How do they do that? As far as I know Kc shouldn't be extracted (except from very old cards). I would be better to know to have an open source sw that allow us to understand...

Another way is to use the "mobile" app from sylvain/testing. It associates with the network and makes calls. If I am not wrong it shows you the Kc, so it would be useful for the original poster.

Ciao.
Dario.