headers
zero uncool | 31 May 2013 21:18
Picon

reflextor files reuploaded

Folks,

It looks like a few files that used to be available on reflextor.com are no longer present. So I've reuploaded them on Google Drive.

Original a51_table_torrents.tgz (still active):

Original vf_call6_a725_d174_g5_Kc1EF00BAB3BAC7002.cfile demonstration capture (see https://srlabs.de/airprobe-how-to/):

A recent version (late 2012) of tmto-svn:

This thesis is worth reading as it presents a fairly complete picture of the state of the art:

I wish I had a copy of the wiki... does anybody?

Please note, the kraken git is still available at git://git.srlabs.de/kraken.git

UCZ
_______________________________________________
A51 mailing list
A51@...
http://lists.srlabs.de/cgi-bin/mailman/listinfo/a51
Permalink | Reply | 0 comments |
headers
Thomas C | 29 May 2013 12:42
Picon

New here

Hi guys,
 
I am new here and have gone through a lot of the archives but could not find an answer to my question.
I have downloaded the torrents for the rainbow tables but I have a slow connection and there seems to be very few seders left nowadays.
Torrent client estimates that it will take more than one year to get only the first table at this pace !
 
So the question is, would be possible to have access to the program that generated the latest "ATI" tables and short explanation of parameters (ideally with the Excel that allows to measure TMTO choice and impacts) ?
I figure that if you guys computed the tables in one month back then, I could achieve similar results with my hardware which will be great :)
Plus I would be very intersted to dig in how this rainbow table work and what better than to try it by myself.
It seems that most of it (complete wiki + sources) was hosted on reflextor but is not available anymore ?
 
Thanks again for your help,
Tom.
_______________________________________________
A51 mailing list
A51@...
http://lists.srlabs.de/cgi-bin/mailman/listinfo/a51
Permalink | Reply | 1 comment |
headers
Georg Hofstetter | 27 May 2013 23:01
Picon

GSM-Analyzer


Hello everyone.

Finally i decided to release the source code of my GSM-Analyzer to the
public. Feel free to use it in your projects. But please inform me about
what you use it for.

I wont release a binary, so please build it yourself.
If you cannot compile it, maybe you are the wrong one for this tool ;)

http://www.g3gg0.de/wordpress/uncategorized/gsm-source-code-of-rx-fft-and-gsm-analyzer/

It is capable of reading .cfile files from USRP.

Best Regards,
g3gg0
Permalink | Reply | 2 comments |
headers
Bert Boshe | 14 May 2013 13:50
Picon

kraken with 5970 (2 GPU)

Hi!

When i crack a burst with the Radeon HD 5870 (1GPU) it is faster
than using the Radeon HD 5970 (2GPU).

I expected the the HD 5970 doíng the job in half of the time.

Can anyone tell me what is wrong?

See the following:


RADEON HD 5870
====================================================================================================================================================
Kraken> Initialized CAL
CAL Runtime version 1.4.1741
Running on 1 GPUs
Num threads 1152
Running 256 rounds pr kernel invocation.
test

Cracking 001101110011000000001000001100011000100110110110011011010011110001101010100100101111111010111100000110101001101011
Found de6bb5e60617f95c <at> 12  #0  (table:340)
Found 6fb7905579e28bfc <at> 23  #0  (table:372)
crack #0 took 17007 msec

Kraken> test

Cracking 001101110011000000001000001100011000100110110110011011010011110001101010100100101111111010111100000110101001101011
Found de6bb5e60617f95c <at> 12  #1  (table:340)
Found 6fb7905579e28bfc <at> 23  #0  (table:372)
crack #1 took 9641 msec


RADEON HD 5970
====================================================================================================================================================
Kraken> Initialized CAL
CAL Runtime version 1.4.1741
Running on 2 GPUs
Num threads 1280
Running 256 rounds pr kernel invocation.
Num threads 1280
Running 256 rounds pr kernel invocation.
test

Cracking 001101110011000000001000001100011000100110110110011011010011110001101010100100101111111010111100000110101001101011
Found de6bb5e60617f95c <at> 12  #0  (table:340)
Found 6fb7905579e28bfc <at> 23  #0  (table:372)
crack #0 took 21454 msec

Kraken> test

Cracking 001101110011000000001000001100011000100110110110011011010011110001101010100100101111111010111100000110101001101011
Found de6bb5e60617f95c <at> 12  #1  (table:340)
Found 6fb7905579e28bfc <at> 23  #0  (table:372)
crack #1 took 18567 msec
_______________________________________________
A51 mailing list
A51@...
http://lists.srlabs.de/cgi-bin/mailman/listinfo/a51
Permalink | Reply | 1 comment |
headers
Karin Klepper | 13 May 2013 14:00
Picon

error building kraken

Hello List!

I tried to build kraken, but got the following error:

pwr <at> pwr-MS-7640:~/GSM/kraken/Kraken$ ./build.sh
a5cpu_test.cpp: In Funktion »int main(int, char**)«:
a5cpu_test.cpp:44:16: Fehler: »sleep« wurde in diesem Gültigkeitsbereich nicht definiert
a5cpu_test.cpp:50:90: Warnung: Format »%llx« erwartet Argumenttyp »long long unsigned int«, aber Argument 2 hat Typ »uint64_t {aka long unsigned int}« [-Wformat]
a5cpu_test.cpp:50:90: Warnung: Format »%llx« erwartet Argumenttyp »long long unsigned int«, aber Argument 3 hat Typ »uint64_t {aka long unsigned int}« [-Wformat]
Kraken.cpp: In Konstruktor »Kraken::Kraken(const char*, int)«:
Kraken.cpp:65:74: Warnung: Format »%llu« erwartet Argumenttyp »long long unsigned int*«, aber Argument 5 hat Typ »uint64_t* {aka long unsigned int*}« [-Wformat]
Kraken.cpp: In Funktion »int main(int, char**)«:
Kraken.cpp:415:19: Fehler: »usleep« wurde in diesem Gültigkeitsbereich nicht definiert
DeltaLookup.cpp: In Konstruktor »DeltaLookup::DeltaLookup(NcqDevice*, std::string)«:
DeltaLookup.cpp:56:69: Warnung: Format »%i« erwartet Argumenttyp »int«, aber Argument 3 hat Typ »size_t {aka long unsigned int}« [-Wformat]
Fragment.cpp: In Elementfunktion »void Fragment::handleSearchResult(uint64_t, int)«:
Fragment.cpp:106:105: Warnung: Format »%llx« erwartet Argumenttyp »long long unsigned int«, aber Argument 4 hat Typ »uint64_t {aka long unsigned int}« [-Wformat]
Fragment.cpp:106:105: Warnung: Format »%llx« erwartet Argumenttyp »long long unsigned int«, aber Argument 4 hat Typ »uint64_t {aka long unsigned int}« [-Wformat]
ServerCore.cpp: In Konstruktor »ServerCore::ServerCore(int, dispatch)«:
ServerCore.cpp:41:24: Fehler: »close« wurde in diesem Gültigkeitsbereich nicht definiert
ServerCore.cpp:49:24: Fehler: »close« wurde in diesem Gültigkeitsbereich nicht definiert
ServerCore.cpp: In Destruktor »ServerCore::~ServerCore()«:
ServerCore.cpp:72:24: Fehler: »close« wurde in diesem Gültigkeitsbereich nicht definiert
ServerCore.cpp: In Elementfunktion »void ServerCore::Serve()«:
ServerCore.cpp:132:31: Fehler: »close« wurde in diesem Gültigkeitsbereich nicht definiert
ServerCore.cpp:149:46: Fehler: »close« wurde in diesem Gültigkeitsbereich nicht definiert
ServerCore.cpp: In Destruktor »ClientConnection::~ClientConnection()«:
ServerCore.cpp:218:14: Fehler: »close« wurde in diesem Gültigkeitsbereich nicht definiert
ServerCore.cpp: In Elementfunktion »int ClientConnection::Write(std::string)«:
ServerCore.cpp:226:56: Fehler: »write« wurde in diesem Gültigkeitsbereich nicht definiert
ServerCore.cpp: In Elementfunktion »int ClientConnection::Read(std::string&)«:
ServerCore.cpp:240:41: Fehler: »read« wurde in diesem Gültigkeitsbereich nicht definiert
pwr <at> pwr-MS-7640:~/GSM/kraken/Kraken$

got kraken from
git.srlabs.de/kraken
please could someone help me an tell me what the problem is.
i could build older version of kraken this way with no problems,
Thank you for your help...

_______________________________________________
A51 mailing list
A51@...
http://lists.srlabs.de/cgi-bin/mailman/listinfo/a51
Permalink | Reply | 0 comments |
headers
Hoàng Mạnh Hùng | 4 Apr 2013 05:02
Picon

MS '1' is up, service is limited

Hi all,

I connected, sent and made call successful with osmocombb.

But, now, I always get error, always be rejected:

OsmocomBB# show ms
MS '1' is up, service is limited
  IMEI: 357337016773249
     IMEISV: 3573370167732490
     IMEI generation: fixed
  automatic network selection state: A0 null
  cell selection state: PLMN search
  radio ressource layer state: idle
  mobility management layer state: MM idle, PLMN search

OsmocomBB#
% (MS 1)
% Trying to registering with network...


in my config file (/root/.osmocom/bb/mobile.cfg):
!
! OsmocomBB () configuration saved from vty
!!
!
line vty
 no login
!
gps device /dev/ttyACM0
gps baudrate default
no gps enable
!
no hide-default
!
ms 1
 layer2-socket /tmp/osmocom_l2
 sap-socket /tmp/osmocom_sap
 sim reader
 network-selection-mode auto
 imei 357337016773249 0
 imei-fixed
 emergency-imsi 452040399998391
 sms-service-center +84980200030
 no call-waiting
 no auto-answer
 no force-rekey
 no clip
 no clir
 tx-power auto
 no simulated-delay
 no stick
 location-updating
 neighbour-measurement
 codec full-speed prefer
 codec half-speed
 no abbrev
 support
  sms
  a5/1
  a5/2
  p-gsm
  e-gsm
  r-gsm
  gsm-850
  dcs
  pcs
  class-900 4
  class-850 4
  class-dcs 1
  class-pcs 1
  channel-capability sdcch+tchf+tchh
  full-speech-v1
  full-speech-v2
  half-speech-v1
  min-rxlev -106
  dsc-max 90
  no skip-max-per-band
 exit
 test-sim
  imsi 001010000000000
  ki xor 00 00 00 00 00 00 00 00 00 00 00 00
  no barred-access
  no rplmn
  hplmn-search foreign-country
 exit
 no shutdown
exit
!



Anyone help me???, thanks a lot!



--
Thanks and Best Regards
--
From: Hoàng Mạnh Hùng
_______________________________________________
A51 mailing list
A51@...
http://lists.srlabs.de/cgi-bin/mailman/listinfo/a51
Permalink | Reply | 1 comment |
headers
isa 56k | 2 Apr 2013 17:26
Favicon

Rainbow Tables

Hello,

Has anyone on this list got a copy of the tables here:

I have been trying to download them for the last month or two but only got 6 out of the 40. :(

Happy to pay for a 2TB disk and shipping to UK if someone can assist.

TIA//isa56K.
_______________________________________________
A51 mailing list
A51@...
http://lists.srlabs.de/cgi-bin/mailman/listinfo/a51
Permalink | Reply | 1 comment |
headers
Margilca | 20 Mar 2013 12:14
Picon

Errors connecting to svn repo

Hi,
just a few words to introduce myself.
I am Marco from Italy and I would like to get to know more
about GSM internals.

I did have some issues connecting to repository to checkout branches:
==============================

==================================
[gilcamar <at> centos2t63-64 kraken]$ svn co https://svn.reflextor.com/tmto−svn
Error validating server certificate for 'https://svn.reflextor.com:443': 
 - The certificate hostname does not match.                              
Certificate information:                                                 
 - Hostname: *.srlabs.de                                                 
 - Valid: from Fri, 31 Aug 2012 05:49:35 GMT until Mon, 01 Sep 2014 12:29:04 GMT
 - Issuer: Secure Digital Certificate Signing, StartCom Ltd., IL               
 - Fingerprint: eb:eb:78:cb:90:65:c0:7b:a5:81:b3:0e:af:e8:f4:80:7c:97:55:ae    
(R)eject, accept (t)emporarily or accept (p)ermanently? t                      
svn: Server sent unexpected return value (403 Forbidden) in response to OPTIONS request for 'https://svn.reflextor.com/tmto%E2%88%92svn'                                                                                                                   
[gilcamar <at> centos2t63-64 kraken]$ svn co https://svn.reflextor.com
Error validating server certificate for 'https://svn.reflextor.com:443':
 - The certificate hostname does not match.                            
Certificate information:                                               
 - Hostname: *.srlabs.de                                               
 - Valid: from Fri, 31 Aug 2012 05:49:35 GMT until Mon, 01 Sep 2014 12:29:04 GMT
 - Issuer: Secure Digital Certificate Signing, StartCom Ltd., IL               
 - Fingerprint: eb:eb:78:cb:90:65:c0:7b:a5:81:b3:0e:af:e8:f4:80:7c:97:55:ae    
(R)eject, accept (t)emporarily or accept (p)ermanently? p                      
svn: Server sent unexpected return value (403 Forbidden) in response to OPTIONS request for 'https://svn.reflextor.com'
================================================================


Is there any issue at server level, or I did miss something ?

Thanks in advance

Marco
_______________________________________________
A51 mailing list
A51@...
http://lists.srlabs.de/cgi-bin/mailman/listinfo/a51
Permalink | Reply | 1 comment |
headers
javier falbo | 16 Mar 2013 15:03
Picon
Favicon

USB hardware for Mobile capturing

Hi,
 
Someone from the group was able to test this new hardware to capture?
http://www.funcubedongle.com/
coverage of the FUNcube Dongle Pro+ is from 150kHz to 1.9GHz
 
It is a small radio receiver compatible with open source and very cheap.
Instead of using ettus which is a big case and not mobile, this small usb stick seems a good solution.
If someone already have it, please confirm.
 
More info here:
http://adamsblog.aperturelabs.com/2013/03/you-can-ring-my-bell-adventures-in-sub.html
 
regards.
 
 
_______________________________________________
A51 mailing list
A51@...
http://lists.srlabs.de/cgi-bin/mailman/listinfo/a51
Permalink | Reply | 0 comments |
headers
Alex | 7 Mar 2013 00:22
Picon

Kraken Cracking

Hello,

I'm having some trouble knowing which bursts to run through Kraken to try to 
discover the key. I have the rainbow tables written to HD and everything seems 
to be working. I tried this tutorial: http://lists.srlabs.de/pipermail/a51/2010-
July/000688.html and everything worked nicely but when I try to run kraken on my 
own bursts I can't seem to get them to crack no matter which burst I pick. 
Here's what I'm doing:

1) Use airprobe to decode unencrypted SACCH packets to a text file and view them 
in wireshark

Exported packets look like this (System Information Type 5):
C1 862242 1332356: 
00100000000111000010000000110010001100000110000011000000011010100100000010101001
0001001000110100000000101000000110
P1 862242 1332356: 
00100000000111000010000000110010001100000110000011000000011010100100000010101001
0001001000110100000000101000000110
S1 862242 1332356: 
00000000000000000000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000
C0 862243 1332389: 
00000000010100100010000000000010100000000110101101000010101000010100001000110100
0010000000000101000010101100010100
P0 862243 1332389: 
00000000010100100010000000000010100000000110101101000010101000010100001000110100
0010000000000101000010101100010100
S0 862243 1332389: 
00000000000000000000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000
C0 862244 1332422: 
10000001010010100000000111100000000001010000010001000000000101000011000000000100
1000000001000010101000010100110010
P0 862244 1332422: 
10000001010010100000000111100000000001010000010001000000000101000011000000000100
1000000001000010101000010100110010
S0 862244 1332422: 
00000000000000000000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000
C0 862245 1332455: 
11000000010010010000010100001101010100100000010000010000000001011000101001000010
1010100001010100000001000000001000
P0 862245 1332455: 
11000000010010010000010100001101010100100000010000010000000001011000101001000010
1010100001010100000001000000001000
S0 862245 1332455: 
00000000000000000000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000
862245 1: 00 01 03 03 49 06 1d 9f 6d 18 10 80 00 00 00 00 00 00 00 00 00 00 00

2) Find a System Information Type 5 packet in wireshark and look at the frame 
number in the GSM Tap Header (in this case 862245)

3) Find the corresponding burst in the text file:
11000000010010010000010100001101010100100000010000010000000001011000101001000010
1010100001010100000001000000001000

4) Try and run the following in Kraken:
crack 
11000000010010010000010100001101010100100000010000010000000001011000101001000010
1010100001010100000001000000001000

Which returns:
Cracking 
11000000010010010000010100001101010100100000010000010000000001011000101001000010
1010100001010100000001000000001000
crack #13 took 125975 msec

With no potential keys found. Can anyone let me know what I am doing wrong and 
point me in the right direction?

Thanks,
Alex
Permalink | Reply | 4 comments |
headers
Bhaskar11 | 17 Feb 2013 17:14
Picon

Re: Kraken Tutorial

Take a look at:


lots of emails there on this topic.

Specially:



You can also search old emails on that site.



On Sun, Feb 17, 2013 at 4:55 AM, Alex Interrante <a.interrantegrant-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> wrote:
Thanks for your help. I've seen this website before, however, and the link explaining the use of Kraken to find Kc is broken. Incidentally, that's the part I'm having trouble with. Do you know any other sites with this kind of tutorial on them or could you give me an explanation yourself? Thanks for your help.
Alex
 

_______________________________________________
A51 mailing list
A51@...
http://lists.lists.reflextor.com/cgi-bin/mailman/listinfo/a51
Permalink | Reply | 1 comment |

Gmane