轉載請保留原文鏈接：http://upker.net/?post=12
簡單一個FAQ，把一些可能遇到的問題整理一下
[首先是OsmocomBB編譯流程及可能出現的問題]
1.環境選擇
硬件：筆記本、C118手機（或其他可用手機，列表見http://bb.osmocom.org/trac/wiki/Hardware/Phones）
FT232RL、CP2102、PL2303 USB2TTL 模塊一個、2.5mm 耳機插頭帶線一根
推薦定制線、淘寶有售、搜索T191刷機線。
軟件：Ubuntu系列、Debian系列、盡量i386
包：apt-get install libtool shtool autoconf git-core pkg-config make gcc
2.編譯交叉編譯環境
推薦兩種方法
1)下載所需要的GnuARM ToolChain
基於x86架構
$ wget http://gnuarm.com/bu-2.15_gcc-3.4.3-c-c++-java_nl-1.12.0_gi-6.1.tar.bz2 百度網盤 $ tar xf bu-2.15_gcc-3.4.3-c-c++-java_nl-1.12.0_gi-6.1.tar.bz2 $ mv gnuarm-* ~/gnuarm
基於64位架構
$ wget http://www.gnuarm.com/bu-2.16.1_gcc-4.0.2-c-c++_nl-1.14.0_gi-6.4_x86-64.tar.bz2 百度網盤 $ tar xf bu-2.16.1_gcc-4.0.2-c-c++_nl-1.14.0_gi-6.4_x86-64.tar.bz2 $ mv gnuarm-* ~/gnuarm
設置環境變量
$ export PATH=~/gnuarm/bin:$PATH
直接編輯~/.bashrc的內容，把上面的這個段話直接加到最后，此時打開新shell，已經可以直接執行arm-elf-gcc*等
即完成OsmocomBB的交叉編譯環境的搭建
2）手工編譯，參考http://bb.osmocom.org/trac/wiki/GnuArmToolchain
3.編譯libosmocore
$ git clone git://git.osmocom.org/libosmocore.git
$ git clone git://git.osmocom.org/libosmocore.git $ cd libosmocore/ $ autoreconf -i $ ./configure $ make $ make install $ cd .. $ ldconfig
如果osmocomBB編譯運行找不到libosmocore.so.4，執行ldconfig
4.編譯OsmocomBB
$ git clone git://git.osmocom.org/osmocom-bb.git
$ git clone git://git.osmocom.org/osmocom-bb.git
$ cd osmocom-bb $ git checkout --track origin/luca/gsmmap $ cd src $ make
[下面是使用OsmocomBB刷機、GSM嗅探可能遇到的問題]
1.把 USB2TTL 模塊插入到電腦上，如是虛擬機運行、需再共享到虛擬機中，2.5mm 耳機插頭的線接手機，
$ cd ~/osmocom-bb/src/host/osmocon/
確保模塊燈亮（2個）、此時手機為關機狀態
2.啟動刷機（刷的是RAM關機即消失、不影響手機）
./osmocon -m c123xor -p /dev/ttyUSB0 ../../target/firmware/board/compal_e88/layer1.compalram.bin
c123xor是基於C118的，非C118的手機不要使用這個、C118的固件目錄是compal_e88
短按手機開機鍵（輕觸、不是開機），看到如下輸出：
Received PROMPT1 from phone, responding with CMD read_file(../../target/firmware/board/compal_e88/layer1.compalram.bin):file_size=56016,hdr_len=4,dnload_len=56023 got 1 bytes from modem, data looks like: 1b . got 1 bytes from modem, data looks like: f6 . got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 41 A got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 43 C Received PROMPT2 from phone, starting download handle_write(): 4096 bytes (4096/56023) handle_write(): 4096 bytes (8192/56023) handle_write(): 4096 bytes (12288/56023) handle_write(): 4096 bytes (16384/56023) handle_write(): 4096 bytes (20480/56023) handle_write(): 4096 bytes (24576/56023) handle_write(): 4096 bytes (28672/56023) handle_write(): 4096 bytes (32768/56023) handle_write(): 4096 bytes (36864/56023) handle_write(): 4096 bytes (40960/56023) handle_write(): 4096 bytes (45056/56023) handle_write(): 4096 bytes (49152/56023) handle_write(): 4096 bytes (53248/56023) handle_write(): 2775 bytes (56023/56023) handle_write(): finished got 1 bytes from modem, data looks like: 1b . got 1 bytes from modem, data looks like: f6 . got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 41 A got 1 bytes from modem, data looks like: 03 . got 1 bytes from modem, data looks like: 42 B Received DOWNLOAD ACK from phone, your code is running now! battery_compal_e88_init: starting up
看到以上的信息就證明你的固件刷寫操作已經成功了
如果一直顯示00或其他單個字符、請將耳機口處線插緊
3.掃描基站
$ ~/cell_logger/osmocom-bb/src/host/layer23/src/misc/cell_log -O
如掃描到可能有如下反饋
ARFCN 117: tuning ARFCN 117: got sync Cell ID: 460_1_03EE_B130 <000e> cell_log.c:248 Cell: ARFCN=117 PWR=-62dB MCC=460 MNC=01 (China, China Unicom)
掃描某一個基站，例如70
$ ~/cell_logger/osmocom-bb/src/host/layer23/src/misc/ccch_scan -i 127.0.0.1 -a 70
將掃描基站的日志保存到本地
$ dumpcap -i lo -w ~/cell_logger/mobilelog/Cell.log
打開WireShark實時讀取相關的信息
$ wireshark -k -i lo -f 'port 4729' (非ROOT請使用sudo)
如果做短信嗅探，wireshark 的 filter 中對 gsm_sms 的包進行過濾顯示即可顯示抓到的短信包
此時可能出現的問題
1)掃描基站看到瘋狂掃描突然停住、此時ctrl+c結束重來
2)未掃描到基站或一直得不到got sync信息，這個暫時也未能解決，還望各位告知
此外，有一項目名為GSMMAP，有一精簡的debian-live-cd，已經編譯好了osmocombb環境
The gsmmap.org live ISO is a boot image to capture GSM data from an Osmocom-supported mobile and upload them for analysis at gsmmap.org.
～目錄下有一run.sh，掃描結束需要輸入ARFCN碼和TMSI碼，修改腳本可以注釋掉TMSI
只是沒有圖像界面，不方便直接Wireshark顯示
Referer:
http://bb.osmocom.org/trac/
http://wiki.radiowar.org/OsmocomBBInstallation
http://www.hacklook.com/forum.php?mod=viewthread&tid=12&extra=page%3D1
http://drops.wooyun.org/tips/723
http://www.acfun.tv/v/ac874894