5 Apr
2016
5 Apr
'16
8:59 a.m.
Dear all
I'm an independent mobile security researcher and coder from Italy
(therefore, forgive me if my English will cause you a
headache), I've been reading GSM specs for quite a few months now and
studying openbts, yatebts and osmo* source code for a few days due to a
GSM related project I'd really like to realize.
I have few questions to ask, but first let me explain my main objective.
I'm working on something like ScaPy ( an ip packet injection and
manipulation framework ) but for GSM, on a higher level what I want to
create is a C library which would allow developers to do something like
(forgive the pseudo-crappy programming and the oversimplification, I
just want to highlight what I'm looking for):
Passive / Sniffing concept:
open(sdr-device)
while(running) {
data = read_and_demodulate
burst = osmo_something_decode(data)
dump(data)
}
close(sdr-device)
Injection concept:
imsi = "1234456..."
open(sdr-device)
data = osmo_encode_packet( IMSI_DETACH, imsi )
osmo_write( sdr-device, data )
close(sdr-device)
( I know I'm not considering synchronization, not really interested in
that, the user would implement his own logic )
My point is that GSM is not "that hard" with the right tools, but
currently there're no such tools and I think it's such a shame because
it should be open to the users exactly as TCP/IP is.
Now to the questions:
A. Is the low-level communication ( from raw to basic demodulated bursts
) with SDR devices still handled by omso-bts-trx? If not, what's
handling the physical layer?
B. Could you point me to the right direction I'd need to take in order
to extend the code to support Nuand's BladeRF devices ( the only one I
have and the only one I can afford right now )?
C. Do you have simple (even incomplete) code examples for both the
"concepts" I've exposed ? I find your documentation to be really great,
but for higher level understanding people need usage examples.
Any piece of code, reference link, guidance, answer or whatever info
will be great.
Thanks,
Simone 'evilsocket' Margaritelli