baseband-devel April 2015

baseband-devel@lists.osmocom.org

8 participants
15 discussions

Start a nNew thread

Engagetted !

by Sébastien Lorquet

http://www.engadget.com/2010/12/29/researchers-eavesdrop-on-encrypted-gsm-c… Congrats!

6 months

OpenBTS OsmocomBB Asterisk

by trixbox.t

Hello! I Need Help I install these three programs OpenBTS, OsmocomBB, Asterisk Then run them, Everything works well OpenBTS sent an SMS to my phones I answered and he checked me I registered into OpenBTS a second phone I tried to transfer SMS between phones - all good but when I try to call from one to another I did not get Asterisk writes ================================================================ *CLI> Retransmission timeout reached on transmission 755803415(a)127.0.0.1 for seqno 179 (Critical Response) -- See wiki.asterisk.org/wiki/display/AST/SIP+Retransmissions Packet timed out after 32001ms with no response ================================================================ Why? What do I do? -- View this message in context: http://baseband-devel.722152.n3.nabble.com/OpenBTS-OsmocomBB-Asterisk-tp402… Sent from the baseband-devel mailing list archive at Nabble.com.

5 years, 9 months

Sniffing GPRS

by canarion

Hi, After compiling osmocom-bb and apply sylvain/burst_ind branch and gprs_multi.patch, I execute it and try to sniff gprs traffic. I loaded the layer1 into my C139 and I obtained an ARFCN code (883). When I run ccch_scan -a 883 I get the next result: opyright (C) 2010 Harald Welte <laforge(a)gnumonks.org> Contributions by Holger Hans Peter Freyther License GPLv2+: GNU GPL version 2 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Failed to connect to '/tmp/osmocom_sap'. Failed during sap_open(), no SIM reader <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(1476410343) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(1207963561) <0001> app_ccch_scan.c:400 Paging1: Normal paging chan tch/f to TMSI M(0x1ad1cda) <0001> app_ccch_scan.c:403 Paging2: Normal paging chan tch/f to TMSI M(0x41ae98f9) <0001> app_ccch_scan.c:426 Paging3: Normal paging chan n/a to imsi M(214031385056117) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3306441249) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to imsi M(214031482053520) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to imsi M(214036185306441) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(4207880193) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(4135931713) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(4214223105) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3388536385) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(134915836) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3961436929) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(4229756769) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(531909) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to imsi M(214034185316455) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3829437761) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to imsi M(214033485554660) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3639403521) <0001> app_ccch_scan.c:105 SI1 received. <0001> app_ccch_scan.c:464 unknown PCH/AGCH type 0x00 <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3827744513) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(335734299) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3561969409) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(4294310401) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3698994241) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3682615617) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(67866789) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(4003487553) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3770351169) <0001> app_ccch_scan.c:400 Paging1: Normal paging chan tch/f to TMSI M(0x41ae98f9) <0001> app_ccch_scan.c:403 Paging2: Normal paging chan tch/f to TMSI M(0x1ad1cda) <0001> app_ccch_scan.c:426 Paging3: Normal paging chan n/a to imsi M(214031385056117) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3306441249) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to imsi M(214031482053520) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to imsi M(214036185306441) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(4102036289) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(4135931713) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to imsi M(214032485273805) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3798414145) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(134915836) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3988859137) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3735175681) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(531909) <0001> app_ccch_scan.c:248 GSM48 IMM ASS (ra=0x78, chan_nr=0x0f, HSN=24, MAIO=1, TS=7, SS=0, TSC=1) Dropping frame with 55 bit errors <000c> l1ctl.c:238 Dropping frame with 55 bit errors <000c> l1ctl.c:290 BURST IND: @(830928 = 0626/20/36) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830928 = 0626/20/36) (-110 dBm, SNR 8) <000c> l1ctl.c:290 BURST IND: @(830929 = 0626/21/37) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830929 = 0626/21/37) ( -83 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830930 = 0626/22/38) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830930 = 0626/22/38) ( -87 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830931 = 0626/23/39) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830931 = 0626/23/39) ( -83 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830932 = 0626/24/40) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830932 = 0626/24/40) ( -88 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830933 = 0626/25/41) (-105 dBm, SNR 8, UL, SACCH) <000c> l1ctl.c:290 BURST IND: @(830933 = 0626/25/41) (-107 dBm, SNR 5, SACCH) <000c> l1ctl.c:290 BURST IND: @(830934 = 0626/00/42) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830934 = 0626/00/42) ( -88 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830935 = 0626/01/43) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830935 = 0626/01/43) ( -83 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830936 = 0626/02/44) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830936 = 0626/02/44) ( -88 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830937 = 0626/03/45) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830937 = 0626/03/45) ( -89 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830938 = 0626/04/46) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830938 = 0626/04/46) ( -88 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830939 = 0626/05/47) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830939 = 0626/05/47) ( -82 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830940 = 0626/06/48) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830940 = 0626/06/48) ( -87 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830941 = 0626/07/49) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830941 = 0626/07/49) ( -87 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830942 = 0626/08/50) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830942 = 0626/08/50) ( -86 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830943 = 0626/09/00) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830943 = 0626/09/00) ( -86 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830944 = 0626/10/01) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830944 = 0626/10/01) ( -87 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830945 = 0626/11/02) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830945 = 0626/11/02) ( -87 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830947 = 0626/13/04) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830947 = 0626/13/04) ( -84 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830948 = 0626/14/05) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830948 = 0626/14/05) ( -85 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830949 = 0626/15/06) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830949 = 0626/15/06) ( -88 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830950 = 0626/16/07) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830950 = 0626/16/07) ( -89 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830951 = 0626/17/08) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830951 = 0626/17/08) ( -88 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830952 = 0626/18/09) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830952 = 0626/18/09) ( -85 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830953 = 0626/19/10) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830953 = 0626/19/10) ( -87 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830954 = 0626/20/11) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830954 = 0626/20/11) ( -87 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830955 = 0626/21/12) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830955 = 0626/21/12) (-106 dBm, SNR 0) <000c> l1ctl.c:290 BURST IND: @(830956 = 0626/22/13) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830956 = 0626/22/13) (-107 dBm, SNR 5) <000c> l1ctl.c:290 BURST IND: @(830957 = 0626/23/14) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830957 = 0626/23/14) (-106 dBm, SNR 2) <000c> l1ctl.c:290 BURST IND: @(830958 = 0626/24/15) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830958 = 0626/24/15) (-108 dBm, SNR 1) <000c> l1ctl.c:290 BURST IND: @(830959 = 0626/25/16) (-106 dBm, SNR 2, UL, SACCH) <000c> l1ctl.c:290 BURST IND: @(830959 = 0626/25/16) (-109 dBm, SNR 5, SACCH) <000c> l1ctl.c:290 BURST IND: @(830960 = 0626/00/17) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830960 = 0626/00/17) (-108 dBm, SNR 3) <000c> l1ctl.c:290 BURST IND: @(830961 = 0626/01/18) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830961 = 0626/01/18) (-106 dBm, SNR 2) <000c> l1ctl.c:290 BURST IND: @(830962 = 0626/02/19) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830962 = 0626/02/19) (-108 dBm, SNR 3) <000c> l1ctl.c:290 BURST IND: @(830963 = 0626/03/20) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830963 = 0626/03/20) (-107 dBm, SNR 0) <000c> l1ctl.c:290 BURST IND: @(830964 = 0626/04/21) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830964 = 0626/04/21) ( -85 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830965 = 0626/05/22) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830965 = 0626/05/22) ( -87 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830966 = 0626/06/23) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830966 = 0626/06/23) ( -85 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830967 = 0626/07/24) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830967 = 0626/07/24) ( -86 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830968 = 0626/08/25) (-107 dBm, SNR 6, UL) <000c> l1ctl.c:290 BURST IND: @(830968 = 0626/08/25) (-109 dBm, SNR 0) <000c> l1ctl.c:290 BURST IND: @(830969 = 0626/09/26) (-101 dBm, SNR 6, UL) But it stop to capture frames, seems to be left in a standby state and I don't know why that is. With gprsdecode I can see the next image in the wireshark: http://baseband-devel.722152.n3.nabble.com/file/n3712433/wireshark-capture.… If someone knows what is the problem, please tell me. Thanks in advance. Cheers, Dani -- View this message in context: http://baseband-devel.722152.n3.nabble.com/Sniffing-GPRS-tp3712433p3712433.… Sent from the baseband-devel mailing list archive at Nabble.com.

7 years, 4 months

"Type not handled! 40" gprsdecode

by George Andguladze

Hey there, I bumped into this error when testing gprsdecode from srldabs.de When I try the sample .dat files provided from srlabs.de it works fine though. Any hints? Kind Regards George AndguladzeSenior Software EngineerBusiness Management Technology www.bmt.ge

7 years, 5 months

layer2/3 ported to target? paging attack code?

by Craig Comstock

Hey, I finally watched Nico's talk "let me answer that for you" and heard him say he ported layer2/3 to target. Also found a mailing list message about him cleaning it up and putting it up on git and sending it to a few folks. Did that code ever get shared? Would be cool to play around with and is certainly something I would eventually want to accomplish for my project of making a phone that works by itself. -Craig

7 years, 8 months

Please can anyone advise me - FMTOOL Error and no further processing

by Raz Sharif

Dear all, I vae the C115 with a T1 USB to Serial cable with the Prolific chipset. When i run osmocon i get :- an its just sits there with no further processing. ./osmocon -p /dev/ttyUSB0 -m c123xor ../../target/firmware/board/compal_e88/loader.compalram.bin read_file(../../target/firmware/board/compal_e88/loader.compalram.bin): file_size=17120, hdr_len=4, dnload_len=17127 read_file(../../target/firmware/board/compal_e88/loader.compalram.bin): file_size=17120, hdr_len=4, dnload_len=17127 got 1 bytes from modem, data looks like: 00 . got 2 bytes from modem, data looks like: 2f 00 /. got 1 bytes from modem, data looks like: 1b . got 3 bytes from modem, data looks like: f6 02 00 ... got 1 bytes from modem, data looks like: 41 A got 1 bytes from modem, data looks like: 01 . got 1 bytes from modem, data looks like: 40 @ Received PROMPT1 from phone, responding with CMD got 1 bytes from modem, data looks like: 66 f got 1 bytes from modem, data looks like: 74 t got 1 bytes from modem, data looks like: 6d m got 1 bytes from modem, data looks like: 74 t got 1 bytes from modem, data looks like: 6f o got 1 bytes from modem, data looks like: 6f o got 1 bytes from modem, data looks like: 6c l Received FTMTOOL from phone, ramloader has aborted got 1 bytes from modem, data looks like: 65 e got 1 bytes from modem, data looks like: 72 r got 1 bytes from modem, data looks like: 72 r got 1 bytes from modem, data looks like: 6f o got 1 bytes from modem, data looks like: 72 r got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . I think the cable is ok as when i run my fingers on the tip i get random Zeros so it appears to be talking to the cable. Also when i tried to run Mobile i get the :- even though i created the Mobile.cfg file in /etc/osmoco Failed to parse the config file: '/home/raz/.osmocom/bb/mobile.cfg' Please check or create config file using: 'touch /home/raz/.osmocom/bb/mobile.cfg' I have spent some hours researching the lists and trying various things to no avail but I want to continue until I resolve this issues and use this great stack to learn about the GSM network. Please advise. Great full for any help or pointers but this maybe a timing issue that is difficult to debug. Thanks Raz

7 years, 11 months

cell re-selection

by Andreas.Eversberg

hi, i did a lot of resarch and testing on cell selection and re-selection process the last two week. the cell selection process, network selection process (manual and automatic) and mobility management process were already implemented in OsmocomBB a long time, but turned out to be buggy and incomplete. i made test drives to check the process and debugged it. the re-selection process is new. it is used to track surrounding cells while listening to the BCCH of the current cell (camping on a cell). special extension to the layer1 firmare is used to measure neighbour cells. if an neighbour cell becomes 'better', the mobile switches to that cell, depening on different criteria. now it is possible to move with OsmocomBB. the re-selection process is not handover! handover is a process where a phone switches between cells while doing a call. handover is one next step to implement. the process is a little more complex, because it requires not only neighbour cell measurements, but also syncing to them without interrupting the traffic channel. most layer 3 stuff of handover is already implemented. if you like to play and test your moving OsmocomBB, you can check out the "jolly/roaming" branch. it contains the extension to layer1, as well as sim reader and fixes from "sylvain/testing" branch. use both "mobile" and "layer1" firmware from this branch. in order to see some process at VTY, you can do: enable monitor network 1 (continously display the strongest cell and neighbour cells) show ms 1 (to see current states) show neighbour-cells 1 (to see a more detailed current list of neighbours) andreas

8 years, 1 month

Set fixed TMSI and Kc

by Simian Denson

Hi, in the osmocom bb mobile.cfg I don't see any posibility to set a fixed Kc encryption key and the tmsi. How could I achieve that osmocom uses my defined Kc and tmsi? cheers, Simian

8 years, 1 month

Baseband: MS '1' is up, service is limited

by Hoàng Mạnh Hùng

Hi all, *I connected, sent and made call successful with osmocombb (with real IMSI and IMEI). But, now, I get error, always be rejected:* OsmocomBB# show ms MS '1' is up, service is limited IMEI: 357337016773249 IMEISV: 3573370167732490 IMEI generation: fixed automatic network selection state: A0 null cell selection state: PLMN search radio ressource layer state: idle mobility management layer state: MM idle, PLMN search OsmocomBB# % (MS 1) % Trying to registering with network... *in my config file (/root/.osmocom/bb/mobile.cfg)**:* ! ! OsmocomBB () configuration saved from vty !! ! line vty no login ! gps device /dev/ttyACM0 gps baudrate default no gps enable ! no hide-default ! ms 1 layer2-socket /tmp/osmocom_l2 sap-socket /tmp/osmocom_sap sim reader network-selection-mode auto imei 357337016773249 0 imei-fixed emergency-imsi 452040399998391 sms-service-center +84980200030 no call-waiting no auto-answer no force-rekey no clip no clir tx-power auto no simulated-delay no stick location-updating neighbour-measurement codec full-speed prefer codec half-speed no abbrev support sms a5/1 a5/2 p-gsm e-gsm r-gsm gsm-850 dcs pcs class-900 4 class-850 4 class-dcs 1 class-pcs 1 channel-capability sdcch+tchf+tchh full-speech-v1 full-speech-v2 half-speech-v1 min-rxlev -106 dsc-max 90 no skip-max-per-band exit test-sim imsi 001010000000000 ki xor 00 00 00 00 00 00 00 00 00 00 00 00 no barred-access no rplmn hplmn-search foreign-country exit no shutdown exit ! Anyone help me???, thanks a lot! -- Thanks and Best Regards -- From: Hoàng Mạnh Hùng

8 years, 11 months

Osmocom-bb cell sync problem in my version without HW

by Miroslav Babjak

Hi everyone, I am working on modification the osmocom-bb project. I try modified the osmocom-bb which could communicate with BTS via UDP sockets. Here you can find the project: https://github.com/clovnrian/osmocom-bb-gprs-no-hw I have problem with cell syncing. This is output from mobile: <0003> gsm322.c:2947 Channel synched. (ARFCN=17, snr=0, BSIC=0) <0003> gsm322.c:698 Starting CS timer with 4 seconds. <0001> gsm322.c:2968 using DSC of 90 The CS timer always timeout. On github you can see what messages BTS sends to mobile. Does anybody know what I have to do to or what message I have to send to mobile? I will be grateful for any help With regards Miroslav Babják

8 years, 11 months

[PATCH] SAP client - revisited

by Tomcsányi, Domonkos

Hi everyone, I'm following up on this conversation: http://comments.gmane.org/gmane.comp.mobile.osmocom.baseband.devel/1796 It seems like there was no movement in this topic in the last couple of years, so I decided to go ahead and integrate Nico's SAP client into the current master branch and created a patch from it. I tested it (with Kevin's softSIM and a pcsc reader), it worked for me, however it is currently quite ugly: it kind of hand crafts the msgb structure (in l1ctl.c, patch line 121), sorry for that, but I kept getting extra bytes stuffed into the msg that was passed to the sap_interface so I decided to manually go around the problem. I'm of course open to any suggestions to get it cleaner, and then if you think and decide so it could be merged into the master (as far as I see. One thing however that I think is strange, and worth mentioning: I'm not sure why Nico decided to implement the switch between phone and SAP-client inside of l1ctl.c, for me it would feel better to do it in sim.c (since sim.c deals with SIM activities, l1ctl should deal only with L1 stuff...also the current SAP client calls back to sim.c, but receives data from l1ctl - little bit confusing), but I left it as is because of not knowing exactly the thoughts behind it. Regards, Domi

8 years, 11 months

nuttx-bb?

by Craig Comstock

Hi all, Was starting to work on making a usable phone again and wondered about the status of nuttx-bb git on osmocom.org versus nuttx source. It seems nuttx source is more up-to-date and has configs for my device: compal_e86/c139. Wondering if there is something in nuttx-bb that is unique that I should pay attention to? Should nuttx-bb be rebased from nuttx upstream? I was able to cobble together a nuttx.bin but on loading it always stops at 88% with the chainloader. The nuttx.bin is 148K which would seem plenty of room since the C139 has 4000K flash (32MBit) (am I doing that calculation correctly)? I had to fiddle with the MEMORY section of the ld.script in order to make space for nuttx, I'm not too familiar with this sort of thing so may have done something wrong... /* E86 stacked flash 32mbit flash, 4mbit sram, DBB internal 256kb SRAM */ /* 0x800000-0x87ffff */ /* bump up because we have 32mbit instead of 16mbit */ /* compal-loaded binary: our text, initialized data */ LRAM (rw) : ORIGIN = 0x00800000, LENGTH = 0x00020000 TRAM (rw) : ORIGIN = 0x00820000, LENGTH = 0x00040000 /* compal-loaded binary: our unitialized data, stacks, heap */ IRAM (rw) : ORIGIN = 0x00860000, LENGTH = 0x00020000 Originally TRAM was 20000 long and gave me an error on building. Not sure if I can fiddle with these values or not. Thanks,Craig

9 years

[PATCH] Fix lintian-reported errors

by Max

Signed-off-by: Max <max.suraev(a)fairwaves.co> --- debian/README.source | 1 + debian/control | 17 ++++++++++++++--- debian/copyright | 15 ++------------- 3 files changed, 17 insertions(+), 16 deletions(-) create mode 100644 debian/README.source diff --git a/debian/README.source b/debian/README.source new file mode 100644 index 0000000..982a696 --- /dev/null +++ b/debian/README.source @@ -0,0 +1 @@ +We do some Debian-specific source patching magic. See debian/patches for clarification. diff --git a/debian/control b/debian/control index 7de6358..1470e73 100644 --- a/debian/control +++ b/debian/control @@ -2,7 +2,7 @@ Source: libosmocore Section: libs Priority: optional Maintainer: Harald Welte <laforge(a)gnumonks.org> -Build-Depends: debhelper (>= 9), autotools-dev, autoconf, automake, libtool, dh-autoreconf, libdpkg-perl, git, doxygen, libpcsclite-dev, pkg-config +Build-Depends: debhelper (>= 9), autotools-dev, autoconf, automake, libtool, dh-autoreconf, libdpkg-perl, git, doxygen, libpcsclite-dev, pkg-config, quilt Standards-Version: 3.9.6 Homepage: http://bb.osmocom.org/trac/wiki/libosmocore Vcs-Git: git://git.osmocom.org/libosmocore.git @@ -14,6 +14,7 @@ Architecture: any Depends: libosmocodec0, libosmocore6, libosmogb3, libosmogsm5, libosmovty1, ${misc:Depends} Multi-Arch: foreign Description: Open Source MObile COMmunications CORE library + Metapackage for Open Source MObile COMmunications CORE library. Package: libosmocodec0 Section: libs @@ -21,6 +22,7 @@ Architecture: any Depends: ${shlibs:Depends}, ${misc:Depends} Multi-Arch: same Description: Osmo codec library + Open Source MObile COMmunications codec library. Package: libosmocore6 Section: libs @@ -28,6 +30,7 @@ Architecture: any Depends: ${shlibs:Depends}, ${misc:Depends} Multi-Arch: same Description: Osmo Core library + Open Source MObile COMmunications CORE library. Package: libosmogb3 Section: libs @@ -35,6 +38,7 @@ Architecture: any Depends: ${shlibs:Depends}, ${misc:Depends} Multi-Arch: same Description: Osmo GPRS GB library + Open Source MObile COMmunications library containing GPRS support functions. Package: libosmogsm5 Section: libs @@ -42,6 +46,7 @@ Architecture: any Depends: ${shlibs:Depends}, ${misc:Depends} Multi-Arch: same Description: Osmo GSM utility library + Open Source MObile COMmunications library implementing various GSM routines. Package: libosmovty1 Section: libs @@ -49,6 +54,7 @@ Architecture: any Depends: ${shlibs:Depends}, ${misc:Depends} Multi-Arch: same Description: Osmo VTY library + Open Source MObile COMmunications library implementing VTY interface. Package: libosmoctrl0 Section: libs @@ -56,6 +62,7 @@ Architecture: any Depends: ${shlibs:Depends}, ${misc:Depends} Multi-Arch: same Description: Osmo control library + Open Source MObile COMmunications control library. Package: libosmosim0 Section: libs @@ -63,19 +70,22 @@ Architecture: any Depends: ${shlibs:Depends}, ${misc:Depends} Multi-Arch: same Description: Osmo SIM library - + Open Source MObile COMmunications SIM library. + Package: libosmocore-dev Section: libdevel Architecture: any -Depends: ${misc:Depends}, libosmocore +Depends: ${misc:Depends}, libosmocore, libjs-jquery Multi-Arch: same Description: Development headers for Open Source MObile COMmunications CORE library + Open Source MObile COMmunications library development files. Package: libosmocore-utils Architecture: any Depends: ${shlibs:Depends}, ${misc:Depends}, libosmocore Multi-Arch: same Description: Utilities for gsm + Open Source MObile COMmunications library utilities. Package: libosmocore-dbg Architecture: any @@ -84,3 +94,4 @@ Priority: extra Depends: libosmocore (= ${binary:Version}), ${misc:Depends} Multi-Arch: same Description: Debug symbols for Open Source MObile COMmunications CORE library + Debug version of Open Source MObile COMmunications CORE library. diff --git a/debian/copyright b/debian/copyright index c450be5..c2bfe66 100644 --- a/debian/copyright +++ b/debian/copyright @@ -6,7 +6,7 @@ It was downloaded from: git://git.osmocom.org/libosmocore.git -Upstream Author(s): +Upstream Authors: Harald Welte <laforge(a)gnumonks.org> Holger Hans Peter Freyther <zecke(a)selfish.org> @@ -36,19 +36,8 @@ Copyright: License: GNU General Public License, Version 2 or later + see "/usr/share/common-licenses/GPL-2" The Debian packaging is: Copyright (C) 2010 Harald Welte <laforge(a)gnumonks.org> - -# Please chose a license for your packaging work. If the program you package -# uses a mainstream license, using the same license is the safest choice. -# Please avoid to pick license terms that are more restrictive than the -# packaged work, as it may make Debian's contributions unacceptable upstream. -# If you just want it to be GPL version 3, leave the following lines in. - -and is licensed under the GPL version 3, -see "/usr/share/common-licenses/GPL-3". - -# Please also look if there are files or directories which have a -# different copyright/license attached and list them here. -- 2.1.0

9 years

[PATCH] Add A5/3-4 cipher support

by Max

Signed-off-by: Max <max.suraev(a)fairwaves.co> --- include/osmocom/gsm/a5.h | 2 +- src/gsm/a5.c | 71 ++++++++++++++++++++++++++++++++++++++++++++++-- tests/Makefile.am | 3 +- tests/a5/a5_test.c | 67 +++++++++++++++++++++++++++++++++++---------- tests/a5/a5_test.ok | 24 ++++++++++++++++ 5 files changed, 148 insertions(+), 19 deletions(-) diff --git a/include/osmocom/gsm/a5.h b/include/osmocom/gsm/a5.h index c076734..d22cdbb 100644 --- a/include/osmocom/gsm/a5.h +++ b/include/osmocom/gsm/a5.h @@ -48,7 +48,7 @@ osmo_a5_fn_count(uint32_t fn) } /* Notes: - * - key must be 8 bytes long (or NULL for A5/0) + * - key must be 8 or 16 (for a5/4) bytes long (or NULL for A5/0) * - the dl and ul pointer must be either NULL or 114 bits long * - fn is the _real_ GSM frame number. * (converted internally to fn_count) diff --git a/src/gsm/a5.c b/src/gsm/a5.c index 10a063e..d0c7c5f 100644 --- a/src/gsm/a5.c +++ b/src/gsm/a5.c @@ -36,23 +36,80 @@ #include <errno.h> #include <string.h> +#include <stdbool.h> #include <osmocom/gsm/a5.h> +#include <osmocom/gsm/kasumi.h> /* Somme OS (like Nuttx) don't have ENOTSUP */ #ifndef ENOTSUP #define ENOTSUP EINVAL #endif +/* ------------------------------------------------------------------------ */ +/* A5/3&4 */ +/* ------------------------------------------------------------------------ */ + +/*! \brief Generate a GSM A5/4 cipher stream + * \param[in] key 16 byte array for the key (as received from the SIM) + * \param[in] fn Frame number + * \param[out] dl Pointer to array of ubits to return Downlink cipher stream + * \param[out] ul Pointer to array of ubits to return Uplink cipher stream + * \param[in] fn_correct true if fn is a real GSM frame number and thus requires internal conversion + * + * Either (or both) of dl/ul should be NULL if not needed. + * + * Implementation based on specifications from 3GPP TS 55.216, 3GPP TR 55.919 and ETSI TS 135 202 + * with slight simplifications (CE hardcoded to 0). + */ +void +_a5_4(const uint8_t *ck, uint32_t fn, ubit_t *dl, ubit_t *ul, bool fn_correct) +{ + uint8_t i, gamma[32], uplink[15]; + uint32_t fn_count = (fn_correct) ? osmo_a5_fn_count(fn) : fn; + + if (ul) { + _kasumi_kgcore(0xF, 0, fn_count, 0, ck, gamma, 228); + for(i = 0; i < 15; i++) uplink[i] = (gamma[i + 14] << 2) + (gamma[i + 15] >> 6); + osmo_pbit2ubit(ul, uplink, 114); + } + if (dl) { + _kasumi_kgcore(0xF, 0, fn_count, 0, ck, gamma, 114); + osmo_pbit2ubit(dl, gamma, 114); + } +} + +/*! \brief Generate a GSM A5/3 cipher stream + * \param[in] key 8 byte array for the key (as received from the SIM) + * \param[in] fn Frame number + * \param[out] dl Pointer to array of ubits to return Downlink cipher stream + * \param[out] ul Pointer to array of ubits to return Uplink cipher stream + * \param[in] fn_correct true if fn is a real GSM frame number and thus requires internal conversion + * + * Either (or both) of dl/ul should be NULL if not needed. + * + * Implementation based on specifications from 3GPP TS 55.216, 3GPP TR 55.919 and ETSI TS 135 202 + * with slight simplifications (CE hardcoded to 0). + */ +void +_a5_3(const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul, bool fn_correct) +{ + uint8_t ck[16]; + memcpy(ck, key, 8); + memcpy(ck + 8, key, 8); + /* internal function require 128 bit key so we expand by concatenating supplied 64 bit key */ + _a5_4(ck, fn, dl, ul, fn_correct); +} + /*! \brief Main method to generate a A5/x cipher stream * \param[in] n Which A5/x method to use - * \param[in] key 8 byte array for the key (as received from the SIM) + * \param[in] key 8 or 16 (for a5/4) byte array for the key (as received from the SIM) * \param[in] fn Frame number * \param[out] dl Pointer to array of ubits to return Downlink cipher stream * \param[out] ul Pointer to array of ubits to return Uplink cipher stream * \returns 0 for success, -ENOTSUP for invalid cipher selection. * - * Currently A5/[0-2] are supported. + * Currently A5/[0-4] are supported. * Either (or both) of dl/ul can be NULL if not needed. */ int @@ -75,8 +132,16 @@ osmo_a5(int n, const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul) osmo_a5_2(key, fn, dl, ul); break; + case 3: + _a5_3(key, fn, dl, ul, true); + break; + + case 4: + _a5_4(key, fn, dl, ul, true); + break; + default: - /* a5/[3..7] not supported here/yet */ + /* a5/[5..7] not supported here/yet */ return -ENOTSUP; } diff --git a/tests/Makefile.am b/tests/Makefile.am index 2c80063..809bf64 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -18,8 +18,9 @@ endif utils_utils_test_SOURCES = utils/utils_test.c utils_utils_test_LDADD = $(top_builddir)/src/libosmocore.la -a5_a5_test_SOURCES = a5/a5_test.c +a5_a5_test_SOURCES = a5/a5_test.c ../src/gsm/a5.c a5_a5_test_LDADD = $(top_builddir)/src/libosmocore.la $(top_builddir)/src/gsm/libosmogsm.la +a5_a5_test_LDFLAGS = -static kasumi_kasumi_test_SOURCES = kasumi/kasumi_test.c ../src/gsm/kasumi.c kasumi_kasumi_test_LDADD = $(top_builddir)/src/libosmocore.la $(top_builddir)/src/gsm/libosmogsm.la diff --git a/tests/a5/a5_test.c b/tests/a5/a5_test.c index 14436f1..0dbc6fb 100644 --- a/tests/a5/a5_test.c +++ b/tests/a5/a5_test.c @@ -2,6 +2,7 @@ #include <stdlib.h> #include <stdint.h> #include <string.h> +#include <stdbool.h> #include <osmocom/core/bits.h> #include <osmocom/core/utils.h> @@ -36,24 +37,48 @@ static const uint8_t ul[] = { 0x80, 0xba, 0xab, 0xc0, 0x59, 0x26, 0x40, }; -static const char * -binstr(ubit_t *d, int n) +static inline bool print_a5(int n, int k, const char * dir, const ubit_t * out, const char * block) { - static char str[256]; - int i; + uint8_t len = 114 / 8 + 1, buf[len], res[len]; + printf("A5/%d - %s: %s => ", n, dir, osmo_ubit_dump(out, 114)); + osmo_hexparse(block, res, len); + osmo_ubit2pbit(buf, out, 114); + if (0 != memcmp(buf, res, len)) { + printf("FAIL\nGOT: [%d] %s\nEXP: [%d] %s\n", k, osmo_hexdump_nospc(buf, len), k, osmo_hexdump_nospc(res, len)); + return false; + } + printf("OK\n"); + return true; +} + +static inline bool test_a53(const char * kc, uint32_t count, const char * block1, const char * block2) +{ + ubit_t dlout[114], ulout[114]; + uint8_t key[8]; + + osmo_hexparse(kc, key, 8); + _a5_3(key, count, dlout, NULL, false); + _a5_3(key, count, NULL, ulout, false); - for (i=0; i<n; i++) - str[i] = d[i] ? '1' : '0'; + return print_a5(3, 8, "DL", dlout, block1) & print_a5(3, 8, "UL", ulout, block2); +} + +static inline bool test_a54(const char * kc, uint32_t count, const char * block1, const char * block2) +{ + ubit_t dlout[114], ulout[114]; + uint8_t key[16]; - str[i] = '\0'; + osmo_hexparse(kc, key, 16); + _a5_4(key, count, dlout, NULL, false); + _a5_4(key, count, NULL, ulout, false); - return str; + return print_a5(4, 8, "DL", dlout, block1) & print_a5(4, 8, "UL", ulout, block2); } + int main(int argc, char **argv) { - ubit_t exp[114]; - ubit_t out[114]; + ubit_t exp[114], out[114]; int n, i; for (n=0; n<3; n++) { @@ -66,13 +91,13 @@ int main(int argc, char **argv) osmo_a5(n, key, fn, out, NULL); - printf("A5/%d - DL: %s", n, binstr(out, 114)); + printf("A5/%d - DL: %s", n, osmo_ubit_dump(out, 114)); if (!memcmp(exp, out, 114)) printf(" => OK\n"); else { printf(" => BAD\n"); - printf(" Expected: %s", binstr(out, 114)); + printf(" Expected: %s", osmo_ubit_dump(out, 114)); fprintf(stderr, "[!] A5/%d DL failed", n); exit(1); } @@ -82,17 +107,31 @@ int main(int argc, char **argv) osmo_a5(n, key, fn, NULL, out); - printf("A5/%d - UL: %s", n, binstr(out, 114)); + printf("A5/%d - UL: %s", n, osmo_ubit_dump(out, 114)); if (!memcmp(exp, out, 114)) printf(" => OK\n"); else { printf(" => BAD\n"); - printf(" Expected: %s", binstr(out, 114)); + printf(" Expected: %s", osmo_ubit_dump(out, 114)); fprintf(stderr, "[!] A5/%d UL failed", n); exit(1); } } +// test vectors from 3GPP TS 55.217 and TS 55.218 + test_a53("2BD6459F82C5BC00", 0x24F20F, "889EEAAF9ED1BA1ABBD8436232E440", "5CA3406AA244CF69CF047AADA2DF40"); + test_a53("952C49104881FF48", 0x061272, "FB4D5FBCEE13A33389285686E9A5C0", "25090378E0540457C57E367662E440"); + test_a53("EFA8B2229E720C2A", 0x33FD3F, "0E4015755A336469C3DD8680E30340", "6F10669E2B4E18B042431A28E47F80"); + test_a53("952C49104881FF48", 0x061527, "AB7DB38A573A325DAA76E4CB800A40", "4C4B594FEA9D00FE8978B7B7BC1080"); + test_a53("3451F23A43BD2C87", 0x0E418C, "75F7C4C51560905DFBA05E46FB54C0", "192C95353CDF979E054186DF15BF00"); + test_a53("CAA2639BE82435CF", 0x2FF229, "301437E4D4D6565D4904C631606EC0", "F0A3B8795E264D3E1A82F684353DC0"); + test_a53("7AE67E87400B9FA6", 0x2F24E5, "F794290FEF643D2EA348A7796A2100", "CB6FA6C6B8A705AF9FEFE975818500"); + test_a53("58AF69935540698B", 0x05446B, "749CA4E6B691E5A598C461D5FE4740", "31C9E444CD04677ADAA8A082ADBC40"); + test_a53("017F81E5F236FE62", 0x156B26, "2A6976761E60CC4E8F9F52160276C0", "A544D8475F2C78C35614128F1179C0"); + test_a53("1ACA8B448B767B39", 0x0BC3B5, "A4F70DC5A2C9707F5FA1C60EB10640", "7780B597B328C1400B5C74823E8500"); + test_a54("3D43C388C9581E337FF1F97EB5C1F85E", 0x35D2CF, "A2FE3034B6B22CC4E33C7090BEC340", "170D7497432FF897B91BE8AECBA880"); + test_a54("A4496A64DF4F399F3B4506814A3E07A1", 0x212777, "89CDEE360DF9110281BCF57755A040", "33822C0C779598C9CBFC49183AF7C0"); + return 0; } diff --git a/tests/a5/a5_test.ok b/tests/a5/a5_test.ok index 4497e14..cefcdb6 100644 --- a/tests/a5/a5_test.ok +++ b/tests/a5/a5_test.ok @@ -4,3 +4,27 @@ A5/1 - DL: 110010111010001001010101011101100001011101011101001110110001110001111 A5/1 - UL: 110110010000001101011110000011110010101011101100000100111001101000000101110101001010100001111011101100010110010010 => OK A5/2 - DL: 010001011001110010001000110000111000001010110111111111111011001110011000110100101111100101101110000011110001010010 => OK A5/2 - UL: 111100000011101010101100110111101110001101011011010111100110010110000000101110101010101111000000010110010010011001 => OK +A5/3 - DL: 100010001001111011101010101011111001111011010001101110100001101010111011110110000100001101100010001100101110010001 => OK +A5/3 - UL: 010111001010001101000000011010101010001001000100110011110110100111001111000001000111101010101101101000101101111101 => OK +A5/3 - DL: 111110110100110101011111101111001110111000010011101000110011001110001001001010000101011010000110111010011010010111 => OK +A5/3 - UL: 001001010000100100000011011110001110000001010100000001000101011111000101011111100011011001110110011000101110010001 => OK +A5/3 - DL: 000011100100000000010101011101010101101000110011011001000110100111000011110111011000011010000000111000110000001101 => OK +A5/3 - UL: 011011110001000001100110100111100010101101001110000110001011000001000010010000110001101000101000111001000111111110 => OK +A5/3 - DL: 101010110111110110110011100010100101011100111010001100100101110110101010011101101110010011001011100000000000101001 => OK +A5/3 - UL: 010011000100101101011001010011111110101010011101000000001111111010001001011110001011011110110111101111000001000010 => OK +A5/3 - DL: 011101011111011111000100110001010001010101100000100100000101110111111011101000000101111001000110111110110101010011 => OK +A5/3 - UL: 000110010010110010010101001101010011110011011111100101111001111000000101010000011000011011011111000101011011111100 => OK +A5/3 - DL: 001100000001010000110111111001001101010011010110010101100101110101001001000001001100011000110001011000000110111011 => OK +A5/3 - UL: 111100001010001110111000011110010101111000100110010011010011111000011010100000101111011010000100001101010011110111 => OK +A5/3 - DL: 111101111001010000101001000011111110111101100100001111010010111010100011010010001010011101111001011010100010000100 => OK +A5/3 - UL: 110010110110111110100110110001101011100010100111000001011010111110011111111011111110100101110101100000011000010100 => OK +A5/3 - DL: 011101001001110010100100111001101011011010010001111001011010010110011000110001000110000111010101111111100100011101 => OK +A5/3 - UL: 001100011100100111100100010001001100110100000100011001110111101011011010101010001010000010000010101011011011110001 => OK +A5/3 - DL: 001010100110100101110110011101100001111001100000110011000100111010001111100111110101001000010110000000100111011011 => OK +A5/3 - UL: 101001010100010011011000010001110101111100101100011110001100001101010110000101000001001010001111000100010111100111 => OK +A5/3 - DL: 101001001111011100001101110001011010001011001001011100000111111101011111101000011100011000001110101100010000011001 => OK +A5/3 - UL: 011101111000000010110101100101111011001100101000110000010100000000001011010111000111010010000010001111101000010100 => OK +A5/4 - DL: 101000101111111000110000001101001011011010110010001011001100010011100011001111000111000010010000101111101100001101 => OK +A5/4 - UL: 000101110000110101110100100101110100001100101111111110001001011110111001000110111110100010101110110010111010100010 => OK +A5/4 - DL: 100010011100110111101110001101100000110111111001000100010000001010000001101111001111010101110111010101011010000001 => OK +A5/4 - UL: 001100111000001000101100000011000111011110010101100110001100100111001011111111000100100100011000001110101111011111 => OK -- 2.1.0

9 years

[PATCH] fix compiler warnings for a5 tests

by Max

Signed-off-by: Max <max.suraev(a)fairwaves.co> --- tests/a5/a5_test.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tests/a5/a5_test.c b/tests/a5/a5_test.c index 0dbc6fb..6d7cc3c 100644 --- a/tests/a5/a5_test.c +++ b/tests/a5/a5_test.c @@ -8,6 +8,10 @@ #include <osmocom/core/utils.h> #include <osmocom/gsm/a5.h> +// make compiler happy +void _a5_3(const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul, bool fn_correct); +void _a5_4(const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul, bool fn_correct); + static const uint8_t key[] = { 0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef }; static const uint32_t fn = 123456; static const uint8_t dl[] = { -- 2.1.0

9 years

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

baseband-devel April 2015