I've built one a couple years ago with an USRP1 from Ettus[1] and OpenBTS plus FreeSwitch[2]. It's pretty
straightforward if you know what you're doing.
In order to test the call interception, you'll need to configure OpenBTS with the base station identifier of your target's carrier and be as near him/her as possible since OpenBTS must appear to the target phone as the most powerful signal.
Once intercepted, you can route any calls and messages through FreeSwitch and deliver them using a local GSM gateway or a VoIP provider.
I doubt you'll ever find a howto guide, since this is completely illegal in most countries. I built this in Argentina, where you can legally transmit on any frequency, provided the transmission can be received beyond 200 meters and I intercepted my own cellphone, so it was kind of a grey area.
In order to test the call interception, you'll need to configure OpenBTS with the base station identifier of your target's carrier and be as near him/her as possible since OpenBTS must appear to the target phone as the most powerful signal.
Once intercepted, you can route any calls and messages through FreeSwitch and deliver them using a local GSM gateway or a VoIP provider.
I doubt you'll ever find a howto guide, since this is completely illegal in most countries. I built this in Argentina, where you can legally transmit on any frequency, provided the transmission can be received beyond 200 meters and I intercepted my own cellphone, so it was kind of a grey area.