Hi all,
After buying a super Sim Kit (16 in 1) from China, I tried the reader (green PCB inside a blue transparent plastic case with a blue LED) and SIM (identified as a fakesupersim) with pysim tool. However i am getting the following error:
/pySim-prog.py -n 26C3 -c 49 -x 262 -y 42 -z 1234 -j 1 -t auto
Insert card now (or CTRL-C to cancel)
Autodetected card type fakemagicsim
Generated card parameters :
> Name : 26C3
> SMSP : e1ffffffffffffffffffffffff058100945555ffffffffffff000000
> ICCID : 8949262427518313026
> MCC/MNC : 262/42
> IMSI : 262422461512085
> Ki : 7b74741a1ee14337ec23f9ab92a13648
> OPC : ccd867d60797d8d45354a51b3ef568ff
Programming ...
Traceback (most recent call last):
File "./pySim-prog.py", line 530, in <module>
card.program(cp)
File "/home/nadicek/pysim/pysim/pySim/cards.py", line 231, in program
self._scc.update_binary('6f30', hplmn + 'ff' * (tl-3))
File "/home/nadicek/pysim/pysim/pySim/commands.py", line 53, in update_binary
return self._tp.send_apdu_checksw(pdu)
File "/home/nadicek/pysim/pysim/pySim/transport/__init__.py", line 87, in send_apdu_checksw
raise RuntimeError("SW match failed ! Expected %s and got %s." % (sw.lower(), rv[1]))
RuntimeError: SW match failed ! Expected 9000 and got 9804.
I checked mailing lists and haven’t found anybody who had similar problem with pysim. Also I have tried forcing different models of SIM, but nothing is working. Obviously I can remove this check from the script file (__init__.py in /pySim/transport), however somebody had a reason to put such condition there. I would like to ask if it is safe to remove that line of code and the purpose of that line of code.
Thanks a lot and best regards
Martin
> I don't understand. This callback will be called with data you need to
write
> to the network. In case of MTP Level3 you will need to wrap that around
the
> msgb you got.
I means: is the interaction with mtp3 layer implemented (is sending sccp
data by mtp3 implemented by the library?)?
Also, what about the reception of data from mtp3 layer. is that implemented
in the sccp lib.
I am asking these questions because I see the code of mtp3 in the lib but no
significant call is present in the sccp part of the lib.
Thank you for your help.
On Tue, Jun 28, 2016 at 10:05:28AM +0200, Harald Welte wrote:
> [translated from german]
> is it certain that we switch a channel to PDCH only when
> gprs mode != none?
A TS can be GSM_PCHAN_TCH_F_PDCH; those are the only ones for which we
send a PDCH ACT message.
We send a PDCH ACT message
- during init (CHANNEL OML's state changed to enabled -> send PDCH ACT),
- and upon channel release ack when pchan == GSM_PCHAN_TCH_F_PDCH.
So the question is, when we receive a channel release ack, could that be
the PDCH release and we switch PDCH right back on by accident? No, because
we only receive a chan rel ack when the *TCH/F* is being released.
That is because the PDCH release is initiated "internally" from the PDCH
DEACT, and thus this condition in common/rsl.c rsl_tx_rf_rel_ack() catches
on, which existed before dyn PDCH:
if (lchan->rel_act_kind != LCHAN_REL_ACT_RSL) {
LOGP(DRSL, LOGL_NOTICE, "%s not sending REL ACK\n",
gsm_lchan_name(lchan));
return 0;
}
In rsl_rx_rf_chan_rel() the rel_act_kind is set to LCHAN_REL_ACT_RSL, but
not in the rsl_rx_dyn_pdch().
This is analogous to the ip.access way -- the ip.access nanobts replies to
a PDCH DEACT with a PDCH DEACT ACK and doesn't send a separate channel
release ack.
Maybe we could set rel_act_kind to some new LCHAN_REL_ACT_IPAC_DYN_PDCH
for clarity? (But we shouldn't actually send a release ack, to stay
compatible.)
Even though it works as-is, we should indeed add another flag check:
- We do check the flags that no ACT/DEACT is already pending;
- And we do send a PDCH DEACT only if ts->flags & TS_F_PDCH_ACTIVE;
- But we would send a PDCH ACT despite ts->flags & TS_F_PDCH_ACTIVE.
This should never happen, but it would make sense to ensure that.
~Neels
Hi,
My name is Brackley Cassinga Form DRC, we run a community network called
pamoja net where we offer gsm services using osmocom open source software
and OC Base station.
Recently I have tried to install another base station as the same installed
but I could not find any resource guiding through all the steps to take to
run NIB on a base station.
I'm currently running Ubuntu and I will appreciate if you could guide me on
the installation of BSC,hlr,MSC , in order to run a basic gsm network.
Thank you. Regards
--
*Ir Brackley heshima Casinga **Pacifique*
*CEO and Founder of kwanzatechnologie*
KwanzaTechnologies ,GlobalElectronics
+243977265291 | +243977265291 | Pcassinga(a)gmail.com/
brackley(a)ensemblepourladifference.org
www.kwantechnologies.jimdosite.com <http://www.kwantechnologies.com/> |
Skype: Brackley cassinga <https://webapp.wisestamp.com/#>
Av Semliki N 43
Dear Osmocom community,
I am using pysim to read values of ISIM. However, it just returns "None, None". And the aids of my SIM card is ['a0000000871002ff86ffff89ffffffff']. It seems does not have ISIM application on my SIM card.
How should I read values of ISIM?
Best regards,
Zishuai CHENG
Hi all.
I would like to implement some functionality that existed as a kind of
happy accident?, in the osmocom-nitb
That is - that media endpoints in INVITEs/200s and re-INVITEs from a SIP
UA to osmo-sip-connector just ended up being transparently communicated
to osmo-bts. This made it really easy to take the pbx out of the audio
stream.
I wanted to share where I am at with that.
freeswitch even has a console command for this: "uuid_media" can switch
the pbx in and out of the stream during the call. In the case of a MS to
MS call on the same bts, we just connect the two osmo-bts media
endpoints to each other. Freeswitch can schedule to playback message on
calls and such like - for "your credit ran out" message for example -
and it works pretty good. FS knows to put itself back into the stream
with a re-INVITE with it's own IP in the SDP before playing the audio
and invites itself back out of the stream as soon as playback is finished.
I've been looking on and off, not that I've given it a huge amount of
time, at how to replicate this with the BSC/MSC/MGW/SIP combination.
First thing was to fix up the BSS messages and Global Call Reference
generation. (TS 23.284) Given that Max had done most of this, that's
pretty easy, although I got lost at one point down a rabbit hole of
trying to figure out more than I needed to with the FSM and BSS
messages, and that put me off working on it for a while.
Anyway, https://gerrit.osmocom.org/c/osmo-msc/+/24236 exists and
"works" - that is you can do LCLS with either mgw-loop or bts-loop
configured on the BSC - but only for the internal mncc, obviously as the
osmo-sip-connector still does not know what to do with the GCR (global
call reference)
I thought about various hackish things to do. (maintain a table of
call-ids and their gcr on the sip conn and add an X-Osmo-CallID header
to the SIP) but I've also been looking at the specs.
TS 29.164 (section 6) says that the GCR should be encapsulated in a
binary encoded ISUP payload, there are pointers in the spec to ITU
Q.1912.5 (Section5 and thereabouts) So the ISUP messages should be added
to SIP messages, requiring a multipart MIME attachment to the INVITE
with the SDP and the ISUP. Also see RFC3204
What I don't know is how sip UEs will respond to these. I wonder will
they decode them, I doubt it, some searching for SIP-I support in
FreeSwitch confirms no support.
So I'm thinking that I need to serialise the GCR and add it to an "X-"
SIP header, so we at get it back on the B-leg.
So yes, I need to just do this, but I got stalled a bit again with my
lack on programming skills trying to learn how to serialise the GCR the
"right" way. - but once I figure that out, then I can at least test what
happens and see how the MSC and MGW behaves with the MNCC messages that
result from SIP re-INVITES.
Maybe that just works, but I don't think so, I think I will need to
implement more BSS LCLS messages to actually change the LCLS states, not
just update media endpoints.
Sometimes I wonder here what should happen in the sip conn and what in
the MSC.
Anyway, It's been on my mind to write this up quickly to the ML just in
case somebody has a "OH... better not do it like that" type comment..
Thanks
k.
Dear Osmocom community,
It's my pleasure to announce the next OsmoDevCall at
May 28, 2021 at 20:00 CEST
at
https://meeting4.franken.de/b/har-xbc-bsx-wvs
This meeting will have the following schedule:
20:00 meet + greet
20:15 presentation by fixeria: "Hacking binary protocols with Pycrate"
21:00 USSE: unstructured supplementary social event [*]
22:00 close of call
Attendance is free of charge and open to anyone with an interest
in Osmocom.
More information about OsmoDevCall, including the schedule
for further upcoming events can be found at
https://osmocom.org/projects/osmo-dev-con/wiki/OsmoDevCall
Looking forward to meeting you on Friday.
Best regards,
Harald
[*] this is how we started to call the "unstructured" part of osmocom
developer conferences in the past, basically where anyone can talk about
anything, no formal schedule or structure.
--
- Harald Welte <laforge(a)osmocom.org> http://laforge.gnumonks.org/
============================================================================
"Privacy in residential applications is a desirable marketing option."
(ETSI EN 300 175-7 Ch. A6)
Hello,
When the phone send *#100#, the ussd responds with "the extension is xxxx" and it gives option to accept after this like button "ok". My question is it possible to perform this response of ussd for two options "reply" and "cancel" and the phone could reply the answer of the network?
Chears,
Dear Osmocom community,
It's my pleasure to announce the next OsmoDevCall at
May 14, 2021 at 20:00 CEST
at
https://meeting4.franken.de/b/har-xbc-bsx-wvs
This meeting will have the following schedule:
20:00 meet + greet
20:15 presentation by laforge: "SS7 and SIGTRAN in 2G/3G networks"
21:00 USSE: unstructured supplementary social event [*]
22:00 close of call
Presentation Abstract:
This talk will cover some classic circuit-switched SS7 basics as
well as SIGTRAN (SS7 over IP) and how this is used as underlying
transport for a variety of interfaces in the 2G (GSM) and 3G
(UMTS) cellular networks even today.
Attendance is free of charge and open to anyone with an interest
in Osmocom.
More information about OsmoDevCall, including the schedule
for further upcoming events can be found at
https://osmocom.org/projects/osmo-dev-con/wiki/OsmoDevCall
Looking forward to meeting you on Friday.
Best regards,
Harald
[*] this is how we started to call the "unstructured" part of osmocom
developer conferences in the past, basically where anyone can talk about
anything, no formal schedule or structure.
--
- Harald Welte <laforge(a)osmocom.org> http://laforge.gnumonks.org/
============================================================================
"Privacy in residential applications is a desirable marketing option."
(ETSI EN 300 175-7 Ch. A6)
Hello Osmocom community,
I made some posts here earlier this year about my attempts to obtain
some programmable SIM cards from Grcard (a well-known Chinese
manufacturer of SIM and other smart cards) that are GSM SIM only,
without USIM or ISIM applications - but I just realized that I never
posted anything regarding the final outcome of those escapades. The
present post is intended to summarize what I obtained and what I
learned through that venture.
The first point to be noted is that Grcard make many bazillion
different card models, but frustratingly, they never let me see any
kind of catalog of their different offerings. Instead what happened
is that when I first approached them back in January and told them
what I was looking for in very basic terms (I simply said that I
wanted a GSM-only SIM card without any USIM or ISIM stuff), they
offered me one of their card models based on those stated requirements,
they first sent me a few sample pieces of this card model they
selected for me, and then I ended up ordering 200 pieces of that same
model with my own custom printing on the cards.
The card model which Grcard offered to me back in January and of which
I got 200 pcs a month ago in April turned out to be exactly the same
in technical terms as the one that was once sold by Sysmocom as
sysmoSIM-GR2:
https://osmocom.org/projects/cellular-infrastructure/wiki/GrcardSIM2
As I understand it, Sysmocom had that sysmoSIM-GR2 as an offering back
in late 2013, thus it was quite surprising to see that Grcard still
readily sell that exact same model 7 and a half years later - but they
do. As a result of having done a ton of work with these cards over
the past few months, I now know a lot more about them than is said in
the scant Osmocom wiki page above, and a lot more than the little bits
of knowledge embedded in pySim code from 2013 supporting this model.
Extensive write-ups about these cards can be found in my fc-sim-tools
repository, but here is a basic summary of the good and the bad:
The good:
* These GrcardSIM2 aka FCSIM1 cards are truly native GSM 11.11 SIM,
and do not speak the unwanted-innovation UICC protocol at all.
* F=512 D=8 speed enhancement (the only SIM speed enhancement mode
called for in the original GSM 11.11 spec and the only one implemented
in most classic GSM MS hardware such as Calypso) is supported by these
cards, thus if your GSM MS firmware has this speed enhancement enabled
(at least with TI platform, many legacy fw versions have it disabled -
don't know about other GSM chipset vendors), your phone will talk to
the SIM at about 50781 bps, instead of the circa 8737 bps you get with
the basic non-enhanced F=372 D=1 mode.
* The security model on these cards works the way it is supposed to:
they initially ship with a known default SUPER ADM key, but if you
change both ADM5 and ADM11 (SUPER ADM) keys to your own secrets, then
the card becomes fully secure in the traditional SIM security sense.
I personally don't understand and will likely never understand what is
so wrong with letting your paying service subscribers know their own
Ki and letting them clone their SIM if they so wish, but if you wish
to replicate the traditional security model where you program Ki and
change ADM keys to some secret, you *can* do it with FCSIM1 cards.
Standard PIN1/PIN2/PUK1/PUK2 can be freely reset if you authenticate
with ADM5 or ADM11, but if you change those ADM keys to secrets, then
the PIN system becomes fully secure too. Contrast the situation with
Grcard's earlier model (sysmoSIM-GR1) where anyone can freely reset
both regular and ADM PINs without any authentication, meaning no
security whatsoever.
* All 3 of COMP128v1, COMP128v2 and COMP128v3 are supported. I
naturally choose COMP128v3 for my own deployments - A5/1 is weak
enough to begin with, no need to weaken it further by reducing the
effective key length to just 54 bits with COMP128v1 or v2.
* As far as I can tell, there are NO unwanted STK applications on
these cards. Harald said here earlier that Sysmocom's business
relationship with Grcard ended when Grcard started shipping cards with
some preinstalled STK applications displaying some pop-up messages in
Chinese, but I see no evidence of any such applications being present
on the FCSIM1 cards I got from them this year. I have tried issuing a
feature-generous TERMINAL PROFILE toward the card (listing support for
all common SAT features), and the SW response was 9000 - no matter
what I tried, I never got the card to respond with SW of 91xx,
indicating some proactive SIM command - thus as far as I can tell,
these SIMs never issue any proactive commands.
* The best good of all: no MOQ! Instead of being forced to buy 1000
or more cards and have them go to waste because I will never find that
many people who have the same pattern of technology likes and dislikes
as I do, I was able to buy just 200 cards - I could have ordered as
few as 100, but I ordered 200 because they were cheap - and I got those
200 cards with my own custom printing and with my choice of form factor
cut - I chose 2FF-only, of course.
The bad:
* The free reformatting ability that existed on sysmoSIM-GR1 has been
taken away. On sysmoSIM-GR1 you could erase the card file system and
recreate your own tree of DFs and EFs according to your own liking
(with you deciding which files to include or omit, what size to
allocate for each file, and what access conditions it should have),
but those proprietary APDU commands from GR1 don't work on GrcardSIM2
(FCSIM1), and the official answer from Grcard is that such downstream
reformatting is not allowed. I am guessing that what I want probably
*can* be done by reformatting the card flash and reloading their
CardOS at a lower level, but needless to say, Grcard won't divulge any
of the knowledge that would be needed for such an endeavor.
* The fixed formatting these cards came with (which we have no way of
changing per above) is far from ideal: EF_AD is only 3 bytes and not 4,
some files that aren't absolutely critical but would be nice to have
like SDN and ECC are missing, and the allocated record size for EF_ADN
is only 28 bytes, allowing only 14 characters for the contact name
field. Contrast with old T-Mobile USA SIMs that have 44-byte ADN
records (30 characters for contact name), or current Sysmocom cards
that have 34-byte ADN records, allowing 20 characters. Grcard people
told me that they can change this file system layout to a different
one with MOQ of 10000 pcs, but of course such MOQs are absolutely not
acceptable for "just for love" applications like mine.
* There is no OTA programming capability on this card model. I was
hoping that I could program EF_MSISDN over the air (yes, I know full
well that a phone doesn't need to know its own MSISDN to make or answer
calls, but all classic GSM phones have a menu command for "Show my
number" or whatever it's called, and that's what EF_MSISDN on the SIM
is for) like I can do on sysmoUSIM-SJS1 and sysmoISIM-SJA2 cards, but
nope, this functionality just isn't there. Grcard folks were telling
me that they have some other card model that supports OTA, but I never
got a straight answer out of them as to whether that other card model
is also GSM SIM only, or if it is UICC/USIM/ISIM - I suspect the
latter, which would be totally uninteresting to me.
* The worst badness of all is that Grcard people absolutely hate
customers who ask too many technical questions, and when pressed, they
typically respond only with non-answers. There is basically NO
technical support of the kind we got used to in highly technical
communities like Osmocom with vendors like Sysmocom, instead they are
used to dealing with sales and marketing types. I also got the
impression that selling to R&D customers is very foreign to them,
instead they are set up for making cards for operator/MVNO type of
customers who let the card vendor do all of the programming at the
factory and don't get into any real technical stuff themselves.
So here is what we got:
https://www.freecalypso.org/members/falcon/pictures/SIMs/FCSIM1_front.jpeghttps://www.freecalypso.org/members/falcon/pictures/SIMs/FCSIM1_back.jpeg
The cards depicted in those photos are quite real, they are sitting
right here at my FreeCalypso HQ in California, and they work in the
sense that I can program everything including IMSI, Ki and COMP128v3
selection. I haven't set up my own GSM network yet - I already
acquired a couple of nanoBTS units (one for 850 MHz, one for 1900 MHz),
but I still need to acquire a better server machine for running
Osmocom CNI software.
Much like any other feeling and soulful human, I have a deep-rooted
urge to share my work with others. When it comes to the present SIM
card venture, I am doing everything I can to share my work with the
community in 3 ways:
1) The software I developed for programming these cards is free to the
world, with an explicit public domain license statement:
https://www.freecalypso.org/hg/fc-sim-tools/
My fc-sim-tools suite is a direct competitor to pySim, written in C
instead of Python, and split into separate fc-simtool and fc-uicc-tool
for the two very different protocols that exist for talking to SIM
cards. Oh, and my tools can be used to program Sysmocom webshop cards
too, not just my Grcard-based FCSIM1.
2) If anyone else would like to buy similar cards from Grcard, I will
be happy to put you in touch with my contact there and guide you through
the process - and by encouraging anyone with a commercial interest to
buy directly from Grcard instead of me acting as a reseller, I
explicitly disavow any thought of commercially profiting from any
related venture or acting as any kind of commercial entity myself.
3) If there is anyone in the world who shares my core philosophical
position whose wording is imprinted on the plastic on my FCSIM1 cards
(see the pictures above) and would like to get a few of these cards,
please let me know, and I will be glad to send you however many cards
you need, for the cost of shipping only, or at most covering my own
cost of ordering more cards in the highly unlikely event that I get
enough interest to run down my stock.
In hacking fellowship,
Mother Mychaela
Hasta la Victoria, Siempre - 2G forever!
