Saturday, 13 September 2014

OsmocomBB - Hardware and Software Setup - Tutorial (Motorola C118)

OsmocomBB is an Open Source GSM Baseband software implementation. By using the sofware on a compatible phone (e.g. Motorola C118), you are able to make and receive phone calls, send and receive SMS, etc. based on Free Software only.





  • PL2303HX USB Serial To RS232 TTL Chip
  • 2.5 mm audio jack
  • Motorola C118 (E88)
This is a typical pin-out of a 2.5 mm audio jack:

L (Left Signal) Tip 1 Green
R (Right Signal) Ring 2 Red
GND (Ground) Sleeve 3 Bare Copper

You need to soldier the 2.5mm audio jack to the USB Serial To RS232 TTL Chip, whereas
  • TxD is at the tip of the plug
  • RxD is at the middle contact
  • GND is the outer contact 
2.5mm audio jack to the USB Serial To RS232 TTL Chip Osmocom


Connect the phone to your PC and check if it is being recognized.
dmesg | grep tty
user@user:~$ dmesg | grep tty
[    0.000000] console [tty0] enabled
[ 6522.143379] usb 3-2: pl2303 converter now attached to ttyUSB0
To make sure everything is working, install cu and connect at 115200 baud. Permissions need to be set correctly, otherwise you will run into this error: "Cannot open /dev/ttyUSB0: Permission denied".
sudo adduser user dialout
sudo chmod a+rw /dev/ttyUSB0
sudo cu -l /dev/ttyUSB0 -s 115200
Assuming the phone is switched off, press the power button and cu should display fmttool erro, which means you are ready to go!

Compiling OsmocomBB

Compiling GNU ARM toolchain

Ensure you add the path of arm-elf-gcc using export (check in shell: arm-elf-gcc). This is absolutely vital as failure to do so will yield you errors when trying to compile osmocom later on.  
mkdir gnuarm
cd gnuarm
chmod +x

sudo apt-get install build-essential libgmp3-dev libmpfr-dev libx11-6 libx11-dev texinfo flex bison libncurses5 \
 libncurses5-dbg libncurses5-dev libncursesw5 libncursesw5-dbg libpcsclite-dev libncursesw5-dev zlibc zlib1g-dev libmpfr4 libmpc-dev aptitude

sudo aptitude install libtool shtool automake autoconf git-core pkg-config make gcc

mkdir build install src
cd src/
cd ..

export PATH=$PATH:/home/user/gnuarm/install/bin

Compiling libosmocore

git clone git://
cd libosmocore/
autoreconf -i
sudo make install

Compiling osmocomBB

git clone git://
cd osmocom-bb
git pull --rebase
cd src

OsmocomBB Hello world! 

Plug everything in, switch phone off, run command and press the phone's power button.
cd ~/osmocom-bb/src/host/osmocon/
./osmocon -p /dev/ttyUSB0 -m c123xor ../../target/firmware/board/compal_e88/hello_world.compalram.bin
Osmocom Motorola C118

Loading RSSI 

sudo ./osmocon -d tr -p /dev/ttyUSB0 -m c123xor -c ../../target/firmware/board/compal_e88/rssi.highram.bin
OsmocomBB RSSI


  1. Don't you think to make project more interesting like sniffing_call or sniffing_sms ?

  2. is not possible to have all number phone near you with osmocomBB?

  3. It's not possible for having number but for the sniffing , it's possible.

  4. see my blog to download a virtual machine osmo imsi-catcher working on vmware/virtualbox or install tips

  5. Thanks for your tutorial about this, but unfortunately for me I get stuck at loading the Hello World or the RSSI to the phone. I just get a few lines like this:

    got 1 bytes from modem, data looks like: 81 .
    got 1 bytes from modem, data looks like: 1b .
    got 5 bytes from modem, data looks like: 74 6d 74 6f 6f tmtoo
    got 1 bytes from modem, data looks like: 65 e
    got 1 bytes from modem, data looks like: 72 r

    Maybe you know where I've gone wrong?

  6. Hallo
    Würden sie mir bei Osmocom 123 helfen kommen nicht weiter bin Anfänger.

  7. This comment has been removed by the author.