baseband-devel

baseband-devel@lists.osmocom.org

2022 discussions

[PATCH] bind VTY to other interfaces than localhost
by Tim Ehlers 21 Feb '12

21 Feb '12

Hi, in some usecases, for people knowing what they are doing, it maybe an advantage to control osmocombb over the network. Since the VTY is already network capable, it just needs to bind to an alternative network interface than localhost. Here is a patch for layer23 (mobile), having an option "-u" (because -v is the port). Passing "-u 0.0.0.0" would bind to any interface. If you think it is useful, please commit it in the git. Cheers Tim

4 4

Network registration fails
by To Beat 21 Feb '12

21 Feb '12

Hi I've a problem with the mobile application since ~1 month. Registering in the network always fails and I don't have any idea why. It used to work in the past, but currently it is not working. Independently from the osmocom version i use (even the version from december 2011 which had worked once now always fail). I am using a C123 with an ftdi cable and the testing branch from sylvain. I tried sim cards for Vodafone/O2/Eplus. The related outputs/logs are the following: Output on telnet interface: OsmocomBB# % (MS 1) % Searching network... % (MS 1) % Trying to registering with network... layer 1 output: http://pastebin.com/c0AhJ3gt mobile app output: http://pastebin.com/vP0YPfpT Any suggestions are appreciated! greetings Philip

2 1

USSD Commands
by Abdul Hakeem 21 Feb '12

21 Feb '12

Hello, Does anyone have a comprehensive list of USSD commands (either at the MS and server sides ), or a link to such a resource ? Regards, Abdul Hakeem

1 0

Problem with decoding.
by Jaka Hudoklin 18 Feb '12

18 Feb '12

Hello. I'm trying to figure out what am i doing wrong for days, and i can't. I'm doing GSM security research for my university. I sniffed A5/1 encrypted bursts of my mobile phone with known KC. The example of burst output is below(C-cyphertext, P-plaintext, F- decoded data): > C 2310735 > 111000010011011101110001010111110100001010101111110001110100011010011011101100101100010010011011010100101111100111 > P 2310735 > 100000000001110111010100000000000001000011011101000000001000000000010101110100000100000010000101010111010101000010 > C 2310736 > 101110101001101010010111111111101010111001111001001110011000011111011001010010010111110010010000111000111011100011 > P 2310736 > 101011111111010101010001100000101010111111010101000100001010111110111101110100010010100010111011111101010001001010 > C 2310737 > 100011010101111101001111011110111010100001010010100010010110000010111110001011010010100111101000011110010100100101 > P 2310737 > 000100010111010100010000101000010100011101010000000010100001000101110101010000000000100001000111010101000000001010 > C 2310738 > 100011100100110101110100001001001111110110110000001101100110001101100011011000011011111111011100101110100000101111 > P 2310738 > 010100001000101011101101010101010100001010111111110101110100000010101010101011010101010100001000101010101101110101 > F 1 22 9 6 32 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b > C 2310752 > 110011010101101010011000000101011010111000001111110111011101011010111101110101000101101001110001000000100000101011 > P 2310752 > 111000101001100101011000011010100001110010100101111101010011000111000111011100110001111110111100000111110100000101 > C 2310753 > 011010111101000101101001001111001001100001101010001011110111011000010101100001000100101010100110110100001000110111 > P 2310753 > 000011111011011101100101100000101011111000100110110001010110010011101111111011000000110010011110001011011000010010 > C 2310754 > 011011000011001100000110001110000011010100000101100000011111101100101000011001001010100001011100001011111011001011 > P 2310754 > 100000010010110101010001101110110100000110011101010111100010100000001001010101011001001001100010101101110100101010 > C 2310755 > 001001010111101010011010100110100011101001010101010010001011111101001000000111101101001011001111001001010001010011 > P 2310755 > 111001001001100011101001100100110100100000110010100110011101010000101010010010101011010001011000000001001100101111 > F 5 3 3 3 2d 6 1e 7 1e 92 f3 14 0 3b 97 88 2b 2b 2b 2b 2b 2b 2b As you can see frames are decoded correctly and they are correctly displayed in wireshark. If i put XOR-ed value betwene cyprtext and plaintext-> keystream to kraken, i don't get any usefull results only the ones that do not produce correct KC. i calculate frame count correctly, because i test it with data from http://lists.lists.reflextor.com/pipermail/a51/2010-July/000803.html. Kraken works correctly for me since i can get correct kc with keystream from http://lists.lists.reflextor.com/pipermail/a51/2010-July/000688.html. The ouput bursts in example above are written using following lines of code: for (i=0; i<57; i++) fprintf( app_state.fh, "%d", bt[i] ); for (i=59; i<116; i++) fprintf( app_state.fh, "%d", bt[i] ); where bt is generated using: osmo_pbit2ubit_ext(bt, 0, bi->bits, 0, 57, 0); osmo_pbit2ubit_ext(bt, 59, bi->bits, 57, 57, 0); Can you help me identify why can't i correctly crack bursts? Thanks!

3 3

osmocombb and usrp
by Paul Lambert 14 Feb '12

14 Feb '12

Hello, I have a ursp1 working fine and I want to use my c123 to conenct to it with osmocombb. Now I face some problems. First of all I have no sim, so I do: sim testcard 1 001 01 The usrp runs a testnetwork (001 01) I don't know how I can associate with the usrp. I tried: network search (lot of output and also my testnet) network show (nothing happens) network select 1 001 01: Network not in list! Any idea what I'm doing wrong? Would be really Cool if i could use opensource only. With best regards, Paul

3 3

changing key as security feature in osmocom?
by Tim Ehlers 13 Feb '12

13 Feb '12

Hi, I just saw the talk of Karsten Nohl at 28C3 and ask myself if it would be possible to trigger a new session key (KC) after every e.g. Call,SMS,USSD and silent SMS :) for next event. I mean it seems that e.g. in O2 Network in germany the key never changes, only when turning off and on the phone and after many events. For O2 it maybe enough to reconnect to the network? I really would like to get a somewhat secure GSM connection for my anchor mobile at home (remotely controlled from the PC) for my nationwide homezone (BWHZ), using osmocombb. :) Has anyone a suggestion, idea? Thanks Tim

3 10

libosmocore re-sync
by Harald Welte 08 Feb '12

08 Feb '12

FYI, I have committed a 'git-subtree' update of libosmocore to osmocom-bb earlier today. It seemed non-intrusive to me, as most of the changes were in testing and gsm 08.08 code, both of which are not used in the ARM-target builds. Nonetheless, if you experience strange new problems, the libosmocore update might be a possible cause. The update was required due to a __attribute((packed)) fix by Andreas to some GSM 04.08 structures... -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

1 0

USSD Traffic analysis
by ty 08 Feb '12

08 Feb '12

Hallo all. I have been playing around with OsmoscomBB for GSM voice traffic and capture. My interested has now stemmed into USSD traffic. Whenever I initiate a ussd session, I get the error "Session Terminated". Has anyone attempted to capture ussd sessions using the Motorola C123 or do I need specialized equipment for this? Also, am looking into researching more into ussd because here in Africa, specifically Kenya, there is a proliferation of financial services over USSD and this begs the question just how secure is it? If anyone on the list might have done a bit of digging around I'd really love to share learnings and insights. -ty

2 3

Patch: Automatically run osmoload from osmocon
by Christian Vogel 06 Feb '12

06 Feb '12

Hi, I'm getting kind of annoyed by the new >64k firmwares that need to be loaded via osmoload. Included patch #2 adds a "-a" option to osmocon that runs an arbitrary script after the main firmware has been successfully uploaded to the phone. This script could, for example, then handle upload of a second stage firmware via osmoload. Also layer23 could be started here just before uploading layer1. The script will be given the socket, serial port, loader method (c123xor...) and main firmware as arguments, those can be used to distinguish several phones that are connected to the same PC. Example usage (using attached osmoload.sh script): osmocon -p /dev/ttyUSB0 -m c155 -a .../osmoload.sh \ .../board/compal_e99/loader.compalram.bin Received DOWNLOAD ACK from phone, your code is running now! OSMOCOM Loader (revision osmocon_v0.0.0-1299-g7c08201) (---- 2 second delay ----) [osmoload.sh] Socket is /tmp/osmocom_loader, port is /dev/ttyUSB0. [osmoload.sh] Loader method was c155. [osmoload.sh] New firmware will be osmocom-bb/src/target/firmware/board/compal_e99/rssi.highram.bin. Received pong. Loading 75472 bytes of memory to address 0x820000 from file osmocom-bb/src/target/firmware/board/compal_e99/rssi.highram.bin .................................................................. Chris

2 2

[PATCH 2/2] osmocon: Option -a runs program/script on upload
by Christian Vogel 06 Feb '12

06 Feb '12

The program option "-a program" runs the specified program or script after a ACK from the phone has been received. This can be used to trigger uploading the second-stage firmware with osmoload after the osmocom loader has successfully been run on the phone. --- src/host/osmocon/osmocon.c | 76 ++++++++++++++++++++++++++++++++++++++++++- 1 files changed, 74 insertions(+), 2 deletions(-) diff --git a/src/host/osmocon/osmocon.c b/src/host/osmocon/osmocon.c index b3eaedb..eefbed2 100644 --- a/src/host/osmocon/osmocon.c +++ b/src/host/osmocon/osmocon.c @@ -30,6 +30,7 @@ #include <stdint.h> #include <fcntl.h> #include <errno.h> +#include <signal.h> #include <termios.h> #include <sys/ioctl.h> #include <sys/types.h> @@ -178,6 +179,19 @@ struct dnload { static struct dnload dnload; static struct osmo_timer_list tick_timer; +/* Information needed for callback on successful program upload to mobile. + * Only active if ack_prog_info.progname != NULL. */ + +#define ACK_PROG_TIMER_DELAY 2000000 +static struct osmo_timer_list ack_prog_timer; +struct ack_prog_info { + char *progname; + char *sockname; + char *serialdev; + char * const *envp; +}; +static struct ack_prog_info ack_prog_info = { NULL }; + /* Compal ramloader specific */ static const uint8_t phone_prompt1[] = { 0x1b, 0xf6, 0x02, 0x00, 0x41, 0x01, 0x40 }; static const uint8_t dnload_cmd[] = { 0x1b, 0xf6, 0x02, 0x00, 0x52, 0x01, 0x53 }; @@ -823,6 +837,9 @@ static int handle_read(void) dnload.write_ptr = dnload.data; dnload.expect_hdlc = 1; + if(ack_prog_info.progname) + osmo_timer_schedule(&ack_prog_timer,0,ACK_PROG_TIMER_DELAY); + /* check for romloader chainloading mode used as a workaround * for the magic on the C139/C140 and J100i */ if (dnload.chainload_filename != NULL) { @@ -1202,6 +1219,7 @@ dnload_mode_to_str(enum dnload_mode mode){ "\t\t [ -m {c123,c123xor,c140,c140xor,c155,romload,mtk} ]\n" \ "\t\t [ -c /to-be-chainloaded-file.bin ]\n" \ "\t\t [ -i beacon-interval (mS) ]\n" \ + "\t\t [ -a program-to-be-run-after-upload-ack ]\n" \ "\t\t file.bin\n\n" \ "* Open serial port /dev/ttyXXXX (connected to your phone)\n" \ "* Perform handshaking with the ramloader in the phone\n" \ @@ -1401,7 +1419,46 @@ void parse_debug(const char *str) } } -int main(int argc, char **argv) +/* timer callback function that gets triggered after ACK + * for successful program upload has been received from the phone + */ + +void +ack_prog_callback(void *p) +{ + pid_t chld; + char *argv[]={ + ack_prog_info.progname, + ack_prog_info.sockname, + ack_prog_info.serialdev, + (char*)dnload_mode_str[dnload.mode], + dnload.filename, + NULL + }; + int i; + + signal(SIGCHLD,SIG_IGN); + + if((chld=fork()) != 0){ /* ---- in parent ---- */ + if(chld == -1) + perror("fork()"); + else + fprintf(stderr,"Running %s on ack.\n", + ack_prog_info.progname); + return; + }; + + /* ---- in child ---- */ + for(i=3;i<1024;i++) + close(i); + + execve(ack_prog_info.progname,argv,ack_prog_info.envp); + perror(ack_prog_info.progname); + exit(1); +} + +int +main(int argc, char **argv,char **envp) { int opt, flags; uint32_t tmp_load_address = ROMLOAD_ADDRESS; @@ -1414,7 +1471,7 @@ int main(int argc, char **argv) dnload.previous_filename = NULL; dnload.beacon_interval = DEFAULT_BEACON_INTERVAL; - while ((opt = getopt(argc, argv, "d:hl:p:m:c:s:i:v")) != -1) { + while ((opt = getopt(argc, argv, "d:hl:p:m:c:s:i:va:")) != -1) { switch (opt) { case 'p': serial_dev = optarg; @@ -1444,6 +1501,9 @@ int main(int argc, char **argv) case 'i': dnload.beacon_interval = atoi(optarg) * 1000; break; + case 'a': + ack_prog_info.progname = optarg; + break; case 'h': default: usage(argv[0]); @@ -1451,12 +1511,23 @@ int main(int argc, char **argv) } } + if (argc <= optind) { dnload.filename = NULL; } else { dnload.filename = argv[optind]; } + if(ack_prog_info.progname){ + fprintf(stderr,"Will run %s on successful upload.\n", + ack_prog_info.progname); + ack_prog_info.sockname = (char*)loader_un_path; + ack_prog_info.serialdev = serial_dev; + ack_prog_info.envp = envp; + ack_prog_timer.cb = ack_prog_callback; + ack_prog_timer.data = &ack_prog_info; + } + dnload.serial_fd.fd = osmo_serial_init(serial_dev, MODEM_BAUDRATE); if (dnload.serial_fd.fd < 0) { fprintf(stderr, "Cannot open serial device %s\n", serial_dev); @@ -1520,3 +1591,4 @@ int main(int argc, char **argv) exit(0); } + -- 1.7.0.4 --X1bOJ3K7DJ5YkBrT Content-Type: text/plain; charset=us-ascii Content-Disposition: attachment; filename="osmoload_sh.txt" #!/bin/bash socket="$1" port="$2" method="$3" main_fw="$4" fw_dir="${main_fw%/*}" new_fw="${fw_dir}/rssi.highram.bin" osmoload="$OSMOCOM_ROOT/osmocom-bb/src/host/osmocon/osmoload" tag="[${0##*/}]" echo "Environment:" env if ! [ -x "$osmoload" ] ; then echo "$tag *** $osmoload not found/not executable." >&2 exit 1 fi if ! [ -f "$new_fw" ] ; then echo "$tag *** $new_fw not found." >&2 exit 1 fi echo "$tag Socket is $socket, port is $port." >&2 echo "$tag Loader method was $method." >&2 echo "$tag New firmware will be $new_fw." >&2 MAX_PINGS=5 N=0 while [ "$N" -lt "$MAX_PINGS" ] ; do N="$(( $N + 1 ))" $osmoload -l $socket ping if [ "$?" == 0 ] ; then break fi done if [ "$N" -ge $MAX_PINGS ] ; then echo "$tag *** could not ping phone!" >&2 exit 1 fi $osmoload -l $socket memload 0x820000 $new_fw if [ "$?" != 0 ] ; then echo "$tag *** could not upload firmware!" >&2 exit 1 fi $osmoload -l $socket jump 0x820000 if [ "$?" != 0 ] ; then echo "$tag *** could not run firmware!" >&2 exit 1 fi --X1bOJ3K7DJ5YkBrT--

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

baseband-devel