baseband-devel

baseband-devel@lists.osmocom.org

2022 discussions

administratively down?
by Sebastian --- 06 Jan '11

06 Jan '11

Next Problem: ./mobile says "MS '1' is administratively down". I tried everything..put osmocom.cfg in /etc/osmocom .... How can I bring it "UP"? (Like in Cisco world :)

1 0

HP 8922 at Helmut Singer
by Harald Welte 04 Jan '11

04 Jan '11

Hi, just in case anyone is looking for a HP 8922 MS tester, there is one available from Helmut Singer. It has an 'ok but not ridiculously cheap' price, based on Dieter and my experience. http://www.helmut-singer.de/stock/1552426140.html The 8922 is particularly well suited for layer 1 testing + development. I personally don't have one (only Racal 6103), and don't want to put another 20kg of old measurement equipment in my lab... -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

2 1

IMPORTANT clarifications about 27C3 GSM Sniff Talk
by Sylvain Munaut 01 Jan '11

01 Jan '11

Hi, Since a lot of people are asking the same questions and there seems to be a rush on the C123 on ebay I tought some clarification is needed. Short version: - The exact tools I used on stage are _not_ and will _not_ be released (or sold ... several people asked ...) - Any one willing to re-code them without any apriori knowledge of GSM would most likely need months to read/understand both the specifications and the way the code works. (That's thousands of page of GSM spec and thousands of line of code) - Osmocom-BB project is not designed to be a sniffer, it's a baseband implementation, I just used part of it as a base. So basically, unless you are really interested in GSM and are willing to dedicate time to understand it deeply and to contribute the various projects, there is not much point in you buying phones, or hanging out in the ml/irc or whatever ... For those who are still reading and interested here's a little more detail: * The HLR query step: -> Go watch the awesome 25C3 talk about it * The TMSI recovering step - Won't be published - If you know how paging works, you know what to do anyway and it's trivial. Method is in the talk, there is nothing to it. * The targeted sniffing application - Won't be published either - Some improvements to the layer23 app frame work will be done but these are generic framework stuff, not app-specific - Again, if you know how L2 works and have looked at several traces, it's obvious what to do. - The 'DSP' part of the sniffer is public for a while with a small demo app (single phone and doesn't exploit the full potential of the DSP patch) and it's perfectly sufficient to debug things on your o wn controlled network. (This is basically what I showed at Deepsec 2010). * The tool to generate the input to Kraken - Won't be published either - Making the guesses is easy for anyone that knows what he's doing. * The improved Kraken - No idea about it, see with Karsten / Sacha / Frank, I only got access to it 1 hour or so before the talk :) * Conversion from burst to audio - This was a hacked software mostly with airprobe code. - The exact app will not be released but I'd like to see the capability put in some clean library we can re-use from airprobe and other application without having to multiply the code each time. - ... But since I'd like it to support AMR and viterbi softoutput before that happens, it could take some time. - Anyone familiar with GSM, airprobe and C could re-hack the same thing in an hour ... As you can see, everything you need to analyze your own network / your own traffic, even at the burst level is already published and has been for more than a month. The other tools have been written only so that we could demonstrate that what we _say_ is possible for about year, we can now do it _practically_. It's apparently needed to get people attentions, "theoretical" attacks are not enough to get the operators / gsma to react. We'll see if that did it ... A few advices that are always good: - Make sure to checkout the a5/1 project ML and airprobe project ML and try to ask your questions in the proper mailing list as much as possible. - Check the wiki and mailing list archives toroughly before asking questions. Cheers, Sylvain Munaut PS: I only posted on this list because it seems a lot of people were pointed here while in fact airprobe would probably be more appropriate to discuss attack scenarios and such, so make sure to answer / start new discussion on the right list.

1 0

27c3 videos
by Jason 31 Dec '10

31 Dec '10

I found the videos at [1], but I don't have an iphone... Are the videos available in different formats? Apparently, Apple's HTTP streaming, segmented mpeg-ts is rather new [2] and there isn't much support for it. I found how to create them [3] and code [4] to create the playlist and segments, but nothing on how to play them or cat them back together. I tried using ffmpeg to convert them the mpeg-ps files, then catting them together (from the ffmpeg manual). This worked, except that the audio went out of sync, and every five seconds the screen goes grey because of the original file boundaries. Any pointers? thx, Jason. [1] http://27c3.iphoneblog.de/recordings/3952.html [2] http://tools.ietf.org/html/draft-pantos-http-live-streaming-01 [3] http://www.ioncannon.net/projects/http-live-video-stream-segmenter-and-dist… [4] https://github.com/carsonmcdonald/HTTP-Live-Video-Stream-Segmenter-and-Dist…

2 2

On the gsm positioning faking
by Fabio Pietrosanti (naif) 31 Dec '10

31 Dec '10

Hi guys, i just looked at 27c3 talk on http://27c3.iphoneblog.de/recordings/3952.html (i really wanted to be there!) and heard about the concept of being able to fake gsm based position systems. Which could in theory the distance that could be faked respect to the knowledge that the BTS can acquire? I mean, the modified timing information provided by phone running osmocombb, how many meters distance from BTS could be? -naif

1 0

Fwd: MTK port: Interesting device.
by Andrew 30 Dec '10

30 Dec '10

Hello all. Just back from the hospital, so I haven't followed the development much for some time. Anyway, I've recently stumbled upon an interesting device: https://www.dealextreme.com/details.dx/sku.50391 I think I'll order that one sometime soon, so that I can look at it in more detail. This is a chinese phone with android, but some things make me think that's MTK inside. According to desctiption: ARM926EJ-S rev 5(v5l) BogoMIPS: 207.66 Android 2.2.1 OS system/Wifi(802.11b)/TV/GPS/FM/JAVA Price - 130 bucks. Sounds familiar? Compared to my E1000: ARM926EJ-S rev 5 (v5l) BogoMIPS: 104.24 Twice more Bogomips. The hardware pretty much seems like a typical MTK, and for that price I guess there actually is MTK inside, something a little better than 2635, so the problem is to find the sources somewhere (And my bet is, that if they don't make it to the mainline - they'll leak out to the web) If the chips are pretty much identical, and they are, this might be a good thing. I think I'll buy one after the holiday madness is over and, hopefully, provide teardown photos, firmware dump and more details. Regards, Andrew.

3 2

AW: TODO: OsmocomBB to continually iterate over all cells and dump SI
by Andreas.Eversberg 26 Dec '10

26 Dec '10

> Just to avoid any duplicate of work as well: most of this is already > done by cell_log (layer23/src/misc). It iterates over the whole spectrum > and tries to get an Immediate Assignment by sending a RACH to every cell. > It stores SI1-4, GPS position and the TA in a logfile, and using the > gsmmap utility you can create a *.kml map of the calculated cell > positions for Google Earth. > So what's missing is really only the PCAP support and a command line > switch to turn off the "active" scanning by sending no RACHs. hi steve, exactly. almost everything is already there. there are some things that may need to be improved in my opinion: - deactivating/activating the RACH request - altering maximum distance (gps) moving off the position of last power scan, before restarting scanning process. - multiple radio support for faster scanning and deeper scanning while moving. - selecting between the generic text format and PCAP. - option to wait some more time to receive more system informations than the mandatory 1..4 regards, andreas

2 2

different behaviour when osmocom-bb runs on c155 and c115
by ste7an 24 Dec '10

24 Dec '10

When running the layer23/mobile host application in combination with layer1 firmware on a c115 (compal_e88 based) I can easily connect with a network (when using Sylvain's test trunk, which supports the SIM very well!). However, running the same code on the C155 (compal_e99 based) the phone refuses to connect to the network and keeps scanning ARFCN's. Is there any real difference between these phones except for the LCD's? In rffe_dualband.c I see a remark about the value of SYSTEM_INHERENT_GAIN that has been measured by Harald on the C123. May that be a different value for the C155? Is this a problem observed by others, or is there a workaround?

1 0

can't get SAM7-p64 board into SAM-BA
by Stefan Op de Beek 21 Dec '10

21 Dec '10

I tried to load the dfu.bin+main.bin (=samba) onto the Olimex SAM7-P64 board. I connected jumper TEST for >10s, disconnected power, reconnected power. I assume that it is possible now to upload firmware using sam-ba (i tried both linux and windows) over the USB port. Even trying to connect through the dbg serial port failed. Is there something wrong with the board or in the procedure I follow. Should I see a USB-CDC serial port when the SAM7 is running the SAM-BA bootloader? Any comments would be appreciated.

2 1

Working on the documentation...
by Holger Freyther 21 Dec '10

21 Dec '10

Hi all, I have started a GettingStarted[1] page to cover the topics of getting the code, getting an ARM toolchain and pointing to the osmocon and layer23 pages for the details. I was also going through the search to update the names of the firmware binaries. The CalypsoRomloader[2] page deserves an update as well. It is referring to the GTA0X but then tries to flash a nonexistent E88 binary. I am not sure what to turn this page into. Do we also have a list of Milestones we want to accomplish (besides merging the sending code to master)? Do we have junior tasks for people that would like to get started on target and host firmware? regards z. [1] http://bb.osmocom.org/trac/wiki/GettingStarted [2] http://bb.osmocom.org/trac/wiki/CalypsoRomloader

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

baseband-devel