3
\$\begingroup\$

I want to develop a GSM/3G Packet Analyzer for study purposes, a somewhat more simplified version of OsmocomBB but without any TX modules.

As some of you may know, even though OsmocomBB is open source, it has not been ported but to some very old Motorola and Sony-Ericsson phones. I would love to be able to do something like OsmocomBB on a newer phone so I can link it with a modern android OS system like Cyanogen.

I've read that Broadcom is one of open-sources Gsm baseband processor manufacturers out there, so - sorry if I have passed some of the information accumulated over here.

Is there any way I can find any open source RTOS (Real Time Operating System) that is compatible with say Broadcom's BCM28155 so I can modify it and be able to read all GSM/3G stack and transfer this layer 1/2 data to android OS? And also be able to re-flash the BCM with a high success rate?

If not, what would be a starting documentation on reverse engineering SoC (System on Chip) chips developed by the main main GSM baseband chip manufacturers so I can start from there. Maybe some books that delve into this specific issues?

\$\endgroup\$
2
  • \$\begingroup\$ I have no idea where to start either, but I'd just like to say I'm glad that someone is attempting this. Maybe the cyanogenmod community have some more details on the current firmware? \$\endgroup\$
    – pjc50
    Commented Apr 30, 2015 at 11:25
  • \$\begingroup\$ Yeah, there are proprietary libraries loaded into the kernel . Android talks with these libraries via AT Hayes modem commands to the RILD socket. Those libraries will have to be reverse engineered aside with the SoC. No open source AFAIK. stackoverflow.com/questions/11111067/… \$\endgroup\$
    – gogonapel
    Commented Apr 30, 2015 at 13:10

1 Answer 1

Reset to default
1
\$\begingroup\$

If you are happy with packet contents after decryption, you can use a rooted Android phone with a Qualcomm baseband. I did implement this for SRLab's SnoopSnitch.

The low-level code can get you started: it opens the Qualcomm debug monitor device /dev/diag and streams messages coming in over this interface. You will then have to send configuration messages to enable logging for the packet type classes you are interested in. This part of the code will point you in the right way. You may have to dig through the rest of the repository to see how the data can be used.

The Qualcomm QXDM tool can show raw messages and decode them - this will help in reverse engineering the data format used in the messages.

\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.