baseband-devel

baseband-devel@lists.osmocom.org

2022 discussions

Re: C139: get ftmtoolerror from ramloader
by Dieter Spaar 19 Mar '10

19 Mar '10

Hello Erik, On Fri, 19 Mar 2010 07:42:06 +0100, "Erik Ekman" <yarrick(a)kryo.se> wrote: > > I did some more research and it seems even the unlocking people are > having the same problems here. So I will just wait for my other phone. I do have one C139 here, it works with the "board/compal_e88/hello_world.bin" firmware and the "-m c123xor" option for "osmocon", however without the display working (its a different display). If I boot the normal phone firmware, I also see some output and have the same "AT" behaviour you reported. But maybe there are different versions of the C139 so that some work and others don't. Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

2 1

C139: get ftmtoolerror from ramloader
by Erik Ekman 19 Mar '10

19 Mar '10

Hi I just got my cable and am trying to download any code into a C139 (tracfone software, bought from usa on ebay). This is what I get: $ ./osmocon -m c123 -p /dev/ttyS2 compal_dump.bin waiting for data got 7 bytes from modem, data looks like: 66 74 6d 74 6f 6f 6c Received FTMTOOL from phone, ramolader has aborted got 1 bytes from modem, data looks like: 65 got 1 bytes from modem, data looks like: 72 got 1 bytes from modem, data looks like: 72 got 1 bytes from modem, data looks like: 6f got 1 bytes from modem, data looks like: 72 ^C

2 2

layer23 : writing msgb to gsmtap fd: Connection refused
by nicolho 19 Mar '10

19 Mar '10

hi, i get errors "writing msgb to gsmtap fd: Connection refused" with layer23 app (see output below). any idea/explanation ? nico nico@debian:~/phone/osmocom-bb/src/host/layer23/src$ ./layer23 -a 4 -i 127.0.0.1 Layer1 Reset. Sending: '01 00 00 00 00 00 04 00 ' SCH: SNR: 6 TDMA: (0609/08/01) bsic: 14 SCH: SNR: 34 TDMA: (0609/18/11) bsic: 14 SCH: SNR: 5 TDMA: (0609/02/21) bsic: 14 SCH: SNR: 218 TDMA: (0609/12/31) bsic: 14 SCH: SNR: 42 TDMA: (0609/22/41) bsic: 14 SCH: SNR: 252 TDMA: (0609/07/01) bsic: 14 SCH: SNR: 148 TDMA: (0609/21/41) bsic: 14 SCH: SNR: 138 TDMA: (0609/06/01) bsic: 14 SCH: SNR: 229 TDMA: (0609/16/11) bsic: 14 SCH: SNR: 203 TDMA: (0609/00/21) bsic: 14 SCH: SNR: 178 TDMA: (0609/10/31) bsic: 14 SCH: SNR: 210 TDMA: (0609/20/41) bsic: 14 BCCH (0609/06/02) 55 06 19 00 00 00 00 00 00 00 00 00 01 ff ff fe 00 00 08 79 00 00 2b l2_ph_data_ind() fmt=Bbis UI RSLms UNIT DATA IND chan_nr=0x80 link_id=0x00 SI1 RACH Req. Sending: '04 00 00 00 00 00 00 00 00 00 ' PCH/AGCH (0609/10/06) 2d 06 22 00 90 17 82 65 6c 10 f4 68 2b 2b 2b 2b 2b 2b 2b 2 b 2b 2b 2b l2_ph_data_ind() fmt=Bbis UI RSLms UNIT DATA IND chan_nr=0x90 link_id=0x00 writing msgb to gsmtap fd: Connection refused PCH/AGCH (0609/16/12) 25 06 21 00 05 f4 9c 04 25 d1 2b 2b 2b 2b 2b 2b 2b 2b 2b 2 b 2b 2b 2b l2_ph_data_ind() fmt=Bbis UI RSLms UNIT DATA IND chan_nr=0x90 link_id=0x00 PCH/AGCH (0609/20/16) 15 06 21 00 01 00 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2 b 2b 2b 2b l2_ph_data_ind() fmt=Bbis UI RSLms UNIT DATA IND chan_nr=0x90 link_id=0x00 writing msgb to gsmtap fd: Connection refused BCCH (0609/05/02) 59 06 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 ca c1 c5 0f 79 00 00 l2_ph_data_ind() fmt=Bbis UI RSLms UNIT DATA IND chan_nr=0x80 link_id=0x00 SI2 RACH Req. Sending: '04 00 00 00 00 00 01 00 00 00 ' PCH/AGCH (0609/09/06) 15 06 21 00 01 00 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2 b 2b 2b 2b l2_ph_data_ind() fmt=Bbis UI RSLms UNIT DATA IND chan_nr=0x90 link_id=0x00 writing msgb to gsmtap fd: Connection refused PCH/AGCH (0609/15/12) 15 06 21 00 01 00 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2 b 2b 2b 2b l2_ph_data_ind() fmt=Bbis UI RSLms UNIT DATA IND chan_nr=0x90 link_id=0x00 ...

3 2

Re: AW: SIM card cuttingg
by Dieter Spaar 19 Mar '10

19 Mar '10

Hello Andreas, On Thu, 18 Mar 2010 10:41:32 +0100, "Andreas.Eversberg" <Andreas.Eversberg(a)versatel.de> wrote: > > i prefer the CNC machine solution. it looks pretty easy to me. in my > example white = fully cut out. black = no cut, light gray = more > deep , dark gray = less deep. Looks good, do you have access to a CNC machine and what costs would you expect for a prototype ? Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

2 1

Calypso DSP reverse engineering front ...
by Sylvain Munaut 19 Mar '10

19 Mar '10

Hi, I've been slowly working on the DSP code for some time now and I tought I'd post a status here in case other people are interested. The ultimate point of this is to add support for things the DSP isn't supposed to do. Like receiving the raw demodulated data without the deciphering / fire code / whatever. Or dealing with raw speech data ... sending other type of burts like SCH / FCCH, or receiving other type of bursts like RACH, ... The DSP ROM dumper has been present for a while but there was no way to really use the output efficiently. For that, I've written a parser that takes the console log output and converts it into a COFF file that you can load in your favorite disassembler. I've been working with IDA 5.6 mostly and I made several enhancement to it to support the calypso better (the tms320c54 module is part of the SDK and can be modded and recompiled) : - Add support for memory mappings so that the same memory zone can 'appear' at several place in the address space (to handle data & code overlay) - Fix the section handling when loading a file: . to set XPC properly, . to not override section name . to support more than 2 sections - Fix a bug in cross reference detection when dealing with section having selectors != 0 - Add stub support for the type system. This allows loading of a .h header file with the NDB structure definition - Add definition for the IO ports so that they are symbolically displayed Here's a sample results of what it looks like now (without much manual fixups, just loading the files and declaring a couple addresses as being structures) : http://www.246tnt.com/files/calypso_dsp_ida_sample.png It becomes clear what function does what :) I'll try to push a maximum in my dsp branch tomorrow. I can't put the IDA processor module modification because even just the patch contains some hex-rays code, so I guess I'll have to ask them permission on a case by case basis to distribute it. (just ask me privately and we'll work it out) Cheers, Sylvain

3 4

Two more small patches
by Erik Ekman 19 Mar '10

19 Mar '10

Hi Found a spelling error while testing my C139, and also fixed the warning discussed in my earlier patch. /Erik

2 1

Regarding the cable from Dealextreme
by Dieter Spaar 19 Mar '10

19 Mar '10

Hello, Just a note about the RS-232 cable from Dealextreme: http://www.dealextreme.com/details.dx/sku.14664 This is a direct connection cable, this means that there is no level-converter between the phone and the RS-232 port from the PC. Despending on the RS-232 port of the PC, I would expect that this can/will damage the phone. I have one of those cables here and can confirm that there is no level-converter in between. Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

3 3

Re: SIM: File structure.
by Dieter Spaar 19 Mar '10

19 Mar '10

Hello Sebastien, On Thu, 18 Mar 2010 12:17:18 +0100, "=?UTF-8?Q?S=C3=A9bastien_Lorquet?=" <squalyl(a)gmail.com> wrote: > > The SIM obviously relies on a filesystem. Some files are defined as > mandatory in TS11.11, so I will include them, but their size is not always > fixed. I'm opening this thread to define this kind of information. Maybe useful: https://sites.google.com/site/savolabs/Home/tools Its about a tool (SIMbrush) to extract all EFs from a SIM. Besides the source code there is also a PDF file with the results from scanning a standard SIM, it contains the file size for the EFs of the scanned SIM. Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

1 0

SIM: File structure.
by Sébastien Lorquet 18 Mar '10

18 Mar '10

Hi all, I'm making progress on the SIM/Filesystem applet. Data access commands are working, I'm now working on writing commands that send replies formatted as defined in TS 11.11 instead of FCI responses. I need input from you: I'm only a "smart card" guy, I can do "whatever is needed", but I need to define *what* is needed with you. I know especially nothing about GSM itself except that the MS talks with the SIM to manage cryptography, store SMS and phonebooks entries, etc. The SIM obviously relies on a filesystem. Some files are defined as mandatory in TS11.11, so I will include them, but their size is not always fixed. I'm opening this thread to define this kind of information. -what should be the N value for files whose size is defined by "3*N, N>=4"? -what optional files will be needed when the layer 2-3 will be ready to talk with the SIM? I let you read the TS11.11 spec to make your choice. Thanks, Sebastien

1 0

AW: SIM card cuttingg
by Andreas.Eversberg 18 Mar '10

18 Mar '10

hi, i prefer the CNC machine solution. it looks pretty easy to me. in my example white = fully cut out. black = no cut, light gray = more deep , dark gray = less deep. two thick metal peaces are cut from a metal band. the left one has partly cut out path for the frame to cut from the card. the right one has partly cut out area to carry the card. the frame is lower than the border, so the card will be positioned before it is cut out. hole in the left plate (white dots) will help to remove the plastic inside the frame path. andreas

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

baseband-devel