baseband-devel

baseband-devel@lists.osmocom.org

2022 discussions

[PATCH] [layer23] fix sim path handling and msisdn path location
by Nico Golde 27 Apr '11

27 Apr '11

From: Nico Golde <nico(a)ngolde.de> --- src/host/layer23/src/common/sim.c | 2 +- src/host/layer23/src/mobile/subscriber.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/host/layer23/src/common/sim.c b/src/host/layer23/src/common/sim.c index 3ef3cf8..5e94c3e 100644 --- a/src/host/layer23/src/common/sim.c +++ b/src/host/layer23/src/common/sim.c @@ -688,7 +688,7 @@ static int sim_process_job(struct osmocom_ms *ms) /* check MF / DF */ i = 0; while (sh->path[i] && sim->path[i]) { - if (sh->path[i] != sh->path[i]) + if (sh->path[i] != sim->path[i]) break; i++; } diff --git a/src/host/layer23/src/mobile/subscriber.c b/src/host/layer23/src/mobile/subscriber.c index 3ba78f3..a16539a 100644 --- a/src/host/layer23/src/mobile/subscriber.c +++ b/src/host/layer23/src/mobile/subscriber.c @@ -492,7 +492,7 @@ static struct subscr_sim_file { { 1, { 0 }, 0x2fe2, subscr_sim_iccid }, { 1, { 0x7f20, 0 }, 0x6f07, subscr_sim_imsi }, { 1, { 0x7f20, 0 }, 0x6f7e, subscr_sim_loci }, - { 0, { 0x7f20, 0 }, 0x6f40, subscr_sim_msisdn }, + { 0, { 0x7f10, 0 }, 0x6f40, subscr_sim_msisdn }, { 0, { 0x7f20, 0 }, 0x6f20, subscr_sim_kc }, { 0, { 0x7f20, 0 }, 0x6f30, subscr_sim_plmnsel }, { 0, { 0x7f20, 0 }, 0x6f31, subscr_sim_hpplmn }, -- 1.7.4.4

1 0

R: running error with branch burst_ind
by screaming-pain＠libero.it 26 Apr '11

26 Apr '11

Hi, I'm having the same problem and as far as I've understood, you need a different serial or usb cableThe program is trying to set a high baud rate which is not supported by your cable.To the best of my understanding a FTDI usb to serial cable it's needed, because this supports higher baud rates. Loretta ----Messaggio originale---- Da: cnwutong(a)gmail.com Data: 25-apr-2011 6.01 A: <baseband-devel(a)lists.osmocom.org> Ogg: running error with branch burst_ind Hi all, Working with a C118 and everything was fine with the master branch, then switched to the burst_ind branch and complied successfully, when running: $ ./osmocon -p /dev/ttyUSB0 -m c123xor ../../target/firmware/board/compal_e88/layer1.compalram.bingot 1 bytes from modem, data looks like: 2f /got 1 bytes from modem, data looks like: 00 . got 5 bytes from modem, data looks like: 1b f6 02 00 41 ....Agot 1 bytes from modem, data looks like: 01 .got 1 bytes from modem, data looks like: 40 @Received PROMPT1 from phone, responding with CMD read_file(../../target/firmware/board/compal_e88/layer1.compalram.bin): file_size=48564, hdr_len=4, dnload_len=48571got 1 bytes from modem, data looks like: 1b .got 1 bytes from modem, data looks like: f6 . got 1 bytes from modem, data looks like: 02 .got 1 bytes from modem, data looks like: 00 .got 1 bytes from modem, data looks like: 41 Agot 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 43 CReceived PROMPT2 from phone, starting downloadhandle_write(): 4096 bytes (4096/48571)handle_write(): 4096 bytes (8192/48571)handle_write(): 4096 bytes (12288/48571) handle_write(): 4096 bytes (16384/48571)handle_write(): 4096 bytes (20480/48571)handle_write(): 4096 bytes (24576/48571)handle_write(): 4096 bytes (28672/48571)handle_write(): 4096 bytes (32768/48571) handle_write(): 4096 bytes (36864/48571)handle_write(): 4096 bytes (40960/48571)handle_write(): 4096 bytes (45056/48571)handle_write(): 3515 bytes (48571/48571)handle_write(): finished got 1 bytes from modem, data looks like: 1b .got 1 bytes from modem, data looks like: f6 .got 1 bytes from modem, data looks like: 02 .got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 41 Agot 1 bytes from modem, data looks like: 03 .got 1 bytes from modem, data looks like: 42 BReceived DOWNLOAD ACK from phone, your code is running now! ioctl(TIOCSSERIAL): Invalid argument $ ./mobileCopyright (C) 2008-2010 ...Contributions by ... License GPLv2+: GNU GPL version 2 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it.There is NO WARRANTY, to the extent permitted by law. VTY available on port 4247.No Mobile Station defined, creating: MS '1' <000e> sim.c:1206 init SIM client<0005> gsm48_cc.c:61 init Call Control<0001> gsm48_rr.c:4944 init Radio Ressource process<0004> gsm48_mm.c:1220 init Mobility Management process <0004> gsm48_mm.c:971 Selecting PLMN SEARCH state, because no SIM.<0002> gsm322.c:3471 init PLMN process<0003> gsm322.c:3472 init Cell Selection process<0003> gsm322.c:3526 No stored BA list Mobile '1' initialized, please start phone now! then no reaction with the mobile application either rebooting the phone (press power bottom) or not, for layer23 application acts the same. tried to search for the message "ioctl(TIOCSSERIAL): Invalid argument" but failed to get any useful information. could anyone help and many thanks for your time and considerations! best regards, flaw

3 2

running error with branch burst_ind
by 吴彤 26 Apr '11

26 Apr '11

Hi all, Working with a C118 and everything was fine with the master branch, then switched to the burst_ind branch and complied successfully, when running: $ ./osmocon -p /dev/ttyUSB0 -m c123xor ../../target/firmware/board/compal_e88/layer1.compalram.bin got 1 bytes from modem, data looks like: 2f / got 1 bytes from modem, data looks like: 00 . got 5 bytes from modem, data looks like: 1b f6 02 00 41 ....A got 1 bytes from modem, data looks like: 01 . got 1 bytes from modem, data looks like: 40 @ Received PROMPT1 from phone, responding with CMD read_file(../../target/firmware/board/compal_e88/layer1.compalram.bin): file_size=48564, hdr_len=4, dnload_len=48571 got 1 bytes from modem, data looks like: 1b . got 1 bytes from modem, data looks like: f6 . got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 41 A got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 43 C Received PROMPT2 from phone, starting download handle_write(): 4096 bytes (4096/48571) handle_write(): 4096 bytes (8192/48571) handle_write(): 4096 bytes (12288/48571) handle_write(): 4096 bytes (16384/48571) handle_write(): 4096 bytes (20480/48571) handle_write(): 4096 bytes (24576/48571) handle_write(): 4096 bytes (28672/48571) handle_write(): 4096 bytes (32768/48571) handle_write(): 4096 bytes (36864/48571) handle_write(): 4096 bytes (40960/48571) handle_write(): 4096 bytes (45056/48571) handle_write(): 3515 bytes (48571/48571) handle_write(): finished got 1 bytes from modem, data looks like: 1b . got 1 bytes from modem, data looks like: f6 . got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 41 A got 1 bytes from modem, data looks like: 03 . got 1 bytes from modem, data looks like: 42 B Received DOWNLOAD ACK from phone, your code is running now! ioctl(TIOCSSERIAL): Invalid argument $ ./mobile Copyright (C) 2008-2010 ... Contributions by ... License GPLv2+: GNU GPL version 2 or later <http://gnu.org/licenses/gpl.html > This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. VTY available on port 4247. No Mobile Station defined, creating: MS '1' <000e> sim.c:1206 init SIM client <0005> gsm48_cc.c:61 init Call Control <0001> gsm48_rr.c:4944 init Radio Ressource process <0004> gsm48_mm.c:1220 init Mobility Management process <0004> gsm48_mm.c:971 Selecting PLMN SEARCH state, because no SIM. <0002> gsm322.c:3471 init PLMN process <0003> gsm322.c:3472 init Cell Selection process <0003> gsm322.c:3526 No stored BA list Mobile '1' initialized, please start phone now! then no reaction with the mobile application either rebooting the phone (press power bottom) or not, for layer23 application acts the same. tried to search for the message "ioctl(TIOCSSERIAL): Invalid argument" but failed to get any useful information. could anyone help and many thanks for your time and considerations! best regards, flaw

3 2

Osmocom + Freerunner compilation issue
by zredlined 25 Apr '11

25 Apr '11

I have been trying to compile the latest osmocom-bb build target binaries directly on my Freerunner, which is running Om2008.8. uname -a // Linux om-gta02 2.6.28-rc4 #1 PREEMPT Mon Mar 2 19:43:22 CET 2009 armv4tl unknown Unfortunately, I am getting an error during compilation in: directory // `/src/shared/libosmocore/build-target/src' GCC output: make[3]: Entering directory `/home/root/osmocom/src/shared/libosmocore/build-target/src' make: *** [shared/libosmocore/build-target/src/.libs/libosmocore.a] Error 2 > Making all in . > make[4]: Entering directory > `/home/root/osmocom/src/shared/libosmocore/build-target/src' > CC gsmtap_util.lo > In file included from ../../src/gsmtap_util.c:37: > /usr/include/netinet/in.h:365: error: expected declaration specifiers or > '...' before '(' token -sh: syntax error: "(" unexpected root@om-gta02 ~/osmocom/src $ /usr/include/netinet/in.h:365: error: expected ')' before '?' token -sh: /usr/include/netinet/in.h:365:: not found root@om-gta02 ~/osmocom/src $ /usr/include/netinet/in.h:366: error: expected declaration specifiers or '...' before '(' token -sh: /usr/include/netinet/in.h:366:: not found root@om-gta02 ~/osmocom/src $ /usr/include/netinet/in.h:366: error: expected ')' before '?' token -sh: /usr/include/netinet/in.h:366:: not found root@om-gta02 ~/osmocom/src $ /usr/include/netinet/in.h:368: error: expected declaration specifiers or '...' before '(' token -sh: /usr/include/netinet/in.h:368:: not found root@om-gta02 ~/osmocom/src $ /usr/include/netinet/in.h:368: error: expected ')' before '?' token -sh: /usr/include/netinet/in.h:368:: not found root@om-gta02 ~/osmocom/src $ /usr/include/netinet/in.h:370: error: expected declaration specifiers or '...' before '(' token -sh: /usr/include/netinet/in.h:370:: not found root@om-gta02 ~/osmocom/src $ /usr/include/netinet/in.h:370: error: expected ')' before '?' token -sh: /usr/include/netinet/in.h:370:: not found root@om-gta02 ~/osmocom/src $ ../../src/gsmtap_util.c: In function 'gsmtap_fd_cb': -sh: ../../src/gsmtap_util.c:: not found root@om-gta02 ~/osmocom/src $ ../../src/gsmtap_util.c:155: warning: implicit declaration of function 'perror' -sh: ../../src/gsmtap_util.c:155:: not found root@om-gta02 ~/osmocom/src $ make[4]: *** [gsmtap_util.lo] Error 1 A google search for "implicit declaration of function 'perror'" made it look like I am missing header declarations included in the "build-essential" packages, but this package does not exist for Om2008.8. I have included my config.log. Any ideas what I am missing? -Alex http://baseband-devel.722152.n3.nabble.com/file/n2851445/config.log config.log -- View this message in context: http://baseband-devel.722152.n3.nabble.com/Osmocom-Freerunner-compilation-i… Sent from the baseband-devel mailing list archive at Nabble.com.

4 5

Wavetek 4201s - GSM Test Set
by Luca Bongiorni 25 Apr '11

25 Apr '11

Hi all, i'm selling my Wavetek 4201s. Unfortunately some days ago i was upgrading the firmware and the power went down. Now it stucks at initializing process. http://tinyurl.com/3dnetqu As you can see was fully working and i used it to make tests with osmocomBB and airprobe. http://tinyurl.com/43exn2s http://tinyurl.com/3qlvz52 As i guess, is possible to repair the corrupted firmware through serial or an internal jtag, unfortunately i have no time to do it and i'm buying another one. I bought it, 3 months ago, fully calibrated and working. (payed 750 €). About the price i thought around 250 euro (because is only a software problem and on ebay is still around 1500 €). About the shipping… will be signed-for (from 4 to 7 days Worldwide), around 30 €. About the payment: Paypal (i'll value other ways, if suggested). What is included: - Wavetek 4201s - Power cable (EU) - Serial Cable - Coupler Antenna R&S CMD-z10 (see here: http://tinyurl.com/3fxf4t8 ) - Manual (IT) - Firmware upgrades by email If someone is interested, please contact me. Thank you for attention Cheers Luca Bongiorni P.S: I apologize for the spam, but i thought that here is the right place to find people with enough skills, time and few money to repair and use it, instead to leave him on the desk and accumulating dust.

1 0

Sniff Tool Development offer
by Marten Christophe 25 Apr '11

25 Apr '11

Hello List, I would like students or free time programmers to develop custom application for sniffing it should be cable for manually entries for (as option of command line) means the tool must be able to tune C131 in Mobile application mode( under full voice function) the desired parameter of user's choice 1 ARFCN 2 TS ( time slot) 3 Hoping sequence it is something we can tune C131 in full voice support to our own choice of AFRCN TS and hopping sequence we must be able to manually enter these parameter while MS is in mobile application mode( DSP in full voice support) I would like you to decide your remunerations /expanses/ development fees. http://bb.osmocom.org/trac/wiki/Sniffing Kind Regards, Maten ========== ======== Hi, Since a lot of people are asking the same questions and there seems to be a rush on the C123 on ebay I tought some clarification is needed. Short version: - The exact tools I used on stage are _not_ and will _not_ be released (or sold ... several people asked ...) - Any one willing to re-code them without any apriori knowledge of GSM would most likely need months to read/understand both the specifications and the way the code works. (That's thousands of page of GSM spec and thousands of line of code) - Osmocom-BB project is not designed to be a sniffer, it's a baseband implementation, I just used part of it as a base. So basically, unless you are really interested in GSM and are willing to dedicate time to understand it deeply and to contribute the various projects, there is not much point in you buying phones, or hanging out in the ml/irc or whatever ... For those who are still reading and interested here's a little more detail: * The HLR query step: -> Go watch the awesome 25C3 talk about it * The TMSI recovering step - Won't be published - If you know how paging works, you know what to do anyway and it's trivial. Method is in the talk, there is nothing to it. * The targeted sniffing application - Won't be published either - Some improvements to the layer23 app frame work will be done but these are generic framework stuff, not app-specific - Again, if you know how L2 works and have looked at several traces, it's obvious what to do. - The 'DSP' part of the sniffer is public for a while with a small demo app (single phone and doesn't exploit the full potential of the DSP patch) and it's perfectly sufficient to debug things on your o wn controlled network. (This is basically what I showed at Deepsec 2010). * The tool to generate the input to Kraken - Won't be published either - Making the guesses is easy for anyone that knows what he's doing. * The improved Kraken - No idea about it, see with Karsten / Sacha / Frank, I only got access to it 1 hour or so before the talk :) * Conversion from burst to audio - This was a hacked software mostly with airprobe code. - The exact app will not be released but I'd like to see the capability put in some clean library we can re-use from airprobe and other application without having to multiply the code each time. - ... But since I'd like it to support AMR and viterbi softoutput before that happens, it could take some time. - Anyone familiar with GSM, airprobe and C could re-hack the same thing in an hour ... As you can see, everything you need to analyze your own network / your own traffic, even at the burst level is already published and has been for more than a month. The other tools have been written only so that we could demonstrate that what we _say_ is possible for about year, we can now do it _practically_. It's apparently needed to get people attentions, "theoretical" attacks are not enough to get the operators / gsma to react. We'll see if that did it ... A few advices that are always good: - Make sure to checkout the a5/1 project ML and airprobe project ML and try to ask your questions in the proper mailing list as much as possible. - Check the wiki and mailing list archives toroughly before asking questions. Cheers, Sylvain Munaut PS: I only posted on this list because it seems a lot of people were pointed here while in fact airprobe would probably be more appropriate to discuss attack scenarios and such, so make sure to answer / start new discussion on the right list.

2 2

buzzer driver
by José Luis Pereira 25 Apr '11

25 Apr '11

Hi all, my name is Jose Pereira, and i'm very interested in helping you with some code! I've wrote the buzzer driver for calypso, not so sure if will help you of anything, but was just for experimenting :) Anyway, i send the patch in attachement. The interface can be simply #include <calypso/buzzer.h> buzzer_mode_pwt(1); buzzer_volume(40); buzzer_note(NOTE(NOTE_E,OCTAVE_5)); Please let me know what do you think of the code, and in what way i can further help. Best regards, -- José Pereira http://onaips.blogspot.com

2 1

Unable to dump traffic with wireshark using C139
by Benedikt Braunger 24 Apr '11

24 Apr '11

Hi, i launched following commands: 1) ./osmocon -p /dev/ttyUSB0 -m c140xor -c ../../target/firmware/board/compal_e86/layer1.highram.bin ../../target/firmware/board/compal_e86/chainload.compalram.bin http://pastebin.com/xcJTuNDF 2) ./mobile -i 127.0.0.1 http://pastebin.com/h3aPFgs1 3) telnet localhost 4247 http://pastebin.com/7nA7KbN8 mobile.cfg: http://pastebin.com/FBM6PCqq unfortunately wireshark 1.5+ devel) or tcpdump couldn't sniff any traffic on lo-interface. can anyone find a missconfiguration? any hint would be awesome! thank you :)

1 0

R: Channel sync error (problem with mobile application)
by screaming-pain＠libero.it 23 Apr '11

23 Apr '11

Hi everybody, I looked a bit more at the code and output of the mobile application, and it seems the problem is that the connection is always dropped because of channel sync failure. Sylvain suggested (to someone having a similar problem) to use the stick option, and actually after trying this, I observed a different behavior it seems the phone performed the identification and the authentication procedures and during a different trial the location update was performed. Can someone explain the stick option? Anyway, I still can't receive or make calls this is what usally happens when trying to make a call <0007> mnccms.c:534 Make call to 150 <0007> mnccms.c:150 support TCH/H also <0007> mnccms.c:174 support full rate v2 <0007> mnccms.c:178 support full rate v1 <0007> mnccms.c:187 support half rate v1 <0005> gsm48_cc.c:496 Sending MMCC_EST_REQ <0004> gsm48_mm.c:3568 (ms 1) Received 'MMCC_EST_REQ' event in state MM idle <0004> gsm48_mm.c:3571 -> substate normal service <0004> gsm48_mm.c:3573 -> callref 8, transaction_id 255 <0004> gsm48_mm.c:2873 Init MM Connection. <0004> gsm48_mm.c:1332 New MM Connection (proto 0x03 trans_id 255 ref 8) <0004> gsm48_mm.c:1291 (ref 8) new state IDLE -> CONN_PEND <0004> gsm48_mm.c:2650 CM SERVICE REQUEST (cause 9) <0004> gsm48_mm.c:2685 -> Using IMSI 234------------- <0001> gsm48_rr.c:4911 (ms 1) Message 'RR_EST_REQ' received in state idle <0001> gsm48_rr.c:4271 Not camping normally, rejecting! (cs->state = 7) <000d> gsm48_rr.c:4241 Establishing radio link not possible <0004> gsm48_mm.c:887 new state MM IDLE, normal service -> wait for RR connection (MM connection) <0004> gsm48_mm.c:3695 (ms 1) Received 'RR_REL_IND' from RR in state wait for RR connection (MM connection) <0004> gsm48_mm.c:1367 Release any MM Connection <0004> gsm48_mm.c:1348 Freeing MM Connection <0004> gsm48_mm.c:1291 (ref 8) new state CONN_PEND -> IDLE <0004> gsm48_mm.c:1055 We are in registered LAI as returning to MM IDLE <0004> gsm48_mm.c:892 new state wait for RR connection (MM connection) -> MM IDLE, normal service <0005> gsm48_cc.c:2122 (ms 1) Received 'MMCC_ERR_IND' in CC state MM_CONNECTION_PEND <0005> gsm48_cc.c:189 (ms 1 ti ff) Sending 'MNCC_REL_IND' to MNCC. <0007> mnccms.c:336 Call has been released (cause 21) Can someone help me with this? I do not understand why is not possible to establish the radio link, and does anyone know where I can find out what 'cause 21' means? Thanks, loretta

1 0

Re: eres de Spain?
by Manuel Borrego 20 Apr '11

20 Apr '11

Sip! Que tal? Pebsaba contactar con los españoles de la lista, pero no he tenido tiempo :P Enviado desde mi iPhone El 18/04/2011, a las 06:55, "Pedro Collado" <edrocoyote(a)yahoo.es> escribió: > por el nombre > >

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

baseband-devel