baseband-devel November 2022

baseband-devel@lists.osmocom.org

5 participants
7 discussions

SMS not received in mobile - Virtual layer1 (osmo-nitb + osmo-bts + osmocom-bb/mobile)
by Sebastian Stumpf 05 Jan '26

05 Jan '26

Hi, Some of my sent SMS are not received by my mobile and I try to figure out if this is a problem with my virtual layer 1, configuration or something in the layers 2+. I use: osmo-nitb: 1 subscriber in hlr (id 1, ext 017519191919) osmo-bts: virt-phy, arfcn 666, TS0=CCCH+SDCCH4, TS1=SDCCH8 MS layer23 app mobile: is the subscriber from osmo-nitb MS layer1 virt-phy: virtual gsmtap layer between bts and mobile I want: Send a sms to subscriber 017519191919. osmo-nitb VTY: OpenBSC# subscriber id 1 sms sender id 1 send Test I have 2 outcomes, first one is the failure. See https://www.dropbox.com/s/eunpfioq518t09a/mobile--ms-virt--bts-virt--bsc-ni… for the pcap. Do not wonder about the duplicated gsmtap messages from mobile, the ones to ip 225.0.0.1 are over virt-phy layer, the ones to localhost from the gsmtap logging option from mobile. Filter them out via "gsmtap && (ip.dst != 127.0.0.1)". 602-613: RR channel establishment with RA and IA as reaction to paging in 590 627,631: SABM from BTS to establish async balanced mode on SAPI3 (SMS) and the ACK from MS 656,684,699: I-Data frames on SAPI3 containing the sms 660,688,703: ReceiveReady's from MS (That ACK all I-frames before N(R)-1 as far as I understood) For me, that looks good and I really do not understand why the MS will not answer with the CP-ACK/RP-ACK after receiving the SMS Data in 699. The LAPDM link will stay up for some more time and be used by the network for retransmission of the sms (1149), but MS will never react to it on the SMS layer (CP-ACK, RP-ACK). Here is the console log for the mobile (https://www.dropbox.com/s/6gug5cd4up5qv7y/mobile--ms-virt--bts-virt--bsc-ni…). The paging is answered in line 378: Fri Mar 10 10:42:06 2017 DLLAPD <0012> lapd_core.c:793 SABM(E) received in state LAPD_STATE_IDLE Second outcome is a successfully sent sms from network to ms. See https://www.dropbox.com/s/ghdn7pc0j4vifbe/mobile--ms-virt--bts-virt--bsc-ni… for the pcap. What is different here? There is no paging, but the sms is sent within the dedicated channel used for the location update initiated by the phone started up. Why there is another outcome, I don't know. 169-181: RR channel establishment with RA and IA as part of mibiles startup routine to make location update 188,416: Location udpdate procedure on SAPI0 230,234: SABM from BTS to establish async balanced mode on SAPI3 (SMS) and the ACK from MS 396,444: I-Data frames on SAPI3 containing the sms 400,449: RR's from MS 450: CP-ACK for BTS 482,499: RP-ACK I-Frames for Network (osmo-nitb) Again, the console log of the mobile (https://www.dropbox.com/s/cujsn40d43g6wxk/mobile--ms-virt--bts-virt--bsc-ni…). The SABM on SAPI3 on downlink is received in line 206: Fri Mar 10 11:06:13 2017 DLLAPD <0012> lapd_core.c:793 SABM(E) received in state LAPD_STATE_IDLE The signaling looks quite similar in both cases, but one time the mobiles sms handler responds to CP-DATA msg containing the SMS, the other time not. Can someone find an error in the signaling I did not see? Is there a known Bug? To be honest, I last merged my branch with master some time ago (~ Jan 18 2017) and thus did not update osmo-nitb and the libraries since then to avoid compatibility problems. Have there been recent changes that could cause that behavior? Thank you and Kind Regards, Sebastian

3 2

Engagetted !
by Sébastien Lorquet 14 Oct '25

14 Oct '25

http://www.engadget.com/2010/12/29/researchers-eavesdrop-on-encrypted-gsm-c… Congrats!

7 7

Re: New attack ?
by Mychaela Falconia 07 Jun '23

07 Jun '23

Bastien Baranoff wrote: > Hello all, the attack : you generate the rainbow tables for each possibles ki > with a given rand set, send this rand (which is not random ;) the phone > respond with sres you make the operation for 3 or 4 rand and meaningly > decrease the possibility of ki. Do you think it is realisable ? Someone please correct me if I'm wrong on this detail, but it is my understanding that no mainstream commercial operator today (outside of personal enthusiast tinkerers in Osmocom and similar communities) issues native 2G SIM cards any more - instead all of their current SIM cards are actually USIM/ISIM, and if GSM 11.11 SIM operation is supported at all, it is only provided as a backward compatibility mode. I reason that these "modern" SIMs must be using Milenage in their native 3G/4G mode, thus their secret key material is not classic Ki, but K/Ki (128 bits) plus OPc (another 128 bits), for a total of 256 bits of secret key material. What happens when these "modern" SIMs are accessed via GSM 11.11 SIM protocol, or when 2G authentication is requested in a USIM session? I find it doubtful that they switch to COMP128 (any version) in this mode, instead I reason that they use 2G mode of Milenage, which still uses both K/Ki and OPc - thus the secret key material used even for 2G Kc and SRES generation from RAND is still 256 bits rather than 128. Again, someone please correct me if my reasoning is wrong here. M~

6 13

failure in Transceiver startup
by Sally Regenbogen 29 Nov '22

29 Nov '22

Hello, I am new to this Project and I am having a Problem with running the Transceiver. I hope you can help me out. When i start the Transceiver on 2 Phones with this commands ./osmocon -p /dev/ttyUSB1 -m c123xor -s /tmp/osmocom_l2 -c /root/osmocom/osmocom-bb/src/target/firmware/board/compal_e88/trx.highram.bin ./osmocon -p /dev/ttyUSB2 -m c123xor -s /tmp/osmocom_l2.2 -c /root/osmocom/osmocom-bb/src/target/firmware/board/compal_e88/trx.highram.bin and sudo ./transceiver -e 1 -2 -a 47 -r 99 it throws an error which i can not solve. Maybe i am blind or something, but it doesn't work. I tried to kill the process but i can't find anything. The CLI gave me this error: ~/osmocom/osmocom-bb/src/host/layer23/src/transceiver# sudo ./transceiver -e 1 -2 -a 47 -r 99 47 41 1 <000c> l1ctl.c:77 Tx Reset Req (1) <000c> l1ctl_link.c:171 Sending: '0d 00 00 00 01 00 00 00 ' <000c> l1ctl.c:77 Tx Reset Req (1) <000c> l1ctl_link.c:171 Sending: '0d 00 00 00 01 00 00 00 ' Aborted Even when i try to start it with only 1 Phone, it doesn't run. There is a Problem, but i can't figure out what it is... I hope you can help me out for running my Transceiver or give me some hints. Thank you very much Sally

2 1

[Job Opening] Cyber Security Engineer @ ZTE CyberSecurity Lab in Dusseldorf
by WHID We Hack In Disguise 23 Nov '22

23 Nov '22

Hi guys, First of all, I want to reassure all the ML members that this is an isolated pseudo spam post and I asked in advance for permission from Harald to post it. Said that... I just wanted to let you know that ZTE is opening a CyberSecurity Lab in Germany and they are looking for Security Engineers passionate about Telco Security. *Position: * Cybersecurity Engineer *Location:* Düsseldorf, Germany *Responsibilities**:* 1. Testing the the security performance (at least but not limited to penetration testing) of ZTE products. Drafting documents and reporting testing results to stakeholders. 2. Participating in security research activities and projects in the Telecommunication field. Study and use cutting-edge security technology/tools for test and research. 3. Participating in product security risk analysis and security requirements collection. 4. Participating in lab operations. 5. Participate in the product security incident response, trace the attack, and give rectification plans. 6. Assisting in security certifications, support security vulnerability verification and rectification of products. 7. Assisting in communicating security-related matters on products across multiple departments *Link for applications:* https://www.linkedin.com/jobs/view/3361789707/ In case of questions, feel free to ping me here or reach me on LinkedIn [1] Cheers Luca [1] https://www.linkedin.com/in/lucabongiorni/

1 0

TRX Error at startup
by msfu777 21 Nov '22

21 Nov '22

Hello, i'm stucking at running my transceiver. it should be working, but it doesn`t. if i am trying to run both transceivers with: root:~/osmocom/osmocom-bb/src/host/osmocon #? $ ./osmocon -p /dev/ttyUSB1 -m c123xor -s /tmp/osmocom_l2 -c /root/osmocom/osmocom-bb/src/target/firmware/board/compal_e88/trx.highram.bin root:~/osmocom/osmocom-bb/src/host/osmocon #? $ ./osmocon -p /dev/ttyUSB2 -m c123xor -s /tmp/osmocom_l2.2 -c /root/osmocom/osmocom-bb/src/target/firmware/board/compal_e88/trx.highram.bin this one here doesn`t work like it did before. It shows me this Error here. What can ido to get rid of this Error? Can i kill the Process of the TRX or restart it? root:~/osmocom/osmocom-bb/src/host/layer23/src/transceiver #? $ sudo ./transceiver -e 1 -2 -a 47 -r 99 47 41 1 <000c> l1ctl.c:77 Tx Reset Req (1) <000c> l1ctl_link.c:171 Sending: '0d 00 00 00 01 00 00 00 ' <000c> l1ctl.c:77 Tx Reset Req (1) <000c> l1ctl_link.c:171 Sending: '0d 00 00 00 01 00 00 00 ' Aborted it would be nice to hear from you. thanks msfu777

1 0

Found spare C155, C116
by muebau 16 Nov '22

16 Nov '22

Hello, I found 3x C155, 1x C116 while cleaning out my attic. I there is somebody interested in this devices? I would be happy to give them to the community. muebau

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

baseband-devel November 2022