Difference between revisions of "AirProbe: Howto"

From OnnoWiki
Jump to navigation Jump to search
 
Line 112: Line 112:
 
* https://srlabs.de/airprobe-how-to/
 
* https://srlabs.de/airprobe-how-to/
 
* https://opensource.srlabs.de/projects/a51-decrypt/files
 
* https://opensource.srlabs.de/projects/a51-decrypt/files
 +
 +
==Pranala Menarik==
 +
 +
* [[OpenBTS]]
 +
* [[OpenBTS: Arsitektur secara umum]]
 +
 +
===Persiapan===
 +
 +
* [[USRP: High Precision Clock]]
 +
* [[USRP: Menyambungkan ClockTamer ke USRP1]]
 +
* [[USRP: Kalibrasi ClockTamer]]
 +
* [[USRP: ClockTamer Control Protocol]]
 +
* [[USRP: ClockTamer Flashing]]
 +
* [[USRP: Instalasi Board]]
 +
* [[OpenBTS: GIT Source Code]]
 +
* [[USRP: Rangkaian Board USRP]]
 +
* [[OpenBTS: Tethr untuk Bencana Alam]]
 +
* [[USRP: Tip Pemesanan]]
 +
 +
===Script===
 +
 +
* [[OpenBTS: Script Membuat GNURadio 3.4.2 di Ubuntu 13.04]]
 +
* [[OpenBTS: Script Membuat OpenBTS dan yate di Ubuntu 13.04]]
 +
* [[OpenBTS: Script Membuat OpenBTS 2.8.0 di RangeNetwork Dev Kit]]
 +
* [[OpenBTS: Script Membuat OpenBTS di RangeNetwork Dev Kit]]
 +
 +
===OpenBTS 2.6===
 +
 +
* [[GNURadio]]
 +
* [[GNURadio: Ubuntu Install]]
 +
* [[GNURadio: Menggunakan UHD]]
 +
* [[GNURadio: Ubuntu Install GNURadio 3.4.2]] '''RECOMMENDED'''
 +
* [[GNURadio: Ubuntu Install GNURadio 3.4.2 Clock 52MHz]] '''RECOMMENDED'''
 +
* [[GNURadio: Ubuntu 13.04 Install GNURadio 3.4.2 Clock 52MHz]] ''NOT RECOMMENDED''
 +
* [[GNURadio: Contoh Aplikasi]]
 +
* [[GNURadio: Spectrum Analizer GSM]]
 +
* [[GNURadio: Mengubah board RFX1800 menjadi RFX900]]
 +
* [[GNURadio: Programming Untuk Pemula]]
 +
* [[OpenBTS: Ubuntu Install]] '''RECOMMENDED'''
 +
* [[OpenBTS: Ubuntu Install OpenBTS 2.6 Clock 52MHz]] '''RECOMMENDED'''
 +
* [[OpenBTS: Ubuntu 13.04 Install OpenBTS 2.6 Clock 52MHz]] ''NOT RECOMMENDED''
 +
* [[OpenBTS: Konfigurasi]] '''RECOMMENDED'''
 +
* [[OpenBTS: Kalibrasi]]
 +
* [[OpenBTS: Konfigurasi Asterisk untuk OpenBTS]] '''RECOMMENDED'''
 +
* [[OpenBTS: Menjalankan smqueue]]
 +
* [[OpenBTS: Mengoperasikan BTS]] '''RECOMMENDED'''
 +
* [[OpenBTS: Tampilan di Nokia saat pakai OpenBTS]]
 +
* [[OpenBTS: Operasi 1800 MHz]]
 +
* [[OpenBTS: Beberapa Tips]]
 +
* [[OpenBTS: USRP2]]
 +
* [[OpenBTS: Amplifier]]
 +
* [[OpenBTS: SMS]]
 +
* [[AirProbe]]
 +
 +
===OpenBTS 2.8===
 +
 +
* [[GNURadio: Ubuntu 11.10 Install]] ''NOT RECOMMENED''
 +
* [[GNURadio: Ubuntu 11.10 instalasi menggunakan Repo]] ''NOT RECOMMENDED''
 +
* [[GNURadio: Download GNURadio]]
 +
* [[GNURadio: Install UHD]]
 +
* [[GNURadio: Ubuntu 11.10 Instal GNURadio 3.3.0]]
 +
* [[GNURadio: Ubuntu 12.10 Instal GNURadio 3.3.0]]
 +
* [[GNURadio: Ubuntu 12.10 Instal GNURadio 3.4.1]] ''NOT RECOMMENDED''
 +
* [[GNURadio: Ubuntu 11.10 Instal GNURadio 3.4.2]] '''RECOMMENDED'''
 +
* [[GNURadio: Ubuntu 12.04 Instal GNURadio 3.4.2]] '''RECOMMENDED'''
 +
* [[GNURadio: Ubuntu 12.04.1 Instal GNURadio 3.4.2]] '''RECOMMENDED'''
 +
* [[GNURadio: Ubuntu 12.10 Instal GNURadio 3.4.2]] ''NOT RECOMMENDED''
 +
* [[GNURadio: Ubuntu 13.04 Instal GNURadio 3.4.2]] '''RECOMMENDED'''
 +
* [[GNURadio: Ubuntu 11.10 Instal GNURadio 3.5.0]] ''NOT RECOMMENDED''
 +
* [[GNURadio: Ubuntu 11.10 Instal GNURadio 3.5.3.2]] ''NOT RECOMMENDED''
 +
* [[GNURadio: Ubuntu 11.10 Instal GNURadio 3.6.0]] ''NOT RECOMMENDED''
 +
* [[GNURadio: Ubuntu 11.10 Install dari GIT GNURadio]] ''NOT RECOMMENDED''
 +
* [[GNURadio: Ubuntu 11.10 cek USRP Daughter Board]]
 +
* [[GNURadio: UHD]] ''NOT RECOMMENDED''
 +
* [[GNURadio: UHD Image]] ''NOT RECOMMENDED''
 +
* [[GNURadio: UHD burn EEPROM RFX Board di USRP1]] ''NOT RECOMMENDED''
 +
* [[GNURadio: UHD Identifikasi Device]]
 +
* [[OpenBTS: Ubuntu 11.10 Install]]
 +
* [[OpenBTS: dari GIT ttsou]]
 +
* [[OpenBTS: 2.8 dari SVN Install]]
 +
* [[OpenBTS: 2.8 dari SVN Install Clock 52MHz]] '''RECOMMENDED'''
 +
* [[OpenBTS: 2.8 dari SVN Install Clock 52MHz di Ubuntu 12.10]] '''RECOMMENDED'''
 +
* [[OpenBTS: 2.8 dari SVN Install Clock 52MHz di Ubuntu 13.04]] '''RECOMMENDED'''
 +
* [[OpenBTS: 2.8 dari SVN 2.8.0 Install Clock 52MHz di Ubuntu 13.04]] '''RECOMMENDED'''
 +
* [[OpenBTS: 2.8 dari SVN Install Clock 52MHz dengan UHD tanpa GNURadio]] ''NOT RECOMMENDED''
 +
* [[OpenBTS: 2.8 Edit User di sqlite3.db]] '''RECOMMEND'''
 +
* [[OpenBTS: Yate Softswitch]] '''RECOMMENDED'''
 +
* [[OpenBTS: Yate Softswitch install Ubuntu 12.10]] '''RECOMMENDED'''
 +
* [[OpenBTS: Yate Softswitch install Ubuntu 13.04]] '''RECOMMENDED'''
 +
* [[OpenBTS: Yate Config Test]]
 +
* [[OpenBTS: 2.8 Instalasi Real Time Asterisk]] '''RECOMMENDED'''
 +
* [[OpenBTS: 2.8 Menjalankan]] '''RECOMMENDED'''
 +
* [[OpenBTS: 2.8 Konfigurasi]]
 +
* [[OpenBTS: 2.8 Konfigurasi Cognitive Radio Elsabagh]]
 +
* [[OpenBTS: 2.8 Konfigurasi Subscriber Registery]]
 +
* [[OpenBTS: Database SQLite]]
 +
* [[OpenBTS: Set SQLite Subscriber Registry secara manual]]
 +
* [[OpenBTS: Set SQLite parameter smqueue]]
 +
* [[OpenBTS: FreeSWITCH]]
 +
 +
===Multi OpenBTS 2.8===
 +
 +
* [[OpenBTS: Pola Multi OpenBTS]] '''RECOMMENDED'''
 +
* [[Multi OpenBTS: Catatan Konfigurasi]] '''RECOMMENDED'''
 +
 +
===OpenBTS 3.1.x===
 +
 +
* [[OpenBTS: Install UHD untuk USRP1]]
 +
* [[OpenBTS: UHD Identifikasi Device]]
 +
* [[OpenBTS: OpenBTS 3.1.3 Compile]] '''Tidak bisa untuk USRP1'''
 +
* [[OpenBTS: Yate Compile]]
 +
 +
===Ettus E110===
 +
 +
* [[OpenBTS: E110 Cara Login]]
 +
* [[OpenBTS: E110 Install Image di MicroSD]] '''*RECOMMENDED*'''
 +
* [[OpenBTS: E110 Cek Daughter Board]]
 +
* [[OpenBTS: E110 Mengubah Master Clock]]
 +
* [[OpenBTS: E110 Kalibrasi Clock]]
 +
* [[OpenBTS: E110 Konfigurasi Jaringan]]
 +
* [[OpenBTS: E110 Bekerja dengan opkg]]
 +
* [[OpenBTS: E110 Instalasi iptables]]
 +
* [[OpenBTS: E110 GNURadio]]
 +
* [[OpenBTS: E110 Compile UHD]] ''Not Recommended''
 +
* [[OpenBTS: E110 Compile UHD dari Release Bukan git]] ''Not Recommended''
 +
* [[OpenBTS: E110 UHD burn EEPROM RFX Board]] ''Not Recommended''
 +
* [[OpenBTS: E110 Install UHD Image]] ''Not Recommended''
 +
* [[OpenBTS: E110 Instalasi OpenBTS]]
 +
* [[OpenBTS: E110 Instalasi OpenBTS 2.6]] ''NOT RECOMMENDED''
 +
* [[OpenBTS: E110 Instalasi OpenBTS 2.8 untuk MultiBTS]] '''*RECOMMENDED*'''
 +
* [[OpenBTS: E110 Yate Softswitch]]
 +
 +
===Ettus N210===
 +
 +
* [[OpenBTS: N210 Instalasi GPSDO Kit]]
 +
* [[OpenBTS: N210 GNURadio]]
 +
* [[OpenBTS: N210 GNURadio 3.7.0]]
 +
* [[OpenBTS: N210 Instalasi OpenBTS]]
 +
* [[OpenBTS: N210 Instalasi Yate]]
 +
* [[OpenBTS: N210 Yate Config Test]]
 +
* [[OpenBTS: N210 Burn Firmware]]
 +
 +
===RangeNetworks===
 +
 +
* [[OpenBTS: RangeNetwork Foto]]
 +
* [[OpenBTS: RangeNetwork Default Setting]]
 +
* [[OpenBTS: RangeNetwork Instalasi UHD]]
 +
* [[OpenBTS: RangeNetwork Compile GNURadio UHD]]
 +
* [[OpenBTS: RangeNetwork Compile]]
 +
* [[OpenBTS: RangeNetwork Compile OpenBTS 2.8.0]]
 +
* [[OpenBTS: RangeNetwork Compile OpenBTS 3.1.3]]
 +
* [[OpenBTS: RangeNetwork Yate Compile]] '''*RECOMMENDED*'''
 +
* [[OpenBTS: RangeNetwork Web Interface]]
 +
* [[OpenBTS: RangeNetwork Trunk ke Asterisk Lain]]
 +
* [[VoIP: Trunk]]
 +
 +
===GPRS===
 +
 +
* [[OpenBTS: GPRS]]
 +
* [[OpenBTS: GPRS Konfigurasi]]
 +
* [[OpenBTS: GPRS untuk dibelakang Router dengan NAT]]
 +
 +
===Briker OpenBTS===
 +
 +
* [[OpenBTS: Briker]]
 +
 +
===FreeSWITCH OpenBTS===
 +
 +
* [[OpenBTS: FreeSWITCH]]
 +
 +
===Power Amplifier===
 +
 +
* [[Driver 900MHz]]
 +
* [[Power Amplifier 900MHz]]
 +
* [[Duplexer]]
 +
* [[OpenBTS: Menaikan Jangkauan OpenBTS]]
 +
 +
===Lain Lain===
 +
 +
* [[OpenBTS: Materi Magang di ICTWATCH]]
 +
* [[OpenBTS: Seminar Outline]]
 +
* [[OpenBTS: Workshop Outline]]
 +
* [[Membuat Base Station GSM Open Source]]
 +
* [[Teknologi Selular]]
 +
* [[GSM: Daftar Channel Frekuensi]]
 +
* [[Wireless Internet]]
 +
* [[OpenBSC]]
 +
* [[AirProbe]]
 +
* [[Base station subsystem]]
 +
* [[GSM]]
 +
* [[Asterisk]]
 +
* [[Mobile phone]]
 +
 +
===Catatan Legal dan Pendukung===
 +
 +
* [[Siapa Bilang OpenBTS Ilegal?]]
 +
* [[OpenBTS: Catatan MNC dan MCC Indonesia]]
 +
* [[OpenBTS: Catatan MNC dan MCC COOL]]
 +
* [[OpenBTS : Alokasi Frekuensi Operator GSM Indonesia]]
 +
* [[GSM: Daftar Channel Frekuensi]]
 +
 +
===Catatan Sejarah===
 +
 +
* [[2011/04/30 - Workshop OpenBTS Pertama di Indonesia dilakukan di Univ Gajah Putih Takengon Aceh Tengah]]
 +
* [[OpenBTS: Daftar Workshop atau Seminar yang pernah dilakukan]]
 +
* [[OpenBTS: Daftar Artikel di Media]]
 +
* [[OpenBTS: Permohonan Kanal dan DID untuk OpenBTS]]
 +
* [[OpenBTS: 2013/02/19 - OpenBTS TelkomSel Mengudara di Muscat Oman]]
 +
* [[OpenBTS: Beroperasi di Papua]]
 +
 +
===Dokumentasi Video===
 +
 +
* http://www.metrotvnews.com/read/newsprograms/2012/10/14/14624/212/Teknologi-BTS
 +
* http://youtu.be/8ogOcUSpINU (1/6)
 +
* http://youtu.be/F5d7HGuhppk (2/6)
 +
* http://youtu.be/90Jgq6bOgrQ (3/6)
 +
* http://youtu.be/cNkx_qNqdfc (4/6)
 +
* http://youtu.be/6LCuoeI57ak (5/6)
 +
* http://youtu.be/-dEqcHoIlYk (6/6)
 +
* http://www.youtube.com/watch?v=Ff_rw4kAOZg&feature=share
 +
 +
===Perjuangan OpenBTS===
 +
 +
* http://www.technologyreview.com/news/522371/how-remote-places-can-get-cellular-coverage-by-doing-it-themselves/?utm_campaign=socialsync&utm_medium=social-post&utm_source=twitter
 +
 +
 +
 +
[[Category: Wireless]]
 +
[[Category: Selular]]

Latest revision as of 06:59, 25 February 2014

Sumber: https://srlabs.de/airprobe-how-to/


Follow these steps to use "gsm-receiver" from Airprobe to debug non-hopping, single ARFCN cells in the downlink direction.

- Capture some downlink traffic of a non-hopping, single ARFCN cell 

 using either the USRP or USRP2 (recommended decimation rate for the
 USRP2 is 174, the default decimation rate for the USRP is 112).
 A sample USRP2 capture is here:

  http://reflextor.com/vf_call6_a725_d174_g5_Kc1EF00BAB3BAC7002.cfile.gz

 (This capture was recorded with:
  usrp2_rx_cfile.py -f `arfcncalc -a 725 -d -b 1800` -d 174 -g 5 output.cfile )

- Start a recent Wireshark version listening to the GSMTAP port 

 (UDP 4729).

- Note: "174" in the following samples is the decimation rate used 

 for the USRP2 capture, "go_usrp2.sh" is used because it is a USRP2
 capture. For the USRP1 "go.sh" would be used instead of "go_usrp2.sh"
 and "112" instead of "174".

- Decode TS0 as "Non-combined" BTS configuration ("0B" parameter). 

 For a "Combined" configuration specify "0C". If not sure, try
 both and take the one which makes more sense or look at "SYSTEM
 INFORMATION 3", "Control Channel Description".

./go_usrp2.sh vf_call6_a725_d174_g5_Kc1EF00BAB3BAC7002.cfile 174 0B > vf_call6

- Look for an "Immediate Assignment" in the Wireshark GSMTAP trace. 

 ==> SDCCH/8 on TS1 is assigned

- Decode TS1 as "SDCCH/8" ("1S" parameter) 

 ./go_usrp2.sh vf_call6_a725_d174_g5_Kc1EF00BAB3BAC7002.cfile 174 1S > vf_call6

- The unencrypted part of the SDCCH/8 is displayed in Wireshark. The 

 encrypted part of SDCCH/8 is contained in the file "vf_call6", those are
 the frames where an error is displayed (e.g. "cannot decode fnr=0x0d288b
 (862347) ts=1").

- File "vf_call6" contains the burst of the frames, for the first encrypted 

 frame the bursts are:

  C1 862344 1332354: 001111000110000100101110000110111111000101111000101001011111001100100110010011011000000100000101010011001000010010
  P1 862344 1332354: 001111000110000100101110000110111111000101111000101001011111001100100110010011011000000100000101010011001000010010
  S1 862344 1332354: 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
  C0 862345 1332387: 010001100001111000010010111111000101101100011010101010001011100010101101001000100101010110001011011010110111001010
  P0 862345 1332387: 010001100001111000010010111111000101101100011010101010001011100010101101001000100101010110001011011010110111001010
  S0 862345 1332387: 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
  C0 862346 1332420: 110100001010010101100110001101001010100011001011100010010110000011010111110000111001110110000011000001110100101011
  P0 862346 1332420: 110100001010010101100110001101001010100011001011100010010110000011010111110000111001110110000011000001110100101011
  S0 862346 1332420: 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
  C0 862347 1332453: 111110000111111010100110101000000100101100001000011111011100001111010001101111001001111001101111111001110101001000
  P0 862347 1332453: 111110000111111010100110101000000100101100001000011111011100001111010001101111001001111001101111111001110101001000
  S0 862347 1332453: 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
  error: sacch: parity error (-1 fn=862347)
  cannot decode fnr=0x0d288b (862347) ts=1

 "Cx" are the encrypted burst bits, "Px" are the decrypted burst bits and
 "Sx" are the keystream bits (encrypted bits XOR decrypted bits). We do not
 decrypt right now so the decrypted burst bits are the same as the encrypted
 burst bits. If "x" is "1" than this is the first burst of a frame.

 The second number is the frame number, the third number is the "modified"
 frame number as required by the A5/1 algorithm.

- Choose a burst where the content of the frame is known and use it 

 to find Kc. Use the Kraken tool to find Kc.

 The resulting Kc is 1EF00BAB3BAC7002.

 Note: this step is not as easy as it sounds. Usually capture some
 calls of your own phone where you know the Kc (it can be read from
 the SIM or displayed by the Engineering Mode Screen of some phones)
 and look for known-plain-text candidates. An example are "SYSTEM
 INFORMATION 5/6/5ter" in the SACCH or "LAPDM U, func=UI" frames.
 Also keep in mind that there could be wrong bits in a burst due to
 distortion.

- Decode TS1 as "SDCCH/8" ("1S" parameter) and decrypt (Kc is specified 

 as parameter)

 ./go_usrp2.sh vf_call6_a725_d174_g5_Kc1EF00BAB3BAC7002.cfile 174 1S 1EF00BAB3BAC7002 > vf_call6

- Look for the "Assignment Command" in the Wireshark GSMTAP trace 

 ==> TCH/F on TS5 is assigned

- Decode and decrypt the speech traffic on TS5 ("5T" parameter, Kc is 

 specified)

./go_usrp2.sh vf_call6_a725_d174_g5_Kc1EF00BAB3BAC7002.cfile 174 5T 1EF00BAB3BAC7002 > vf_call6

- The file "speech.au.gsm" contains the speech traffic. It can be converted 

 with "toast" (http://www.quut.com/gsm/) to an audio file:

   toast -d speech.au.gsm

 The resulting file "speech.au" can be played back.



Referensi

Pranala Menarik

Persiapan

Script

OpenBTS 2.6

OpenBTS 2.8

Multi OpenBTS 2.8

OpenBTS 3.1.x

Ettus E110

Ettus N210

RangeNetworks

GPRS

Briker OpenBTS

FreeSWITCH OpenBTS

Power Amplifier

Lain Lain

Catatan Legal dan Pendukung

Catatan Sejarah

Dokumentasi Video

Perjuangan OpenBTS

Retrieved from "https://onnocenter.or.id/wiki/index.php?title=AirProbe:_Howto&oldid=39811"