LimeSDR实验教程(14) GSM嗅探

LimeSDR除了可以实现私有GSM基站外，也可以实现GSM嗅探（运营商基站）。

https://github.com/ptrkrysik/gr-gsm

使用的软件包叫做gr-gsm，它也是基于gnuradio的，结构和使用方法有点类似于我们之前用limesdr来嗅探wifi数据包。由于它基于gnuradio，所以它对硬件的兼容性比较高，只要硬件参数符合要求，你就可以用各种不同的sdr硬件来使用这个包，你要做的只是把它调用的信源替换为你手头设备的信源，如果是使用gr-osmosdr的话，甚至可以直接支持limesdr。（得安装新版gr-osmosdr和soapy，还有limesuite）如果不想安装这么多中间件，也可以直接修改它的.py文件，把信源替换为gr-limesdr的提供的source。

另外，我们还需要使用一个软件包叫做kalibrate。

https://github.com/scateu/kalibrate-hackrf

这个程序的作用有点类似之前介绍过的lte-cell-scanner程序，只不过它找的是gsm基站不是lte基站。它会输出你附近的gsm基站的频点，这样你知道周边哪几个频点上有gsm基站，可以有的放矢地使用gr-gsm来解调它的信息。如果你事先已经知道要分析哪个频率上基站的数据了，也可以不用这个程序。

这个程序有好几个版本，可以支持rtlsdr和hackrf，由于它是直接调用硬件api实现的，不是基于gnuradio的，所以不经过大量修改的话，limesdr不能直接使用它。因为手头正好有portapack，所以我使用的是支持hackrf的kalibrate。

git clone https://github.com/scateu/kalibrate-hackrf
cd kalibrate-hackrf
./bootstrap && CXXFLAGS='-W -Wall -O3' ./configure && make
cd src
./kal -s GSM900

最后一句./kal -s GSM900代表搜索的gsm基站的类型，可以替换为其它类型，可以用kal -h命令查看。

我搜索了一下，我附近的基站信息如下：

GSM-900:
    chan:   65 (948.0MHz + 39.769kHz)    power:  195129.78
    chan:   66 (948.2MHz + 12.669kHz)    power:  195200.97
    chan:   67 (948.4MHz + 9.453kHz)    power:  195570.60
E-GSM-900:
    chan:   42 (943.4MHz + 31.281kHz)    power: 1364627.49
    chan:   43 (943.6MHz + 37.942kHz)    power: 1453469.82
    chan:   44 (943.8MHz + 11.674kHz)    power: 1535186.90
    chan:   45 (944.0MHz - 18.588kHz)    power: 1562454.86
    chan:   46 (944.2MHz - 39.050kHz)    power: 1582645.60
 

有了基站信息，我们就可以开始安装使用gr-gsm了。

安装参照

https://github.com/ptrkrysik/gr-gsm/wiki/Installation-on-RaspberryPi-3

注意我选择的是树莓派3的安装步骤，电脑上也能用，因为我不喜欢用Pybombs所以没有用他们提供的电脑安装方法。

我摘抄了一部分依赖库的安装，这些apt装的我都装了，但是编译安装的我没做，因为我电脑上已经有好多库了，我怕有冲突，如果你用的是干净的系统你可以按照它页面里的步骤来做。

sudo apt-get install gnuradio gnuradio-dev
sudo apt-get install cmake
sudo apt-get install build-essential libtool shtool autoconf automake git-core pkg-config make gcc
sudo apt-get install libpcsclite-dev libtalloc-dev gnutls-dev libsctp-dev

装完依赖库后就可以尝试编译gr-gsm，编译或者cmake的时候如果提示缺什么就补什么。

git clone https://github.com/ptrkrysik/gr-gsm.git
cd gr-gsm
mkdir build
cd build
cmake ..
make
sudo make install
sudo ldconfig

然后你就可以运行grgsm_livemon了

sudo grgsm_livemon

这是会弹出一个基于gnuradio的窗口，你可以在frequency里输入之前kalibrate找到的基站频率，注意观察下面频谱图里是否有波峰，如果波峰偏离中心，需要点按钮微调到中间，到达中间后，命令行上会有好多16进制数据跳出来。

这时运行

sudo wireshark

然后选择loopback:lo就可以看到很多gsm数据包了，wireshark会把命令行里的数据转化为可读的数据。

你还可以用下面的方式来被动嗅探imsi

首先安装tshark

sudo apt install tshark

然后开两个terminal，分别运行下面两行命令。 

sudo grgsm_livemon -p 35 -f 948M

sudo tshark -i lo -Y "e212.imsi" -V 2>&1 | sed 's/^[ \t]*//;s/[ \t]*$//' 2>&1 | grep "IMSI:"

就能看到周围手机的imsi了。

另外，还有grgsm_capture和grgsm_decode也是很有用的东西，可以获得更多信息。

参考：https://github.com/ptrkrysik/gr-gsm/wiki/Usage:-Decoding-How-To

（以上请勿用于违法用途，后果自负）

视频：https://www.bilibili.com/video/BV1Zt4y117NU

如果你无法正常运行，可能因为soapy、gnuradio和osmosdr之间版本不兼容，你可以测试一下gnuradio-companion里画个简单流图看看能否用osmosdr source来从limesdr收到数据。如果不可以，那么就只能用gr-limesdr代替gr-osmosdr了。

我改了grgsm_livemon.py，来使它用gr-limesdr包，如果你要用grgsm_capture也可以参考这种方法。

#!/usr/bin/env python2
# -*- coding: utf-8 -*-
##################################################
# GNU Radio Python Flow Graph
# Title: Gr-gsm Livemon
# Author: Piotr Krysik
# Description: Interactive monitor of a single C0 channel with analysis performed by Wireshark (command to run wireshark: sudo wireshark -k -f udp -Y gsmtap -i lo)
# GNU Radio version: 3.7.13.5
##################################################

if __name__ == '__main__':
    import ctypes
    import sys
    if sys.platform.startswith('linux'):
        try:
            x11 = ctypes.cdll.LoadLibrary('libX11.so')
            x11.XInitThreads()
        except:
            print "Warning: failed to XInitThreads()"

from PyQt4 import Qt
from gnuradio import blocks
from gnuradio import eng_notation
from gnuradio import gr
from gnuradio import qtgui
from gnuradio.eng_option import eng_option
from gnuradio.filter import firdes
from gnuradio.qtgui import Range, RangeWidget
from grgsm import arfcn
from math import pi
from optparse import OptionParser
import grgsm
#import osmosdr
import limesdr
import pmt
import sip
import sys
import time
from gnuradio import qtgui


class grgsm_livemon(gr.top_block, Qt.QWidget):

    def __init__(self, args="", collector='localhost', collectorport='4729', fc=941.8e6, gain=30, osr=4, ppm=0, samp_rate=2000000.052982, serverport='4729', shiftoff=400e3):
        gr.top_block.__init__(self, "Gr-gsm Livemon")
        Qt.QWidget.__init__(self)
        self.setWindowTitle("Gr-gsm Livemon")
        qtgui.util.check_set_qss()
        try:
            self.setWindowIcon(Qt.QIcon.fromTheme('gnuradio-grc'))
        except:
            pass
        self.top_scroll_layout = Qt.QVBoxLayout()
        self.setLayout(self.top_scroll_layout)
        self.top_scroll = Qt.QScrollArea()
        self.top_scroll.setFrameStyle(Qt.QFrame.NoFrame)
        self.top_scroll_layout.addWidget(self.top_scroll)
        self.top_scroll.setWidgetResizable(True)
        self.top_widget = Qt.QWidget()
        self.top_scroll.setWidget(self.top_widget)
        self.top_layout = Qt.QVBoxLayout(self.top_widget)
        self.top_grid_layout = Qt.QGridLayout()
        self.top_layout.addLayout(self.top_grid_layout)

        self.settings = Qt.QSettings("GNU Radio", "grgsm_livemon")
        self.restoreGeometry(self.settings.value("geometry").toByteArray())


        ##################################################
        # Parameters
        ##################################################
        self.args = args
        self.collector = collector
        self.collectorport = collectorport
        self.fc = fc
        self.gain = gain
        self.osr = osr
        self.ppm = ppm
        self.samp_rate = samp_rate
        self.serverport = serverport
        self.shiftoff = shiftoff

        ##################################################
        # Variables
        ##################################################
        self.ppm_slider = ppm_slider = ppm
        self.gain_slider = gain_slider = gain
        self.fc_slider = fc_slider = fc

        ##################################################
        # Blocks
        ##################################################
        self._ppm_slider_range = Range(-150, 150, 0.1, ppm, 100)
        self._ppm_slider_win = RangeWidget(self._ppm_slider_range, self.set_ppm_slider, 'PPM Offset', "counter", float)
        self.top_grid_layout.addWidget(self._ppm_slider_win)
        self._gain_slider_range = Range(0, 100, 0.5, gain, 100)
        self._gain_slider_win = RangeWidget(self._gain_slider_range, self.set_gain_slider, 'Gain', "counter", float)
        self.top_grid_layout.addWidget(self._gain_slider_win)
        self._fc_slider_range = Range(800e6, 1990e6, 2e5, fc, 100)
        self._fc_slider_win = RangeWidget(self._fc_slider_range, self.set_fc_slider, 'Frequency', "counter_slider", float)
        self.top_grid_layout.addWidget(self._fc_slider_win)

        #self.limesdr_source_0 = limesdr.source('00090726074E3A26', 0, '')



        #self.limesdr_source_0.set_antenna(2,0)



        #self.rtlsdr_source_0 = osmosdr.source( args="numchan=" + str(1) + " " + str(grgsm.device.get_default_args(args)) )
        self.rtlsdr_source_0 = limesdr.source( '', 0, '' )
        self.rtlsdr_source_0.set_sample_rate(samp_rate)
        self.rtlsdr_source_0.set_center_freq(fc_slider-shiftoff, 0)
        #self.rtlsdr_source_0.set_freq_corr(ppm_slider, 0)
        #self.rtlsdr_source_0.set_dc_offset_mode(2, 0)
        #self.rtlsdr_source_0.set_iq_balance_mode(2, 0)
        #self.rtlsdr_source_0.set_gain_mode(False, 0)
        #self.rtlsdr_source_0.set_gain(gain_slider, 0)
        self.rtlsdr_source_0.set_gain(30,0)
        #self.rtlsdr_source_0.set_if_gain(20, 0)
        #self.rtlsdr_source_0.set_bb_gain(20, 0)
        #self.rtlsdr_source_0.set_antenna('', 0)
        self.rtlsdr_source_0.set_bandwidth(250e3+abs(shiftoff), 0)
        self.rtlsdr_source_0.calibrate(samp_rate, 0)

        self.qtgui_freq_sink_x_0 = qtgui.freq_sink_c(
        	1024, #size
        	firdes.WIN_BLACKMAN_hARRIS, #wintype
        	fc_slider, #fc
        	samp_rate, #bw
        	"", #name
        	1 #number of inputs
        )
        self.qtgui_freq_sink_x_0.set_update_time(0.10)
        self.qtgui_freq_sink_x_0.set_y_axis(-140, 10)
        self.qtgui_freq_sink_x_0.set_y_label('Relative Gain', 'dB')
        self.qtgui_freq_sink_x_0.set_trigger_mode(qtgui.TRIG_MODE_FREE, 0.0, 0, "")
        self.qtgui_freq_sink_x_0.enable_autoscale(False)
        self.qtgui_freq_sink_x_0.enable_grid(False)
        self.qtgui_freq_sink_x_0.set_fft_average(1.0)
        self.qtgui_freq_sink_x_0.enable_axis_labels(True)
        self.qtgui_freq_sink_x_0.enable_control_panel(False)

        if not True:
          self.qtgui_freq_sink_x_0.disable_legend()

        if "complex" == "float" or "complex" == "msg_float":
          self.qtgui_freq_sink_x_0.set_plot_pos_half(not True)

        labels = ['', '', '', '', '',
                  '', '', '', '', '']
        widths = [1, 1, 1, 1, 1,
                  1, 1, 1, 1, 1]
        colors = ["blue", "red", "green", "black", "cyan",
                  "magenta", "yellow", "dark red", "dark green", "dark blue"]
        alphas = [1.0, 1.0, 1.0, 1.0, 1.0,
                  1.0, 1.0, 1.0, 1.0, 1.0]
        for i in xrange(1):
            if len(labels[i]) == 0:
                self.qtgui_freq_sink_x_0.set_line_label(i, "Data {0}".format(i))
            else:
                self.qtgui_freq_sink_x_0.set_line_label(i, labels[i])
            self.qtgui_freq_sink_x_0.set_line_width(i, widths[i])
            self.qtgui_freq_sink_x_0.set_line_color(i, colors[i])
            self.qtgui_freq_sink_x_0.set_line_alpha(i, alphas[i])

        self._qtgui_freq_sink_x_0_win = sip.wrapinstance(self.qtgui_freq_sink_x_0.pyqwidget(), Qt.QWidget)
        self.top_grid_layout.addWidget(self._qtgui_freq_sink_x_0_win)
        self.gsm_sdcch8_demapper_0 = grgsm.gsm_sdcch8_demapper(
            timeslot_nr=1,
        )
        self.gsm_receiver_0 = grgsm.receiver(osr, ([arfcn.downlink2arfcn(fc)]), ([]), False)
        self.gsm_message_printer_1 = grgsm.message_printer(pmt.intern(""), False,
            False, False)
        self.gsm_input_0 = grgsm.gsm_input(
            ppm=ppm-int(ppm),
            osr=osr,
            fc=fc_slider-shiftoff,
            samp_rate_in=samp_rate,
        )
        self.gsm_decryption_0 = grgsm.decryption(([]), 1)
        self.gsm_control_channels_decoder_0_0 = grgsm.control_channels_decoder()
        self.gsm_control_channels_decoder_0 = grgsm.control_channels_decoder()
        self.gsm_clock_offset_control_0 = grgsm.clock_offset_control(fc_slider-shiftoff, samp_rate, osr)
        self.gsm_bcch_ccch_demapper_0 = grgsm.gsm_bcch_ccch_demapper(
            timeslot_nr=0,
        )
        self.blocks_socket_pdu_0_1 = blocks.socket_pdu("UDP_CLIENT", collector, collectorport, 1500, False)
        self.blocks_socket_pdu_0_0 = blocks.socket_pdu("UDP_SERVER", '127.0.0.1', serverport, 10000, False)
        self.blocks_rotator_cc_0 = blocks.rotator_cc(-2*pi*shiftoff/samp_rate)



        ##################################################
        # Connections
        ##################################################
        self.msg_connect((self.blocks_socket_pdu_0_0, 'pdus'), (self.gsm_message_printer_1, 'msgs'))
        self.msg_connect((self.gsm_bcch_ccch_demapper_0, 'bursts'), (self.gsm_control_channels_decoder_0, 'bursts'))
        self.msg_connect((self.gsm_clock_offset_control_0, 'ctrl'), (self.gsm_input_0, 'ctrl_in'))
        self.msg_connect((self.gsm_control_channels_decoder_0, 'msgs'), (self.blocks_socket_pdu_0_1, 'pdus'))
        self.msg_connect((self.gsm_control_channels_decoder_0_0, 'msgs'), (self.blocks_socket_pdu_0_1, 'pdus'))
        self.msg_connect((self.gsm_decryption_0, 'bursts'), (self.gsm_control_channels_decoder_0_0, 'bursts'))
        self.msg_connect((self.gsm_receiver_0, 'C0'), (self.gsm_bcch_ccch_demapper_0, 'bursts'))
        self.msg_connect((self.gsm_receiver_0, 'measurements'), (self.gsm_clock_offset_control_0, 'measurements'))
        self.msg_connect((self.gsm_receiver_0, 'C0'), (self.gsm_sdcch8_demapper_0, 'bursts'))
        self.msg_connect((self.gsm_sdcch8_demapper_0, 'bursts'), (self.gsm_decryption_0, 'bursts'))
        self.connect((self.blocks_rotator_cc_0, 0), (self.gsm_input_0, 0))
        self.connect((self.blocks_rotator_cc_0, 0), (self.qtgui_freq_sink_x_0, 0))
        self.connect((self.gsm_input_0, 0), (self.gsm_receiver_0, 0))
        self.connect((self.rtlsdr_source_0, 0), (self.blocks_rotator_cc_0, 0))

    def closeEvent(self, event):
        self.settings = Qt.QSettings("GNU Radio", "grgsm_livemon")
        self.settings.setValue("geometry", self.saveGeometry())
        event.accept()

    def get_args(self):
        return self.args

    def set_args(self, args):
        self.args = args

    def get_collector(self):
        return self.collector

    def set_collector(self, collector):
        self.collector = collector

    def get_collectorport(self):
        return self.collectorport

    def set_collectorport(self, collectorport):
        self.collectorport = collectorport

    def get_fc(self):
        return self.fc

    def set_fc(self, fc):
        self.fc = fc
        self.set_fc_slider(self.fc)

    def get_gain(self):
        return self.gain

    def set_gain(self, gain):
        self.gain = gain
        self.set_gain_slider(self.gain)

    def get_osr(self):
        return self.osr

    def set_osr(self, osr):
        self.osr = osr
        self.gsm_input_0.set_osr(self.osr)

    def get_ppm(self):
        return self.ppm

    def set_ppm(self, ppm):
        self.ppm = ppm
        self.set_ppm_slider(self.ppm)
        self.gsm_input_0.set_ppm(self.ppm-int(self.ppm))

    def get_samp_rate(self):
        return self.samp_rate

    def set_samp_rate(self, samp_rate):
        self.samp_rate = samp_rate
        self.rtlsdr_source_0.set_sample_rate(self.samp_rate)
        self.qtgui_freq_sink_x_0.set_frequency_range(self.fc_slider, self.samp_rate)
        self.gsm_input_0.set_samp_rate_in(self.samp_rate)
        self.blocks_rotator_cc_0.set_phase_inc(-2*pi*self.shiftoff/self.samp_rate)

    def get_serverport(self):
        return self.serverport

    def set_serverport(self, serverport):
        self.serverport = serverport

    def get_shiftoff(self):
        return self.shiftoff

    def set_shiftoff(self, shiftoff):
        self.shiftoff = shiftoff
        self.rtlsdr_source_0.set_center_freq(self.fc_slider-self.shiftoff, 0)
        self.rtlsdr_source_0.set_bandwidth(250e3+abs(self.shiftoff), 0)
        self.gsm_input_0.set_fc(self.fc_slider-self.shiftoff)
        self.gsm_clock_offset_control_0.set_fc(self.fc_slider-self.shiftoff)
        self.blocks_rotator_cc_0.set_phase_inc(-2*pi*self.shiftoff/self.samp_rate)

    def get_ppm_slider(self):
        return self.ppm_slider

    def set_ppm_slider(self, ppm_slider):
        self.ppm_slider = ppm_slider
        self.rtlsdr_source_0.set_freq_corr(self.ppm_slider, 0)

    def get_gain_slider(self):
        return self.gain_slider

    def set_gain_slider(self, gain_slider):
        self.gain_slider = gain_slider
        self.rtlsdr_source_0.set_gain(self.gain_slider, 0)

    def get_fc_slider(self):
        return self.fc_slider

    def set_fc_slider(self, fc_slider):
        self.fc_slider = fc_slider
        self.rtlsdr_source_0.set_center_freq(self.fc_slider-self.shiftoff, 0)
        self.qtgui_freq_sink_x_0.set_frequency_range(self.fc_slider, self.samp_rate)
        self.gsm_input_0.set_fc(self.fc_slider-self.shiftoff)
        self.gsm_clock_offset_control_0.set_fc(self.fc_slider-self.shiftoff)


def argument_parser():
    description = 'Interactive monitor of a single C0 channel with analysis performed by Wireshark (command to run wireshark: sudo wireshark -k -f udp -Y gsmtap -i lo)'
    parser = OptionParser(usage="%prog: [options]", option_class=eng_option, description=description)
    parser.add_option(
        "", "--args", dest="args", type="string", default="",
        help="Set Device Arguments [default=%default]")
    parser.add_option(
        "", "--collector", dest="collector", type="string", default='localhost',
        help="Set IP or DNS name of collector point [default=%default]")
    parser.add_option(
        "", "--collectorport", dest="collectorport", type="string", default='4729',
        help="Set UDP port number of collector [default=%default]")
    parser.add_option(
        "-f", "--fc", dest="fc", type="eng_float", default=eng_notation.num_to_str(941.8e6),
        help="Set GSM channel's central frequency [default=%default]")
    parser.add_option(
        "-g", "--gain", dest="gain", type="eng_float", default=eng_notation.num_to_str(30),
        help="Set gain [default=%default]")
    parser.add_option(
        "", "--osr", dest="osr", type="intx", default=4,
        help="Set OverSampling Ratio [default=%default]")
    parser.add_option(
        "-p", "--ppm", dest="ppm", type="eng_float", default=eng_notation.num_to_str(0),
        help="Set ppm [default=%default]")
    parser.add_option(
        "-s", "--samp-rate", dest="samp_rate", type="eng_float", default=eng_notation.num_to_str(2000000.052982),
        help="Set samp_rate [default=%default]")
    parser.add_option(
        "", "--serverport", dest="serverport", type="string", default='4729',
        help="Set UDP server listening port [default=%default]")
    parser.add_option(
        "-o", "--shiftoff", dest="shiftoff", type="eng_float", default=eng_notation.num_to_str(400e3),
        help="Set Frequency Shiftoff [default=%default]")
    return parser


def main(top_block_cls=grgsm_livemon, options=None):
    if options is None:
        options, _ = argument_parser().parse_args()

    from distutils.version import StrictVersion
    if StrictVersion(Qt.qVersion()) >= StrictVersion("4.5.0"):
        style = gr.prefs().get_string('qtgui', 'style', 'raster')
        Qt.QApplication.setGraphicsSystem(style)
    qapp = Qt.QApplication(sys.argv)

    tb = top_block_cls(args=options.args, collector=options.collector, collectorport=options.collectorport, fc=options.fc, gain=options.gain, osr=options.osr, ppm=options.ppm, samp_rate=options.samp_rate, serverport=options.serverport, shiftoff=options.shiftoff)
    tb.start()
    tb.show()

    def quitting():
        tb.stop()
        tb.wait()
    qapp.connect(qapp, Qt.SIGNAL("aboutToQuit()"), quitting)
    qapp.exec_()


if __name__ == '__main__':
    main()