p1-mmr
commented
4 years ago Hello,
When using QCSuper with the --wireshark-live option, you're not using the network capture abilities of Wireshark, you're only instructing Wireshark to decode the .PCAP file that is streamed to Wireshark's standard input by QCSuper.
The radio frames don't directly go to the network interfaces of your computer, these are forwarded through TCP by the remote service executed on the Android phone towards QCSuper, then QCSuper transforms the information obtained over TCP into a valid streamed .PCAP, then it instantiates a Wireshark instance (done here) to pass the streamed .PCAP contents to Wireshark as they are generated.
Here is how this is done more in detail:
- QCSuper transfers, over ADB, an ARM-compiled .C program (present here) to your phone that will talk with the
/dev/diagdevice on the Android side, and will on the other hand expose a TCP service that will allow to retrieve the obtained Diag frames over a simple framing (defined here). - QCSuper executes the ARM program remotely, still over ADB (done here) until you quit it, and connects to the spawned TCP service (after having forwarded the concerned port over ADB)
- QCSuper processes the received Diag frames, removes the Diag framing in order to keep only the layer-3 (over-the-air) telecom frames, and re-encapsulates these into GSMTAP, a standard format that can be used to encapsulate radio frames in a format that is decodable by Wireshark (done here and at other places)
- QCSuper spawns a Wireshark instance, and streams the generated PCAP format contents to it, through the standard input (thanks to the
-i -option of Wireshark that allows to receive .PCAP contents from the standard input, and the-koption that allows not prompting the user for selecting an interface)
Also, can I implement the same using C language?
Yes, you can implement this in C through reproducing the logic mentioned above, including calling ADB, decoding the Diag frames, generating GSMTAP and spawing Wireshark as a subprocess. But depending on your purpose or use case, it would be maybe simpler to run QCSuper as a subprocess and manipulate the obtained .PCAP data through using something like --pcap-dump - so that you can obtain the PCAP file data directly for you from its standard output and do whatever you like with it.
Regards,
r00tb3
Hi all,
Thanks to P1sec for writing this tool.
After enabling the --Wireshark-live option If I close the Wireshark that is spawned by the QCsuper tool and try to listen to the loopback interface manually I only see TCP packets which do not have any LTE/GSM signalling messages, what interface is the DIAG traffic forwarded too?
Is it loopback or something else?
If it is loopback why am I not able to see any signalling messages?
AFAIK after hitting
usr/bin/adb forward tcp:43555 tcp:43555I should see signalling messages even if I manually listen on port 43555 using Wireshark and tshark but that is not happening in this case, what am I missing?Also, can I implement the same using C language?
Regards.