as I find an ASS_CMD I send a l1ctl_tx_dm_est_req with new channel parameters and jump to a TCH/F+SACCH/F+FACCH/F TS 4. I am receiving bursts after this. They contain SACCH SI5/6 as I see them in Wireshark and also some bursts (I hope a mix of FACCH and TCH). Is it necessary to do BCCH again. If I don't do Won't I receive TCH frames.? Will the be good TCH frames. ? But I see the tch_schedule_set working good. I receive once UL and next DL bursts. and sometimes SACCH. Can someone explain me. Thank You Altaf -- View this message in context: http://baseband-devel.722152.n3.nabble.com/Moving-to-TCH-without-doing-a-BC… Sent from the baseband-devel mailing list archive at Nabble.com.

1 0

app_ccch_scan for capturing FR data.
by Akib Sayyed 15 Aug '12

15 Aug '12

hello list i have been trying to sniff FR codec traffic from OpenBTS network.i tried to modify patch of bob with little help of airprobe. but when i try to play file toast says bad frame no. can any one help me with that here is app link http://pastebin.com/GwmB7UGK -- Akib Sayyed Matrix-Shell akibsayyed(a)gmail.com akibsayyed(a)matrixshell.com Mob:- +91-966-514-2243

2 1

[PATCH] change the keypad layout and the uart port number for the Pirelli DP-L10
by Marco Schwan 15 Aug '12

15 Aug '12

Hi, I have make a patch for the Pirelli DP-L10 created. You can enable and disable the patch in the makefile (src/target/firmware/Makefile). The Keypad layout is tested with rssi.bin app. Only the power button is not available. regards Marco

5 9

pirelli charging
by Kevin Redon 14 Aug '12

14 Aug '12

Hi, Christian Vogel commited the battery charging capability for the C123. I wanted to know if someone also looked at the Pirelli DP-L10 (maybe steve|m), which uses the USB port for charging (also used serial communication)? Or maybe it could be possible to use the USB power instead (or along) of the battery, which would be enough for RX only. thanks, kevin

1 0

about the IMSI Detach in various status
by gcc 13 Aug '12

13 Aug '12

Hi, List. I am studying the IMSI Detach attack now. I have some doubt. 1. if the victim is already off-line, what is the effect of the attack? 2. In my network, I send the IMSI detach Indication, and the base station sends me the Channel Release. but the victims is still online,why? I am confused！ -- View this message in context: http://baseband-devel.722152.n3.nabble.com/about-the-IMSI-Detach-in-various… Sent from the baseband-devel mailing list archive at Nabble.com.

1 0

Re: Any interest for Osmocom meetings in Bavaria ?
by Dieter Spaar 08 Aug '12

08 Aug '12

Hello Alexander, On Wed, 8 Aug 2012 20:44:12 +0400, "Alexander Chemeris" <alexander.chemeris(a)gmail.com> wrote: > > I'd love to join, but it strongly depends on the exact dates of the > meeting. I have very tight travel schedule in the next months. Just to avoid any misunderstanding: Those meetings are not supposed to be something similar to the Osmocom Developer Conference earlier this year. The idea is to have a regular or "on demand" oportunity to meet with people for a few hours and demonstrate or talk about the Osmocom projects or share new ideas. Its comparable to the regular Berlin meetings, you can get an idea of what goes on there: http://openbsc.osmocom.org/trac/blog/osmug-20120808 Of course you can attend, if you are close (Munich airport is 120 km away) but I would expect that Berlin is more convenient if you come from really far away and Berlin already has regular meetings. Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

1 0

Re: Any interest for Osmocom meetings in Bavaria ?
by Dieter Spaar 08 Aug '12

08 Aug '12

As a quick follow up: The proposal for the meeting is intended for everyone interested in the various Osmocom projects (e.g. OpenBSC, OsmocomBB, TETRA, SimTrace, OsmoSDR). The meeting is not limited to only those who are actively participating. I will wait until next week to see how many people are interested, so far I am aware of two persons. Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

2 1

Working of ccch_scan and capturing the SDCCH.
by Altaf 08 Aug '12

08 Aug '12

Hello Sylvain I am using the burst_ind branch and have some doubts. I am using a test network, and it has no encryption. Usually the n/w has a low load and the channel structure followed during the assignment is SDCCH/4 + SACCH/C4 or CBCH(SDCCH/4). and timeslot 0 . SDCCH is assigned on timeslot 0.. The ccch_scan is able to capture the SMS sent on timeslot 0 and also only one of the subchannel as per the above assignment. Just for testing, When I use two phones and send an SMS from both of them simultaneously both are assigned timeslot 0 and different subchannels. CCCH_scan could capture only one SMS. meaning that it could only get one subchannel. Am I right about ccch_scan or does it have the capability to get a complete timeslot. ? Thank you Altaf -- View this message in context: http://baseband-devel.722152.n3.nabble.com/Working-of-ccch-scan-and-capturi… Sent from the baseband-devel mailing list archive at Nabble.com.

5 10

Any interest for Osmocom meetings in Bavaria ?
by Dieter Spaar 08 Aug '12

08 Aug '12

I would like to ask if there is interest to have some kind of Osmocom meetings in Bavaria. Suggested location is here at my place in the south-east of Bavaria near Pfarrkirchen. There are no large cities close, but the location is still in reach with a car, some examples (single distance): - from Munich: 130 km - from Passau: 55 km - from Salzburg: 90 km - from Linz: 140 km Why at my place ? There is some GSM/3G/TETRA equipment and RF measurement gear around which could be demonstrated. It is not yet decided when and how (regular or "on demand") this meeting should take place. Before that I want to find out if there is interest at all and how many people are interested. So please write to the list what you think. Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

2 1

August 8, 8pm / Osmocom meeting in Berlin
by Harald Welte 07 Aug '12

07 Aug '12

Hi all! This is the announcement for the next Osmocom Berlin meeting. Aug 08, 8pm @ CCC Berlin, Marienstr. 11, 10113 Berlin Harald will be giving a short presentation on contemporary smartphone hardware architecture. Furthermore, updates and discussions on various current developments will be exchanged, such as * Demo of OsmoPCU on sysmoBTS * Status of new SMSC * Planning phase of custom calypso board If you are interested to show up, feel free to do so. There is no registration required. The meeting is free as in "free beer", despite no actual free beer being around. Updates and the blog post can be found here: http://openbsc.osmocom.org/trac/blog/osmug-20120808 -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

2 2

free O2 prepaid
by jolly 06 Aug '12

06 Aug '12

15 euros for O2: 5258-9990-7370 *103*525899907370# have phun...

1 0

EMFCamp - A UK Hackcamp this summer!
by Paul Dart 01 Aug '12

01 Aug '12

Hello ! Although not entirely on topic, Harold is happy for me to post to these lists about an event I've been involved in. Electromagnetic Field is a UK hacker/maker camp that is occurring in just under a months time. In case you haven't, here's the gist: Electromagnetic Field is a non-profit three day camping festival for people with an inquisitive mind or an interest in making things: hackers, geeks, scientists, engineers, artists, and craftspeople. It's taking place in Milton Keynes between the 31st August and the 2nd September and is inspired by European camps such as the Chaos Communication Camp and Hacking At Random, which means that we have an absurd internet connection to a field, and power to every tent. There will be talks and workshops on everything from genetic modification to lockpicking, blacksmithing to high-energy physics, reverse engineering to electronic engineering, quadcopters to beer brewing and crocheting to carpentry. If you decide to talk about something, there's space for you to do so, and plenty of people who want to listen. The campsite will be littered with interesting things to play with and explore, from ride-on tanks to giant dinosaurs. And more lasers than you can shake a laser-covered stick at. Attendees are encouraged to form villages and put on activities for other people around the camp, and we're going to have villages covering everything from gaming to 3D printing. If you'd like to form a village, get in touch! https://www.emfcamp.org/tickets Your ticket will give you the following things: * A secure place to camp for three days. * Power to your tent. * Very fast internet access (both wired and wireless). * Access to running water and hot showers. * A whole pile of awesome talks and workshops by amazing people. * A full bar. * One fully programmable camp badge, equipped with wireless communications. * A campsite equipped with weird and wonderful things to play with. * A weekend unlike any other in the UK. If we've still not sold you, maybe you should read our website and blog, which have exhaustive information about the camp: https://www.emfcamp.org http://blog.emfcamp.org If you've got any questions feel free to email me or the team! Paul

1 0

cp2102 (betemcu, B75937)
by lonelysurfer 31 Jul '12

31 Jul '12

...a never ending story: i have a working ftdi-ttl, but the cp2102-adapters (http://www.ebay.de/itm/USB-2-0-to-UART-TTL-6PIN-Module-Serial-Converter-CP2…) with the same cable dont work under ubuntu or windows. if i rub the top of the 2.55mm with my finger random data appears. but the loader doesnt upload the firmware. i used the txd, rxd and gnd pins and checked the connections with a multimeter. i tested -m c123xor, -m c123 and the default firmware. flashing custom baudrates was no problem. rivers are installed correctly (stady ttyusb0 under ubuntu/ com1 under win). is there any hint? -- View this message in context: http://baseband-devel.722152.n3.nabble.com/cp2102-betemcu-B75937-tp3489336p… Sent from the baseband-devel mailing list archive at Nabble.com.

3 4

OSMOCOM RECEIVING BUT NOT SENDING DATA THROUGHT TXD - HARDWARE&SOFTWARE TESTED - GNUARM&OSMOCOM BUILT FROM OSMOCOM PAGE INSTRUCTIONS
by Filipe RC - 27 Jul '12

27 Jul '12

Hi, im having some problems in software only, that i describe bellow in my log: -FTDI based interface sold by tronix (vendor link on your site), usb2 to serial adaptor ( model TRX1227, CHIPSET FT232R ) -gnuarm&osmocom compiled from source on debian stable as per osmocom without a single problem. -ran osmocom from su (tried user as well), as instructed and as follows: $ ./osmocon -p /dev/ttyUSB0 -m c123xor ../../target/firmware/board/compal_e88/loader.compalram.bin output: whenever power button was pressed, all i got was some aparently random hex…(no expert on phone flashing here) with no getting to PROMPT1: "root@box:/home/box/osmocomm/osmocom-bb/src/host/osmocon# sudo ./osmocon -p /dev/ttyUSB0 -m c123 ../../target/firmware/board/compal_e88/loader.compalram.bin got 1 bytes from modem, data looks like: 00 . got 2 bytes from modem, data looks like: 00 00 .. got 3 bytes from modem, data looks like: 72 82 bf r.. got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: a6 . got 1 bytes from modem, data looks like: 51 Q got 1 bytes from modem, data looks like: d2 . got 1 bytes from modem, data looks like: 51 Q got 1 bytes from modem, data looks like: b2 . got 1 bytes from modem, data looks like: a4 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 4d M got 1 bytes from modem, data looks like: a3 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . 2nd press: got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . third press: got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 72 r got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . fourth press: got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 72 r got 1 bytes from modem, data looks like: 82 . got 1 bytes from modem, data looks like: bf . got 1 bytes from modem, data looks like: 7d } got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: a6 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . " Same output, (maybe with a few more presses) in hex, using gtkterm@115200baud,8bit,nopar,1stop: " 00 F1 00 72 82 BF 7D FD 7F 00 A6 51 D2 51 B2 A4 12 00 4D A3 A3 68 23 00 00 00 F1 00 72 82 BF 7D FD 7F 00 A6 51 D2 51 A4 A4 12 00 4D A3 A3 68 23 00 00 00 F1 00 72 82 BF 7D FD 7F 00 A6 51 D2 51 B2 A4 12 00 4D A3 A3 64 23 00 00 00 F1 00 72 82 BF 7D FD 7F 00 A6 51 D2 51 A4 A4 12 00 4D A3 A3 64 23 00 00 00 F1 00 72 82 BF 7D FD 7F 00 A6 51 D2 51 B2 A4 12 00 4D A3 A3 48 23 00 00 00 F1 00 72 82 BF 7D FD 7F 00 A6 51 D2 51 B2 A4 12 00 4D A3 A3 64 23 00 00 00 F1 00 72 82 BF 7D FD 7F 00 A6 51 D2 51 B4 A4 12 00 4D A3 A3 48 23 00 00 00 F1 00 72 82 BF 7D FD 7F 00 A6 51 D2 51 A4 A4 12 00 4D A3 A3 48 23 00 00 " -/dev/USB0 permission check - good, even chmoded 777&chown on rc.local. -cable check: thought txd was broken, but wasnt. checked from linux with a led stuck to the txd end of the jack, echo "whatever" > /dev/ttyUSB0, led did flash. -chances i put are: osmocom dependent on some specific C123 firmware? some kind of hidden compilation complication? some kind of ftdi eeprom config/bitrate/parity config missing for osmocom? I hope i have managed to be concise enough. Great work guys. Greatings from portugal, Filipe RC

1 1

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

baseband-devel