brmlab project:gsm

project:gsm:gsmstack-doc

Anonymous (anonymous@undisclosed.example.com) — 2015-12-06T19:05:17+00:00

1382390964	current
Line 1:	Line 1:
	+	<note warning>This is outdated. We are working hard on getting this project finished (ETA Christmas 2013).</note>

	+	<note tip>It seems that nobody cares about "ETA Christmas 2013". (--Christmas 2015)</note>
	+
	+	brmlab GSM stack is similar to ccch_scan, but should implement the following two important features:
	+	* use "sendfifo" to inject a hopping sequence into a running sniffer - to sniff calls after you cracked the key
	+	* use master-slave architecture to sniff multiple parallel conversations on one BTS - one phone camps on BCCH and instructs other phones to go to CCCH
	+
	+	It used to work, but now it is broken.
	+	* Hopping channels don't work at all. Like if you have an immediate assignment to a hopping CCCH, you won't sniff anything.
	+	* The slave takes several frames to sync, so you lose valuable known plaintext. This could be fixed by pre-syncing slaves.
	+
	+	Despite having my e-mail address in AUTHORS file, I will not support this thing anymore. Use [[user:jenda:gsm\|gsmtk]] or try to work this out.
	+
	+	<code>
	+
	+	Quick start guide to this distribution
	+
	+	***
	+
	+	What you will need
	+
	+	+ A Linux distribution (tested Debian Wheezy and Fedora on x86 and amd64)
	+	+ there used to be "recent" here, but it was here for several years, so "recent" is not required anymore
	+	+ An osmocom-compatible phone (Motorola Cxxx) or modem (openmoko/freerunner) and serial interface to it
	+	+ Wireshark 1.8.0 or newer
	+	+ ~600 MB of disk space
	+	+ 1337 h4x1n9 skillz
	+
	+	It would be nice to have
	+	+ More phones
	+	+ Uplink filters removed
	+	Phones have bandpass filter that they don't receive uplink well (only 10-30 metres).
	+	http://bb.osmocom.org/trac/wiki/Hardware/FilterReplacement
	+	+ Access to a fast A5/1 cracker (demand 1s/burst throughput and 10s latency :)
	+	It is possible to do some work on desktop with 2TB harddrive, but it's extremely slow.
	+	+ Genuine brmbora™ hardware with Next-Businness-Day support
	+
	+	The compilation of all sources will take several minutes on a modern Core i* computer or 2 hours on Intel Atom netbook.
	+
	+	***
	+
	+	OsmocomBB firmware
	+
	+	http://bb.osmocom.org/trac/wiki/GettingStarted
	+
	+	+ Install ARM toolchain. The phone is an arm, so we will crosscompile on our x86.
	+	+ git clone git://git.osmocom.org/osmocom-bb.git
	+	+ git checkout sylvain/burst_ind
	+	this branch has patched DSP so it allows us to sniff traffic off-the-air
	+	+ make
	+
	+	***
	+
	+	Installing other tools
	+
	+	+ Copy mysrc/.omgsm to ~
	+	+ edit ~/.omgsm/config and ~/.omgsm/phones
	+	GSMPATH=path to this
	+	GSMDEFSESSION=where sniffed data are stored (usually several MB per hour)
	+	GSMMAXCELLS=when scanning for BTS, pick N strongest
	+	GSMKRAKENHOST,GSMKRAKENPORT=where your A5/1 cracker lives
	+	they tend to listen only on localhost, so try ssh -L 6666:localhost:6666
	+	GSMBRMBORACTL=where brmbora™ conTROLLer is
	+	leave blank if you don't have a brmbora™ genuine device and order on at shop.brmlab.cz
	+	GSMSESSION=current session, will be set automatically on first run
	+	+ cd mysrc; make
	+	+ Kraken will tell you the secret state at some round of A5/1 keystream generator. You need something to backclock (revert and extract original key) the cipher. Use find_kc from Kraken-Utilities patched with our version to support uplink.
	+	git clone git://git.srlabs.de/kraken.git
	+	cd kraken/Utilities
	+	cp mysrc/find_kc.cpp .
	+	make find_kc
	+	deposit the binary to GSMPATH/kraken/Utilities/
	+
	+	***
	+
	+	Initializing hardware
	+
	+	Check scripts in bin/
	+	+ gsm_init_hw.sh
	+	+ Without a brmbora™ genuine device you need to press button on your phone.
	+	+ You should see the firmware loading. The correct output should have the following features:
	+	Received PROMPT1 from phone, responding with CMD
	+	read_file(../../target/firmware/board/compal_e88/hello_world.compalram.bin): file_size=27192, hdr_len=4, dnload_len=27199
	+	Received PROMPT2 from phone, starting download
	+	handle_write(): finished
	+	Received DOWNLOAD ACK from phone, your code is running now!
	+	LOST nnnn!
	+	If it got stuck before the "LOST" message, try again. Contact your brmbora™ authorized reseller in case of problems.
	+
	+	***
	+
	+	Initianing a new session, scanning BTS
	+
	+	+ gsm_bts_scan.sh
	+
	+	***
	+
	+	Investigating the SESSION direstory
	+
	+	arfcn - what channels we will sniff on
	+	new/ - captured data
	+	tmsi2bursts.txt - phones seen on air and their data
	+
	+	***
	+
	+	Start sniffing
	+
	+	gsm_start_sniff.sh
	+
	+	Some .dat files should appear in SESSION/new/. They are usually 5-15 kB each.
	+
	+	FIXME We now have better sniffer using master-slave architecture useful if you have 4+ phones. See bin/gsm_spawn_master_slave.sh for more info.
	+
	+	***
	+
	+	Viewing sniffed data with Wireshark
	+
	+	iptables -A INPUT -p UDP --dport 4729 -j DROP
	+	# we will send dummy packets and kernel will reply with ICMP port unreachable
	+
	+	start Wireshark on localhost
	+
	+	gsm_convert -f SESSION/new/file-to-view.dat -d
	+	will convert data to GSMTAP frames and send them to Wireshark
	+
	+	Some packets should appear in Wireshark: http://bb.osmocom.org/trac/wiki/WiresharkIntegration
	+
	+	***
	+
	+	Cracking your own data from your very own phone of course!
	+
	+	Use napalmex.py for a statistical keystream guesser with up to 100% efficiency on less-secure networks and ability to crack about 50% of traffic even on secure networks!
	+
	+	***
	+
	+	Viewing cracked data
	+
	+	start Wireshark on localhost
	+
	+	gsm_convert -f SESSION/new/file-to-view.dat -k KEY
	+
	+	Interesting .dat files are the bigger ones (10kB). Interesting frames are "GSM-SMS CP-DATA".
	+	See gsm_evenlog.sh for tips how to extract phone numbers, SMS messages etc.
	+	See this link for guessing which types of communication are in the file even berofe it is cracked:
	+	http://jenda.hrach.eu/brm/sms_analysis.png
	+	</code>

Efficient plaintext guessing HOWTO

Anonymous (anonymous@undisclosed.example.com) — 2021-03-31T20:41:31+00:00

1457390416		current
Line 3:		Line 3:
	This page describes a more efficient approach to guess known plaintext for known plaintext attacks in GSM networks.		This page describes a more efficient approach to guess known plaintext for known plaintext attacks in GSM networks.

-	Some of it is implemented in tkgenstat.pl/tkconvert/tknapalmex of [[:user:jenda:gsm\|gsmtk]]	+	Some of it is implemented in tkgenstat.pl/tkconvert/tknapalmex of [[https://jenda.hrach.eu/w/gsm\|gsmtk]]

	===== Naive approach =====		===== Naive approach =====

OsmoBOX, the ultimate Osmocom phones driver

Anonymous (anonymous@undisclosed.example.com) — 2013-01-12T05:23:33+00:00

1347109956	current
Line 1:	Line 1:
	+	===== OsmoBOX, the ultimate Osmocom phones driver =====
	+
	+	==== Abstract ====

	+	This document describes implementation of a "GSM Box" - an inconspicuous box that looks like an external USB harddrive, that actually contains 4 or 8 OsmocomBB phones and a watchdog that automatically loads supplied firmware and resets phones when the firmware freezes. Additional hardware is a wideband GSM amplifier to catch traffic even from more distant handsets (work in progress). Cirtuit diagrams, board design, source code and CAD files are provided under GPL.
	+
	+	Designing of this box showed to be a non-trivial engineering problem, so we hope releasing this material will save others people time and energy by avoiding them from making common pitfalls.
	+
	+	==== Preparing the phone ====
	+
	+	Decap everything, later you can also strip (using a knife and moderate force) the display and LEDs to conserve power.
	+
	+	Use a sharp knife to remove the round metal plate from the power button.
	+
	+	If you don't want to bother with these 2.5mm jacks, you can either strip the 2.5mm jack connector at all (you will then need to solder to small soldering pads) or better cut the upper half of it. Use a sharp knife, little pliers or a tweezer. See, what happens when you plug in the jack (i.e. what contacts are shorted) and short them too.
	+
	+	{{ :project:gsm:jack.jpg?200 \|}}
	+
	+	Use sandpaper and then tin the inner circle of the button, battery terminals, ground contact of the pager motor and the serial port pads. Use as much soldering flux as possible.
	+
	+	{{ :project:gsm:overall.jpg?200 \|}}
	+
	+	Then solder your favorite 5-pin (button, GND, Vcc, Rx, Tx) connector. For our first prototype we used [[http://frontx.com/cpx512.html\|header and female cable connector for it]] and it sucks. Visit your local electro store and look for something better.
	+
	+	==== The Phone ====
	+
	+	A c123xor phone has the following interesting terminals:
	+
	+	* BAT+ terminal (inner)
	+	* BAT- terminal (outer)
	+	* Common ground (COM) (shielding, outer JACK connector and almost all ground plate on PCB)
	+	* 3.3V serial port in an audio jack. Phone's Tx is white cable on the photo above, Rx is blue.
	+	* Power button (red one)
	+
	+	Under normal operation, common ground is at +0.6V (given BAT- as a reference). This means that BAT- is not connected with the serial port GND. However, we are powering the phone from an external 4.3V power supply and we shorted BAT- with COM and it wowks fine. Mechanically, this can be best done by connecting BAT- with "-" terminal of the pager motor. Multimeter is your friend.
	+
	+	==== Pressing the power button ====
	+
	+	Unpressed button = the inner circle is electrically floating.
	+
	+	Pressed button = the inner circle is grounded (LOG0).
	+
	+	==== Powering the phone ====
	+
	+	When you have the serial connected, the phone is automatically grounded (when powering it from USB and using FTDI, V- is connected to serial GND). However, as this grounds only COM and not BAT-, some features (especially buttons) don't work. This is why you need to short COM and BAT-.
	+
	+	We finally (after several nights of debugging) settled on the following schematics that seems to be working now.
	+
	+	{{ :project:gsm:one_driver.png?200 \|}}
	+
	+	The Darlington switch is actually ULN2003A. Single NPN transistor could be used too (peak current is about 200mA), FET probably too. Using Darlington has one disadvantage - the whole phone is at +0.6 (single silicon junction). Fortunately, our FTDI discriminates +0.6V as a correct LOG0.
	+
	+	==== Note on USB hubs and cables ====
	+
	+	Some USB hubs have a diode between input and output V+. There is a voltage drop of about 0.4-0.5V. Just short the diode, we don't want this drop.
	+
	+	Another voltage drop is on USB cable. Manufacturers tend to save copper, so they use very thin wires. I have seen a cable that had 2 ohms! This is drop of 0.8V at 400mA! The symptoms were simple - two or three phones worked, other didn't. Original FW was complaining about empty battery. Btw. osmocom Hello World FW measures the voltage too. Or just use your voltmeter...
	+	==== Driving BTN_DRIVE and PWR_DRIVE ====
	+
	+	You need 2 GPIO pins for each phone. Trivial approach was to use DTR/RTS signalling from the FTDI serial port. Unfortunately, when you touch it (disabling hardware control flow), there pins are reset. This could be a driver issue, but we didn't want to hack the kernel driver. We decided to debug it on an Arduino shield and later, it will be probably drived by a standalone ATmega.
	+
	+	This is the first prototype, drawn by a flipchart marker and then etched; ULNs are surface-mounted. It's a disaster, but it works. Notice the Ultimate Debugging LED™.
	+
	+	{{ :project:gsm:shield.jpg?200 \|}}
	+
	+	Much better is the current PCB. Eagle files can be obtained [[https://github.com/brmlab/spagata\|from Github]] or here is a 300DPI PNG. It is driven by Arduino Nano and it supports 8 phones.
	+
	+	{{ :project:gsm:brmbora.png?200 \|}}
	+
	+	There is unfortunately one HW bug. Our Nano from DealExtreme has too narrow trace for USB V+. Therefore, running more than ~4 phones will cause voltage drop. This can be fixed by connecting USB V+ from your USB hub with the main Vcc trace on the board.
	+
	+	Phones are connected using 40-pin IDE connector. Phones can be either soldered or on connectors.
	+
	+	Please download [[http://jenda.hrach.eu/brm/ftdi.jpg\|this handy reference]] to avoid stroke when studying official vendor's manual.
	+
	+	When done properly, all this should fit into 3.5"-harddrive-like box. Phones are isolated using a plastic bag.
	+	==== Driver protocol ====
	+
	+	[[https://github.com/brmlab/spagata\|Firmware source code is on GitHub]]
	+
	+	brmboractl, gsm_init_hw and motoload are user-space tools used to manage this. TODO solve license problems with them and publish them (you can speed this up by carefully dropping us an e-mail :)
	+
	+	--
	+
	+	Fire up your favorite terminal and begin the communication.
	+	<code>
	+	# Minicom configuration
	+	pu port /dev/ttyFFFFUUUU
	+	pu baudrate 9600
	+	pu rtscts No
	+	</code>
	+
	+	* "-" cleans the buffer
	+	* CR, LF or @ executes the buffer
	+	* no backspace, history or command-line editing implemented
	+	* The only implemented command is "s"
	+	* Syntax: sx1
	+	* x ... pin letter (documented on the paper somewhere in brmlab)
	+	* 1 or 0 ... on/off
	+	* e.g. to turn on the LED, send "st1@"
	+
	+	When controlling from bash (echo bah > /dev/ttyUSB0), make sure you have echoing on your serial port turned OFF! stty -F /dev/ttyUSB0 -echo
	+
	+	==== Upstream Filters ====
	+
	+	http://bb.osmocom.org/trac/wiki/Hardware/FilterReplacement
	+
	+	==== Antenna ====
	+
	+	==== Amplifier ====
	+
	+	==== People ====
	+
	+	* Jan Hrach (jenda .a. hrach.eu)
	+	* Řehoř Gölöncséryi (niekt0 .a. hysteria.sk)
	+	* License: FIXME
	+
	+	==== brmbora anthem \o/ ====
	+
	+	http://www.karaoketexty.cz/texty-pisni/nightwork/cekam-na-signal-315898

GSM

Anonymous (anonymous@undisclosed.example.com) — 2016-11-28T02:38:12+00:00

1480225486		current
Line 1:		Line 1:
	====== GSM ======		====== GSM ======
-	{{template>infobox\|	+	{{template>:project:infobox\|
	name=GSM\|		name=GSM\|
-	image=GSMLogo.png?186\|	+	image=GSMLogo.png?200\|
	sw=\|		sw=\|
	founder=\|		founder=\|
Line 10:		Line 10:
	~~META:		~~META:
	status = active		status = active
		+	&relation firstimage = :project:GSMLogo.png
	~~		~~