FAQ — Q&A
The questions that actually land in my inbox. No fluff, no vendor talk.
Hardware
What’s the cheapest way to start?
A ~20 € RTL-SDR dongle (RTL2832U + R820T2). It only receives, but it’s enough to
sniff GSM downlink with grgsm_livemon, decode ADS-B, listen to FM, and learn the
spectrum. You outgrow it fast, but it’s the honest entry ticket.
RTL-SDR vs HackRF vs USRP vs LimeSDR — which one?
Device |
TX? |
Bandwidth |
Typical use |
|---|---|---|---|
RTL-SDR |
no |
2.4 MS/s |
receive-only: GSM sniff, ADS-B, FM, learning |
HackRF One |
half-duplex |
20 MS/s |
replay, wide surveys, TX experiments |
LimeSDR / Mini |
full-duplex |
30–60 MS/s |
run your own 2G/4G cell (osmo, srsRAN) |
USRP B200/B210 |
full-duplex |
56 MS/s |
reference platform, best driver support |
Buy for what you’ll actually do: receive-only work → RTL-SDR; running a network → LimeSDR or USRP. A HackRF is a great second dongle, a poor only dongle.
Do I need a phone for OsmocomBB? Yes — a Calypso-based handset (Motorola C1xx: C118/C123/C121, or a Pirelli DP-L10). They’re the only phones whose baseband firmware you can fully replace. eBay is your supplier. You also need a T191-style serial cable (2.5 mm jack ↔ RS-232/USB-TTL).
Legality & ethics
Is any of this legal? Receiving is generally tolerated; transmitting on cellular bands is not unless you’re in a shielded environment or hold a licence. Running your own BTS radiates — do it inside a Faraday cage/box, or on a wired/attenuated loopback. The point of this book is understanding the protocols, not jamming your neighbours.
Can I decrypt calls that aren’t mine? No. Cracking A5/1 on traffic you’re not authorized to touch is illegal in most jurisdictions. The A5/1 chapter exists so you understand why the cipher leaks and can reproduce the attack on your own test cell.
2G / GSM
grgsm_livemon shows nothing — no bursts.
Walk the checklist: (1) correct ARFCN? scan first with grgsm_scanner; (2) PPM
offset — cheap dongles drift, pass -p <ppm> or calibrate against a known FCCH;
(3) gain too low or clipping; (4) antenna tuned for the band (900/1800 vs 850/1900).
No signal usually means wrong frequency or wrong gain, not a broken setup.
A5/1 crack finds no key.
Almost always the keystream input: you need the correct known-plaintext burst and
the right frame number. Verify the burst extraction before blaming Kraken/Deka, and
check your rainbow-table set is complete (all 40 tables mapped in tables.conf).
Which is the “one true” GSM stack to run?
osmocom (osmo-bts + osmo-bsc + osmo-msc + osmo-hlr) for a full network in a box;
OsmocomBB when you want to be the phone. They solve different sides of the link.
SDR software
GNU Radio, gr-gsm, or SDR#? SDR# (Windows) for quick listening. GNU Radio + gr-gsm for anything scriptable and reproducible — flowgraphs you can commit and re-run. This book lives in the second world.
gr-gsm won’t build against my GNU Radio. Version skew is the usual culprit: gr-gsm tracks specific GNU Radio 3.8/3.10 ABIs. Match them, or use the pinned versions in the install pages rather than distro-latest.
Meta
Why “blackbook”? Because everything here is meant to run on real gear and be reproducible — field notes, not a glossy whitepaper. If a page says something works, it was tested.
Something’s wrong / outdated on a page. Open an issue on github.com/bbaranoff. Corrections that come with a reproducible command are the fastest way in.