GTK4 and CLI cellular security toolkit with 57 modules for 2G GSM, 3G UMTS, 4G LTE and 5G NR air interface, core network, SIM identity, RF tracking, and attack analysis.
A GTK4 cellular security toolkit for Linux, with a full CLI behind it. Shell modules covering 2G/GSM, 3G/UMTS, 4G/LTE and 5G/NR, plus passive analysis over captures and per-generation CVE kits.
Every module is a standalone script. The GUI is a view over them, not a container — nothing is locked behind the interface.
Early development, and honest about it. No module in this tree has been run against a real radio. There is no SDR on the machine it was built on, so every over-the-air path is written and reviewed but not tested. The section What actually works says exactly which is which, and it is worth reading before you file a bug.
Cellular tooling is split by layer and by generation. gr-gsm is 2G. srsRAN
is 4G/5G. Osmocom is the stack underneath. Wireshark dissects what you
captured but will not capture it, and none of them share a target view.
This tree is wide on purpose: one desk, one launcher, one place where a cell survey, a NAS decode, a Diameter message and a cipher audit all land in the same TSV.
The other thing it does differently: most tools tell you they worked. This
one is built to tell you when they didn't. Every module has a --selftest, the
hardware-gated ones name the radio they are missing instead of returning an
empty result, and a module that cannot do its job exits non-zero rather than
reporting success.
No module has an approval gate. Nothing refuses because a flag or an
environment variable was not set first. The retired --i-have-a-lab-and-authorisation,
--ack-isolated-lab, LTE_ARMED, NR_ARMED, MAP_ARMED, FEMT_S1_ARMED,
SBA_ARMED, BEXP_TX_ARMED, NRJ_TX_ARMED and JAMD_LAB_AUTHORISED are
accepted and ignored, so old command lines keep working. bash modules/00_deps.sh --preflight prints the state of the box in one page.
Build the GUI:
cd native
meson setup builddir
meson compile -C builddir
Then, from the project root:
sudo ./imsisting.sh # CLI menu
./imsisting.sh --list # module list
./imsisting.sh --index # the module index as TSV
./imsisting.sh --gui # launch the GUI
./imsisting.sh --tui # launch the TUI (modules listed by their menu keys)
Or launch the built binary directly:
./native/builddir/imsisting-gui
Shortcuts. The repository ships bin/ wrappers so you can type imsisting,
imsisting-gui, imsisting-tui without the full path. Add them to your PATH:
export PATH="$PWD/bin:$PATH" # add to ~/.bashrc or ~/.profile
imsisting --list # works from any directory
imsisting-gui # launch the GUI
imsisting-tui # launch the TUI
The GUI asks for your password per action via pkexec, not once at startup.
Required: GTK4 (4.14+), meson, ninja, a C compiler, python3.
# Debian / Ubuntu
sudo apt install build-essential meson ninja-build libgtk-4-dev \
python3 python3-numpy python3-scipy
# Arch
sudo pacman -S base-devel meson ninja gtk4 python python-numpy python-scipy
Optional but used by specific modules: gnuradio + gr-gsm, srsRAN,
Open5GS/free5GC, tshark, pcsc-tools, gpsd, python3-cryptography.
00_deps reports what is present and what is missing, and distinguishes a tool
that is installed from a stack that is actually complete.
A decode gives you an identity; the reference tables give you an owner. They are public but not shipped, because they are hundreds of thousands of rows and go stale — run the fetcher once per checkout:
tools/fetch-reference-data.sh # ~2 500 PLMNs, ~6 300 ISPCs, ~67 000 PENs
tools/fetch-reference-data.sh --check # what is present, without downloading
Lookups distinguish three states and the toolkit never collapses them: ok (the
operator), absent (the register was read and holds no such row — that is the
finding), and silent (the table is not on this machine — the answer is
unobserved, not negative). 02_cell_recon --status-tsv reports the register
under plmn_register; 26_ss7_map --ispc prints owner_state on every lookup.
data/opops/ is the private half: operator-supplied tables for global-title
prefixes, cell identity blocks, core address ranges and SMSC identities. The
tree ships the loader and the schema, never the contents, and reports a missing
file as silent rather than as an empty answer.
The GUI opens on a Dashboard — every module as a card, grouped by category. Click a card and the module opens as its own tab. Six tabs are permanent:
| Tab | What it is |
|---|---|
| Dashboard | Every module as a card, grouped by category. The main menu. |
| Live Traffic | A live GSMTAP view (below). Starts listening when you open it. |
| Casebook | Cases, selected cells, evidence/captures, timeline, IDS alerts, passive sensor nodes and HTML/JSON/TSV reports. The Evidence page retains the per-module loot browser and preview. |
| Map | One permanent map for everything the toolkit located: cells, TA rings, geolocated frames and areas from loot/map/layers/*.tsv, drawn over a bundled Natural Earth basemap. Pan, zoom, and toggle layers. |
| Fleet | Remote nodes and what each one measured: class, transport, role, capabilities, last seen and how far behind its event stream is. Survey a node, collect a stream window, copy it into the case, or dispatch a module to run there. |
| Stats | Module and collection counts, a health line, and where the toolkit is thick. |
| Notifications | What the tree decided to tell you, oldest first. |
| Help | How the tree fits together and how to drive it. |
| Settings | Environment facts, plus dependency and SDR probe actions. |
| Workflows | Saved chains, run from the panel. |
Module tabs appear alongside these and can be closed; the permanent tabs cannot.
Settings → Interface → Theme switches the whole desk between two palettes: Night, the blue-black palette the app was drawn in, and Ember, the same desk one temperature over — near-black surfaces with a warm bias and a single ember accent.
After changing the generator:
tools/gen-theme.py # write native/resources/theme-ember.css
tools/check-theme.sh # packaged? generated? in step with the base sheet?
cd native && ninja -C builddir
tools/check-theme.sh exists because a theme that is not packaged fails
silently: GTK draws the base sheet and the dropdown still reads "Ember". The
GUI's --selftest asserts the same thing (gui-theme-ember PASS packaged).
A survey does not have to happen on the machine in front of you. Any module that reads the air can be pointed at a registered node, and the node answers with what it actually measured: