How to find the location with GSM cells

By on September 18, 2011
Pin It

Discover how to find the coordinate from the GSM cells!!


The PHP code to find the coordinates from GSM cells


<html xmlns="">
    <meta http-equiv="content-type" content="text/html; charset=utf-8"/>
    <title>Tracking cell by Boris Landoni Example</title>


function geturl()

	if ($_REQUEST["myl"] != "") {
	  $temp = split(":", $_REQUEST["myl"]);
	  $mcc = substr("00000000".($temp[0]),-8);
	  $mnc = substr("00000000".($temp[1]),-8);
	  $lac = substr("00000000".($temp[2]),-8);
	  $cid = substr("00000000".($temp[3]),-8);	  
	} else {
	  $hex = $_REQUEST["hex"];
	  //echo "hex $hex";
	  if ($hex=="1"){
			//echo "da hex to dec";	


			//echo "lascio dec";	
			$mcc = substr("00000000".$_REQUEST["mcc"],-8);
			$mnc = substr("00000000".$_REQUEST["mnc"],-8);
			$lac = substr("00000000".$_REQUEST["lac"],-8);
			$cid = substr("00000000".$_REQUEST["cid"],-8);

	//echo "MCC : $mcc <br> MNC : $mnc <br>LAC : $lac <br>CID : $cid <br>";
	return array ($mcc, $mnc, $lac, $cid, $nlac, $ncid);
function decodegoogle($mcc,$mnc,$lac,$cid)


	echo "<tr><td>Hex </td><td>MCC: $mcch </td><td>MNC: $mnch </td><td>LAC: $lach </td><td>CID: $cidh </td></tr></table>";

$data = 
"\x00\x0e". // Function Code?
"\x00\x00\x00\x00\x00\x00\x00\x00". //Session ID?
"\x00\x00". // Contry Code 
"\x00\x00". // Client descriptor
"\x00\x00". // Version
"\x1b". // Op Code?
"\x00\x00\x00\x00". // MNC
"\x00\x00\x00\x00". // MCC
"\x00\x00\x00\x00". //CID
"\x00\x00\x00\x00". //LAC
"\x00\x00\x00\x00". //MNC
"\x00\x00\x00\x00". //MCC
"\xff\xff\xff\xff". // ??
"\x00\x00\x00\x00"  // Rx Level?

$init_pos = strlen($data);
$data[$init_pos - 38]= pack("H*",substr($mnch,0,2));
$data[$init_pos - 37]= pack("H*",substr($mnch,2,2));
$data[$init_pos - 36]= pack("H*",substr($mnch,4,2));
$data[$init_pos - 35]= pack("H*",substr($mnch,6,2));
$data[$init_pos - 34]= pack("H*",substr($mcch,0,2));
$data[$init_pos - 33]= pack("H*",substr($mcch,2,2));
$data[$init_pos - 32]= pack("H*",substr($mcch,4,2));
$data[$init_pos - 31]= pack("H*",substr($mcch,6,2));
$data[$init_pos - 24]= pack("H*",substr($cidh,0,2));
$data[$init_pos - 23]= pack("H*",substr($cidh,2,2));
$data[$init_pos - 22]= pack("H*",substr($cidh,4,2));
$data[$init_pos - 21]= pack("H*",substr($cidh,6,2));
$data[$init_pos - 20]= pack("H*",substr($lach,0,2));
$data[$init_pos - 19]= pack("H*",substr($lach,2,2));
$data[$init_pos - 18]= pack("H*",substr($lach,4,2));
$data[$init_pos - 17]= pack("H*",substr($lach,6,2));
$data[$init_pos - 16]= pack("H*",substr($mnch,0,2));
$data[$init_pos - 15]= pack("H*",substr($mnch,2,2));
$data[$init_pos - 14]= pack("H*",substr($mnch,4,2));
$data[$init_pos - 13]= pack("H*",substr($mnch,6,2));
$data[$init_pos - 12]= pack("H*",substr($mcch,0,2));
$data[$init_pos - 11]= pack("H*",substr($mcch,2,2));
$data[$init_pos - 10]= pack("H*",substr($mcch,4,2));
$data[$init_pos - 9]= pack("H*",substr($mcch,6,2));

if ((hexdec($cid) > 0xffff) && ($mcch != "00000000") && ($mnch != "00000000")) {
  $data[$init_pos - 27] = chr(5);
} else {
  $data[$init_pos - 24]= chr(0);
  $data[$init_pos - 23]= chr(0);

$context = array (
        'http' => array (
            'method' => 'POST',
            'header'=> "Content-type: application/binary\r\n"
                . "Content-Length: " . strlen($data) . "\r\n",
            'content' => $data

$xcontext = stream_context_create($context);

if (strlen($str) > 10) {
  $lat_tmp = unpack("l",$str[10].$str[9].$str[8].$str[7]);
  $lat = $lat_tmp[1]/1000000;
  $lon_tmp = unpack("l",$str[14].$str[13].$str[12].$str[11]);
  $lon = $lon_tmp[1]/1000000;
  $raggio_tmp = unpack("l",$str[18].$str[17].$str[16].$str[15]);
  $raggio = $raggio_tmp[1]/1;
  } else {
  echo "Not found!";
  $lat = 0;
  $lon = 0;
  return array($lat,$lon,$raggio);


list($mcc,$mnc,$lac,$cid, $nlac, $ncid)=geturl();

echo "<table cellspacing=30><tr><td>Dec</td><td>MCC: $mcc </td><td>MNC: $mnc </td><td>LAC: $lac </td><td>CID: $cid </td></tr>";

list ($lat,$lon,$raggio)=decodegoogle($mcc,$mnc,$lac,$cid);

  echo "<br>Google result for the main Cell<br>";
  echo "Lat=$lat <br> Lon=$lon <br> Range=$raggio m<br>";
  echo "<a href=\"$lat,$lon&z=14\" TARGET=\"_blank\" >See on Google maps</a> <BR> <br>";

  for ($contatore=0; $contatore < (count($nlac)); $contatore++) {
	if ($nlac[$contatore]==0) {
		//echo "trovato campo vuoto al contatore $contatore<BR>";

for ($contatore=0; $contatore < ($ncelle); $contatore++) {
	echo "LAC: $nlac[$contatore]\t CID: $ncid[$contatore]<BR>";
	list ($nlat[$contatore],$nlon[$contatore],$nraggio[$contatore])=decodegoogle($mcc,$mnc,$nlac[$contatore],$ncid[$contatore]);
	echo "<br>Google result for the Neighbor Cell $contatore <br>";
	echo "nLat=$nlat[$contatore] <br> nLon=$nlon[$contatore] <br> nRaggio=$nraggio[$contatore] m<br><br>";

  echo "<div id=\"map\" style=\"width: 100%; height: 700px\"></div>";
  echo "<script type=\"text/javascript\">";
  echo "var latgoogle=$lat;";
  echo "var longoogle=$lon;";
  echo "var raggio=$raggio;";

//creo un file contenente le coordinate delle celle ****  
	$stringa_xml_doc = " <markers>\n\t";
	$stringa_xml_doc =$stringa_xml_doc. "<marker lat=\"$lat\" lng=\"$lon\" rag=\"$raggio\" html=\"Main cell\" ico=\"antred\" label=\"Main\" />"; 
		for($contatore= 0; $contatore < $ncelle; $contatore++) 
			if ($nlat[$contatore]!=0) {
				$stringa_xml_doc =$stringa_xml_doc. "<marker lat=\"$nlat[$contatore]\" lng=\"$nlon[$contatore]\" rag=\"$nraggio[$contatore]\" html=\"Cell $contatore\" ico=\"antbrown\" label=\"Marker $contatore\" />"; 

	$stringa_xml_doc =$stringa_xml_doc."\n </markers>";

	echo ($stringa_xml_doc);
	//$stringa_xml = $stringa_xml_dtd.$stringa_xml_doc;
	$stringa_xml = $stringa_xml_doc;

	$file_name = "celle_xml.xml";
	$file = fopen ($file_name,"w");
	$num = fwrite ($file, $stringa_xml);


	echo("File XML creato con successo!!");


  echo "nLat=new Array();";
  echo "nLon=new Array();";
  echo "nraggio=new Array();";
  for ($contatore=0; $contatore < ($ncelle); $contatore++)
  echo "        nLat [$contatore]   =$nlat[$contatore];
				nLon [$contatore]   =$nlon[$contatore];
				nraggio [$contatore]=$nraggio[$contatore];";


  echo "</script>";


			<iframe width='100%' height='540' marginwidth='0' marginheight='0' scrolling='no' frameborder='0'  src='' ></iframe>

	<script src=";v=2&amp;key=ABQIAAAAIJFMStkxCl4SCny-4ljyrBRkrgiUOwoahV4KonZmGOdSmhVVVBTizYtL9IQMT4sND3EJvMdlOrIA8g" type="text/javascript"></script> 


 <body onunload="GUnload()">

		<script type="text/javascript"><!--
google_ad_client = "ca-pub-5248152858136551";
/* OE Link Banner post */
google_ad_slot = "3312240372";
google_ad_width = 468;
google_ad_height = 60;
<script type="text/javascript"

	<script type="text/javascript">

   //function initialize() {
      if (GBrowserIsCompatible()) {


	// This function picks up the click and opens the corresponding info window
      function myclick(i) {
        GEvent.trigger(gmarkers[i], "click");

	    var map = new GMap2(document.getElementById("map"));
        //map.setCenter(new GLatLng(37.4419, -122.1419), 13);

	function cursore() {
		var pointg = new GLatLng(latgoogle,longoogle);

	  // A function to create the marker and set up the event window
      function createMarker(point,name,html,icona) {		
        var marker = new GMarker(point,markerOptions);
        GEvent.addListener(marker, "click", function() {
        return marker;

// Read the data from example.xml
      GDownloadUrl("celle_xml.xml", function(doc) {
        var xmlDoc = GXml.parse(doc);
        var markers = xmlDoc.documentElement.getElementsByTagName("marker");

        for (var i = 0; i < markers.length; i++) {
          // obtain the attribues of each marker
          var lat = parseFloat(markers[i].getAttribute("lat"));
          var lng = parseFloat(markers[i].getAttribute("lng"));
          var raggio = parseFloat(markers[i].getAttribute("rag"));
		  var icona = markers[i].getAttribute("ico");
		  var Icon = new GIcon(G_DEFAULT_ICON);
			Icon.image = icona + ".png";

			// Set up our GMarkerOptions object

				markerOptions = { icon:Icon };

		  var point = new GLatLng(lat,lng);

          var html = markers[i].getAttribute("html");
          var label = markers[i].getAttribute("label");

          // create the marker
			if (icona=="antred") {
				var color="#FF0000";
				var fillColor="#FF6600";
			else {
				var color="#FF6699";
				var fillColor="#FF99CC";
		  var thickness=4;
		  var opacity=0.4;

		  var fillOpacity=0.2;

		  var polyCircle=drawCircle(point, raggio, color, thickness, opacity, fillColor, fillOpacity);		
          var marker = createMarker(point,label,html,markerOptions);
			map.setCenter(point, 13);
        // put the assembled side_bar_html contents into the side_bar div
        //document.getElementById("side_bar").innerHTML = side_bar_html;

        function drawCircle(center, radius, color, thickness, opacity, fillColor, fillOpacity) 

            var degreesPerPoint = 8; 
            var radiusLat = radiusMiles * (1/69.046767); // there are >> >> > 69.046767 miles per degree latitude 
            var radiusLon = radiusMiles * (1/(69.046767 * Math.cos(parseFloat( * Math.PI / 180))); 
            var points = new Array(); 
            //Loop through all degrees from 0 to 360 
            for(var i = 0; i < 360; i += degreesPerPoint) 
                var point = new GLatLng(parseFloat( + (radiusLat * Math.sin(i * Math.PI / 180)), parseFloat(center.lng()) + (radiusLon * Math.cos(i * Math.PI / 180))); 
            points.push(points[0]);     // close the circle 

            polyCircle = new GPolygon(points, color, thickness, opacity, fillColor, fillOpacity) 
            return polyCircle;


<script type="text/javascript">	

  //cursore(); 	//carica il marcatore



About Boris Landoni

Boris Landoni is the technical manager of Skilled in the GSM field, embraces the Open Source philosophy and its projects are available to the community.
  • Bajpan Gosh

    it’s my cell location details but i cant find the location# could you ex plane ..#

  • Hi, can you give me other cells?
    Could be that they are wrong or that this cell is not in Google database.

  • logbor

    Halo Boris,
    Iam tested my cellId and LAC is worked.
    Iam interested with this script.
    But iam newbie and want to learn it.
    Can you upload one bundled all script php and html, so i can upload to my hosting to runing it.

    many-many thanks

  • logbor

    And for you info:
    i was upload to my hosting: celltrack.html and cell.php
    But when i click “send”, not open the result.

    I guess i need the right html.


  • Hi logbor, the code in this page is the PHP code…

  • logbor

    Hai Boris,
    Thats OK Now.
    Please delete my last comment.


  • Pingback: Arturo Escalante (chinazo) | Pearltrees()

  • Chuka

    Hi. I was testing the code on my Local Server but i got this error “Parse error: syntax error, unexpected ‘function’ (T_FUNCTION) in C:phphtdocsPhone-Trackertracker.php on line 8”

    I saved the php code in a file named “tracker.php”

    pls help

  • Tejas Shinde

    hlleo Boris how it will work in India?

    • BorisLandoni

      We are using a quadband module and Google services.
      I think yes

  • Johhny

    I have found user-friendly interface for searching coordinates of GSM cells I get the 100% base stations locations there. perfect

  • Andy Crofts

    Oh, this is WICKED!!!!
    I’m designing a new datalogger for a company who make environment measuring tools. One of the applications is for a buoy, floating in the sea or in a lake, (near land). It communicates periodically via GSM.
    One has broken free….It’s solar-powered, and still transmitting, but we haven’t a clue where the damn thing is! That early model doesn’t give LAC, CID etc.
    I’m gonna code this ability in the new logger to send this cell info. to a Raspberry Pi in our office via SMS, so we can track them in future.
    (Incidentally, we’re using a Quectel M66 module in the new logger. Its command to send this info. is AT+QENG=2,4 and to stop it sending it’s AT+QENG=0
    Telit modules use #MONI, and it seems SIM900 is like Quectel, but it seems to be AT+CENG=2 (from the datasheet – not tested by me) )

  • Renuka B

    how can i get cell id and lac of unknow person using phone number