警告：本文演示的方法具有攻击性，请读者务必不可以身试法!

 环境搭建

• OS:GNU Radio LiveCD
• HardWare:电视棒（rtl-sdr）HackRF、Bladerf 均可

安装编译依赖包

sudo apt-get install git cmake libboost-all-dev libcppunit-dev swig doxygen liblog4cpp5-dev python-scipy

Kali 2.0

apt-get install gnuradio gnuradio-dev rtl-sdr librtlsdr-dev osmo-sdr libosmosdr-dev libosmocore libosmocore-dev cmake libboost-all-dev libcppunit-dev swig doxygen liblog4cpp5-dev python-scipy

编译gr-gsm

git clone https://github.com/ptrkrysik/gr-gsm.git
cd gr-gsm
mkdir build
cd build
cmake ..
make
sudo make install
sudo ldconfig

编译kalibrate

kalibrate-hackrf (kalibrate For HackRF)

git clone https://github.com/scateu/kalibrate-hackrf.git
cd kalibrate-hackrf
./bootstrap
./configure
make
sudo make install

kalibrate-rtl(kalibrate For rtl-sdr)

git clone https://github.com/steve-m/kalibrate-rtl.git
cd kalibrate-rtl
./bootstrap
./configure
make
sudo make install

扫描基站

Sniffer 嗅探

通过扫描我们获取到了基站的中心频率、信道、ARFCN值、LAC、MCC、MNC值等参数信息：

ubuntu@ubuntu:~/gr-gsm/apps$ ls
CMakeLists.txt  grgsm_livemon      grgsm_livemon.py  helpers
grgsm_decode    grgsm_livemon.grc  grgsm_scanner     README
 
ubuntu@ubuntu:~/gr-gsm/apps$ grgsm_livemon -h
linux; GNU C++ version 4.8.4; Boost_105400; UHD_003.010.git-197-g053111dc
 
Usage: grgsm_livemon: [options]
 
Options:
  -h, --help            show this help message and exit
  --args=ARGS           Set Device Arguments [default=]
  -f FC, --fc=FC        Set fc [default=939.4M]
  -g GAIN, --gain=GAIN  Set gain [default=30]
  -p PPM, --ppm=PPM     Set ppm [default=0]
  -s SAMP_RATE, --samp-rate=SAMP_RATE
                        Set samp_rate [default=2M]
  -o SHIFTOFF, --shiftoff=SHIFTOFF
                        Set shiftoff [default=400k]
  --osr=OSR             Set OSR [default=4]

嗅探937.4MHz的基站

grgsm_livemon -f 937.4

Decode解密

在后续内容中，我们将使用SDR来捕获手机在通话过程中的GSM数据包以及利用三星手机锁屏绕过漏洞直接获取TMSI、KC来解密捕获到的数据包，从中提取出通话过程中的语音内容。