November 2012 - baseband-devel

Engagetted !

by Sébastien Lorquet

http://www.engadget.com/2010/12/29/researchers-eavesdrop-on-encrypted-gsm-c… Congrats!

6 months, 1 week

5
5
0 0

Sniffing GPRS

by canarion

Hi, After compiling osmocom-bb and apply sylvain/burst_ind branch and gprs_multi.patch, I execute it and try to sniff gprs traffic. I loaded the layer1 into my C139 and I obtained an ARFCN code (883). When I run ccch_scan -a 883 I get the next result: opyright (C) 2010 Harald Welte <laforge(a)gnumonks.org> Contributions by Holger Hans Peter Freyther License GPLv2+: GNU GPL version 2 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Failed to connect to '/tmp/osmocom_sap'. Failed during sap_open(), no SIM reader <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(1476410343) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(1207963561) <0001> app_ccch_scan.c:400 Paging1: Normal paging chan tch/f to TMSI M(0x1ad1cda) <0001> app_ccch_scan.c:403 Paging2: Normal paging chan tch/f to TMSI M(0x41ae98f9) <0001> app_ccch_scan.c:426 Paging3: Normal paging chan n/a to imsi M(214031385056117) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3306441249) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to imsi M(214031482053520) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to imsi M(214036185306441) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(4207880193) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(4135931713) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(4214223105) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3388536385) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(134915836) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3961436929) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(4229756769) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(531909) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to imsi M(214034185316455) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3829437761) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to imsi M(214033485554660) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3639403521) <0001> app_ccch_scan.c:105 SI1 received. <0001> app_ccch_scan.c:464 unknown PCH/AGCH type 0x00 <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3827744513) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(335734299) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3561969409) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(4294310401) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3698994241) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3682615617) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(67866789) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(4003487553) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3770351169) <0001> app_ccch_scan.c:400 Paging1: Normal paging chan tch/f to TMSI M(0x41ae98f9) <0001> app_ccch_scan.c:403 Paging2: Normal paging chan tch/f to TMSI M(0x1ad1cda) <0001> app_ccch_scan.c:426 Paging3: Normal paging chan n/a to imsi M(214031385056117) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3306441249) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to imsi M(214031482053520) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to imsi M(214036185306441) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(4102036289) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(4135931713) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to imsi M(214032485273805) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3798414145) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(134915836) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3988859137) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3735175681) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(531909) <0001> app_ccch_scan.c:248 GSM48 IMM ASS (ra=0x78, chan_nr=0x0f, HSN=24, MAIO=1, TS=7, SS=0, TSC=1) Dropping frame with 55 bit errors <000c> l1ctl.c:238 Dropping frame with 55 bit errors <000c> l1ctl.c:290 BURST IND: @(830928 = 0626/20/36) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830928 = 0626/20/36) (-110 dBm, SNR 8) <000c> l1ctl.c:290 BURST IND: @(830929 = 0626/21/37) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830929 = 0626/21/37) ( -83 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830930 = 0626/22/38) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830930 = 0626/22/38) ( -87 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830931 = 0626/23/39) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830931 = 0626/23/39) ( -83 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830932 = 0626/24/40) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830932 = 0626/24/40) ( -88 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830933 = 0626/25/41) (-105 dBm, SNR 8, UL, SACCH) <000c> l1ctl.c:290 BURST IND: @(830933 = 0626/25/41) (-107 dBm, SNR 5, SACCH) <000c> l1ctl.c:290 BURST IND: @(830934 = 0626/00/42) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830934 = 0626/00/42) ( -88 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830935 = 0626/01/43) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830935 = 0626/01/43) ( -83 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830936 = 0626/02/44) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830936 = 0626/02/44) ( -88 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830937 = 0626/03/45) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830937 = 0626/03/45) ( -89 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830938 = 0626/04/46) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830938 = 0626/04/46) ( -88 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830939 = 0626/05/47) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830939 = 0626/05/47) ( -82 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830940 = 0626/06/48) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830940 = 0626/06/48) ( -87 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830941 = 0626/07/49) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830941 = 0626/07/49) ( -87 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830942 = 0626/08/50) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830942 = 0626/08/50) ( -86 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830943 = 0626/09/00) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830943 = 0626/09/00) ( -86 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830944 = 0626/10/01) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830944 = 0626/10/01) ( -87 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830945 = 0626/11/02) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830945 = 0626/11/02) ( -87 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830947 = 0626/13/04) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830947 = 0626/13/04) ( -84 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830948 = 0626/14/05) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830948 = 0626/14/05) ( -85 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830949 = 0626/15/06) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830949 = 0626/15/06) ( -88 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830950 = 0626/16/07) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830950 = 0626/16/07) ( -89 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830951 = 0626/17/08) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830951 = 0626/17/08) ( -88 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830952 = 0626/18/09) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830952 = 0626/18/09) ( -85 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830953 = 0626/19/10) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830953 = 0626/19/10) ( -87 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830954 = 0626/20/11) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830954 = 0626/20/11) ( -87 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830955 = 0626/21/12) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830955 = 0626/21/12) (-106 dBm, SNR 0) <000c> l1ctl.c:290 BURST IND: @(830956 = 0626/22/13) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830956 = 0626/22/13) (-107 dBm, SNR 5) <000c> l1ctl.c:290 BURST IND: @(830957 = 0626/23/14) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830957 = 0626/23/14) (-106 dBm, SNR 2) <000c> l1ctl.c:290 BURST IND: @(830958 = 0626/24/15) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830958 = 0626/24/15) (-108 dBm, SNR 1) <000c> l1ctl.c:290 BURST IND: @(830959 = 0626/25/16) (-106 dBm, SNR 2, UL, SACCH) <000c> l1ctl.c:290 BURST IND: @(830959 = 0626/25/16) (-109 dBm, SNR 5, SACCH) <000c> l1ctl.c:290 BURST IND: @(830960 = 0626/00/17) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830960 = 0626/00/17) (-108 dBm, SNR 3) <000c> l1ctl.c:290 BURST IND: @(830961 = 0626/01/18) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830961 = 0626/01/18) (-106 dBm, SNR 2) <000c> l1ctl.c:290 BURST IND: @(830962 = 0626/02/19) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830962 = 0626/02/19) (-108 dBm, SNR 3) <000c> l1ctl.c:290 BURST IND: @(830963 = 0626/03/20) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830963 = 0626/03/20) (-107 dBm, SNR 0) <000c> l1ctl.c:290 BURST IND: @(830964 = 0626/04/21) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830964 = 0626/04/21) ( -85 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830965 = 0626/05/22) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830965 = 0626/05/22) ( -87 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830966 = 0626/06/23) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830966 = 0626/06/23) ( -85 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830967 = 0626/07/24) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830967 = 0626/07/24) ( -86 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830968 = 0626/08/25) (-107 dBm, SNR 6, UL) <000c> l1ctl.c:290 BURST IND: @(830968 = 0626/08/25) (-109 dBm, SNR 0) <000c> l1ctl.c:290 BURST IND: @(830969 = 0626/09/26) (-101 dBm, SNR 6, UL) But it stop to capture frames, seems to be left in a standby state and I don't know why that is. With gprsdecode I can see the next image in the wireshark: http://baseband-devel.722152.n3.nabble.com/file/n3712433/wireshark-capture.… If someone knows what is the problem, please tell me. Thanks in advance. Cheers, Dani -- View this message in context: http://baseband-devel.722152.n3.nabble.com/Sniffing-GPRS-tp3712433p3712433.… Sent from the baseband-devel mailing list archive at Nabble.com.

7 years, 4 months

8
12
0 0

Please can anyone advise me - FMTOOL Error and no further processing

by Raz Sharif

Dear all, I vae the C115 with a T1 USB to Serial cable with the Prolific chipset. When i run osmocon i get :- an its just sits there with no further processing. ./osmocon -p /dev/ttyUSB0 -m c123xor ../../target/firmware/board/compal_e88/loader.compalram.bin read_file(../../target/firmware/board/compal_e88/loader.compalram.bin): file_size=17120, hdr_len=4, dnload_len=17127 read_file(../../target/firmware/board/compal_e88/loader.compalram.bin): file_size=17120, hdr_len=4, dnload_len=17127 got 1 bytes from modem, data looks like: 00 . got 2 bytes from modem, data looks like: 2f 00 /. got 1 bytes from modem, data looks like: 1b . got 3 bytes from modem, data looks like: f6 02 00 ... got 1 bytes from modem, data looks like: 41 A got 1 bytes from modem, data looks like: 01 . got 1 bytes from modem, data looks like: 40 @ Received PROMPT1 from phone, responding with CMD got 1 bytes from modem, data looks like: 66 f got 1 bytes from modem, data looks like: 74 t got 1 bytes from modem, data looks like: 6d m got 1 bytes from modem, data looks like: 74 t got 1 bytes from modem, data looks like: 6f o got 1 bytes from modem, data looks like: 6f o got 1 bytes from modem, data looks like: 6c l Received FTMTOOL from phone, ramloader has aborted got 1 bytes from modem, data looks like: 65 e got 1 bytes from modem, data looks like: 72 r got 1 bytes from modem, data looks like: 72 r got 1 bytes from modem, data looks like: 6f o got 1 bytes from modem, data looks like: 72 r got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . I think the cable is ok as when i run my fingers on the tip i get random Zeros so it appears to be talking to the cable. Also when i tried to run Mobile i get the :- even though i created the Mobile.cfg file in /etc/osmoco Failed to parse the config file: '/home/raz/.osmocom/bb/mobile.cfg' Please check or create config file using: 'touch /home/raz/.osmocom/bb/mobile.cfg' I have spent some hours researching the lists and trying various things to no avail but I want to continue until I resolve this issues and use this great stack to learn about the GSM network. Please advise. Great full for any help or pointers but this maybe a timing issue that is difficult to debug. Thanks Raz

7 years, 11 months

5
6
0 0

cell re-selection

by Andreas.Eversberg

hi, i did a lot of resarch and testing on cell selection and re-selection process the last two week. the cell selection process, network selection process (manual and automatic) and mobility management process were already implemented in OsmocomBB a long time, but turned out to be buggy and incomplete. i made test drives to check the process and debugged it. the re-selection process is new. it is used to track surrounding cells while listening to the BCCH of the current cell (camping on a cell). special extension to the layer1 firmare is used to measure neighbour cells. if an neighbour cell becomes 'better', the mobile switches to that cell, depening on different criteria. now it is possible to move with OsmocomBB. the re-selection process is not handover! handover is a process where a phone switches between cells while doing a call. handover is one next step to implement. the process is a little more complex, because it requires not only neighbour cell measurements, but also syncing to them without interrupting the traffic channel. most layer 3 stuff of handover is already implemented. if you like to play and test your moving OsmocomBB, you can check out the "jolly/roaming" branch. it contains the extension to layer1, as well as sim reader and fixes from "sylvain/testing" branch. use both "mobile" and "layer1" firmware from this branch. in order to see some process at VTY, you can do: enable monitor network 1 (continously display the strongest cell and neighbour cells) show ms 1 (to see current states) show neighbour-cells 1 (to see a more detailed current list of neighbours) andreas

8 years, 1 month

3
3
0 0

Set fixed TMSI and Kc

by Simian Denson

Hi, in the osmocom bb mobile.cfg I don't see any posibility to set a fixed Kc encryption key and the tmsi. How could I achieve that osmocom uses my defined Kc and tmsi? cheers, Simian

8 years, 1 month

5
21
0 0

Location update problems on Motorola C118

by Maciej Grela

Hi, I'm trying to run the latest osmocom-bb git on a Motorola C118 phone. After a minor problem with the build (as you may've noticed in the patch I've sent). I got to the point of successfuly running layer1 on the phone and the mobile app on the PC (I have also enabled TX). The process seems to be stuck on trying to perform a location update. The status of the ms is always either: show ms MS '1' is up, MM connection active IMEI: 000000000000000 IMEISV: 0000000000000000 IMEI generation: fixed automatic network selection state: A1 trying RPLMN MCC=104 MNC=002 (104, 002) cell selection state: connected mode 1 ARFCN=19 MCC=104 MNC=002 LAC=0xb00f CELLID=0x4fd9 (104, 002) radio ressource layer state: connection pending mobility management layer state: wait for RR connection (location updating) OsmocomBB> or show ms MS '1' is up, service is limited (pending) IMEI: 000000000000000 IMEISV: 0000000000000000 IMEI generation: fixed automatic network selection state: A1 trying RPLMN MCC=104 MNC=002 (104, 002) cell selection state: C3 camped normally ARFCN=19 MCC=104 MNC=002 LAC=0xb00f CELLID=0x4fd9 (104, 002) radio ressource layer state: idle mobility management layer state: MM idle, attempting to update OsmocomBB> I think, that because of this I can't make any calls or send sms (all the requests are being rejected): OsmocomBB# call 1 <X> call 1 <X> OsmocomBB# % (MS 1) % Call has been rejected The log information from mobile when it's trying to do a location update is show below: <000b> gsm48_rr.c:2174 PAGING REQUEST 1 <000b> gsm48_rr.c:2141 IMSI 260021964220249 (not for us) <000b> gsm48_rr.c:2132 TMSI fd82a501 (not for us) <000e> gsm48_mm.c:344 Location update retry <0005> gsm48_mm.c:345 timer T3211 (loc. upd. retry delay) has fired <0005> gsm48_mm.c:4311 (ms 1) Received 'MM_EVENT_TIMEOUT_T3211' event in state MM IDLE, attempting to update <000e> gsm48_mm.c:2199 Perform location update (MCC 104, MNC 002 LAC 0xb00f) <0005> gsm48_mm.c:2333 LOCATION UPDATING REQUEST <0005> gsm48_mm.c:2355 using LAI (mcc 104 mnc 002 lac 0xb00f) <0005> gsm48_mm.c:2363 using TMSI 0x28a3d62e <0005> gsm48_mm.c:914 new state MM IDLE, attempting to update -> wait for RR connection (location updating) <0001> gsm48_rr.c:5428 (ms 1) Message 'RR_EST_REQ' received in state idle (sapi 0) <000e> gsm48_rr.c:1318 Establish radio link due to mobility management request <0003> gsm322.c:4037 (ms 1) Event 'EVENT_LEAVE_IDLE' for Cell selection in state 'C3 camped normally' <0003> gsm322.c:823 new state 'C3 camped normally' -> 'connected mode 1' <0003> gsm322.c:3653 Going to camping (normal) ARFCN 19. <0003> gsm322.c:463 Sync to ARFCN=19 rxlev=-74 (Sysinfo, ccch mode NON-COMB) <0001> gsm48_rr.c:366 new state idle -> connection pending <0001> gsm48_rr.c:1465 CHANNEL REQUEST: 00 (Location Update with NECI) <0003> gsm322.c:2938 Channel synched. (ARFCN=19, snr=16, BSIC=17) <0001> gsm322.c:2959 using DSC of 90 <0003> gsm48_rr.c:4816 Channel provides data. <0001> gsm48_rr.c:1601 RANDOM ACCESS (requests left 5) <0001> gsm48_rr.c:1658 RANDOM ACCESS (Tx-integer 50 combined no S(lots) 0 ra 0x0e) <0001> gsm48_rr.c:1697 Use MS-TXPWR-MAX-CCH power value 5 (33 dBm) <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:1601 RANDOM ACCESS (requests left 4) <0001> gsm48_rr.c:1658 RANDOM ACCESS (Tx-integer 50 combined no S(lots) 55 ra 0x07) <0001> gsm48_rr.c:1697 Use MS-TXPWR-MAX-CCH power value 5 (33 dBm) <0001> gsm48_rr.c:2450 IMMEDIATE ASSIGNMENT: <0001> gsm48_rr.c:2462 (ta 2/1107m ra 0x75 chan_nr 0x0a MAIO 0 HSN 38 TS 2 SS 0 TSC 0) <0001> gsm48_rr.c:2503 Request, but not for us. <0001> gsm48_rr.c:2450 IMMEDIATE ASSIGNMENT: <0001> gsm48_rr.c:2462 (ta 2/1107m ra 0x75 chan_nr 0x0a MAIO 0 HSN 38 TS 2 SS 0 TSC 0) <0001> gsm48_rr.c:2503 Request, but not for us. <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:673 MON: f=19 lev=-78 snr= 0 ber= 0 LAI=104 002 b00f ID=4fd9 <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:1601 RANDOM ACCESS (requests left 3) <0001> gsm48_rr.c:1658 RANDOM ACCESS (Tx-integer 50 combined no S(lots) 55 ra 0x0f) <0001> gsm48_rr.c:1697 Use MS-TXPWR-MAX-CCH power value 5 (33 dBm) <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:1601 RANDOM ACCESS (requests left 2) <0001> gsm48_rr.c:1658 RANDOM ACCESS (Tx-integer 50 combined no S(lots) 55 ra 0x01) <0001> gsm48_rr.c:1697 Use MS-TXPWR-MAX-CCH power value 5 (33 dBm) <0001> gsm48_rr.c:2450 IMMEDIATE ASSIGNMENT: <0001> gsm48_rr.c:2473 (ta 1/553m ra 0x18 chan_nr 0x59 ARFCN 19 TS 1 SS 3 TSC 1) <0001> gsm48_rr.c:2503 Request, but not for us. <0001> gsm48_rr.c:2450 IMMEDIATE ASSIGNMENT: <0001> gsm48_rr.c:2473 (ta 1/553m ra 0x18 chan_nr 0x59 ARFCN 19 TS 1 SS 3 TSC 1) <0001> gsm48_rr.c:2503 Request, but not for us. <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:1601 RANDOM ACCESS (requests left 1) <0001> gsm48_rr.c:1658 RANDOM ACCESS (Tx-integer 50 combined no S(lots) 55 ra 0x0a) <0001> gsm48_rr.c:1697 Use MS-TXPWR-MAX-CCH power value 5 (33 dBm) <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:673 MON: f=19 lev=-78 snr= 0 ber= 1 LAI=104 002 b00f ID=4fd9 <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:1601 RANDOM ACCESS (requests left 0) <0001> gsm48_rr.c:1605 Done with sending RANDOM ACCESS bursts <0001> gsm48_rr.c:836 starting T3126 with 5.000 seconds <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2225 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:673 MON: f=19 lev=-78 snr= 0 ber= 0 LAI=104 002 b00f ID=4fd9 <0001> gsm48_rr.c:2450 IMMEDIATE ASSIGNMENT: <0001> gsm48_rr.c:2473 (ta 2/1107m ra 0x0a chan_nr 0x41 ARFCN 19 TS 1 SS 0 TSC 1) <0001> gsm48_rr.c:2393 request 0a matches but not frame number (IMM.ASS fn=22,6,30 != RACH fn=22,5,25) <0001> gsm48_rr.c:2503 Request, but not for us. <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2450 IMMEDIATE ASSIGNMENT: <0001> gsm48_rr.c:2473 (ta 2/1107m ra 0x05 chan_nr 0x49 ARFCN 19 TS 1 SS 1 TSC 1) <0001> gsm48_rr.c:2503 Request, but not for us. <0001> gsm48_rr.c:2450 IMMEDIATE ASSIGNMENT: <0001> gsm48_rr.c:2473 (ta 2/1107m ra 0x05 chan_nr 0x49 ARFCN 19 TS 1 SS 1 TSC 1) <0001> gsm48_rr.c:2503 Request, but not for us. <0001> gsm48_rr.c:2225 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:673 MON: f=19 lev=-77 snr= 0 ber= 6 LAI=104 002 b00f ID=4fd9 <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2450 IMMEDIATE ASSIGNMENT: <0001> gsm48_rr.c:2473 (ta 2/1107m ra 0x00 chan_nr 0x61 ARFCN 19 TS 1 SS 4 TSC 1) <0001> gsm48_rr.c:2503 Request, but not for us. <0001> gsm48_rr.c:2450 IMMEDIATE ASSIGNMENT: <0001> gsm48_rr.c:2473 (ta 2/1107m ra 0x00 chan_nr 0x61 ARFCN 19 TS 1 SS 4 TSC 1) <0001> gsm48_rr.c:2503 Request, but not for us. <0001> gsm48_rr.c:2450 IMMEDIATE ASSIGNMENT: <0001> gsm48_rr.c:2462 (ta 2/1107m ra 0x7d chan_nr 0x0b MAIO 0 HSN 38 TS 3 SS 0 TSC 0) <0001> gsm48_rr.c:2503 Request, but not for us. <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2450 IMMEDIATE ASSIGNMENT: <0001> gsm48_rr.c:2462 (ta 2/1107m ra 0x7d chan_nr 0x0b MAIO 0 HSN 38 TS 3 SS 0 TSC 0) <0001> gsm48_rr.c:2503 Request, but not for us. <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:673 MON: f=19 lev=-78 snr= 0 ber= 0 LAI=104 002 b00f ID=4fd9 <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2225 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2225 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:673 MON: f=19 lev=-78 snr= 0 ber= 3 LAI=104 002 b00f ID=4fd9 <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2450 IMMEDIATE ASSIGNMENT: <0001> gsm48_rr.c:2462 (ta 2/1107m ra 0x77 chan_nr 0x09 MAIO 0 HSN 38 TS 1 SS 0 TSC 0) <0001> gsm48_rr.c:2503 Request, but not for us. <0001> gsm48_rr.c:2450 IMMEDIATE ASSIGNMENT: <0001> gsm48_rr.c:2462 (ta 2/1107m ra 0x77 chan_nr 0x09 MAIO 0 HSN 38 TS 1 SS 0 TSC 0) <0001> gsm48_rr.c:2503 Request, but not for us. <0001> gsm48_rr.c:2225 PAGING ignored, we are not camping. <0001> gsm48_rr.c:2170 PAGING ignored, we are not camping. <0001> gsm48_rr.c:673 MON: f=19 lev=-78 snr= 0 ber= 6 LAI=104 002 b00f ID=4fd9 <0001> gsm48_rr.c:765 timer T3126 has fired <000e> gsm48_rr.c:770 Requesting channel failed <0001> gsm48_rr.c:366 new state connection pending -> idle <0003> gsm322.c:4037 (ms 1) Event 'EVENT_RET_IDLE' for Cell selection in state 'connected mode 1' <0003> gsm322.c:3565 Selecting ARFCN 19. after LOC.UPD. <0003> gsm322.c:463 Sync to ARFCN=19 rxlev=-74 (Sysinfo, ccch mode NON-COMB) <0003> gsm322.c:823 new state 'connected mode 1' -> 'C3 camped normally' <0005> gsm48_mm.c:3902 (ms 1) Received 'RR_REL_IND' from RR in state wait for RR connection (location updating) (sapi 0) <0005> gsm48_mm.c:2732 RR link released after loc. upd. <000e> gsm48_mm.c:2676 Location update failed <000e> gsm48_mm.c:2686 Try location update later <0005> gsm48_mm.c:2688 Loc. upd. failed, retry #0 <0005> gsm48_mm.c:413 starting T3211 (loc. upd. retry delay) with 15.0 seconds <0005> gsm48_mm.c:1143 We are camping normally as returning to MM IDLE <0005> gsm48_mm.c:1159 Loc. upd. allowed. <0005> gsm48_mm.c:919 new state wait for RR connection (location updating) -> MM IDLE, location updating needed <0005> gsm48_mm.c:909 new MM IDLE state location updating needed -> attempting to update <0005> gsm48_mm.c:2215 Loc. upd. already pending. <0005> gsm48_mm.c:4311 (ms 1) Received 'MM_EVENT_CELL_SELECTED' event in state MM IDLE, attempting to update <0005> gsm48_mm.c:2215 Loc. upd. already pending. <0003> gsm322.c:2938 Channel synched. (ARFCN=19, snr=16, BSIC=17) <0001> gsm322.c:2959 using DSC of 90 Can you provide me any hints on how to debug this ? Why is the location update failing constantly ? Thanks in advance for your help. Best regards, Maciej Grela

9 years, 5 months

6
9
0 0

Re: Any interest for Osmocom meetings in Bavaria ?

by Dieter Spaar

So far three persons have indicated their interest to join a meeting at my place. Considering the time it takes to drive to my place, it probably makes sense to have the meeting at the weekend (either Saturday or Sunday) so that there is more time for the meeting itself. I can suggest one of the following dates for the first meeting, somewhere between 10:00 to 18:00 on each day: 25.8. (Sa) or 26.8. (Su) 1.9. (Sa) or 2.9. (Su) 8.9. (Sa) or 9.9. (Su) So please let me know when you have time and also make suggestions in which Osmocom topic you are interested in so that we can have some sort of agenda for the meeting to make best use of the time. Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

10 years, 10 months

13
42
0 0

asn.1 compilation

by ☎

Hello. I'm having troubles compiling asn.1 files from http://www.3gpp.org/ftp/Specs/archive/24_series/24.080/ASN.1/ I'm getting syntax error (syntax error at line 264 in module SS-Operations.asn: got 'SEQUENCE' expected ':') while running erlc SS-Operations.asn using Erlang version 15.b.1 As far as I recall Harald has done this for MAP asn.1 Are there any hints on what might be wrong? Tried online compiler but it gives different errors in different places. Should I use different version? Compile smth else before attempting to compile this file? Fix syntax using some clever trick? Do some rtfm? Any advices would be greatly appreciated. -- best regards, Max, http://fairwaves.ru

11 years

3
5
0 0

AW: The call has been rejected

by Andreas.Eversberg

hi josephli, > Read stored BA list mnc=01 the mobile application stores the last cells and neighbour cells (band allocation) of each network. this way the scanning is much faster when restarting. because you use the SIM card with MNC == 02 the first time, there is no band allocation stored for that. the mobile will do a full scan in this case. > while the sim card service I am tesing is actually with mnc 00 and 02. i know that MNC == 0 will not work until i commited improvements of cell selection process last sunday. you should retry that, but first try with an MNC > 0. can you provide debug output when trying a call? also can you provide VTY output of "show ms" before you make the call? regards, andreas

11 years

3
2
0 0

status report layer1 and layer23

by Andreas.Eversberg

hi, i just fixed some locking issues the last days. fix will follow. it took a bit longer, because there were some race conditions. it took up to about one hour until it crashed. my way to detect the area where the crash happened, was to turn on buzzer before that area, and turn it off after that area. after many hours of approximation, i finally found out that the major crash happend during _talloc_zero. (first it looks for a free memory chunk, then it allocates it.) since it can be called from all contexts (main, irq, fiq), it need to be locked against any interrupt, otherwise the memory chunk can be assigned multiple times. (the process of _talloc_free is "atomic" and requires no locking.) because it seems pretty stable, i think it is time to merge some branches into the master. (i made a 6 hours call yesterday. and no crash after bugfix ever since.) i will do that together with sylvain, if we find the time this weekend. currently i use the jolly/voice together with the sylvain/traffic branch. i am able to use an isdn phone togehter with linux-call-router and make/receive calls. audio is passed both ways. i think this is a stage where it actually become "usable". (if not moving arround.) one of my major work for the next weeks/months will be the neighbour cell measurement, cell re-selection, and handover. this is essential when moving with the phone. regards, andreas

11 years

2
1
0 0

is the Viterbi decode for the AFS provided by Sylvain right?

by bob

Hi ,List: search some materials, find that the decode method of AFS convolutional code is different from the EFS`, it use RSC, and need SOVA(soft output viterbi algorithm). am i right? -- View this message in context: http://baseband-devel.722152.n3.nabble.com/is-the-Viterbi-decode-for-the-AF… Sent from the baseband-devel mailing list archive at Nabble.com.

11 years, 1 month

4
7
0 0

Can't compile after last pull

by Dario Lombardo

I've pulled git repo today, but the RSSI firmware gets an error. apps/rssi/main.c: In function `main': apps/rssi/main.c:896: warning: 'a' might be used uninitialized in this function apps/rssi/main.c:896: warning: 'e' might be used uninitialized in this function CC board/compal_e88/rssi.compalram.manifest.o LD board/compal_e88/rssi.compalram.elf OBJ board/compal_e88/rssi.compalram.bin CC board/compal_e88/rssi.highram.manifest.o LD board/compal_e88/rssi.highram.elf OBJ board/compal_e88/rssi.highram.bin CC board/compal_e88/rssi.e88loader.manifest.o LD board/compal_e88/rssi.e88loader.elf OBJ board/compal_e88/rssi.e88loader.bin CC board/compal_e88/rssi.e88flash.manifest.o LD board/compal_e88/rssi.e88flash.elf OBJ board/compal_e88/rssi.e88flash.bin CC board/compal_e86/rssi.compalram.manifest.o LD board/compal_e86/rssi.compalram.elf arm-elf-ld: region LRAM is full (board/compal_e86/rssi.compalram.elf section .data) make[1]: *** [board/compal_e86/rssi.compalram.elf] Error 1 make[1]: Leaving directory src/target/firmware' make: *** [firmware] Error 2 $ git pull Already up-to-date. $ Anyone experiencing the same issue?

11 years, 4 months

9
11
0 0

Is airprobe still being developed?

by Philip Peter

The last changes in the airprobe svn seem to be 17 months ago. I was wondering whether airprobe is assumed to be stable, without need for further development, has been superseded by a different toolkit or if it has been abandonded.

11 years, 4 months

3
4
0 0

[PATCH] Add return value to indicate unsopported cipher

by ☎

Hello. Right now there's no way for user of osmo_a5(..) to understand if particular cipher (a5/3 for example) is supported or not. Attached patch adds simple return value to osmo_a5 to fix that. Of course I would rather see a5/3 included into mainline but in a meantime this patch might be useful too :) -- best regards, Max, http://fairwaves.ru

11 years, 4 months

2
3
0 0

[PATCH] Add return value to indicate unsopported cipher.

by Max

--- include/osmocom/gsm/a5.h | 2 +- src/gsm/a5.c | 8 ++++++-- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/include/osmocom/gsm/a5.h b/include/osmocom/gsm/a5.h index 649dbab..f237c42 100644 --- a/include/osmocom/gsm/a5.h +++ b/include/osmocom/gsm/a5.h @@ -54,7 +54,7 @@ osmo_a5_fn_count(uint32_t fn) * - fn is the _real_ GSM frame number. * (converted internally to fn_count) */ -void osmo_a5(int n, const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul); +unsigned osmo_a5(int n, const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul); void osmo_a5_1(const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul); void osmo_a5_2(const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul); diff --git a/src/gsm/a5.c b/src/gsm/a5.c index 356060a..68d703a 100644 --- a/src/gsm/a5.c +++ b/src/gsm/a5.c @@ -45,10 +45,10 @@ * \param[out] dl Pointer to array of ubits to return Downlink cipher stream * \param[out] ul Pointer to array of ubits to return Uplink cipher stream * - * Currently A5/[0-2] are supported. + * Currently A5/[0-2] are supported: 0 returned in this case, 1 s returned otherwise. * Either (or both) of dl/ul can be NULL if not needed. */ -void +unsigned osmo_a5(int n, const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul) { switch (n) @@ -58,18 +58,22 @@ osmo_a5(int n, const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul) memset(dl, 0x00, 114); if (ul) memset(ul, 0x00, 114); + return 1; break; case 1: osmo_a5_1(key, fn, dl, ul); + return 1; break; case 2: osmo_a5_2(key, fn, dl, ul); + return 1; break; default: /* a5/[3..7] not supported here/yet */ + return 0; break; } } -- 1.7.10.4 --------------090904030806030201060909--

11 years, 4 months

1
0
0 0

[PATCH] Add A5/3 support.

by Max

--- include/osmocom/gsm/a5.h | 4 +- src/gsm/a5.c | 246 ++++++++++++++++++++++++++++++++++++++++++++-- 2 files changed, 239 insertions(+), 11 deletions(-) diff --git a/include/osmocom/gsm/a5.h b/include/osmocom/gsm/a5.h index 649dbab..46cf4fb 100644 --- a/include/osmocom/gsm/a5.h +++ b/include/osmocom/gsm/a5.h @@ -54,10 +54,10 @@ osmo_a5_fn_count(uint32_t fn) * - fn is the _real_ GSM frame number. * (converted internally to fn_count) */ -void osmo_a5(int n, const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul); +int osmo_a5(int n, const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul); void osmo_a5_1(const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul); void osmo_a5_2(const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul); - +void osmo_a5_3(const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul); /*! @} */ #endif /* __OSMO_A5_H__ */ diff --git a/src/gsm/a5.c b/src/gsm/a5.c index 356060a..d95283e 100644 --- a/src/gsm/a5.c +++ b/src/gsm/a5.c @@ -33,9 +33,10 @@ /*! \file gsm/a5.c * \brief Osmocom GSM A5 ciphering algorithm implementation */ - +#include <stdio.h> #include <string.h> - +#include <errno.h> +#include <osmocom/core/bits.h> #include <osmocom/gsm/a5.h> /*! \brief Main method to generate a A5/x cipher stream @@ -45,10 +46,10 @@ * \param[out] dl Pointer to array of ubits to return Downlink cipher stream * \param[out] ul Pointer to array of ubits to return Uplink cipher stream * - * Currently A5/[0-2] are supported. + * Currently A5/[0-2] are supported: -ENOTSUP returned in this case, 0 returned for supported ciphers. * Either (or both) of dl/ul can be NULL if not needed. */ -void +int osmo_a5(int n, const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul) { switch (n) @@ -58,20 +59,25 @@ osmo_a5(int n, const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul) memset(dl, 0x00, 114); if (ul) memset(ul, 0x00, 114); - break; + return 0; case 1: osmo_a5_1(key, fn, dl, ul); - break; + return 0; case 2: osmo_a5_2(key, fn, dl, ul); - break; + return 0; + + case 3: + osmo_a5_3(key, fn, dl, ul); + return 0; default: - /* a5/[3..7] not supported here/yet */ - break; + /* a5/[4..7] not supported here/yet */ + return -ENOTSUP; } + return -ENOTSUP; /* make compiler happy */ } @@ -364,4 +370,226 @@ osmo_a5_2(const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul) } } +/* ------------------------------------------------------------------------ */ +/* A5/3 */ +/* ------------------------------------------------------------------------ */ + +uint16_t _rol16(uint16_t in, unsigned shift) +{ + return (in << shift) | (in >> (16 - shift)); +} + +uint16_t osmo_get2bytes(uint8_t *a) +{ /* UNSAFE! Do NOT use unless you know what you are doing! */ + return (uint16_t)((((uint16_t)a[0]) << 8) + (uint16_t)a[1]); +} + +void osmo_64pack2pbit(uint64_t in, pbit_t *out) +{ + int i; + for (i = 7; i >=0; i--) { + out[i] = in & 0xFF; + in >>= 8; + } +} + +uint16_t +_a5_3_kasumi_FI(uint16_t I, uint16_t skey) +{ + static uint16_t S7[] = { + 54, 50, 62, 56, 22, 34, 94, 96, 38, 6, 63, 93, 2, 18, 123, 33, + 55, 113, 39, 114, 21, 67, 65, 12, 47, 73, 46, 27, 25, 111, 124, 81, + 53, 9, 121, 79, 52, 60, 58, 48, 101, 127, 40, 120, 104, 70, 71, 43, + 20, 122, 72, 61, 23, 109, 13, 100, 77, 1, 16, 7, 82, 10, 105, 98, + 117, 116, 76, 11, 89, 106, 0,125,118, 99, 86, 69, 30, 57, 126, 87, + 112, 51, 17, 5, 95, 14, 90, 84, 91, 8, 35,103, 32, 97, 28, 66, + 102, 31, 26, 45, 75, 4, 85, 92, 37, 74, 80, 49, 68, 29, 115, 44, + 64, 107, 108, 24, 110, 83, 36, 78, 42, 19, 15, 41, 88, 119, 59, 3 + }; + static uint16_t S9[] = { + 167, 239, 161, 379, 391, 334, 9, 338, 38, 226, 48, 358, 452, 385, 90, 397, + 183, 253, 147, 331, 415, 340, 51, 362, 306, 500, 262, 82, 216, 159, 356, 177, + 175, 241, 489, 37, 206, 17, 0, 333, 44, 254, 378, 58, 143, 220, 81, 400, + 95, 3, 315, 245, 54, 235, 218, 405, 472, 264, 172, 494, 371, 290, 399, 76, + 165, 197, 395, 121, 257, 480, 423, 212, 240, 28, 462, 176, 406, 507, 288, 223, + 501, 407, 249, 265, 89, 186, 221, 428,164, 74, 440, 196, 458, 421, 350, 163, + 232, 158, 134, 354, 13, 250, 491, 142,191, 69, 193, 425, 152, 227, 366, 135, + 344, 300, 276, 242, 437, 320, 113, 278, 11, 243, 87, 317, 36, 93, 496, 27, + 487, 446, 482, 41, 68, 156, 457, 131, 326, 403, 339, 20, 39, 115, 442, 124, + 475, 384, 508, 53, 112, 170, 479, 151, 126, 169, 73, 268, 279, 321, 168, 364, + 363, 292, 46, 499, 393, 327, 324, 24, 456, 267, 157, 460, 488, 426, 309, 229, + 439, 506, 208, 271, 349, 401, 434, 236, 16, 209, 359, 52, 56, 120, 199, 277, + 465, 416, 252, 287, 246, 6, 83, 305, 420, 345, 153,502, 65, 61, 244, 282, + 173, 222, 418, 67, 386, 368, 261, 101, 476, 291, 195,430, 49, 79, 166, 330, + 280, 383, 373, 128, 382, 408, 155, 495, 367, 388, 274, 107, 459, 417, 62, 454, + 132, 225, 203, 316, 234, 14, 301, 91, 503, 286, 424, 211, 347, 307, 140, 374, + 35, 103, 125, 427, 19, 214, 453, 146, 498, 314, 444, 230, 256, 329, 198, 285, + 50, 116, 78, 410, 10, 205, 510, 171, 231, 45, 139, 467, 29, 86, 505, 32, + 72, 26, 342, 150, 313, 490, 431, 238, 411, 325, 149, 473, 40, 119, 174, 355, + 185, 233, 389, 71, 448, 273, 372, 55, 110, 178, 322, 12, 469, 392, 369, 190, + 1, 109, 375, 137, 181, 88, 75, 308, 260, 484, 98, 272, 370, 275, 412, 111, + 336, 318, 4, 504, 492, 259, 304, 77, 337, 435, 21, 357, 303, 332, 483, 18, + 47, 85, 25, 497, 474, 289, 100, 269, 296, 478, 270, 106, 31, 104, 433, 84, + 414, 486, 394, 96, 99, 154, 511, 148, 413, 361, 409, 255, 162, 215, 302, 201, + 266, 351, 343, 144, 441, 365, 108, 298, 251, 34, 182, 509, 138, 210, 335, 133, + 311, 352, 328, 141, 396, 346, 123, 319, 450, 281, 429, 228, 443, 481, 92, 404, + 485, 422, 248, 297, 23, 213, 130, 466, 22, 217, 283, 70, 294, 360, 419, 127, + 312, 377, 7, 468, 194, 2, 117, 295, 463, 258, 224, 447, 247, 187, 80, 398, + 284, 353, 105, 390, 299, 471, 470, 184, 57, 200, 348, 63, 204, 188, 33, 451, + 97, 30, 310, 219, 94, 160, 129, 493, 64, 179, 263, 102, 189, 207, 114, 402, + 438, 477, 387, 122, 192, 42, 381, 5, 145, 118, 180, 449, 293, 323, 136, 380, + 43, 66, 60, 455, 341, 445, 202, 432, 8, 237, 15, 376, 436, 464, 59, 461 + }; + uint16_t L, R; + + /* Split 16 bit input into two unequal halves: 9 and 7 bits, same for subkey */ + L = I >> 7; /* take 9 bits */ + R = I & 0x7F; /* take 7 bits */ + + L = S9[L] ^ R; + R = S7[R] ^ (L & 0x7F); + + L ^= (skey & 0x1FF); + R ^= (skey >> 9); + + L = S9[L] ^ R; + R = S7[R] ^ (L & 0x7F); + + return (R << 9) + L; +} + +uint32_t +_a5_3_kasumi_FO(uint32_t I, uint16_t *KOi1, uint16_t *KOi2, uint16_t *KOi3, uint16_t *KIi1, uint16_t *KIi2, uint16_t *KIi3, unsigned i) +{ + uint16_t L = I >> 16, R = I; /* Split 32 bit input into Left and Right parts */ + + L ^= KOi1[i]; + L = _a5_3_kasumi_FI(L, KIi1[i]); + L ^= R; + + R ^= KOi2[i]; + R =_a5_3_kasumi_FI(R, KIi2[i]); + R ^= L; + + L ^= KOi3[i]; + L = _a5_3_kasumi_FI(L, KIi3[i]); + L ^= R; + + return (((uint32_t)R) << 16) + L; +} + +uint32_t +_a5_3_kasumi_FL(uint32_t I, uint16_t *KLi1, uint16_t *KLi2, unsigned i) +{ + uint16_t L = I >> 16, R = I, tmp; /* Split 32 bit input into Left and Right parts */ + + tmp = L & KLi1[i]; + R ^= _rol16(tmp, 1); + + tmp = R | KLi2[i]; + L ^= _rol16(tmp, 1); + + return (((uint32_t)L) << 16) + R; +} + +uint64_t +_a5_3_kasumi(uint64_t P, uint16_t *KLi1, uint16_t *KLi2, uint16_t *KOi1, uint16_t *KOi2, uint16_t *KOi3, uint16_t *KIi1, uint16_t *KIi2, uint16_t *KIi3) +{ + uint32_t i, L = P >> 32, R = P; /* Split 64 bit input into Left and Right parts */ + + for (i = 0; i < 8; i++) + { + R ^= _a5_3_kasumi_FO(_a5_3_kasumi_FL(L, KLi1, KLi2, i), KOi1, KOi2, KOi3, KIi1, KIi2, KIi3, i); /* odd round */ + i++; + L ^= _a5_3_kasumi_FL(_a5_3_kasumi_FO(R, KOi1, KOi2, KOi3, KIi1, KIi2, KIi3, i), KLi1, KLi2, i); /* even round */ + } + return (((uint64_t)L) << 32) + R; /* Concatenate Left and Right 32 bits into 64 bit ciphertext */ +} + +/*! \brief Expand key into set of subkeys + * \param[in] key (128 bits) as array of bytes + * \param[out] arrays of round-specific subkeys - see TS 135 202 for details + */ +void +_a5_3_key_expand(uint8_t *key, uint16_t *KLi1, uint16_t *KLi2, uint16_t *KOi1, uint16_t *KOi2, uint16_t *KOi3, uint16_t *KIi1, uint16_t *KIi2, uint16_t *KIi3) +{ + uint16_t i, C[] = { 0x0123, 0x4567, 0x89AB, 0xCDEF, 0xFEDC, 0xBA98, 0x7654, 0x3210 }; + + for (i = 0; i < 8; i++) /* Work with 16 bit subkeys and create prime subkeys */ + { + C[i] ^= osmo_get2bytes(key + i * 2); + } + /* C[] now stores K-prime[] */ + for (i = 0; i < 8; i++) /* Create round-specific subkeys */ + { + KLi1[i] = _rol16(osmo_get2bytes(key + i * 2), 1); + KLi2[i] = C[(i + 2) & 0x7]; + + KOi1[i] = _rol16(osmo_get2bytes(key + ((2 * (i + 1)) & 0xE)), 5); + KOi2[i] = _rol16(osmo_get2bytes(key + ((2 * (i + 5)) & 0xE)), 8); + KOi3[i] = _rol16(osmo_get2bytes(key + ((2 * (i + 6)) & 0xE)), 13); + + KIi1[i] = C[(i + 4) & 0x7]; + KIi2[i] = C[(i + 3) & 0x7]; + KIi3[i] = C[(i + 7) & 0x7]; + } +} + +void +_a5_3_kgcore_gsm(uint8_t CA, uint8_t cb, uint32_t cc, uint8_t cd, uint8_t *ck, uint8_t *co, uint16_t cl) +{ + uint16_t KLi1[8], KLi2[8], KOi1[8], KOi2[8], KOi3[8], KIi1[8], KIi2[8], KIi3[8], i; + uint64_t A = ((uint64_t)cc) << 32, BLK = 0, _ca = ((uint64_t)CA << 16) ; + A |= _ca; + _ca = (uint64_t)((cb << 3) | (cd << 2)) << 24; + A |= _ca; + /* Register loading complete: see TR 55.919 8.2 and TS 55.216 3.2 */ + + uint8_t ck_km[16]; + for (i = 0; i < 16; i++) ck_km[i] = ck[i] ^ 0x55; /* Modified key established */ + + /* preliminary round with modified key */ + _a5_3_key_expand(ck_km, KLi1, KLi2, KOi1, KOi2, KOi3, KIi1, KIi2, KIi3); + A = _a5_3_kasumi(A, KLi1, KLi2, KOi1, KOi2, KOi3, KIi1, KIi2, KIi3); + + /* Run Kasumi in OFB to obtain enough data for gamma. */ + _a5_3_key_expand(ck, KLi1, KLi2, KOi1, KOi2, KOi3, KIi1, KIi2, KIi3); + for (i = 0; i < cl / 64 + 1; i++) /* i is a block counter */ + { + BLK = _a5_3_kasumi(A ^ i ^ BLK, KLi1, KLi2, KOi1, KOi2, KOi3, KIi1, KIi2, KIi3); + osmo_64pack2pbit(BLK, co + (i * 8)); + } +} + +/*! \brief Generate a GSM A5/3 cipher stream + * \param[in] key 8 byte array for the key (as received from the SIM) + * \param[in] fn Frame number + * \param[out] dl Pointer to array of ubits to return Downlink cipher stream + * \param[out] ul Pointer to array of ubits to return Uplink cipher stream + * + * Either (or both) of dl/ul should be NULL if not needed. + * + * Implementation based on specifications from 3GPP TS 55.216, 3GPP TR 55.919 and ETSI TS 135 202 + * with slight simplifications (CE hardcoded to 0). + */ +void +osmo_a5_3(const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul) +{ + /* internal function require 128 bit key so we expand by concatenating supplied 64 bit key */ + uint8_t i, ck[16], gamma[32]; + memcpy(ck, key, 8); + memcpy(ck + 8, key, 8); + uint32_t fn_count = osmo_a5_fn_count(fn); /* Frame count load */ + if (dl) { + _a5_3_kgcore_gsm(0xF, 0, fn_count, 0, ck, gamma, 114); + osmo_pbit2ubit(dl, gamma, 114); + } + if (ul) { + _a5_3_kgcore_gsm(0xF, 0, fn_count, 0, ck, gamma, 228); + uint8_t uplink[15]; + for(i = 0; i < 15; i++) uplink[i] = (gamma[i + 14] << 2) + (gamma[i + 15] >> 6); + osmo_pbit2ubit(ul, uplink, 114); + } +} + /*! @} */ -- 1.7.10.4 --------------080507080909000101000702--

11 years, 4 months

1
0
0 0

Re: Programming SIM card RAND?

by Dieter Spaar

Hello Andrew, On Sat, 24 Nov 2012 10:42:00 +0000, "Andrew Back" <andrew(a)carrierdetect.com> wrote: > > I bought one of those generic test SIMs from eBay that claim to work > with HP8922 etc. testers. Now this is probably another stupid > question, but how do I determine the IMSI and Ki? Or maybe set them > (pySim-prog.py doesn't seem to work with it). For the IMSI you can read the appropriate EF of the SIM (the phone does the same to get the IMSI). Ki usually cannot be read back but because A3/A8 for a Test SIM is GSM XOR you can calculate Ki from the SIM response to the RUN GSM ALGORITHM command. OpenBSC contains code for the GSM XOR algorithm, this should give enough hints for how the calculation is done. For setting IMSI and Ki you most certainly have to contact the seller of the SIM card and hope that he can/will tell you the details. Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

11 years, 4 months

2
1
0 0

Re: osmocom-commitlog Digest, Vol 557, Issue 1

by Andreas Eversberg

osmocom-commitlog-request(a)lists.osmocom.org wrote: > The branch, zecke/work-with-nitb has been created > at 2076448d458ce1271dcd4d584fe276a8b8857e35 (commit) > > - Log ----------------------------------------------------------------- > http://cgit.osmocom.org/cgit/osmocom-bb/commit/?id=2076448d458ce1271dcd4d58… > > commit 2076448d458ce1271dcd4d584fe276a8b8857e35 > Author: Holger Hans Peter Freyther<zecke(a)selfish.org> > Date: Mon Nov 26 17:15:07 2012 +0100 > > mobile: Do the LU with a IMSI... to deal with changing NITBs.. > > NITB will not ask for the IMSI if the TMSI is not known... work around > and do the LU with the IMSI.. hi holger, i saw your patch, but i did not like it. i just breaks the way location updating is done by standard. it is a workaround and not committed to master, but i think this should be an option for a baseband stack that is designed to test an play with. therefore i made a patch to configure this option via vty. it is not tested, but it obviously should work. regards, andreas

11 years, 4 months

2
2
0 0

[PATCH] Add option to force location updating with IMSI, event if TMSI is valid

by Andreas Eversberg

To set this option, enter VTY: enable conf t ms 1 location-updating imsi-only write --- .../layer23/include/osmocom/bb/mobile/settings.h | 1 + src/host/layer23/src/mobile/gsm48_mm.c | 2 +- src/host/layer23/src/mobile/vty_interface.c | 33 ++++++++++++++++++- 3 files changed, 33 insertions(+), 3 deletions(-) diff --git a/src/host/layer23/include/osmocom/bb/mobile/settings.h b/src/host/layer23/include/osmocom/bb/mobile/settings.h index fae1220..6ff8b12 100644 --- a/src/host/layer23/include/osmocom/bb/mobile/settings.h +++ b/src/host/layer23/include/osmocom/bb/mobile/settings.h @@ -51,6 +51,7 @@ struct gsm_settings { uint16_t stick_arfcn; uint8_t skip_max_per_band; uint8_t no_lupd; + uint8_t lupd_imsi; uint8_t no_neighbour; /* supported by configuration */ diff --git a/src/host/layer23/src/mobile/gsm48_mm.c b/src/host/layer23/src/mobile/gsm48_mm.c index 0598768..06f6629 100644 --- a/src/host/layer23/src/mobile/gsm48_mm.c +++ b/src/host/layer23/src/mobile/gsm48_mm.c @@ -2358,7 +2358,7 @@ static int gsm48_mm_tx_loc_upd_req(struct osmocom_ms *ms) gsm48_encode_classmark1(&nlu->classmark1, sup->rev_lev, sup->es_ind, set->a5_1, pwr_lev); /* MI */ - if (0 && subscr->tmsi != 0xffffffff) { /* have TMSI ? */ + if (!set->lupd_imsi && subscr->tmsi != 0xffffffff) { /* have TMSI ? */ gsm48_encode_mi(buf, NULL, ms, GSM_MI_TYPE_TMSI); LOGP(DMM, LOGL_INFO, " using TMSI 0x%08x\n", subscr->tmsi); } else { diff --git a/src/host/layer23/src/mobile/vty_interface.c b/src/host/layer23/src/mobile/vty_interface.c index 4d7f6a2..e6add60 100644 --- a/src/host/layer23/src/mobile/vty_interface.c +++ b/src/host/layer23/src/mobile/vty_interface.c @@ -1334,6 +1334,9 @@ static void config_write_ms(struct vty *vty, struct osmocom_ms *ms) if (!hide_default || set->no_lupd) vty_out(vty, " %slocation-updating%s", (set->no_lupd) ? "no " : "", VTY_NEWLINE); + if (!hide_default || set->lupd_imsi) + vty_out(vty, " %slocation-updating imsi-only%s", + (set->lupd_imsi) ? "" : "no ", VTY_NEWLINE); if (!hide_default || set->no_neighbour) vty_out(vty, " %sneighbour-measurement%s", (set->no_neighbour) ? "no " : "", VTY_NEWLINE); @@ -1893,7 +1896,7 @@ DEFUN(cfg_ms_no_stick, cfg_ms_no_stick_cmd, "no stick", } DEFUN(cfg_ms_lupd, cfg_ms_lupd_cmd, "location-updating", - "Allow location updating") + "Do location updating") { struct osmocom_ms *ms = vty->index; struct gsm_settings *set = &ms->settings; @@ -1904,7 +1907,7 @@ DEFUN(cfg_ms_lupd, cfg_ms_lupd_cmd, "location-updating", } DEFUN(cfg_ms_no_lupd, cfg_ms_no_lupd_cmd, "no location-updating", - NO_STR "Do not allow location updating") + NO_STR "Do not perform location updating") { struct osmocom_ms *ms = vty->index; struct gsm_settings *set = &ms->settings; @@ -1914,6 +1917,30 @@ DEFUN(cfg_ms_no_lupd, cfg_ms_no_lupd_cmd, "no location-updating", return CMD_SUCCESS; } +DEFUN(cfg_ms_lupd_imsi, cfg_ms_lupd_imsi_cmd, "location-updating imsi-only", + "Do location updating\nAlways use IMSI to perform location updating") +{ + struct osmocom_ms *ms = vty->index; + struct gsm_settings *set = &ms->settings; + + set->lupd_imsi = 1; + + return CMD_SUCCESS; +} + +DEFUN(cfg_ms_no__imsilupd, cfg_ms_no_lupd_imsi_cmd, + "no location-updating imsi-only", + NO_STR "Do not perform location updating\n" + "Do not force location updating with IMSI, if TMSI is valid") +{ + struct osmocom_ms *ms = vty->index; + struct gsm_settings *set = &ms->settings; + + set->lupd_imsi = 0; + + return CMD_SUCCESS; +} + DEFUN(cfg_codec_full, cfg_ms_codec_full_cmd, "codec full-speed", "Enable codec\nFull speed speech codec") { @@ -2821,6 +2848,8 @@ int ms_vty_init(void) install_element(MS_NODE, &cfg_ms_no_stick_cmd); install_element(MS_NODE, &cfg_ms_lupd_cmd); install_element(MS_NODE, &cfg_ms_no_lupd_cmd); + install_element(MS_NODE, &cfg_ms_lupd_imsi_cmd); + install_element(MS_NODE, &cfg_ms_no_lupd_imsi_cmd); install_element(MS_NODE, &cfg_ms_codec_full_cmd); install_element(MS_NODE, &cfg_ms_codec_full_pref_cmd); install_element(MS_NODE, &cfg_ms_codec_half_cmd); -- 1.7.3.4 --------------030505010406090507000203--

11 years, 4 months

1
0
0 0

Re: baseband-devel Digest, Vol 34, Issue 17

by Christian Inci

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I'd the same problem. Now, my C118 is bricked. :-( I'm now waiting for my Bus Pirate in order to unbrick it. Does anybody knows a fast way to do it? Should I use the test points (maybe those who are accessible from the battery compartment) or even directly to the nor flash? Many thanks in advance! - -Chris On 11/27/2012 12:00 PM, baseband-devel-request(a)lists.osmocom.org wrote: > Send baseband-devel mailing list submissions to > baseband-devel(a)lists.osmocom.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.osmocom.org/mailman/listinfo/baseband-devel or, via > email, send a message with subject or body 'help' to > baseband-devel-request(a)lists.osmocom.org > > You can reach the person managing the list at > baseband-devel-owner(a)lists.osmocom.org > > When replying, please edit your Subject line so it is more > specific than "Re: Contents of baseband-devel digest..." > > > Today's Topics: > > 1. Unable to flash firmware (Akib Sayyed) 2. Re: Unable to flash > firmware (Alexander Huemer) 3. Re: Unable to flash firmware (Akib > Sayyed) 4. Re: Unable to flash firmware (Akib Sayyed) > > > ---------------------------------------------------------------------- > > Message: 1 Date: Tue, 27 Nov 2012 12:30:30 +0300 From: Akib Sayyed > <akibsayyed(a)gmail.com> To: baseband-devel(a)lists.osmocom.org > Subject: Unable to flash firmware Message-ID: > <CAMG-S93etEd9b_zo-YiwXWdRwBZiXzx=fa8SWjJzZVqxz486Dw(a)mail.gmail.com> > > Content-Type: text/plain; charset="utf-8" > > Dear all i am unable to flash firmware of C118 with RSSI.bin > > i am using 64bit Ubuntu.and 64bit gnu toolchain > -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (GNU/Linux) Comment: Using GnuPG with undefined - http://www.enigmail.net/ iQIcBAEBAgAGBQJQtK0BAAoJEDfL/pqB6n6N3dAQAJLpkD+4MVJbzfBHDt6mepN6 OcXyX/EbgZkN7zZY4ulRadlqyMvq7MH7pN9zv1sRk+2oMWRTEOwHeT1xG8Lfoukp J4GMTY21bv6Ov0QLQOisxydRH4TQ7riJGfSbATPA6VBUMQWuxrws140BFDslXaPk 8Vk9o5a2G9kQTbLdJp/tqxjKnlLZ3m22qSgph0O1uV7w4e82tc45rOX8FiAps7f2 cCjGfbphjpb+GVx/OT5mSTaKseYAPyLsm2n1CvTbFYm0OVlJ9d8Pp/iVluQdrPdQ pBLpF/MFPdqw7swUTXTSjL5PFjhBnwz1b0hImdoFBG/uHRGrU8l8sG4ll553DWtw OnPEo1lEDkPdoRY0vpqYWVhrf6t1b54k5cc+ISKVvLweRoscMjkU7DBdzwuSyIQv FVLk9cLatp33ogCqpzinebEBNl6eQpa869c+MC2ii/Y+A82QRiyhSs6JMmYOCYRg jMiw/0lZIZcUEzHfGm75X7LnyfEyPDaG39MWl8m/xU/1aQhZHN4p23sKrqEAaZQp z439nICJoCybsPsPDZiz1XEqcD4lNVVWvba6Ofd+cNKNzSJb3Y8IjUFFPwPyCCw6 dlkgqo52xBnQvb3PzAv+JTUkFesdGqyvcSOMsnFxB8zZGl3pkRn0XPnX+0TsLZdC B701/yHCM9CXYeckOYft =Rsu7 -----END PGP SIGNATURE-----

11 years, 4 months

2
3
0 0

Unable to flash firmware

by Akib Sayyed

Dear all i am unable to flash firmware of C118 with RSSI.bin i am using 64bit Ubuntu.and 64bit gnu toolchain -- Akib Sayyed Matrix-Shell akibsayyed(a)gmail.com akibsayyed(a)matrixshell.com Mob:- +91-966-514-2243

11 years, 4 months

2
3
0 0

Re: Programming SIM card RAND?

by Dieter Spaar

Hello Andrew, On Mon, 12 Nov 2012 10:25:19 +0000, "Andrew Back" <andrew(a)carrierdetect.com> wrote: > > I'm trying to get some MS test equipment working and have programmed a > SIM with pysim-prog.py, but the tester has a configuration field for > RAND and I cannot see how to set this on the SIM. In fact this has > confused me as I thought the network always supplied this... Most certainly the RAND value of your MS tester is the value which is sent during authentication. All MS testers I have seen so far allow to configure this value, either use random data or set it to a fixed value. > I have the IMSI, Ki, MCC and MNC set the same on the tester and SIM, > but tests don't get very far and fail with "incorrect SRES". I would expect that you need a SIM card which supports XOR for A3/A8. This algorithm is the only one I have seen on nearly all MS tests sets I have access to. Those test sets usually don't support COMP128 and its variants (I guess your SIM card only supports this algorithm), so you need a SIM card which uses the same algorithm as the MS test set. However if you can set a fixed RAND value on the MS test set you can check what your SIM card will return with this RAND and set Kc and SRES on the test set to those values. Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

11 years, 4 months

3
3
0 0

Re: Using 900/1800 C118 on 1900

by Akib Sayyed

i ordered stuff to modify phones. just waiting for them to be delivered On Sat, Nov 24, 2012 at 3:48 PM, Marten Christophe <technosabby(a)gmail.com>wrote: > Hello Akib, > > > Have you able to sniff TCH channel or intercept other phone calls by > OsmocomBB > > Regards, > dev > > On Tue, Nov 20, 2012 at 7:37 AM, Akib Sayyed <akibsayyed(a)gmail.com> wrote: > > phone with filter rework will work right and i also will be able to sniff > > traffic on 1900mhz witnh burst_ind.but my issue is how to tell code of > > app_ccch to sniff 1900 mhz instead of 1800 as they share same arfcn no?? > > > > > > > > On Tue, Nov 20, 2012 at 10:33 AM, Harald Welte <laforge(a)gnumonks.org> > wrote: > >> > >> On Mon, Nov 19, 2012 at 07:24:45AM +0300, Akib Sayyed wrote: > >> > Guys is wanted to know if there is any tweak that can allow me to use > >> > 900/1800 C118 phone on 1900 band. > >> > >> you have to remove the shielding cover and replace the 1800 band filters > >> with footprint-compatible 1900 MHz filters. It's possible, but requires > >> good SMD soldering skills and access to the right parts. > >> > >> You can also remove the filters completely. This will hovever > >> significantly degrade receiver performance in the presence of > >> out-of-band interferers. > >> > >> -- > >> - Harald Welte <laforge(a)gnumonks.org> > >> http://laforge.gnumonks.org/ > >> > >> > ============================================================================ > >> "Privacy in residential applications is a desirable marketing option." > >> (ETSI EN 300 175-7 Ch. > >> A6) > > > > > > > > > > -- > > Akib Sayyed > > Matrix-Shell > > akibsayyed(a)gmail.com > > akibsayyed(a)matrixshell.com > > Mob:- +91-966-514-2243 > > > > > -- Akib Sayyed Matrix-Shell akibsayyed(a)gmail.com akibsayyed(a)matrixshell.com Mob:- +91-966-514-2243

11 years, 5 months

1
0
0 0

is my decode for efr decode right?

by bob

Hi, list I write a decode for efr decode for TCH,but there some bug, and I have not a debug device, Can someone help me find the problem, Thanks! static void process_tch_efr(struct osmocom_ms *ms,struct l1ctl_burst_ind *bi) { int16_t rx_dbm; uint16_t arfcn; uint32_t fn,B; uint8_t cbits, tn, lch_idx; int ul, bid, i, k, length; sbit_t *bursts, mC[456]; ubit_t steal_bit[2], bt[114],convu[189],convd[189],tch_raw[260],TCHW[260],EFRBits[244],EFRAMR[8 + 244]; pbit_t voice[33]; /* Get params (Only for SDCCH and SACCH/{4,8,F,H}) */ arfcn = ntohs(bi->band_arfcn); rx_dbm = rxlev2dbm(bi->rx_level); fn = ntohl(bi->frame_nr); ul = !!(arfcn & ARFCN_UPLINK); cbits = bi->chan_nr >> 3; tn = bi->chan_nr & 7; B = -1; if((fn%13)%4 == 0) flag= 1; if(!flag) return; //B = count_tch % 8; B = (fn % 13) % 8; printf("fn % 26 = %d, fn % 13 = %d,B = %d\n",fn%26 ,fn%13 ,B); if (B == -1) return; /* Unpack (ignore hu/hl) */ osmo_pbit2ubit_ext(bt, 0, bi->bits, 0, 57, 0); osmo_pbit2ubit_ext(bt, 57, bi->bits, 57, 57, 0); //osmo_pbit2ubit_ext(steal_bit, 0 , bi->bits, 114 , 2 , 0); //printf("steal_bit %x , %x\n",steal_bit[0],steal_bit[1]); /* save stealing flags */ hl[B] = !!(bi->bits[14] & 0x10); // hl 57 hu[B] = !!(bi->bits[14] & 0x20); // hu 58 printf("steal_bit %x , %x\n", hl[B],hu[B]); /* Convert to softbits */ for (i=0; i<114; i++) app_state.mI[B][i] = bt[i] ? - (bi->snr >> 1) : (bi->snr >> 1); count_tch++; // Deinterleave according to the diagonal "phase" of B. // See GSM 05.03 3.1.3. // Deinterleaves i[] to c[] if((B % 4 ==3)&&(count_tch >= 7)){ if(B == 3) { if(!hl[0] && !hl[1] && !hl[2] && !hl[3] && !hu[4] && !hu[5] && !hu[6] && !hu[7]) { tch_deinterleave(mC, 4); } else if(hl[0] && hl[1] && hl[2] && hl[3] && hu[4] && hu[5] && hu[6] && hu[7]) { printf(" may be FACCH.\n"); return; }else{ printf("not a speech frame.\n"); return; } }else{ if(!hl[4] && !hl[5] && !hl[6] && !hl[7] && !hu[0] && !hu[1] && !hu[2] && !hu[3]) { tch_deinterleave(mC,0); } else if(hl[4] && hl[5] && hl[6] && hl[7] && hu[0] && hu[1] && hu[2] && hu[3]) { printf(" may be FACCH.\n"); return; }else{ printf("not a speech frame.\n"); return; } } //mC is soft bit, and must convert to ubit type for (k = 0; k < 78; k++) { if(mC[378 + k] < 0){ tch_raw[182 + k] = 1; }else{ tch_raw[182 + k] = 0; } } osmo_conv_decode(&conv_tch_afs_12_2, mC, convu); // 3.1.2.1 // copy class 1 bits u[] to d[] for (k = 0; k <= 90; k++) { convd[2*k] = convu[k]; convd[2*k+1] = convu[184-k]; } memcpy(tch_raw,convd,182); // the last 78 bit has been stored! //now only process EFR or AMR 12_2, fix me! tch_unmap(gsm660_bitorder, 260, TCHW, tch_raw); // Remove repeating bits and CRC to get raw EFR frame (244 bits) for (k=0; k<71; k++) EFRBits[k] = TCHW[k]; for (k=73; k<123; k++) EFRBits[k-2] = TCHW[k]; for (k=125; k<178; k++) EFRBits[k-4] = TCHW[k]; for (k=180; k<230; k++) EFRBits[k-6] = TCHW[k]; for (k=232; k<252; k++) EFRBits[k-8] = TCHW[k]; // Map bits as AMR 12.2k tch_map(gsm690_12_2_bitorder, 244, EFRAMR + 8,EFRBits); fillField(EFRAMR, 0, 0x3c, 8); length = osmo_ubit2pbit_ext(voice, 0, EFRAMR, 0, 8 + gsm690_12_2_len, 0); fwrite(voice, 1, length, d_speech_file); } } -- View this message in context: http://baseband-devel.722152.n3.nabble.com/is-my-decode-for-efr-decode-righ… Sent from the baseband-devel mailing list archive at Nabble.com.

11 years, 5 months

2
1
0 0

Re: osmocom-commitlog Digest, Vol 551, Issue 1

by Andreas Eversberg

osmocom-commitlog-request(a)lists.osmocom.org wrote: > commit 73a809e57b8a531b9b8a33b6841ed3df2ea22620 > Author: Harald Welte<laforge(a)gnumonks.org> > Date: Tue Nov 20 10:13:44 2012 +0100 > > Tell L1CTL_FBSB_REQ the expected received signal level > hi harald, please note that cell_log.c and mobile (gsm322.c) use signed uint8_t for real rx-level (dbm). i think you should use dbm2rxlev() before handing it to l1ctl_tx_fbsb_req(). regards, andreas

11 years, 5 months

3
2
0 0

gsm322.c:arfcn2index patch

by Joshua Lackey

(This is a patch against the latest, as of last night, git master.) If you enable PCS, you'll never make it out of power-measurement without this patch: (This should be applied by everyone.) ---8<--- diff --git a/src/host/layer23/src/mobile/gsm322.c b/src/host/layer23/src/mobile/gsm322.c index ce5e1e1..ffecfc3 100644 --- a/src/host/layer23/src/mobile/gsm322.c +++ b/src/host/layer23/src/mobile/gsm322.c @@ -300,11 +300,14 @@ uint16_t index2arfcn(int index) int arfcn2index(uint16_t arfcn) { - if ((arfcn & ARFCN_PCS) && arfcn >= 512 && arfcn <= 810) + int is_pcs = arfcn & ARFCN_PCS; + arfcn &= ~ARFCN_FLAG_MASK; + if ((is_pcs) && (arfcn >= 512) && (arfcn <= 810)) return (arfcn & 1023)-512+1024; return arfcn & 1023; } + static char *bargraph(int value, int min, int max) { static char bar[128]; ---8<--- If you enable PCS, you'll never receive packets without this patch: (which I only include for e88 and e86 but it should work for others) (This should be applied if you don't use DCS in your area.) ---8<--- diff --git a/src/target/firmware/board/compal/rffe_dualband.c b/src/target/firmware/board/compal/rffe_dualband.c index f4b7361..5df1dfc 100644 --- a/src/target/firmware/board/compal/rffe_dualband.c +++ b/src/target/firmware/board/compal/rffe_dualband.c @@ -47,7 +47,8 @@ void rffe_mode(enum gsm_band band, int tx) /* Returns RF wiring */ uint32_t rffe_get_rx_ports(void) { - return (1 << PORT_LO) | (1 << PORT_DCS1800); + // return (1 << PORT_LO) | (1 << PORT_DCS1800); + return (1 << PORT_LO) | (1 << PORT_PCS1900); } uint32_t rffe_get_tx_ports(void) diff --git a/src/target/firmware/board/compal_e86/rffe_dualband_e86.c b/src/target/firmware/board/compal_e86/rffe_dualband_e86.c index 25bb099..10459d9 100644 --- a/src/target/firmware/board/compal_e86/rffe_dualband_e86.c +++ b/src/target/firmware/board/compal_e86/rffe_dualband_e86.c @@ -51,7 +51,8 @@ void rffe_mode(enum gsm_band band, int tx) /* Returns RF wiring */ uint32_t rffe_get_rx_ports(void) { - return (1 << PORT_LO) | (1 << PORT_DCS1800); + // return (1 << PORT_LO) | (1 << PORT_DCS1800); + return (1 << PORT_LO) | (1 << PORT_PCS1900); } uint32_t rffe_get_tx_ports(void) ---8<---

11 years, 5 months

5
7
0 0

Using 900/1800 C118 on 1900

by Akib Sayyed

Guys is wanted to know if there is any tweak that can allow me to use 900/1800 C118 phone on 1900 band. please let me know. -- Akib Sayyed Matrix-Shell akibsayyed(a)gmail.com akibsayyed(a)matrixshell.com Mob:- +91-966-514-2243

11 years, 5 months

3
3
0 0

[PATCH] Fix wrong printing of end freq in powerscan

by Pavel Baturko

Hi All, This is small patch that fixes wrong printing of scanning frequencies due powerscan: <0003> gsm322.c:2794 Scanning power for all frequencies. <0003> gsm322.c:2855 Scanning frequencies. (0..0) .. <0003> gsm322.c:2855 Scanning frequencies. (512(DCS)..512(DCS)) .. <0003> gsm322.c:2855 Scanning frequencies. (955..955) with this fix: <0003> gsm322.c:2797 Scanning power for all frequencies. <0003> gsm322.c:2860 Scanning frequencies. (0..124) .. <0003> gsm322.c:2860 Scanning frequencies. (512(DCS)..885(DCS)) .. <0003> gsm322.c:2860 Scanning frequencies. (955..1023) Thanks, Pavel

11 years, 5 months

2
1
0 0

Programming SIM card RAND?

by Andrew Back

Hello, I'm trying to get some MS test equipment working and have programmed a SIM with pysim-prog.py, but the tester has a configuration field for RAND and I cannot see how to set this on the SIM. In fact this has confused me as I thought the network always supplied this... I have the IMSI, Ki, MCC and MNC set the same on the tester and SIM, but tests don't get very far and fail with "incorrect SRES". Any ideas? Regards, Andrew -- Andrew Back http://carrierdetect.com

11 years, 5 months

2
1
0 0

Presentations at upcoming CCC?

by Bhaskar11

Are any presentations planned on Osmocom-BB and A51 at the upcoming CCC? B.

11 years, 5 months

2
1
0 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

baseband-devel November 2012