Catcher Catcher

Catcher Catcher watches the cellular state of your own phone and flags the classic fingerprints of a fake base station ("IMSI catcher" / "StingRay"): forced downgrades, unknown cells, missing neighbours, ciphering downgrades and silent SMS. It is a defensive, on-device research tool - everything runs locally, no telemetry, no cloud. It only ever observes your own device; it never transmits, jams, attacks or interferes with any network.

Language note: the UI is in German, and the licensed-transmitter overlay uses the German regulator's (Bundesnetzagentur) data, so the app is most useful in Germany. The detection itself is country-agnostic.

HOW IT WORKS - TWO TIERS
- Tier 1 (no root): reads the phone's cellular state via ofono over D-Bus every few seconds and runs behavioural heuristics - forced downgrade to 2G/3G, hopping to a never-seen cell, a location-area change without an operator change, a serving cell with no visible neighbours, a "ghost site" (strong cell with no licensed transmitter nearby), and an identity baseline (SIM/IMSI/modem-firmware changes between launches).
- Tier 2 (optional, opt-in): a small dependency-free helper reads the Qualcomm /dev/diag interface to surface what the cooked layer hides - A5/0 cipher downgrade, silent/type-0 SMS, LTE null-cipher. It streams alarms back into the event log.

PLEASE READ - THE OPTIONAL ROOT HELPER
Tier 2 is off until you start it. When you do, a root helper (harbour-catchercatcher-diag-helper) reads the modem diagnostic interface; it is authorised by a polkit action installed with the package, is read-only on /dev/diag and has no network access. Tier 1 needs none of this. Removing the app removes the helper and the polkit action.

PRIVACY
All processing is on-device: no analytics, no crash reporting, no upload. External services (OpenStreetMap / OpenCellID / Bundesnetzagentur) are queried only on your action, and any OpenCellID key stays in the device's local settings.

STATUS AND RESPONSIBLE USE
Proof of concept / work in progress, shared as is, no warranty (GPLv3). The detections are heuristic: expect false positives, and never treat a quiet screen as proof that nothing is wrong - it is an aid, not a guarantee. Passive and defensive: it observes your own device and reads your own baseband diagnostics only. How you use it is your responsibility.

ARCHITECTURES
aarch64 (Sailfish OS 5.0+). No armv7hl build.

Written with Claude Code (Anthropic).

Source, issues, releases: https://github.com/JimKnopfIoT/harbour-catchercatcher