osmocombb+c118 gsm-sniffer:
youtube:
https://youtu.be/ZDToZIYHmJM
blog:
http://gsmsuperben.blogspot.my/2016/07/osmocombbc118-gsm-sniffer.html
System :
ubuntu12.04-i386(or kali)
一:update system
update(or vi /etc/apt/sources.list )
settings
Inside find software update source download from modifying their own country
Then save the exit
now open terminal
$ sudo apt-get update
$ sudo apt-get upgrade
二:Then install a series of dependency
$ sudo apt-get install libusb-0.1-4 libpcsclite1 libccid pcscd
$ sudo apt-get install libtool shtool autoconf git-core pkg-config make gcc
build-essential libgmp3-dev libmpfr-dev libx11-6 libx11-dev texinfo flex
bison libncurses5 libncurses5-dbg libncurses5-dev libncursesw5
libncursesw5-dbg libncursesw5-dev zlibc zlib1g-dev libmpfr4 libmpc-dev
libpcsclite-dev
(copy)
三:Create several directories , download ARM compiler
$ mkdir osmocombb
$ cd osmocombb
$ mkdir build install src
$ cd src
$ wget ftp://sources.redhat.com/pub/newlib/newlib-1.19.0.tar.gz
四:install gnu-arm-build.3.sh
$ cd ..
$ chmod +x gnu-arm-build.3.sh
$ ./gnu-arm-build.3.sh
See here you can directly enter
五:After you install the add environment
$ cd install/bin
$ pwd
$ vi ~/./. bashrc
export PATH=$PATH:/osmocombb/ install/bin
$ source ~/.bashrc
六:Download and compile osmocomBB
back osmocombb download osmocom
$ git clone git://git.osmocom.org/libosmocore.git
$ git clone git://git.osmocom.org/osmocom-bb.git
When installing libosmocore execute ./configure many people will encounter
No package 'talloc' found such a mistake , because they can not talloc, Here
is the solution
$ wget https://www.samba.org/ftp/talloc/talloc-2.1.7.tar.gz
$ tar -zxvf talloc-2.1.7.tar.gz
$ cd talloc-2.1.7/
$ ./configure
$ make
$ sudo make install
install libosmocore
$ cd libosmocore/
$ autoreconf -i
$ ./configure
$ make
$ sudo make install $ cd ..
Compile osmocombb
$ cd osmocom-bb
$ git checkout --track origin/luca/gsmmap
$ cd src
$ make
七:Modify the problem file ( if you are gnu-arm-build.2.sh and no cell
scanning immobile problem , skip this step )
Enter osmocom-bb find these files and modify them
vi osmocom-bb/ src/target/firmware/board/compal/highram.lds
vi osmocom-bb/ src/target/firmware/board/compal/ram.lds
vi osmocom-bb/ src/target/firmware/board/compal_e88/flash.lds
vi osmocom-bb/ src/target/firmware/board/compal_e88/loader.lds
vi osmocom-bb/ src/target/firmware/board/mediatek/ram.lds
Found inside this string of code
KEEP(*(SORT(.ctors)))
In the following is added
KEEP(*(SORT(.init_array)))
Listed as:
To save , all changes well in entering osmocom-bb / src recompile
$ make -e CROSS_TOOL_PREFIX=arm-none-eabi-
八:Insert your brush into the firmware 118
in osmocom-bb directory
$ cd src/host/osmocon
$ sudo ./osmocon -m c123xor -p /dev/ttyUSB0
../../target/firmware/board/compal_e88/layer1.compalram.bin
Enter appear so wait when you click c118 power button , click on it
If this is the brush into failure , look at your c118 cable, if you are
buying a new phone line proposed to insert a little tight . . Best to shell
removed
九:Scanning station information
Open a new terminal or in osmocom-bb directory
$ cd src/host/layer23/src/misc
$ sudo ./cell_log -O
Then enter
$ sudo ./ccch_scan -i 127.0.0.1 -a ARFCN
ARFCN is circled out above that value , such as column
$ sudo ./ccch_scan -i 127.0.0.1 -a 59
十:install wireshark
Open a new terminal
$ sudo apt-get install wireshark
$ sudo wireshark -k -i lo -f 'port 4729'
In the filter input gsm_sms Then quietly wait for it。。。
--
View this message in context: http://baseband-devel.722152.n3.nabble.com/smocombb-c118-gsm-sniffer-tp4026…
Sent from the baseband-devel mailing list archive at Nabble.com.
I have fernvale-nuttx running on a couple of MTK6260-based watch phones and plan on working on porting layer1 to these devices.
https://www.kosagi.com/forums/viewtopic.php?id=407
I saw the most recent activity on nuttx-bb seems to be http://cgit.osmocom.org/nuttx-bb/log/?h=gnutoo/layer1-2015-wip
wondering if anyone else is working on this elsewhere that we can coordinate?
If there are any particular suggestions/hints/warnings please chime in so I make better progress and have less trouble when I submit pull requests and such.
Cheers,Craig
Greetings,
I have been working with OsmocomBB with C155 model.
After a lot of reading and understanding issues on mailing list, following
the right instructions I am unable to understand where the problem is -
cable or the locked tracfone C155 or my setup.
I was successfully able to build the project.
I am stuck on executing the following command
~/osmocom-bb/src/host/osmocon# ./osmocon -p /dev/ttyUSB0 -m c155
../../target/firmware/board/compal_e99/layer1.compalram.bin
<No output at all>
<Even on slight push on power button no output>
Please find my specifications and findings below:
1. C155 locked tracfone.
2. FTDI adapter USB serial from - Fonefunshop
Is there a way to test the FTDI adapter ?
dmesg - list that FTDI adapter attached to ttyUSB0.
FTDI VCP driver is built into the Linux kernel. Do I need D2XX driver ?
3. I'm trying to write the firmware (layer1) with a working GSM sim inside
and not tracfone sim card.
4. strace gives me no trouble other than this access("/etc/ld.so.nohwcap",
F_OK) = -1 ENOENT (No such file or directory) - Is it a worry ?
5. When I execute ./osmocon with all necessary params.
I open a new console and type the following ./osmoload memdump 0x000000
0x2000 dump. - Is this valid at this point? just to see where the actual
firmware is located at?
Dumping 12288 bytes of memory at 0x0 to file dump - Nothing gets dumped into
file dump
Although, I see some output - 'got 2 bytes from modem... ' in the osmocon
window - ./osmocon
It would be very kind if someone could guide me.
How do I verify there is a cable issue <Any software to test TX> since I
have bought these and if not the cable them am I doing something wrong ?
Looking forward to the reply!
Thanks,
Gerard.
--
View this message in context: http://baseband-devel.722152.n3.nabble.com/OsmocomBB-C155-stuck-at-flashing…
Sent from the baseband-devel mailing list archive at Nabble.com.
Hi,
My advice you is to stop waiting for someone, who will help you.
Just try to dig into the source code yourself, it's interesting!
And in case of any successes, patches are welcome.
With best regards,
Vadim Yanitskiy.
Hey, I finally watched Nico's talk "let me answer that for you" and heard him say he ported layer2/3 to target.
Also found a mailing list message about him cleaning it up and putting it up on git and sending it to a few folks.
Did that code ever get shared? Would be cool to play around with and is certainly something I would eventually want to accomplish for my project of making a phone that works by itself.
-Craig
Dear all,
I have been testing the mobile app for some time but I faced a small problem where not all my sim cards work fine when listening to paging messages. I have seen the patch presented by Harald Welte and I printed the value of ‘tn’ and found out that it is always 0 whatever the IMSI of the sim card is. Did I miss something or is the paging group part still not implemented in the mobile app.
I really appreciate any help.
Hi Robert,
There are many possible issues, which can cause your problem.
So, it would be good to see more details. Please, prepare two
measurements using cell_log application: one inside any
building, and another one outside. Attach both outputs from
the cell_log and from the osmocon.
I have several phones, and some of them have different RX
signal level. I think, it's due to individual calibration
tables, which aren't used in OsmocomBB firmware.
BTW: if your phone's case is open, make sure that antenna is
connected to the phone's board.
With best regards,
Vadim Yanitskiy.
Hi,
when using the mobile app I cannot connect to the BTS unless I get my phone outside any building, although when using the original firmware I can connect from inside my room. Is there a way to increase the sensitivity of the phone ?