The RTL-SDR can be used to analyze cellular phone GSM signals using the Linux based tools gr-gsm and Wireshark. The G lobal S ystem for M obile communications (GSM) is the communications protocol that is used by many mobile phones. The data in GSM signals such as text messages and voice data are of course encrypted, however it is possible to analyze the GSM system used in your area as there are multiple plain text system messages (not personal messages) that can be received with an RTL-SDR. Note that with this tutorial you will not be able to receive any sensitive personal data. Below we show an image that shows some of the information that can be received.
The first step is to find out at what frequencies GSM signals are at in your area. For most of the world, the primary GSM band is 900 MHz, in the USA it starts from 850 MHz. If you have an E4000 RTL-SDR, you may also be able to find GSM signals in the 1800 MHz band for most of the world and 1900 MHz band for the USA. Open up SDR# or your favorite SDR receiver software and scan around the 900 MHz (or 850 MHz) band for a signal that looks like the waterfall image below. This image shows a non-hopping GSM downlink signal. Check the Signal Identification Wiki (www.sigidwiki.com ) for a GSM sound sample. Note down the strongest GSM frequencies you can find.
The rest of the tutorial is performed in Linux and for this we assume that you have basic Linux skills in using the terminal. Here we start from a fresh install of Ubuntu 14.04 on a virtual machine but this tutorial may also work on other Linux installations including ones that have GNU Radio preinstalled, but we cannot guarantee it.
INSTALLATION OF GR-GSM
This tutorial is heavily based on the instructions from the gr-gsm GitHub readme at https://github.com/ptrkrysik/gr-gsm .
1. The easiest way to install gr-gsm is to use Pybombs. Pybombs will automatically install gr-gsm, and all the required dependencies including GNU Radio.
git clone https://github.com/pybombs/pybombs.git cd pybombs
sudo ./pybombs config
2. After running config you will be asked above several options. Leave everything as the default except for the install prefix which should be set to /usr/local . You can select the default options by simply pressing enter at each line. 3. Check to see if your Linux distribution has a GNU Radio 3.7.3 or higher package in its repository with the following. Ubuntu 14.10 should have GNU Radio 3.7.3+ in its repositories, but older versions will not.
apt-cache policy gnuradio-dev
4. If it does use GNU Radio 3.7.3+ then use the following code to install GNU Radio via the repository package, rather than from source which will save significant amounts of installation time. Do not install from repositories if the GNU Radio version is older.
./pybombs config forcebuild ' '
5. Now install gr-gsm by running
./pybombs install gr-gsm
6. Once installed you can start gr-gsm from anywhere by simply running the following.
airprobe_rtlsdr.py
7. In the window that pops up you can set the frequency of a GSM signal. For example in this image we tune to a GSM signal at 945.402 MHz, which we would enter under center_frequency as 9.45402e+08. Be sure to also adjust the gain and PPM settings if needed.
8. Now run Wireshark by typing into a terminal
sudo wireshark
9. Since gr-gsm dumps data into a UDP port, we must set Wireshark to listen to this. Under the Start button in Wireshark, first set the capture interface to Loopback:lo and then press Start. Then in the filter box near the top of the Wireshark window, type in !icmp && gsmtap . This will ensure that only airprobe GSM data is displayed.
Note that you can also start wireshark by using sudo wireshark -k -Y '!icmp && gsmtap' -i lo which will automatically start wireshark in the loopback mode with the gsmtap filter activated.
If you have problems installing gr-gsm via Pybombs, you can install GNU Radio first via the Marcus Leech install script and then install gr-gsm as follows.
git clone https://github.com/ptrkrysik/gr-gsm.git cd gr-gsm
mkdir build cd build cmake .. make sudo make install sudo ldconfig
INSTALLATION AND TESTING OF AIRPROBE
If for some reason you cannot get the newer and more up to date gr-gsm software to run, you can still use the older Airprobe software which gr-gsm is based on to analyze GSM signals. The install procedure for this method is a little longer. Note that you only need to go through the following procedure if you cannot get gr-gsm to work. We recommend trying to get gr-gsm to work first as its decoding performance is much better and more stable compared to Airprobe.
1. First, install GNU Radio using the Marcus Leech install script.
sudo apt-get update
2. Install wireshark which is a program that will be used to display the data that is output by Airprobe.
sudo apt-get install wireshark
3. Install some dependencies required by Airprobe and libosmocore that may not have been installed by the GNU Radio installation script.
sudo apt-get install git-core autoconf automake libtool g++ python-dev swig libpcap0.8-dev pkg-config liblog4cpp5-dev
4. Airprobe also requires that the libosmocore libraries are installed. They can be installed with the following procedure.
git clone git://git.osmocom.org/libosmocore.git cd libosmocore
autoreconf –i ./configure make sudo make install sudo ldconfig
5. Clone the Airprobe git repository using the following command.
git clone git://git.gnumonks.org/airprobe.git
6. Because the GNU Radio installation script installs the latest version of GNU Radio (version 3.7+), we need to use a patch by an RTL-SDR.com commenter named neeo/zmiana. This is because Airprobe has not been updated in a while and still expects GNU Radio 3.6. Download the patch file from http://speedy.sh/NBRYB/zmiana3.patch (Mirror: http://bit.ly/1v8e3T2 ) and move it into the Airprobe directory. (Note another option instead of patching may be to install the older GNU Radio version 3.6 by using the -o flag on the GNU Radio installation script)
7. In the Airprobe directory apply the patch by using the following patch command. After this command you should see several lines of text indicating that the patching was successful.
cd airprobe patch -p1 < zmiana3.patch
8. Install gsm-receiver by using the following commands.
cd airprobe/gsm-receiver ./bootstrap ./configure make
9. Next we will test if Airprobe installed correctly by downloading a pre-recorded cfile, which contains a GSM signal. ( A mirror of cfile is available at http://bit.ly/1snLGCw .)
cd airprobe/gsm-receiver/src/python
wget --no-check-certificate https://svn.berlin.ccc.de/projects/airprobe/raw-attachment/wiki/DeModulation/capture_941.8M_112.cfile
10. Open a second terminal window or tab and open wireshark by typing sudo wireshark into a second terminal window. Because we are running Wireshark as sudo, some errors and warnings may pop up, but these can be safely ignored. Note that we are running Wireshark as sudo in order to get access to the local loopback interface.
11. Since Airprobe dumps data into a UDP port, we must set Wireshark to listen to this. Under the Start button in Wireshark, first set the capture interface to Loopback:lo and then press Start. Then in the filter box near the top of the Wireshark window, type in gsmtap. This will ensure that only airprobe GSM data is displayed.
12. Note that you can also start wireshark by using sudo wireshark -k -Y 'gsmtap' -i lo which will automatically start wireshark in the loopback mode with the gsmtap filter activated. 13. Back in the first terminal that is in the Airprobe/gsm-receiver/src/python directory, type in the following.
./go.sh capture_941.8M_112.cfile
14. If everything installed correctly, you should now be able to see the sample GSM data in wireshark. RECEIVING A LIVE GSM CHANNEL
1. To decode a live channel using a RTL-SDR type the following into terminal where -f specifies the frequency of your GSM signal and -g species the RTL-SDR gain. The -s flag is used here to set the sample rate to 1.0 MSPS, which seems to work much better than the default of 1.8 MSPS.
./gsm_receive_rtl.py -s 1e6 -f 936.6M -g 24
2. A new window will pop up. Within a few seconds you should see hex data scrolling in the terminal window and some GSM data should begin to show in Wireshark. If you get “cannot decode” errors or errors like ERR: conv_decode 11 then try and better center the GSM signal in the RF display window. It may help to use Kalibrate and determine your dongles exact frequency offset to help get a better centering. You should also wait for your dongle to warm up so that the frequency offset stabilizes. You can also try clicking in the center of the GSM signal in the spectrum to try and tune it. If you still have tuning errors try capturing an offline recording as shown below instead.
CAPTURING A CFILE WITH THE RTL-SDR
1. First save a rtl_sdr raw .bin data file using rtl_sdr as shown below where -s is the sample rate, -f is the GSM signal frequency and -g is the gain setting.
rtl_sdr /tmp/rtl_sdr_capture.bin -s 1.0e6 -f 938.345M -g 24
2. Next, download this GNU Radio Companion (GRC) 3.7 flow graph from http://bit.ly/1ulL6VP . This flow graph will convert the rtl_sdr .bin file into a .cfile. In the flow graph set the file source block to the /tmp/capture.bin file and set the file output in the file sink block to a file called /tmp/capture.cfile. Also, make sure that ‘Repeat’ in the file source block is set to ‘No’.
3. Now execute the flow graph by clicking on the execute button which is the one that looks like the play button. The flow chart will not stop by itself when it’s done, so you will need to monitor the output cfile file size until it stops growing, then stop the flowgraph by clicking on the stop button. Note that the output .cfile file size will be about four times larger than the input .bin file and that processing may take a while especially if your input .bin file is large. 4. Copy the capture.cfile over the to the airprobe/gsm-receiver/src/python folder.
5. Next open Wireshark as shown before and run the command shown below. GSM data should begin to show in Wireshark.
./go.sh capture.cfile 64
DECODING GSM MESSAGES AND VOICE
It is actually possible to decode text messages and voice from your own cell phone by getting your personal decryption codes from your SIM card. This process is significantly more involved that the above tutorial, but a good starting point to learning how to do this might be this tutorial http://domonkos.tomcsanyi.net/?p=418 .