On Mon, May 28, 2018 at 10:05:25AM +0200, Harald Welte wrote:

AFAIR a not published (probably too hackish?) tool originally written by Kevin Redon.

I think it simply sends the raw hex encoded file as part of a WRITE BINARY APDU. But Kevin (Cc) should know better...

I used two programs to write the SIM file containing the list of forbidden PLMN (EF_FPLMN). The first is in C and was used to provision SIM cards (e.g. writing a lot of other files). The second is easier and more convenient to use. It's a scriptor script. Scriptor is a tool included in the pcsc-tool package (also providing pcsc_check) which allows to send raw APDU through PCSC card readers.

Here the script: #!/usr/bin/env scriptor reset # select MF a0 a4 00 00 02 3f 00 # select DF_GSM a0 a4 00 00 02 7f 20 # verify ADM #A0 20 00 05 08 xx xx xx xx xx xx xx xx # select EF_FPLMN a0 a4 00 00 02 6f 7b # write binary EF_FPLMN (forbid 262 01, 262 02, 262 03, 262 07) a0 d6 00 00 0c 62 f2 10 62 f2 20 62 f2 30 62 f2 70

put that in a file and run it using scriptor this script has the advantage to work with SIMs and USIMs, and is easy to modify. the FPLMN file can be updated by the user, but you need to verify CHV1/PIN1 (e.g. the PIN) if it is set. to avoid asking the user his pin when updating the card I just used the ADM pin (# verify ADM line), which was static for the SIM cards provided up to 31c3. the list of FPLMN is 262 01, 262 02, 262 03, 262 07. You can read it in the file content (swap nibble, f padded, e.g. 262 01 becomes 62 f2 10). When addind/removing data from this hex string, don't forget to update the length field (0c here).