Problem with decoding. - baseband-devel

15 Feb 2012

Hello.

I'm trying to figure out what am i doing wrong for days, and i can't. I'm
doing GSM security research for my university.

I sniffed A5/1 encrypted bursts of my mobile phone with known KC. The
example of burst output is below(C-cyphertext, P-plaintext, F- decoded
data):

...
  C 2310735

111000010011011101110001010111110100001010101111110001110100011010011011101100101100010010011011010100101111100111
 P 2310735

100000000001110111010100000000000001000011011101000000001000000000010101110100000100000010000101010111010101000010
 C 2310736

101110101001101010010111111111101010111001111001001110011000011111011001010010010111110010010000111000111011100011
 P 2310736

101011111111010101010001100000101010111111010101000100001010111110111101110100010010100010111011111101010001001010
 C 2310737

100011010101111101001111011110111010100001010010100010010110000010111110001011010010100111101000011110010100100101
 P 2310737

000100010111010100010000101000010100011101010000000010100001000101110101010000000000100001000111010101000000001010
 C 2310738

100011100100110101110100001001001111110110110000001101100110001101100011011000011011111111011100101110100000101111
 P 2310738

010100001000101011101101010101010100001010111111110101110100000010101010101011010101010100001000101010101101110101
 F 1 22 9 6 32 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b
 C 2310752

110011010101101010011000000101011010111000001111110111011101011010111101110101000101101001110001000000100000101011
 P 2310752

111000101001100101011000011010100001110010100101111101010011000111000111011100110001111110111100000111110100000101
 C 2310753

011010111101000101101001001111001001100001101010001011110111011000010101100001000100101010100110110100001000110111
 P 2310753

000011111011011101100101100000101011111000100110110001010110010011101111111011000000110010011110001011011000010010
 C 2310754

011011000011001100000110001110000011010100000101100000011111101100101000011001001010100001011100001011111011001011
 P 2310754

100000010010110101010001101110110100000110011101010111100010100000001001010101011001001001100010101101110100101010
 C 2310755

001001010111101010011010100110100011101001010101010010001011111101001000000111101101001011001111001001010001010011
 P 2310755

111001001001100011101001100100110100100000110010100110011101010000101010010010101011010001011000000001001100101111
 F 5 3 3 3 2d 6 1e 7 1e 92 f3 14 0 3b 97 88 2b 2b 2b 2b 2b 2b 2b 

As you can see frames are decoded correctly and they are correctly
displayed in wireshark.

If i put XOR-ed value betwene cyprtext and plaintext-> keystream to kraken,
i don't get any usefull results only the ones that do not produce correct
KC. i calculate frame count correctly, because i test it with data from
http://lists.lists.reflextor.com/pipermail/a51/2010-July/000803.html.
Kraken works correctly for me since i can get correct kc with keystream
from http://lists.lists.reflextor.com/pipermail/a51/2010-July/000688.html.

The ouput bursts in example above are written using following lines of code:
        for (i=0; i<57; i++)
                fprintf( app_state.fh, "%d", bt[i] );
        for (i=59; i<116; i++)
                fprintf( app_state.fh, "%d", bt[i] );
where bt is generated using:
        osmo_pbit2ubit_ext(bt,  0, bi->bits,  0, 57, 0);
        osmo_pbit2ubit_ext(bt, 59, bi->bits, 57, 57, 0);

Can you help me identify why can't i correctly crack bursts?

Thanks!