Hi guys,
i just looked at 27c3 talk on
http://27c3.iphoneblog.de/recordings/3952.html (i really wanted to be
there!) and heard about the concept of being able to fake gsm based
position systems.
Which could in theory the distance that could be faked respect to the
knowledge that the BTS can acquire?
I mean, the modified timing information provided by phone running
osmocombb, how many meters distance from BTS could be?
-naif
Hello all.
Just back from the hospital, so I haven't followed the development much
for some time.
Anyway, I've recently stumbled upon an interesting device:
https://www.dealextreme.com/details.dx/sku.50391
I think I'll order that one sometime soon, so that I can look at it in
more detail.
This is a chinese phone with android, but some things make me think that's
MTK inside.
According to desctiption:
ARM926EJ-S rev 5(v5l) BogoMIPS: 207.66
Android 2.2.1 OS system/Wifi(802.11b)/TV/GPS/FM/JAVA
Price - 130 bucks.
Sounds familiar?
Compared to my E1000:
ARM926EJ-S rev 5 (v5l) BogoMIPS: 104.24
Twice more Bogomips. The hardware pretty much seems like a typical MTK,
and for that price I guess there actually is MTK inside, something a
little
better than 2635, so the problem is to find the sources somewhere (And my
bet is, that if they don't make it to the mainline - they'll leak out to
the web) If the chips are pretty much identical, and they are, this might
be a good thing. I think I'll buy one after the holiday madness is over
and, hopefully, provide teardown photos, firmware dump and more details.
Regards,
Andrew.
> Just to avoid any duplicate of work as well: most of this is already
> done by cell_log (layer23/src/misc). It iterates over the whole
spectrum
> and tries to get an Immediate Assignment by sending a RACH to every
cell.
> It stores SI1-4, GPS position and the TA in a logfile, and using the
> gsmmap utility you can create a *.kml map of the calculated cell
> positions for Google Earth.
> So what's missing is really only the PCAP support and a command line
> switch to turn off the "active" scanning by sending no RACHs.
hi steve,
exactly. almost everything is already there. there are some things that
may need to be improved in my opinion:
- deactivating/activating the RACH request
- altering maximum distance (gps) moving off the position of last power
scan, before restarting scanning process.
- multiple radio support for faster scanning and deeper scanning while
moving.
- selecting between the generic text format and PCAP.
- option to wait some more time to receive more system informations than
the mandatory 1..4
regards,
andreas
When running the layer23/mobile host application in combination with layer1
firmware on a c115 (compal_e88 based) I can easily connect with a network
(when using Sylvain's test trunk, which supports the SIM very well!).
However, running the same code on the C155 (compal_e99 based) the phone
refuses to connect to the network and keeps scanning ARFCN's. Is there any
real difference between these phones except for the LCD's? In
rffe_dualband.c I see a remark about the value of SYSTEM_INHERENT_GAIN that
has been measured by Harald on the C123. May that be a different value for
the C155? Is this a problem observed by others, or is there a workaround?
I tried to load the dfu.bin+main.bin (=samba) onto the Olimex SAM7-P64
board. I connected jumper TEST for >10s, disconnected power, reconnected
power. I assume that it is possible now to upload firmware using sam-ba (i
tried both linux and windows) over the USB port. Even trying to connect
through the dbg serial port failed. Is there something wrong with the board
or in the procedure I follow. Should I see a USB-CDC serial port when the
SAM7 is running the SAM-BA bootloader? Any comments would be appreciated.
Hi all,
I have started a GettingStarted[1] page to cover the topics of getting the
code, getting an ARM toolchain and pointing to the osmocon and layer23 pages
for the details. I was also going through the search to update the names of
the firmware binaries.
The CalypsoRomloader[2] page deserves an update as well. It is referring to
the GTA0X but then tries to flash a nonexistent E88 binary. I am not sure what
to turn this page into.
Do we also have a list of Milestones we want to accomplish (besides merging
the sending code to master)? Do we have junior tasks for people that would
like to get started on target and host firmware?
regards
z.
[1] http://bb.osmocom.org/trac/wiki/GettingStarted
[2] http://bb.osmocom.org/trac/wiki/CalypsoRomloader
Hi,
I made a lot of changes to the SIMtrace hardware schema.
Here my v0.5 : https://gsm.tsaitgaist.info/SIMtrace/v0.5/SIMtrace.ps
Some important point that are unclear, where I would like to have some
comments :
- I do not use USB_DP_PUP which I found in several at91sam7s design (and
openPCD). I don't know if it will be useful or required.
- I use npn transistor as switches (2 for I/O because bidirectional).
Maybe (N/P/C)MOS is a better solution.
I already bought most of the parts and would like to start drawing the
PCB. Please tell me if you find some errors or have any advices.
kevin
I ordered a SAM7-P64 board for running Simtrace (received board today, but
still waiting for the REBELSIm connectors). When compiling the code (using
Gnuarm3.4.3) I got two errors:
1) the --g($DEBUGF) option was not understood; omitting this, made the
Makefile (for dfu and main) working
2) in /lib/vsprintf.c I had to add #include <limits.h> in order to prevent
errors related to MAX_INT etc.
Are there any ideas for making a man-in-the-middle SIM device? One master
interface to a real SIM, another slave interface providing a SIM interface
towards a phone with the possibility to filter certain APDU's or to add
files or commands on top of the real SIM. This would need an additional SIM
master interface (to send and receive APDU's to the real SIM) on top of what
already is in SIMtrace and the slave interface should be capable of sending
messaged back to the real SIM master. I will look into it, first starting
with implementing a simple SIM card master on the other UART.
hi,
i want to make a cable for the sciphone g2 that provides serial communication and charging with one connector.
unfortunately the pictures at [1] aren't clear enough for me. i don't want to kill my phone.
actually i count 15 pins in the picture, where mine has only 12.
that's weird. i guess that 2 are just for aligning the case, but that still makes 13 vs. 12.
i tried to ascii draw the connector from the back (soldering) side. the rounded half of the connector on the upper side.
The pins i found described elsewhere on the internet are already marked.
--------------------------
( )
( ) |
( ) |
+-------------------------+ |
| | | | | | | | /
| | | | | | | | /
+-------------------------+/
^ ^ ^ ^
| | | |
| | | +--- GND
| | +----- GND
| +----------- RX (PC -> Phone)
+--------------- TX (Phone -> PC)
could someone please mark the pins that have to be connected for charging ?
i guess one of the two GND pins is involved.
kind regards and
thanks for your time
-Alex
[1] http://en.qi-hardware.com/wiki/Sciphone_Dream_G2