SIMtrace issues

tsaitgaist ml at
Sun Jan 30 22:05:59 UTC 2011


I'll be listing some issues I found in SIMtrace.
This is to warn future users.
I don't have time now, but I intend to work on this project in 1 or 2
weeks and correct these bugs.

1. when starting host program simtrace, the firmware will first return
ATR. This is an error if simtrace is started after the card has been
reseted. The program should use the state of the reset and vcc lines to
know the state.

2. when using a usb hub, having a lot of USB traffic, or poor USB signal
quality (I don't know exactly), bulk read timeouts can occur in host program
simtrace/at91sam7/host/main.c line 230:
rc = usb_bulk_read(udev, SIMTRACE_IN_EP, buf, sizeof(buf), 100000);

rc is -110 (REQUEST_TIMEOUT). I increased the timeout (100000) so to
have less errors (but they still occur), and I ignore this error instead
of exiting (tracing still works).

3. it seems simtrace can loose track of the I/O stream after some
traffic. see pcsc_apdu.log to see the original, and simtrace_apdu.log
for the captured traffic.
in the end, simtrace misses:
APDU: A0 C0 00 00 0F
and does a wrong following APDU parsing

The problem occurs when using a OmniKey CardMan 5321 and Alcor Micro
AU9520. Thus the reader should not be the origin.
Also, if only the command where the error occurs is sent, no bytes are
skipped. But another error occurs (see next bug)

4. when executing only the last commands, then it is wrongly interpreted
(as ATR), but no bytes are skipped
ATR (12):  3b 0a 41 00 3f 43 00 01 50 29 01 02
ATR (66):  a0 a4 00 00 02 a4 7f 20 9f 17 a0 a4 00 00 02 a4 6f ad 9f 0f
a0 c0 00 00 0f c0 00 00 00 03 6f ad 04 00 04 f0 44 01 02 00 00 90 00 a0
b0 00 00 03 b0 00 00 00 90 00 3b 0a 41 00 3f 43 00 01 50 29 01 02

I already wrote a SIM traffic parser for the PC before simtrace
appeared. I used a logic analyzer to record the traffic.
I will integrate the ATR and APDU parsing/checking into the simtrace
firmware. Wrong recorded traffic will be discarded instead of affecting
the rest of the parsing.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: pcsc_apdu.log
Type: text/x-log
Size: 4408 bytes
Desc: not available
URL: <>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: simtrace_apdu.log
Type: text/x-log
Size: 3711 bytes
Desc: not available
URL: <>

More information about the baseband-devel mailing list