21 Oct
2010
21 Oct
'10
10:44 p.m.
Hi,
Hello Deiter ,Sylvian
btw, it's Dieter and Sylvain :)
I just want to know one thing that is , during the
channel request MS
send burst on RACH with RA ref number, where this RAF or RA reference
number stored on MS side
In the 'mobile' application (full phone stack), it's kept in a cr_hist
(Channel request history) list in gsm48_rr.c
In the test 'layer23' application, it's not stored and we just follow
the first assignement we see (which on a real network is probably not
ours).
, because when Immediate assignment send
from the network it must be match before tuning to particular SDCCH, i
want to apply a trick here i will copy the RA reference from the
immediate assignment message and will replace with original one stored
in MS, hence MS will think this channel is for me and tune to the
SDCCH accordingly, further it will keep on listening all process like
authentication, location updating
I assume you're talking about the 'mobile' application.
If you have TX enabled, all it's gonna do is jam the other mobile,
preventing any kind of traffic ... (because you'll TX at the same time
as the 'real' phone to which the assignement was for.
For this kind of work you shouldn't use the 'mobile' application stack
and just hack a small program like 'layer23' does.
kindly tell me if it is feasible , or there is more i
need to think.
Well you obviously missed a big point : You _shouldn't_ use the
'mobile' stack at all and just rewrite everything above l1ctl for your
own app ...
Cheers,
Sylvain