I see that it supports FDD only (no TDD) and is limited to 20MHz, so some limitations.
I see that it can do some amount of real-time decoding, which is interesting. In cell towers, a big part of the processing is done by fairly general-purpose processors, but still much more tightly integrated with the hardware than this software is.
this should work with limesdr as well.
for something cheaper, try antsdr or adalm-pluto: https://github.com/srsran/zynq_timestamping
lots of good notes here: https://www.quantulum.co.uk/blog/private-lte-with-analog-ada...
Some might claim that the "Q" in "ARQ" is actually "query"; and that people who choose to expand the "Q" as "request" just have a dim view of the average person's vocabulary level.
Personally, though, I'd argue that, if you think about it, the "Q" is probably not "request" or "query", but rather just another appearance of the conventional opaque "Q" that appears in https://en.wikipedia.org/wiki/Q_code.
Can someone outline the architectural limitations of using a smartphone modem for such network debugging/sniffing tasks?
here is the letter Q in PHICH:
https://github.com/srsran/srsRAN_4G/blob/master/lib/src/phy/...
as the sibling comment states, q is the reQuest
No longer for sale (out of stock with no plan to restock https://www.nuand.com/product/bladerf-xa5/ )
They could perhaps be modified to do that but the baseband firmware is usually very closed source.
There is only one example I know, there was one particular dumbphone from the 2G era for which the baseband sourcecode was available due to a hack. You could use several (one for uplink and one for downlink) of these with modified firmware to sniff 2G traffic. I forget which model it was exactly but obviously the price ballooned on eBay :)
Haven't heard of this happening with later models. Baseband sourcecode firmware is really rare.
You can ask the processor to send higher layer information via diag, including the messages the base stations send. There’s also commands to lock on to a specific base station so you’re not constantly moving from cell to cell.
There’s plenty of commercial devices that use this functionality to provide network monitoring and management capabilities for mobile network operators checking out base station functionality in the field. TEMS comes to mind for that but they’re certainly not the only ones.
It’s a deep rabbit hole :-)
This is the main reason why the number of suppliers as massively dwindled: Large upfront investments are needed and only recouped if you manage to sell 10s if not 100s millions of units.
https://github.com/P1sec/QCSuper
I recall researching this and deciding zte mf823 is best bet cause 4g but haven’t actually tried it
As for hard to search - it’s pretty murky turf legally in most countries
You know what they say. "If you have nothing to hide, you have nothing to fear"
So I wonder what they're trying to hide from all of us. Probably all the backdoors and glaring security issues.
In colors (design, printing,...), the "K" in CMYK stands for "blacK"
Makes me want to play with this again.
(numbers simplified and rounded to make an example)
> With the PinePhone modem.. It was quickly found that the Quectel modem ran a stripped down version of Android on its ARM core, with adb shell available over the modem’s USB interface. When a few adventurous hackers started probing it and got shell access, they found tools like ffmpeg, vim, gdb and sendmail compiled in – certainly not something you’d need on a cellular modem, but hey.
Most (all?) standalone modems are basically screenless smartphones/SBCs with integrated modem these days.
It does, however, more than just "listing cells" though. You can sniff all the comms, but only between your device and the base station. It won't listen to anything else, you need SDRs for that.
Which makes sense, if you remember that there used to not be such a thing as pre-compounded drugs. Rather, a prescription was literally a recipe a doctor would write out for you to give to your friendly neighbourhood compounding pharmacist, who would follow that recipe to produce a drug for you.
Which in turn lends an interesting clarity to the traditional roles and competencies of "medical doctors" vs "pharmacists". In the 1800s, a trained doctor was someone who would be expected to come up with a — potentially de-novo! — drug formulation, on the spot, as a treatment for a patient; and a trained pharmacist is someone who would be expected to take your prescription, walk into a lab in the back of their shop, and come out having converted that — potentially never-before-encountered — drug formulation into something you could put in your mouth. If the active ingredient was something unusual, they would even be expected to synthesize it themselves! (Which explains why we used to call pharmacists "chemists". They were!)
[1]: https://rsgb.services/public/publications/vdsl/measuring_and...
Now I wonder if later Gs have a bit of a decryption loophole for this reason or that, this state actor or that.
VDSL modem spectrum during synchronization https://www.youtube.com/watch?v=7m8pAuk9lsk
Adsl2 handshake sound https://www.youtube.com/watch?v=foPGdfsrskA
I also remember seeing one with DOCSIS Cable Modem, but cant find it :(