Module: PWN::SDR::Decoder::GSM

Defined in:
lib/pwn/sdr/decoder/gsm.rb

Overview

GSM (2G) broadcast-channel decoder.

GSM is 270.833 kbit/s GMSK — it CANNOT be recovered from GQRX's 48 kHz demodulated-audio UDP tap. This module therefore drives the SDR directly via grgsm_livemon_headless (from gr-gsm), which publishes decoded Um bursts as GSMTAP on udp/4729, and reads them back with tshark for structured field extraction (MCC/MNC/LAC/CI/ARFCN, paging IMSIs/TMSIs, System Information messages, etc.).

Interface matches PWN::SDR::Decoder::Flex / ::RDS so the GQRX dispatcher (decoder: :gsm) works uniformly.

NOTE: grgsm_livemon_headless opens the SDR hardware itself. If GQRX already owns the device, pass a distinct --args string via freq_obj (e.g. 'rtl=1' or 'hackrf=0') or stop GQRX's DSP first (U DSP 0).

Constant Summary collapse

TSHARK_FIELDS = 
%w[
  frame.time
  gsmtap.arfcn
  gsmtap.chan_type
  gsm_a.imsi
  gsm_a.tmsi
  e212.mcc
  e212.mnc
  gsm_a.lac
  gsm_a.bssmap.cell_ci
  gsm_a.dtap.msg_rr_type
].freeze

Class Method Summary collapse

Class Method Details

.authors ⇒ Object

Author(s)

0day Inc. support@0dayinc.com



115
116
117
 
# File 'lib/pwn/sdr/decoder/gsm.rb', line 115

public_class_method def self.authors
  "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
end

.decode(opts = {}) ⇒ Object

Supported Method Parameters

PWN::SDR::Decoder::GSM.decode( freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq' )



43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
 
# File 'lib/pwn/sdr/decoder/gsm.rb', line 43

public_class_method def self.decode(opts = {})
  freq_obj = opts[:freq_obj]
  raise 'ERROR: :freq_obj is required' unless freq_obj.is_a?(Hash)

  hz       = PWN::SDR.hz_to_i(freq: freq_obj[:freq])
  gain     = (freq_obj[:rf_gain] || 40).to_s.to_f
  sdr_args = freq_obj[:sdr_args].to_s
  gsmtap   = (freq_obj[:gsmtap_port] || 4729).to_i

  grgsm = ['grgsm_livemon_headless', '-f', hz.to_s, '-g', gain.to_s]
  grgsm.push('--args', sdr_args) unless sdr_args.empty?

  tshark = ['tshark', '-i', 'lo', '-l', '-n',
            '-f', "udp port #{gsmtap}",
            '-Y', 'gsmtap',
            '-T', 'fields', '-E', 'separator=|']
  TSHARK_FIELDS.each { |f| tshark.push('-e', f) }

  # bash -c '<grgsm> >/dev/null 2>&1 & pid=$!; trap ... ; <tshark>'
  inner = "#{Shellwords.join(grgsm)} >/dev/null 2>&1 & " \
          'LMPID=$!; trap "kill $LMPID 2>/dev/null" EXIT INT TERM; ' \
          "sleep 2; exec #{Shellwords.join(tshark)}"
  direct_cmd = "bash -c #{Shellwords.escape(inner)}"

  PWN::SDR::Decoder::Base.run_pipeline(
    freq_obj: freq_obj,
    protocol: 'GSM',
    required_bins: %w[grgsm_livemon_headless tshark],
    direct_cmd: direct_cmd,
    line_match: /\S/,
    parser: proc { |line| parse_line(line: line) }
  )
end

.help ⇒ Object

Display Usage for this Module



121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
 
# File 'lib/pwn/sdr/decoder/gsm.rb', line 121

public_class_method def self.help
  puts "USAGE:
    #{self}.decode(
      freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
    )

    NOTE: Requires `grgsm_livemon_headless` (gr-gsm) and `tshark`.
          GSM cannot be decoded from GQRX's 48 kHz audio tap; this
          module drives the SDR directly and reads GSMTAP on lo:4729.
          Set freq_obj[:sdr_args] (e.g. 'rtl=1') if GQRX owns device 0.

    #{self}.parse_line(line: 'ts|arfcn|chan|imsi|tmsi|mcc|mnc|lac|ci|rr')

    #{self}.authors
  "
end

.parse_line(opts = {}) ⇒ Object

Supported Method Parameters

PWN::SDR::Decoder::GSM.parse_line(line: 'ts|arfcn|chan|imsi|tmsi|mcc|mnc|lac|ci|rr')



80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
 
# File 'lib/pwn/sdr/decoder/gsm.rb', line 80

public_class_method def self.parse_line(opts = {})
  line = opts[:line].to_s
  f = line.split('|', -1)
  out = {
    protocol: 'GSM',
    frame_time: f[0],
    arfcn: f[1],
    chan_type: f[2],
    imsi: f[3],
    tmsi: f[4],
    mcc: f[5],
    mnc: f[6],
    lac: f[7],
    cell_id: f[8],
    rr_msg_type: f[9]
  }.reject { |_, v| v.to_s.empty? }

  if out[:imsi].to_s.length.between?(14, 16)
    out[:imsi_mcc]  = out[:imsi][0, 3]
    out[:imsi_mnc]  = out[:imsi][3, 3]
    out[:imsi_msin] = out[:imsi][6..]
  end

  bits = []
  bits << "ARFCN=#{out[:arfcn]}" if out[:arfcn]
  bits << "MCC/MNC=#{out[:mcc]}/#{out[:mnc]}" if out[:mcc]
  bits << "LAC=#{out[:lac]} CI=#{out[:cell_id]}" if out[:lac]
  bits << "IMSI=#{out[:imsi]}" if out[:imsi]
  bits << "TMSI=#{out[:tmsi]}" if out[:tmsi]
  out[:summary] = "GSM #{bits.join(' ')}".strip
  out
end