23

As mentioned above by 0xea, @domi007 published 4 blog posts (1,2,3,4) detailing his experience with GSM sniffing and cracking. He also published his recorded presentation about GSM security (slides). On the same topic, there's also Sniffing GSM with HackRF, Analyzing GSM with Airprobe and Wireshark, three Chaos Computer Club presentations (One discussing ...


12

@domi007 recently published a series of blog posts detailing his efforts on snooping and decrypting GSM. Insted of USRP, he used rtlsdr. He also used an osmocomBB enabled phone. His efforts build upon the research done by Karsten Nohl on cracking GSM (you can see the video too) and his ~1.5 terabyte of rainbow tables.


5

(I don't have quite enough reputation for a comment so please excuse a very partial answer.) You need to consider whether some of the bits are not part of the packet data but part of an encoding for transmission. e.g. the 1's at regularly spaced bit positions 8, 17, 26, 35 could well be there to prevent a run of 0's getting too long. (Knowing the ...


4

As atdre suggested, you might want to check on and learn how usual, known, modulations function. That way you'll usually be able to at least figure out what kind of modulation is in question. In most cases it will turn out to be some known modulation. Read on how AFSK or POCSAG work for example. Carl Weisman did a series of introductory lessons on RF and ...


2

Many checksums, especially with small packets of data, are very simple to keep load down on the teeny-tiny brains of embedded devices. Also consider that the checksum must be fast and simple to verify. Generally, the checksum is designed so that the final result is 0 (zero), as that's super simple to check. Some things to try: add all the BYTES (8 bit ...


2

RF signals are composed of three possible modulations: Amplitude, Frequency, and Phase. Once you've determined the width and center frequency of the signal, analyze the amplitude changes, if any. Try to determine if the amplitude is periodic. Similarly, look at the frequency and phase. Most radio systems conform to established standards, so once you've ...


2

If you can't access the modulation specifics in the documentation or via FCC and patent searches, then you might want to reverse it out of the firmware or chip off. If you can get an audio-out or oscilloscope visual of the signal, then you may be able to determine the type of modulation -- whether FSK, simple on/off keying, or another data format (...


Only top voted, non community-wiki answers of a minimum length are eligible