GSM Sniffing and Decoding

1. Install RTL-SDR Driver

git clone git://git.osmocom.org/rtl-sdr.git

cd rtl-sdr/

mkdir build

cd build

cmake ../

make

sudo make install

sudo ldconfig

2. Install OSMO-SDR

git clone git://git.osmocom.org/gr-osmosdr
cd gr-osmosdr

git checkout gr3.6
mkdir build 

cd build/

cmake ../
make 

sudo make install 

sudo ldconfig

3. Install Airprobe

Install gsmdecode

cd airprobe/gsmdecode
./bootstrap
./configure
make

Install gsm-receiver

cd airprobe/gsm-receiver
./bootstrap
./configure
make

4. Start Live Decoding

./gsm_receive_rtl.py -s 1e6 -f 951.8M

if you receive many errors no (sch.c:260 ERR: conv_decode 12), you need to calibrate.

5. Recording data Capturing a cfile with the RTL-SDR

First save a rtl_sdr .bin data file using where -s is the sample rate, -f is the GSM signal frequency and -g is the gain setting. (rtl_sdr is stored in ‘gnuradio-src/rtl-sdr/src’)

rtl_sdr /tmp/rtl_sdr_capture.bin -s 1.0e6 -f 955363665

Next, download this GNU Radio Companion (GRC) flow graph (scroll all the way down for the link), which will convert the rtl_sdr .bin file into a .cfile. Set the file source to the capture.bin file, and set the file output for a file called capture.cfile which should be located in the ‘airprobe/gsm-receiver/src/python’ folder. Also, make sure that ‘Repeat’ in the File Source block is set to ‘No’.

Now execute the GRC flow graph by clicking on the icon that looks like grey cogs. This will create the capture.cfile. The flow chart will not stop by itself when it’s done, so once the file has been written press the red X icon in GRC to stop the flow chart running.

The capture.cfile can now be used in airprobe. However, to use this cfile, I found that I had to use ./gsm_receive.py, rather than ./go.sh as a custom decimation rate is required. I’m not sure why, but a decimation rate of 64 worked for me, which is set with the -d flag.

./gsm_receive.py -I rtl_sdr_capture.cfile -d 64

For Decoding a message

./go.sh output.cfile 64 0C (EFKC KEY)

EFKC is unique per mobile user and changeable

Notes for errors:

1. Invalid Driver

Message: "Kernel driver is active, or device is claimed by second instance of librtlsdr.

In the first case, please either detach or blacklist the kernel module

(dvb_usb_rtl28xxu), or enable automatic detaching at compile time."

Solution: sudo rmmod dvb_usb_rtl28xxu rtl2832 

If this works, and you don't want to use the device for TV reception, 
you can stop the module from ever being loaded, solving the problem 
permanently.  The exact method depends on your Linux distribution, but 
for me (running Arch Linux) I create a file in /etc/modprobe.d with 
a .conf extension (I called it "no-rtl.conf") with these contents: 

  blacklist dvb_usb_rtl28xxu 
  blacklist rtl2832 
  blacklist rtl2830 

2. Calibration

git clone git://github.com/steve-m/kalibrate-rtl

cd kalibrate-rtl

./bootstrap && CXXFLAGS='-W -Wall -03'

./configure

make

make install

kal -s 900

kal -c (channel Number)

Source:

1. https://github.com/ksnieck/airprobe

2. http://www.rtl-sdr.com/rtl-sdr-tutorial-analyzing-gsm-with-airprobe-and-wireshark/

3. http://sdr.osmocom.org/trac/wiki/rtl-sdr