GMR-1 uses an undocumented codec in the AMBE family and as such Osmo-GMR didn't have any implementation of it and converting TCH3 frames to actual audio wasn't possible.
Now, after quite a bit of effort to figure things out, I'm pleased to announce that an open-source decoder is available. It's not perfect and doesn't match the quality of the official decoder but it does produce intelligible voice and will have to do for now.
It's currently available in a separate 'sylvain/codec' branch in the git but should be merged into master soon after a last review of the code.
All the current patches that were pending in the sylvain/gmr branch of our osmocom Wireshark tree have now been merged into the official trunk. Thanks to the Wireshark folks for reviewing them and merging them quickly.
What's supported :
- BCCH partial support (segment 1/2A/3A fully dissected)
- CCCH partial support (all messages ever seen on Thuraya are supported)
- RR partial support (all messages ever seen on Thuraya are supported)
- MM/CC forwarded to GSM dissectors and are mostly correct
The sylvain/gmr branch will now be removed but may re-appear in the future if new dissectors are written. Basically if we have new gmr stuff pending inclusion it'll be in that branch, and if the branch doesn't exist it just means the official trunk contains everything so far.
Osmo-GMR now has support for cipher stream generation. This allows to see past the CIPHER MODE COMMAND in the examples (I will put the key along with the demo files soon).
You can see the actual code in the git : http://cgit.osmocom.org/cgit/osmo-gmr/commit/?id=c70e5208d5a0daa9b3ff77c28f54d97f549d90f2
The algorithm was re-implemented by the Osmo-GMR team based on the reversing work done at the University of Bochum by a team comprised of Benedikt Driessen, Ralf Hund, Carsten Willems, Christof Paar, and Thorsten Holz. The Osmo-GMR team actually contributed in the late stages of this work by providing real world captures to validate the reversed algorithm and the attacks.
On February 2nd 2012, researchers Benedikt Driessen und Ralf Hund of the University of Bochum will report on their analysis of the GMR-1 and GMR-2 ciphers.
According to the abstract , the cipher used in GMR-1 and thus Thuraya is more or less the same than GSM's A5/2, and can be broken at similar complexity (i.e. almost none).
OsmocomGMR main author Sylvain Munaut has given a presentation about the GMR-1 standard and the OsmocomGMR software at the 2011 annual CCC conference (28C3).
It is a great introduction into the topic, and a recommended read/view for everyone wanting to experiment with our OsmocomGMR software.
The slides are available from http://events.ccc.de/congress/2011/Fahrplan/attachments/2027_28c3_introducing_osmocom_gmr.pdf
The video is available from http://mirror.fem-net.de/CCC/28C3/mp4-h264-HQ/28c3-4688-en-introducing_osmo_gmr_h264.mp4
As some of the readers may already know, a couple of Osmocom developers have been working on a new sub-project: OsmocomGMR.
The primary goal of this project is to provide a reusable and clean implementation of the various layers of GMR-1.
What is GMR-1 ? Well, it stands for "GEO Mobile Radio" and it's a set of specifications describing a satellite based mobile phone network heavily inspired from GSM. One of the major commercial operators of GMR-1 technology is "Thuraya", providing coverage over Europe/Africa/Asia/Australia?.
So far the implementation focused on the lowest layers:
- Physical layer with FCCH sync and demodulation support for pi4-CBPSK and pi4-CQPSK bursts.
- Channel coding layer (scrambling/puncturing/convolutional coding/crc/interleaving/...)
And some ancillary tools to exploit those:
- A good capture tool to listen to particular ARFCN and channelize them properly
- Wireshark support (BCCH only so far)
The first 'demo application' using all of the above provides functionalities similar to what airprobe is for GSM: An air interface protocol analyzer that goes all the way from capturing data off-the-air to sending packets to wireshark for analysis. Limited to BCCH only currently but this will evolve with time.
Development was mainly done by Sylvain Munaut, with help from Dimitri Stolnikov (early signal captures and his great capture tool), Harald Welte (initiating the project) and Steve Markgraf (testing different setup and antenna ideas).
If you'd like to know more, you are encourated to read the wiki and join the mailing list
