June 2015 - baseband-devel - lists.osmocom.org

Engagetted !

by Sébastien Lorquet

http://www.engadget.com/2010/12/29/researchers-eavesdrop-on-encrypted-gsm-c… Congrats!

6 months, 1 week

5
5
0 0

OpenBTS OsmocomBB Asterisk

by trixbox.t

Hello! I Need Help I install these three programs OpenBTS, OsmocomBB, Asterisk Then run them, Everything works well OpenBTS sent an SMS to my phones I answered and he checked me I registered into OpenBTS a second phone I tried to transfer SMS between phones - all good but when I try to call from one to another I did not get Asterisk writes ================================================================ *CLI> Retransmission timeout reached on transmission 755803415(a)127.0.0.1 for seqno 179 (Critical Response) -- See wiki.asterisk.org/wiki/display/AST/SIP+Retransmissions Packet timed out after 32001ms with no response ================================================================ Why? What do I do? -- View this message in context: http://baseband-devel.722152.n3.nabble.com/OpenBTS-OsmocomBB-Asterisk-tp402… Sent from the baseband-devel mailing list archive at Nabble.com.

5 years, 9 months

6
14
0 0

Sniffing GPRS

by canarion

Hi, After compiling osmocom-bb and apply sylvain/burst_ind branch and gprs_multi.patch, I execute it and try to sniff gprs traffic. I loaded the layer1 into my C139 and I obtained an ARFCN code (883). When I run ccch_scan -a 883 I get the next result: opyright (C) 2010 Harald Welte <laforge(a)gnumonks.org> Contributions by Holger Hans Peter Freyther License GPLv2+: GNU GPL version 2 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Failed to connect to '/tmp/osmocom_sap'. Failed during sap_open(), no SIM reader <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(1476410343) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(1207963561) <0001> app_ccch_scan.c:400 Paging1: Normal paging chan tch/f to TMSI M(0x1ad1cda) <0001> app_ccch_scan.c:403 Paging2: Normal paging chan tch/f to TMSI M(0x41ae98f9) <0001> app_ccch_scan.c:426 Paging3: Normal paging chan n/a to imsi M(214031385056117) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3306441249) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to imsi M(214031482053520) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to imsi M(214036185306441) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(4207880193) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(4135931713) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(4214223105) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3388536385) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(134915836) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3961436929) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(4229756769) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(531909) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to imsi M(214034185316455) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3829437761) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to imsi M(214033485554660) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3639403521) <0001> app_ccch_scan.c:105 SI1 received. <0001> app_ccch_scan.c:464 unknown PCH/AGCH type 0x00 <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3827744513) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(335734299) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3561969409) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(4294310401) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3698994241) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3682615617) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(67866789) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(4003487553) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3770351169) <0001> app_ccch_scan.c:400 Paging1: Normal paging chan tch/f to TMSI M(0x41ae98f9) <0001> app_ccch_scan.c:403 Paging2: Normal paging chan tch/f to TMSI M(0x1ad1cda) <0001> app_ccch_scan.c:426 Paging3: Normal paging chan n/a to imsi M(214031385056117) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3306441249) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to imsi M(214031482053520) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to imsi M(214036185306441) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(4102036289) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(4135931713) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to imsi M(214032485273805) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3798414145) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(134915836) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3988859137) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(3735175681) <0001> app_ccch_scan.c:360 Paging1: Normal paging chan tch/f to tmsi M(531909) <0001> app_ccch_scan.c:248 GSM48 IMM ASS (ra=0x78, chan_nr=0x0f, HSN=24, MAIO=1, TS=7, SS=0, TSC=1) Dropping frame with 55 bit errors <000c> l1ctl.c:238 Dropping frame with 55 bit errors <000c> l1ctl.c:290 BURST IND: @(830928 = 0626/20/36) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830928 = 0626/20/36) (-110 dBm, SNR 8) <000c> l1ctl.c:290 BURST IND: @(830929 = 0626/21/37) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830929 = 0626/21/37) ( -83 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830930 = 0626/22/38) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830930 = 0626/22/38) ( -87 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830931 = 0626/23/39) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830931 = 0626/23/39) ( -83 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830932 = 0626/24/40) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830932 = 0626/24/40) ( -88 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830933 = 0626/25/41) (-105 dBm, SNR 8, UL, SACCH) <000c> l1ctl.c:290 BURST IND: @(830933 = 0626/25/41) (-107 dBm, SNR 5, SACCH) <000c> l1ctl.c:290 BURST IND: @(830934 = 0626/00/42) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830934 = 0626/00/42) ( -88 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830935 = 0626/01/43) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830935 = 0626/01/43) ( -83 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830936 = 0626/02/44) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830936 = 0626/02/44) ( -88 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830937 = 0626/03/45) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830937 = 0626/03/45) ( -89 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830938 = 0626/04/46) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830938 = 0626/04/46) ( -88 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830939 = 0626/05/47) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830939 = 0626/05/47) ( -82 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830940 = 0626/06/48) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830940 = 0626/06/48) ( -87 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830941 = 0626/07/49) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830941 = 0626/07/49) ( -87 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830942 = 0626/08/50) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830942 = 0626/08/50) ( -86 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830943 = 0626/09/00) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830943 = 0626/09/00) ( -86 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830944 = 0626/10/01) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830944 = 0626/10/01) ( -87 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830945 = 0626/11/02) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830945 = 0626/11/02) ( -87 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830947 = 0626/13/04) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830947 = 0626/13/04) ( -84 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830948 = 0626/14/05) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830948 = 0626/14/05) ( -85 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830949 = 0626/15/06) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830949 = 0626/15/06) ( -88 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830950 = 0626/16/07) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830950 = 0626/16/07) ( -89 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830951 = 0626/17/08) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830951 = 0626/17/08) ( -88 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830952 = 0626/18/09) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830952 = 0626/18/09) ( -85 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830953 = 0626/19/10) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830953 = 0626/19/10) ( -87 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830954 = 0626/20/11) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830954 = 0626/20/11) ( -87 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830955 = 0626/21/12) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830955 = 0626/21/12) (-106 dBm, SNR 0) <000c> l1ctl.c:290 BURST IND: @(830956 = 0626/22/13) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830956 = 0626/22/13) (-107 dBm, SNR 5) <000c> l1ctl.c:290 BURST IND: @(830957 = 0626/23/14) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830957 = 0626/23/14) (-106 dBm, SNR 2) <000c> l1ctl.c:290 BURST IND: @(830958 = 0626/24/15) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830958 = 0626/24/15) (-108 dBm, SNR 1) <000c> l1ctl.c:290 BURST IND: @(830959 = 0626/25/16) (-106 dBm, SNR 2, UL, SACCH) <000c> l1ctl.c:290 BURST IND: @(830959 = 0626/25/16) (-109 dBm, SNR 5, SACCH) <000c> l1ctl.c:290 BURST IND: @(830960 = 0626/00/17) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830960 = 0626/00/17) (-108 dBm, SNR 3) <000c> l1ctl.c:290 BURST IND: @(830961 = 0626/01/18) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830961 = 0626/01/18) (-106 dBm, SNR 2) <000c> l1ctl.c:290 BURST IND: @(830962 = 0626/02/19) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830962 = 0626/02/19) (-108 dBm, SNR 3) <000c> l1ctl.c:290 BURST IND: @(830963 = 0626/03/20) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830963 = 0626/03/20) (-107 dBm, SNR 0) <000c> l1ctl.c:290 BURST IND: @(830964 = 0626/04/21) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830964 = 0626/04/21) ( -85 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830965 = 0626/05/22) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830965 = 0626/05/22) ( -87 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830966 = 0626/06/23) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830966 = 0626/06/23) ( -85 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830967 = 0626/07/24) ( -47 dBm, SNR 255, UL) <000c> l1ctl.c:290 BURST IND: @(830967 = 0626/07/24) ( -86 dBm, SNR 255) <000c> l1ctl.c:290 BURST IND: @(830968 = 0626/08/25) (-107 dBm, SNR 6, UL) <000c> l1ctl.c:290 BURST IND: @(830968 = 0626/08/25) (-109 dBm, SNR 0) <000c> l1ctl.c:290 BURST IND: @(830969 = 0626/09/26) (-101 dBm, SNR 6, UL) But it stop to capture frames, seems to be left in a standby state and I don't know why that is. With gprsdecode I can see the next image in the wireshark: http://baseband-devel.722152.n3.nabble.com/file/n3712433/wireshark-capture.… If someone knows what is the problem, please tell me. Thanks in advance. Cheers, Dani -- View this message in context: http://baseband-devel.722152.n3.nabble.com/Sniffing-GPRS-tp3712433p3712433.… Sent from the baseband-devel mailing list archive at Nabble.com.

7 years, 4 months

8
12
0 0

"Type not handled! 40" gprsdecode

by George Andguladze

Hey there, I bumped into this error when testing gprsdecode from srldabs.de When I try the sample .dat files provided from srlabs.de it works fine though. Any hints? Kind Regards George AndguladzeSenior Software EngineerBusiness Management Technology www.bmt.ge

7 years, 5 months

2
1
0 0

layer2/3 ported to target? paging attack code?

by Craig Comstock

Hey, I finally watched Nico's talk "let me answer that for you" and heard him say he ported layer2/3 to target. Also found a mailing list message about him cleaning it up and putting it up on git and sending it to a few folks. Did that code ever get shared? Would be cool to play around with and is certainly something I would eventually want to accomplish for my project of making a phone that works by itself. -Craig

7 years, 8 months

8
15
0 0

Please can anyone advise me - FMTOOL Error and no further processing

by Raz Sharif

Dear all, I vae the C115 with a T1 USB to Serial cable with the Prolific chipset. When i run osmocon i get :- an its just sits there with no further processing. ./osmocon -p /dev/ttyUSB0 -m c123xor ../../target/firmware/board/compal_e88/loader.compalram.bin read_file(../../target/firmware/board/compal_e88/loader.compalram.bin): file_size=17120, hdr_len=4, dnload_len=17127 read_file(../../target/firmware/board/compal_e88/loader.compalram.bin): file_size=17120, hdr_len=4, dnload_len=17127 got 1 bytes from modem, data looks like: 00 . got 2 bytes from modem, data looks like: 2f 00 /. got 1 bytes from modem, data looks like: 1b . got 3 bytes from modem, data looks like: f6 02 00 ... got 1 bytes from modem, data looks like: 41 A got 1 bytes from modem, data looks like: 01 . got 1 bytes from modem, data looks like: 40 @ Received PROMPT1 from phone, responding with CMD got 1 bytes from modem, data looks like: 66 f got 1 bytes from modem, data looks like: 74 t got 1 bytes from modem, data looks like: 6d m got 1 bytes from modem, data looks like: 74 t got 1 bytes from modem, data looks like: 6f o got 1 bytes from modem, data looks like: 6f o got 1 bytes from modem, data looks like: 6c l Received FTMTOOL from phone, ramloader has aborted got 1 bytes from modem, data looks like: 65 e got 1 bytes from modem, data looks like: 72 r got 1 bytes from modem, data looks like: 72 r got 1 bytes from modem, data looks like: 6f o got 1 bytes from modem, data looks like: 72 r got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . I think the cable is ok as when i run my fingers on the tip i get random Zeros so it appears to be talking to the cable. Also when i tried to run Mobile i get the :- even though i created the Mobile.cfg file in /etc/osmoco Failed to parse the config file: '/home/raz/.osmocom/bb/mobile.cfg' Please check or create config file using: 'touch /home/raz/.osmocom/bb/mobile.cfg' I have spent some hours researching the lists and trying various things to no avail but I want to continue until I resolve this issues and use this great stack to learn about the GSM network. Please advise. Great full for any help or pointers but this maybe a timing issue that is difficult to debug. Thanks Raz

7 years, 11 months

5
6
0 0

cell re-selection

by Andreas.Eversberg

hi, i did a lot of resarch and testing on cell selection and re-selection process the last two week. the cell selection process, network selection process (manual and automatic) and mobility management process were already implemented in OsmocomBB a long time, but turned out to be buggy and incomplete. i made test drives to check the process and debugged it. the re-selection process is new. it is used to track surrounding cells while listening to the BCCH of the current cell (camping on a cell). special extension to the layer1 firmare is used to measure neighbour cells. if an neighbour cell becomes 'better', the mobile switches to that cell, depening on different criteria. now it is possible to move with OsmocomBB. the re-selection process is not handover! handover is a process where a phone switches between cells while doing a call. handover is one next step to implement. the process is a little more complex, because it requires not only neighbour cell measurements, but also syncing to them without interrupting the traffic channel. most layer 3 stuff of handover is already implemented. if you like to play and test your moving OsmocomBB, you can check out the "jolly/roaming" branch. it contains the extension to layer1, as well as sim reader and fixes from "sylvain/testing" branch. use both "mobile" and "layer1" firmware from this branch. in order to see some process at VTY, you can do: enable monitor network 1 (continously display the strongest cell and neighbour cells) show ms 1 (to see current states) show neighbour-cells 1 (to see a more detailed current list of neighbours) andreas

8 years, 1 month

3
3
0 0

Set fixed TMSI and Kc

by Simian Denson

Hi, in the osmocom bb mobile.cfg I don't see any posibility to set a fixed Kc encryption key and the tmsi. How could I achieve that osmocom uses my defined Kc and tmsi? cheers, Simian

8 years, 1 month

5
21
0 0

c113a works

by Craig Comstock

FWIW, someone asked me whether c113 worked. I found a cheap 113a and hello_world loaded pretty well. The screen on my phone is shot but the backlight did come on.it works fine with the following command: craig@craig:~/c115-osmocom-bb/src$ host/osmocon/osmocon -p /dev/ttyUSB0 -m c123xor target/firmware/board/compal_e88/hello_world.compalram.bin OsmocomBB Hello World (revision osmocon_v0.0.0-1754-gfc20a37) ====================================================================== Device ID code: 0xb4fb Device Version code: 0x0000 ARM ID code: 0xfff3 cDSP ID code: 0x0128 Die ID code: c5c63637a5039778 ====================================================================== REG_DPLL=0x2413 CNTL_ARM_CLK=0xf0a1 CNTL_CLK=0xff91 CNTL_RST=0xfff3 CNTL_ARM_DIV=0xfff9 ====================================================================== REG_DPLL=0x2413 CNTL_ARM_CLK=0xf0a1 CNTL_CLK=0xff91 CNTL_RST=0xfff3 CNTL_ARM_DIV=0xfff9 ====================================================================== entering interrupt loop

8 years, 8 months

4
3
0 0

segfault on bssgp test

by ☎

Hi. Anyone else experienced this with latest libosmocore from git? ./testsuite.at:124: $abs_top_builddir/tests/gb/gprs_bssgp_test stderr: MESSAGE to 0x7f0000ff, msg length 12 02 00 81 01 01 82 0b 56 04 82 0b 55 All NS-VCs for NSEI 2901 are either dead or blocked! All NS-VCs for NSEI 2901 are either dead or blocked! BSSGP BVCI=0 Rx BVC STATUS, cause=Protocol error - unspecified BSSGP BVCI=1234 Rx BVC STATUS, cause=Unknown BVCI NSEI=2901/BVCI=2989 Cannot handle PDU type 34 for unknown BVCI, NS BVCI 2989 Unable to resolve NSEI 4660 to NS-VC! Assert failed rc >= 0 gb/gprs_bssgp_test.c:229 /home/user/source/libosmocore/tests/testsuite.dir/at-groups/19/test-source: line 25: 8497 Aborted (core dumped) $abs_top_builddir/tests/gb/gprs_ bssgp_test -- best regards, Max, http://fairwaves.co

8 years, 9 months

2
7
0 0

Beginning with a Motorola C121 or C139

by Tobias XY

Hello list, i´m new here and i want to begin with the project osmocom on the Motorola C121 or C139. I have both mobile phones here and the USB to TTL Plug with the cable. How can i start now. Is there a tutorial? Greetings, Tobi

8 years, 10 months

3
3
0 0

[PATCH] Fix automake warnings

by Max

Signed-off-by: Max <max.suraev(a)fairwaves.co> --- configure.ac | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/configure.ac b/configure.ac index acd153d..11c82a9 100644 --- a/configure.ac +++ b/configure.ac @@ -2,7 +2,7 @@ AC_INIT([libosmocore], m4_esyscmd([./git-version-gen .tarball-version]), [openbsc(a)lists.osmocom.org]) -AM_INIT_AUTOMAKE([foreign dist-bzip2 no-dist-gzip 1.6]) +AM_INIT_AUTOMAKE([foreign subdir-objects dist-bzip2 no-dist-gzip 1.6]) AC_CONFIG_TESTDIR(tests) dnl kernel style compile messages -- 2.1.4

8 years, 10 months

1
0
0 0

Master thesis feedback

by François Pönsgen

Hello list, I'm writing a master thesis on: "GSM and GPRS security using OsmocomBB". The goal of this thesis is to describe the various attacks made possible by the project, and to analyze their impact on Norwegian networks. I finally have an almost complete draft for all the chapters: the chapters 2 and 3 introduce the necessary background, chapter 4 describes the eavesdropping attack, chapter 5 describes various DoS attacks, and finally chapter 6 analyzes their impact on Norwegian networks. I'm looking for feedback on this thesis, and I thought that the topic might interest subscribers of this mailing list! I would really appreciate any constructive criticism on this report, so if you have any please do not hesitate to contact me. The deadline is on the 8th of June, in one week, so there is not much time left. The thesis is available here: https://gitlab.com/francoip/thesis/blob/public/thesis.pdf Thanks a lot, François Pönsgen

8 years, 10 months

2
2
0 0

Python Code

by Dast

I would really realize the project by Sylvain Minaut but my problem is that i can't find a script python consist to switch with another phone . ispy = identityspy(number, imsi); and ispy._apisms ?? Could someone help me please? -- View this message in context: http://baseband-devel.722152.n3.nabble.com/Python-Code-tp4026716.html Sent from the baseband-devel mailing list archive at Nabble.com.

8 years, 10 months

1
0
0 0

bad crc 9bf1

by Alexander

Hello Biggest thanks for the osmocombb project! I am trying to follow this wikki http://bb.osmocom.org/trac/wiki/flashing_new to flash rssi app And facing this error host/osmocon/osmoload fprogram 0 0x010000 compal_loader.bin Loading 8192 bytes of memory at 0x10000 in chip 0 from file compal_loader.bin bad crc 9bf1 (not 4190) at offset 0x00000000 status 69206016, aborting How to solve it? I use latest jolly/menu git branch HW: C115 and c113 ( e88) both providing same error -- Sincerely, Alexander.

8 years, 10 months

2
2
0 0

[PATCH] Remove comp128 from public API - use osmocom/crypt/auth.h instead

by Max

Signed-off-by: Max <max.suraev(a)fairwaves.co> --- TODO-RELEASE | 1 + include/Makefile.am | 6 +++--- include/osmocom/gsm/comp128.h | 4 ++-- src/gsm/auth_comp128v1.c | 2 +- src/gsm/comp128.c | 2 +- src/gsm/libosmogsm.map | 1 - tests/comp128/comp128_test.c | 1 - 7 files changed, 8 insertions(+), 9 deletions(-) diff --git a/TODO-RELEASE b/TODO-RELEASE index d03aa49..956b4be 100644 --- a/TODO-RELEASE +++ b/TODO-RELEASE @@ -1,2 +1,3 @@ #library what description / commit summary line +libosmogsm api-change remove comp128 from public API libosmogb abi-change bssgp: Fix bssgp_tx_fc_bvc parameter type diff --git a/include/Makefile.am b/include/Makefile.am index 52c6a38..b4da54e 100644 --- a/include/Makefile.am +++ b/include/Makefile.am @@ -51,8 +51,6 @@ nobase_include_HEADERS = \ osmocom/gsm/a5.h \ osmocom/gsm/abis_nm.h \ osmocom/gsm/apn.h \ - osmocom/gsm/comp128.h \ - osmocom/gsm/comp128v23.h \ osmocom/gsm/gan.h \ osmocom/gsm/gsm0341.h \ osmocom/gsm/gsm0411_smc.h \ @@ -121,7 +119,9 @@ endif noinst_HEADERS = \ osmocom/core/timer_compat.h \ - osmocom/gsm/kasumi.h + osmocom/gsm/kasumi.h \ + osmocom/gsm/comp128.h \ + osmocom/gsm/comp128v23.h osmocom/core/bit%gen.h: osmocom/core/bitXXgen.h.tpl $(AM_V_GEN)$(MKDIR_P) $(dir $@) diff --git a/include/osmocom/gsm/comp128.h b/include/osmocom/gsm/comp128.h index 33b997a..c45da37 100644 --- a/include/osmocom/gsm/comp128.h +++ b/include/osmocom/gsm/comp128.h @@ -9,10 +9,10 @@ #include <stdint.h> /* - * Performs the COMP128 algorithm (used as A3/A8) + * Performs the COMP128v1 algorithm (used as A3/A8) * ki : uint8_t [16] * srand : uint8_t [16] * sres : uint8_t [4] * kc : uint8_t [8] */ -void comp128(const uint8_t *ki, const uint8_t *srand, uint8_t *sres, uint8_t *kc); +void comp128v1(const uint8_t *ki, const uint8_t *srand, uint8_t *sres, uint8_t *kc); diff --git a/src/gsm/auth_comp128v1.c b/src/gsm/auth_comp128v1.c index 41aef71..c40027e 100644 --- a/src/gsm/auth_comp128v1.c +++ b/src/gsm/auth_comp128v1.c @@ -28,7 +28,7 @@ static int c128v1_gen_vec(struct osmo_auth_vector *vec, struct osmo_sub_auth_data *aud, const uint8_t *_rand) { - comp128(aud->u.gsm.ki, _rand, vec->sres, vec->kc); + comp128v1(aud->u.gsm.ki, _rand, vec->sres, vec->kc); vec->auth_types = OSMO_AUTH_TYPE_GSM; return 0; diff --git a/src/gsm/comp128.c b/src/gsm/comp128.c index b7a2382..e36c20d 100644 --- a/src/gsm/comp128.c +++ b/src/gsm/comp128.c @@ -185,7 +185,7 @@ _comp128_permutation(uint8_t *x, uint8_t *bits) } void -comp128(const uint8_t *ki, const uint8_t *rand, uint8_t *sres, uint8_t *kc) +comp128v1(const uint8_t *ki, const uint8_t *rand, uint8_t *sres, uint8_t *kc) { int i; uint8_t x[32], bits[128]; diff --git a/src/gsm/libosmogsm.map b/src/gsm/libosmogsm.map index 22428a2..c80c15f 100644 --- a/src/gsm/libosmogsm.map +++ b/src/gsm/libosmogsm.map @@ -26,7 +26,6 @@ abis_nm_ipa_magic; osmo_sitype_strs; -comp128; dbm2rxlev; gprs_cipher_gen_input_i; diff --git a/tests/comp128/comp128_test.c b/tests/comp128/comp128_test.c index eb6fb12..d6a6401 100644 --- a/tests/comp128/comp128_test.c +++ b/tests/comp128/comp128_test.c @@ -6,7 +6,6 @@ #include <osmocom/core/bits.h> #include <osmocom/core/utils.h> -#include <osmocom/gsm/comp128v23.h> #include <osmocom/crypt/auth.h> static struct osmo_sub_auth_data test_aux2 = { -- 2.1.4

8 years, 10 months

1
0
0 0

[PATCH] Remove osmo_a5_1 and osmo_a5_2 from public API - use generic osmo_a5() instead

by Max

Signed-off-by: Max <max.suraev(a)fairwaves.co> --- TODO-RELEASE | 1 + include/osmocom/gsm/a5.h | 2 - src/gsm/a5.c | 98 ++++++++++++++++++++++++------------------------ src/gsm/libosmogsm.map | 2 - 4 files changed, 49 insertions(+), 54 deletions(-) diff --git a/TODO-RELEASE b/TODO-RELEASE index d03aa49..ddae4c9 100644 --- a/TODO-RELEASE +++ b/TODO-RELEASE @@ -1,2 +1,3 @@ #library what description / commit summary line +libosmogsm api-change remove osmo_a5_1 and osmo_a5_2 - generic osmo_a5 should suffice for all use cases libosmogb abi-change bssgp: Fix bssgp_tx_fc_bvc parameter type diff --git a/include/osmocom/gsm/a5.h b/include/osmocom/gsm/a5.h index d22cdbb..9d12b03 100644 --- a/include/osmocom/gsm/a5.h +++ b/include/osmocom/gsm/a5.h @@ -54,7 +54,5 @@ osmo_a5_fn_count(uint32_t fn) * (converted internally to fn_count) */ int osmo_a5(int n, const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul); -void osmo_a5_1(const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul); -void osmo_a5_2(const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul); /*! @} */ diff --git a/src/gsm/a5.c b/src/gsm/a5.c index d0c7c5f..225ff87 100644 --- a/src/gsm/a5.c +++ b/src/gsm/a5.c @@ -101,54 +101,6 @@ _a5_3(const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul, bool fn_correct) _a5_4(ck, fn, dl, ul, fn_correct); } -/*! \brief Main method to generate a A5/x cipher stream - * \param[in] n Which A5/x method to use - * \param[in] key 8 or 16 (for a5/4) byte array for the key (as received from the SIM) - * \param[in] fn Frame number - * \param[out] dl Pointer to array of ubits to return Downlink cipher stream - * \param[out] ul Pointer to array of ubits to return Uplink cipher stream - * \returns 0 for success, -ENOTSUP for invalid cipher selection. - * - * Currently A5/[0-4] are supported. - * Either (or both) of dl/ul can be NULL if not needed. - */ -int -osmo_a5(int n, const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul) -{ - switch (n) - { - case 0: - if (dl) - memset(dl, 0x00, 114); - if (ul) - memset(ul, 0x00, 114); - break; - - case 1: - osmo_a5_1(key, fn, dl, ul); - break; - - case 2: - osmo_a5_2(key, fn, dl, ul); - break; - - case 3: - _a5_3(key, fn, dl, ul, true); - break; - - case 4: - _a5_4(key, fn, dl, ul, true); - break; - - default: - /* a5/[5..7] not supported here/yet */ - return -ENOTSUP; - } - - return 0; -} - - /* ------------------------------------------------------------------------ */ /* A5/1&2 common stuff */ /* ------------------------------------------------------------------------ */ @@ -261,7 +213,7 @@ _a5_1_get_output(uint32_t r[]) * Either (or both) of dl/ul can be NULL if not needed. */ void -osmo_a5_1(const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul) +_a5_1(const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul) { uint32_t r[3] = {0, 0, 0}; uint32_t fn_count; @@ -378,7 +330,7 @@ _a5_2_get_output(uint32_t r[]) * Either (or both) of dl/ul can be NULL if not needed. */ void -osmo_a5_2(const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul) +_a5_2(const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul) { uint32_t r[4] = {0, 0, 0, 0}; uint32_t fn_count; @@ -437,5 +389,51 @@ osmo_a5_2(const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul) ul[i] = _a5_2_get_output(r); } } +/*! \brief Main method to generate a A5/x cipher stream + * \param[in] n Which A5/x method to use + * \param[in] key 8 or 16 (for a5/4) byte array for the key (as received from the SIM) + * \param[in] fn Frame number + * \param[out] dl Pointer to array of ubits to return Downlink cipher stream + * \param[out] ul Pointer to array of ubits to return Uplink cipher stream + * \returns 0 for success, -ENOTSUP for invalid cipher selection. + * + * Currently A5/[0-4] are supported. + * Either (or both) of dl/ul can be NULL if not needed. + */ +int +osmo_a5(int n, const uint8_t *key, uint32_t fn, ubit_t *dl, ubit_t *ul) +{ + switch (n) + { + case 0: + if (dl) + memset(dl, 0x00, 114); + if (ul) + memset(ul, 0x00, 114); + break; + + case 1: + _a5_1(key, fn, dl, ul); + break; + + case 2: + _a5_2(key, fn, dl, ul); + break; + + case 3: + _a5_3(key, fn, dl, ul, true); + break; + + case 4: + _a5_4(key, fn, dl, ul, true); + break; + + default: + /* a5/[5..7] not supported here/yet */ + return -ENOTSUP; + } + + return 0; +} /*! @} */ diff --git a/src/gsm/libosmogsm.map b/src/gsm/libosmogsm.map index 22428a2..56f33d9 100644 --- a/src/gsm/libosmogsm.map +++ b/src/gsm/libosmogsm.map @@ -201,8 +201,6 @@ ms_pwr_ctl_lvl; ms_pwr_dbm; osmo_a5; -osmo_a5_1; -osmo_a5_2; osmo_auth_alg_name; osmo_auth_alg_parse; -- 2.1.4

8 years, 10 months

1
0
0 0

[PATCH] ignore .deb build logs

by Max

Signed-off-by: Max <max.suraev(a)fairwaves.co> --- .gitignore | 1 + 1 file changed, 1 insertion(+) diff --git a/.gitignore b/.gitignore index 24c3af7..56133da 100644 --- a/.gitignore +++ b/.gitignore @@ -41,6 +41,7 @@ debian/tmp/ debian/libosmocore*.substvars debian/libosmocore/ debian/libosmocore.post*.debhelper +debian/*.log .tarball-version .version -- 2.1.4

8 years, 10 months

1
0
0 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

baseband-devel June 2015