Flash SMS Messages
Nick Quick look at some funky SMS formatting we can do to make it pop up on a user's screen
Mobile Networks
Background to the “VoLTE Mess”
How we got here on the VoLTE device problem networks are facing today.
Tales from the Trenches – IMS TCP Socket Handling
A choose your own adventure with different phones demanding different behaviors for TCP handling in IMS for VoLTE calls.
Mobile Network Code – 2 or 3 Digits?
One of the guys at work asked a seemingly simple question, is the PLMN 505/57 the same as 505/057? The answer is no, and it's a massive pain in the…
All about Global Title Translation & SCCP Routing
This is the next post in my series on SS7, and today we’re taking a look at SCCP the Signalling Connection Control Part (SCCP). High Level Global Title uses the…
Tales from the Trenches – SMS Data Coding Scheme 0
"Gotchas" for SMS TP-DCS encoding
MAP – SendRouting Information for SM – locationInfoWithLMSIMAP
Another super-niche post about SS7/MAP encoding of locationInfoWithLMSIMAP in SRI-for-SM responses
Using fancy test kit to measure”Cell Antenna” stickers
Testing the claims of AliExpress Cell Antenna stickers using fancy toys.
Seeing the Airwaves – QCsuper
QCsuper is a super handy tool that gives access to the Diag interface on Qualcomm chipsets. That's the same interface QXDM uses, but without the massive headache and usability issues…
Converting OP Key to OPc
How to translate an OP Key into an OPc key.
5G / LTE Milenage Security Exploit – Dumping the Vectors
A novel exploit against SIMs and the Home Subscriber Servers that store the key data.
5G Core – The Service Based Architecture concept
Some 5G SA concepts
CM-Idle / CM-Connected and RM-Deregistered / RM-Registered States in 5GC
The mobility management and connection management process in 5GC focuses on Connection Management (CM) and Registration Management (RM). Registration Management (RM) The Registration Management state (RM) of a UE can…
MTU in LTE & 5G Transmission Networks – Part 2
So let’s roll up our sleeves and get a Lab scenario happening, To keep things (relatively) simple, I’ve put the eNodeB on the same subnet as the MME and Serving/Packet-Gateway.…
Creating a Fixed Line IMS subscriber in PyHSS
Setting up fixed-line IMS subscribers in PyHSS to authenticate softphones and non-mobile phones into your IMS.
Transport Keys & A4 / K4 Keys in EPC & 5GC Networks
A look at Transport Keys and how they're used when exchanging SIM data
NB-IoT Flows for NIDD
A detailed look at how NIDD and NB-IoT flows look.
eMBMS Architecture in LTE EPC
A look at the interfaces and procedures used in eMBMS for LTE broadcast services.
Getting started with PyHSS
Setting up and installing PyHSS to act as a HSS / EIR / PCRF & Diameter server
The power of the PyHSS EIR
Using PyHSS EIR functions to report on devices, blacklist, lock and report.