First of all I want to emphasize that my work has followed an interesting blog that treats this topic of cracking GSM really good, but I think that some explanation details can be explained in a better way to solve some important problems that I have come across during the developement of this task and that are not so simple to solve as in a beginning one could think. Previous LINKS: So before beginning with the development I advice you to read the following blog: I think that Domi has performed a real fantastic task explaining all the details in his blog. I also recommend to read all the related topics about GSM that are explained in the rtl-sdr. I have to alert you that some linux distributions may not be able to get airprobe working. In my case I tried first to get airprobe at ubuntu 12. It comes with some radio features that enhance the experience of anyone who likes sniffing diferent types of signals. Once you have this software opened, look for gnuradio packets and install all of them. This is the best way of installing gnuradio because the system will compile all the necessary scripts without any problem and all the related packets will be installed too. At the next link, there are some explanations of how to update softwares available in Kali linux: After installing gnuradio and check that it works well, the next step is to install the gqrx software by the same way I have described you to install gnuradio. After getting gqrx running correctly, you will have to compile airprobe software using the steps at the link above, and if all goes well you will have to get it working correctly without any problem. You can setup this software using this other link: This software is used to calibrate the RTL-SDR USB dongle offset and know if you are tunning on the exact frequency or you are working with some offset. But in our case, we will use this tool to identify the most powerful GSM channels in our area. The separate GPU that Karsten Nohl recommended to me by mail is an ATI 5xxx GPU. But to make some ideas is good to read it. Finally, here are some slides of Domi, the author of the blog. Recommendation: All of the above documents are available to download freely for everyone but in case some links become broken, I recommend anyone who is interested in to contact me and I send the documents which I have previously downloaded. In samsung devices with a Stock ROM, when you connect via USB the device to your computer, it will be recognized as a Modem as well as an ADB interface in case you have the ADB downloaded and installed in your computer and as a folder with files like images, songs and videos too. In the case you have a Samsung device, you are lucky today!!! So you can be able to get this running until the step I have reached in case you follow my blog. I will also be really happy if someone could tell me why the Stock ROMs of Samsung make possible the characteristic of being treated as a Modem, so if someone is an expert of the android system I would really be very happy if you contact with me my mail is in the about page of this blog. So after this quite a long chatter, we can begin with the principal steps: STEP 0: Put your Mobile device working only in GSM not in 3G. Make sure that your option is selected and go back. With this action you have forced the phone to use the GSM network only. So you have to enter to advanced options to change it. STEP 1: Capture the data on the main ARFCN. The main ARFCN for the cell would be the one with the maximum signal strength and this can be determined with kalibrate tool. We use this tool to get the maximum signal strength in a certain moment. GSM-900: chan: 74 949. In my case, VODAFONE Espanya is my service provider and I identified that the frequency range assigned to them in Spain is between: 949,9 — 959,9 MHz. I found this information in wikipedia: Do a google search for your country and for sure you will get success. Another thing that you must take into account is that airprobe is only able to decode the GSM downlink frequency channel. So after identifing your own service provider frequency range, you have to look for those frequencies in Kalibrate tool that are inside the range of your service provider. These are the frequencies you have to tune with the RTL-SDR USB dongle to find your call or SMS. I recommend you to look for them at this link: in Spanish, but you can translate it with your browser Here is explained what are the MNC and MCC numbers and which are the ones for your country MCC and for your service provider MNC. These numbers can be used to place in a map the BTS towers you are using at a specified moment. This number is the one that is assigned to your phone when it is paged and is going to comunicate with the BTS tower. So this is the number that the BTS will use to identify your mobile device. To get this number I used the AT commands procedure to get acces to the SIM card of the mobile device where this number is stored and then I followed this link to enter the specific AT commands for this case: it also shows how to obtain the Kc key, this key will be necessary for decrypting the GSM information and get the data of our call or SMS. They are only signalling messages. This first type of messages contains information of the BTS towers of the system. Neighbour cell description — BCCH frequency list. Some GPRS information too. Neighbour cell description — Extended BCCH frequency list. Like 3G neighbour cell description. This second type contains information of the Mobile Station MS. Només el IMSI del MS1 o bé No idnetity code, etc. The -s flag is to specify the sample rate which seems to be better than the 1. The other settings are the frequency which we want to tune and the gain. As we know the GSM is a frequency hopping system that will change the transmitter and receiver frequency in a call following the pattern of ARFCNs received in the System Information Type 1 frames before setting the call. STEP 5: Convert the. The gnuradio-companion is a tool that comes with gnuradio and it has a graphical interface. You must download the next file: Go to the end of the page and click on download in original format. After this, open gnuradio-companion by typing it in a terminal prompt: gnuradio-companion And the program will open, the go to the tab open file and search the downloaded file named: rtl2832-cfile. Set the file source to the capture. Now execute the GRC flow graph by clicking on the icon that looks like grey cogs. This will create the capture. Then you can close the gnuradio-companion and delete the. Then the wireshark software will open and you must select lo loopback and start. Note that wireshark comes installed in kali linux. When a window which is capturing is opened go to the filter box and write gsmtap to see only the GSM frames. STEP 7: Finally use the go. First, we have to decode the signalling frames to know more things about the calls we are decoding:. With this we will get information about the system and of the calls identification numbers TMSI or IMSI in few cases. The information that contains any frame of signalling will be explained in a new thread in the next days. STEP 8: Procedure and configuration of airprobe to identify all the information and decode it. It is important to try both and figure out which one is correct for the cell you are observing. I will assume you sent a text message to yourself while capturing data. So now you can see all the messages of the beacon channel, but what are you looking for in the Wireshark log? These are the messages which indicate that a transaction actually happened. Now to continue with the flow it is best to try to decode the same cfile but now giving the key too to go. What are we looking for now? So, for example if it says that the phone needs to go to Timeslot 2 then your command would be:. Also worth noting that SMS messages are almost always sent on the Control Channel not on the Traffic Channel. Well the first step is the same as it was when we decoded a text message: we look at the beacon channel, Timeslot 0:. Here is again a flow chart showing the process: Now there is only one question left: how do we decode the traffic channel to actually get the voice data? Again, it is something that depends on the network: if the network uses simply Full Rate Speech then you can do the same what has been written in :. It decodes Timeslot 1 as a Traffic Channel. If you can not hear anything but beeps and other weird noises then there is a pretty good chance that the cell is using Enhanced Full Rate Speech instead of simple Full Rate Speech. To decode the channel as an Enhanced Full Rate Speech Traffic Channel:. You can read them on the first page!!! El que pots arribar a veure és el TMSI que és el identificador del terminal respecte la torre!!! Per saber la situació o quin tens a prop hauries de saber el Cell ID que és el identificador de la torre BTS de GSM i aquest nombre si que el pots saber amb el dongle!!! But I was in a quite good zone without many buildings surrounding the place. So for a better reception I recommend you using a real ADS-B antenna like that: This will improve your reception! But as you should know you have to position the antenna in the top of your building house or whatever! Thank a lot for your article. Basically, I would like to have both GSM 900, 1800 and 1900. If you have additional information for japanese phones, that would be great as well. Other cellular technologies UMTS, HSDPA, LTE, etc. Your valuable comments are welcomed. GSM-900: chan: 74 949.
