simtrace

simtrace@lists.osmocom.org

350 discussions

Sharing my mixed success story with Grcard SIMs
by Mychaela Falconia 06 May '21

06 May '21

Hello Osmocom community, I made some posts here earlier this year about my attempts to obtain some programmable SIM cards from Grcard (a well-known Chinese manufacturer of SIM and other smart cards) that are GSM SIM only, without USIM or ISIM applications - but I just realized that I never posted anything regarding the final outcome of those escapades. The present post is intended to summarize what I obtained and what I learned through that venture. The first point to be noted is that Grcard make many bazillion different card models, but frustratingly, they never let me see any kind of catalog of their different offerings. Instead what happened is that when I first approached them back in January and told them what I was looking for in very basic terms (I simply said that I wanted a GSM-only SIM card without any USIM or ISIM stuff), they offered me one of their card models based on those stated requirements, they first sent me a few sample pieces of this card model they selected for me, and then I ended up ordering 200 pieces of that same model with my own custom printing on the cards. The card model which Grcard offered to me back in January and of which I got 200 pcs a month ago in April turned out to be exactly the same in technical terms as the one that was once sold by Sysmocom as sysmoSIM-GR2: https://osmocom.org/projects/cellular-infrastructure/wiki/GrcardSIM2 As I understand it, Sysmocom had that sysmoSIM-GR2 as an offering back in late 2013, thus it was quite surprising to see that Grcard still readily sell that exact same model 7 and a half years later - but they do. As a result of having done a ton of work with these cards over the past few months, I now know a lot more about them than is said in the scant Osmocom wiki page above, and a lot more than the little bits of knowledge embedded in pySim code from 2013 supporting this model. Extensive write-ups about these cards can be found in my fc-sim-tools repository, but here is a basic summary of the good and the bad: The good: * These GrcardSIM2 aka FCSIM1 cards are truly native GSM 11.11 SIM, and do not speak the unwanted-innovation UICC protocol at all. * F=512 D=8 speed enhancement (the only SIM speed enhancement mode called for in the original GSM 11.11 spec and the only one implemented in most classic GSM MS hardware such as Calypso) is supported by these cards, thus if your GSM MS firmware has this speed enhancement enabled (at least with TI platform, many legacy fw versions have it disabled - don't know about other GSM chipset vendors), your phone will talk to the SIM at about 50781 bps, instead of the circa 8737 bps you get with the basic non-enhanced F=372 D=1 mode. * The security model on these cards works the way it is supposed to: they initially ship with a known default SUPER ADM key, but if you change both ADM5 and ADM11 (SUPER ADM) keys to your own secrets, then the card becomes fully secure in the traditional SIM security sense. I personally don't understand and will likely never understand what is so wrong with letting your paying service subscribers know their own Ki and letting them clone their SIM if they so wish, but if you wish to replicate the traditional security model where you program Ki and change ADM keys to some secret, you *can* do it with FCSIM1 cards. Standard PIN1/PIN2/PUK1/PUK2 can be freely reset if you authenticate with ADM5 or ADM11, but if you change those ADM keys to secrets, then the PIN system becomes fully secure too. Contrast the situation with Grcard's earlier model (sysmoSIM-GR1) where anyone can freely reset both regular and ADM PINs without any authentication, meaning no security whatsoever. * All 3 of COMP128v1, COMP128v2 and COMP128v3 are supported. I naturally choose COMP128v3 for my own deployments - A5/1 is weak enough to begin with, no need to weaken it further by reducing the effective key length to just 54 bits with COMP128v1 or v2. * As far as I can tell, there are NO unwanted STK applications on these cards. Harald said here earlier that Sysmocom's business relationship with Grcard ended when Grcard started shipping cards with some preinstalled STK applications displaying some pop-up messages in Chinese, but I see no evidence of any such applications being present on the FCSIM1 cards I got from them this year. I have tried issuing a feature-generous TERMINAL PROFILE toward the card (listing support for all common SAT features), and the SW response was 9000 - no matter what I tried, I never got the card to respond with SW of 91xx, indicating some proactive SIM command - thus as far as I can tell, these SIMs never issue any proactive commands. * The best good of all: no MOQ! Instead of being forced to buy 1000 or more cards and have them go to waste because I will never find that many people who have the same pattern of technology likes and dislikes as I do, I was able to buy just 200 cards - I could have ordered as few as 100, but I ordered 200 because they were cheap - and I got those 200 cards with my own custom printing and with my choice of form factor cut - I chose 2FF-only, of course. The bad: * The free reformatting ability that existed on sysmoSIM-GR1 has been taken away. On sysmoSIM-GR1 you could erase the card file system and recreate your own tree of DFs and EFs according to your own liking (with you deciding which files to include or omit, what size to allocate for each file, and what access conditions it should have), but those proprietary APDU commands from GR1 don't work on GrcardSIM2 (FCSIM1), and the official answer from Grcard is that such downstream reformatting is not allowed. I am guessing that what I want probably *can* be done by reformatting the card flash and reloading their CardOS at a lower level, but needless to say, Grcard won't divulge any of the knowledge that would be needed for such an endeavor. * The fixed formatting these cards came with (which we have no way of changing per above) is far from ideal: EF_AD is only 3 bytes and not 4, some files that aren't absolutely critical but would be nice to have like SDN and ECC are missing, and the allocated record size for EF_ADN is only 28 bytes, allowing only 14 characters for the contact name field. Contrast with old T-Mobile USA SIMs that have 44-byte ADN records (30 characters for contact name), or current Sysmocom cards that have 34-byte ADN records, allowing 20 characters. Grcard people told me that they can change this file system layout to a different one with MOQ of 10000 pcs, but of course such MOQs are absolutely not acceptable for "just for love" applications like mine. * There is no OTA programming capability on this card model. I was hoping that I could program EF_MSISDN over the air (yes, I know full well that a phone doesn't need to know its own MSISDN to make or answer calls, but all classic GSM phones have a menu command for "Show my number" or whatever it's called, and that's what EF_MSISDN on the SIM is for) like I can do on sysmoUSIM-SJS1 and sysmoISIM-SJA2 cards, but nope, this functionality just isn't there. Grcard folks were telling me that they have some other card model that supports OTA, but I never got a straight answer out of them as to whether that other card model is also GSM SIM only, or if it is UICC/USIM/ISIM - I suspect the latter, which would be totally uninteresting to me. * The worst badness of all is that Grcard people absolutely hate customers who ask too many technical questions, and when pressed, they typically respond only with non-answers. There is basically NO technical support of the kind we got used to in highly technical communities like Osmocom with vendors like Sysmocom, instead they are used to dealing with sales and marketing types. I also got the impression that selling to R&D customers is very foreign to them, instead they are set up for making cards for operator/MVNO type of customers who let the card vendor do all of the programming at the factory and don't get into any real technical stuff themselves. So here is what we got: https://www.freecalypso.org/members/falcon/pictures/SIMs/FCSIM1_front.jpeg https://www.freecalypso.org/members/falcon/pictures/SIMs/FCSIM1_back.jpeg The cards depicted in those photos are quite real, they are sitting right here at my FreeCalypso HQ in California, and they work in the sense that I can program everything including IMSI, Ki and COMP128v3 selection. I haven't set up my own GSM network yet - I already acquired a couple of nanoBTS units (one for 850 MHz, one for 1900 MHz), but I still need to acquire a better server machine for running Osmocom CNI software. Much like any other feeling and soulful human, I have a deep-rooted urge to share my work with others. When it comes to the present SIM card venture, I am doing everything I can to share my work with the community in 3 ways: 1) The software I developed for programming these cards is free to the world, with an explicit public domain license statement: https://www.freecalypso.org/hg/fc-sim-tools/ My fc-sim-tools suite is a direct competitor to pySim, written in C instead of Python, and split into separate fc-simtool and fc-uicc-tool for the two very different protocols that exist for talking to SIM cards. Oh, and my tools can be used to program Sysmocom webshop cards too, not just my Grcard-based FCSIM1. 2) If anyone else would like to buy similar cards from Grcard, I will be happy to put you in touch with my contact there and guide you through the process - and by encouraging anyone with a commercial interest to buy directly from Grcard instead of me acting as a reseller, I explicitly disavow any thought of commercially profiting from any related venture or acting as any kind of commercial entity myself. 3) If there is anyone in the world who shares my core philosophical position whose wording is imprinted on the plastic on my FCSIM1 cards (see the pictures above) and would like to get a few of these cards, please let me know, and I will be glad to send you however many cards you need, for the cost of shipping only, or at most covering my own cost of ordering more cards in the highly unlikely event that I get enough interest to run down my stock. In hacking fellowship, Mother Mychaela Hasta la Victoria, Siempre - 2G forever!

1 0

Announcement of "OsmoDevCall" on April 23, 2021
by Harald Welte 18 Apr '21

18 Apr '21

Dear Osmocom community, It's my pleasure to announce the next OsmoDevCall at April 23, 2021 at 20:00 CEST at https://meeting4.franken.de/b/har-xbc-bsx-wvs This meeting will have the following schedule: 20:00 meet + greet 20:15 presentation by horiz0n: "YIG & YANG (Yet ANother yiG driver)" 21:00 USSE: unstructured supplementary social event [*] 22:00 close of call Presentation Abstract: This talk will briefly introduce the working principles of YIG (Yttrium Iron Garnet) microwave circuits, their applications and finally conclude with a presentation of a recently developed driver circuit. Attendance is free of charge and open to anyone with an interest in Osmocom. More information about OsmoDevCall, including the schedule for further upcoming events can be found at https://osmocom.org/projects/osmo-dev-con/wiki/OsmoDevCall Looking forward to meeting you on Friday. Best regards, Harald [*] this is how we started to call the "unstructured" part of osmocom developer conferences in the past, basically where anyone can talk about anything, no formal schedule or structure. -- - Harald Welte <laforge(a)osmocom.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

1 0

Announcement of "OsmoDevCall" on April 9, 2021
by Harald Welte 07 Apr '21

07 Apr '21

Dear Osmocom community, It's my pleasure to announce the next OsmoDevCall at April 9, 2021 at 20:00 CET at https://meeting4.franken.de/b/har-xbc-bsx-wvs This meeting will have the following schedule: 20:00 meet + greet 20:15 presentation: pySim-shell - the next generation of pySim 21:00 USSE: unstructured supplementary social event [*] 22:00 close of call Presentation Abstract: For more than a decade, pySim-prog has been the tool to configure/program SIM cards in research/lab/private cellular networks. Originally designed for very simplistic GSM-only SIM Cards, it was extended again and again to cover more use cases and parameters. There is a limit as to how far one can go with stuffing everything into command line arguments. In 2021, pySim-shell was created as the next generation tool. It features interactive navigation around the file system, editing capabilities, backup and restore of all [known] files, ... Attendance is free of charge and open to anyone with an interest in Osmocom. More information about OsmoDevCall, including the schedule for further upcoming events can be found at https://osmocom.org/projects/osmo-dev-con/wiki/OsmoDevCall Looking forward to meeting you on Friday. Best regards, Harald [*] this is how we started to call the "unstructured" part of osmocom developer conferences in the past, basically where anyone can talk about anything, no formal schedule or structure. -- - Harald Welte <laforge(a)osmocom.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

1 0

WIP / RFC for pysim 'next generation;' aka pysim-shell
by Harald Welte 07 Apr '21

07 Apr '21

Dear Osmocom community, pySim-prog was nice when there were only 5 parameters on a SIM that we could program, and where the use case was pretty limited. Today, we have SIM/USIM/ISIM cards with hundreds of files and even more parameters to program. We cannot add a command line argument for each file to pySim-prog. Instead, this introduces an interactive command-line shell / REPL, in which one can navigate the file system of the card, read and update files both in raw format and in decoded/parsed format. The idea is primarily inspired by Henryk Ploetz' venerable cyberflex-shell, but implemented on a more modern basis using the cmd2 python module. You can see the very first prototype in the laforge/shell branch of pysim.git You can do things with it like this: ===> Start-up and authenticate with adm pin ---------------------------------------------------------------------- $ ./pysim-shell.py -p 0 Using PC/SC reader interface Autodetected card type: sysmoISIM-SJA2 AIDs on card: ['a0000000871002ffffffff8907090000', 'a0000000871004ffffffff8907090000'] Welcome to pySim-shell! pySIM-shell (3f00)> verify_adm 92990895 ---------------------------------------------------------------------- ===> interactive help ---------------------------------------------------------------------- pySIM-shell (3f00)> help Documented commands (use 'help -v' for verbose/'help <topic>' for details): ISO7816 Commands ================ read_binary select_adf select_file update_binary update_record verify_chv pySim Commands ============== intro verify_adm USIM Commands ============= read_ehplmn ust_service_activate ust_service_deactivate pySim-shell built-in commands ============================= alias help macro quit run_script shell edit history py run_pyscript set shortcuts ---------------------------------------------------------------------- ===> more interactive help ---------------------------------------------------------------------- pySIM-shell (3f00)> help read_binary usage: read_binary [-h] [--file-id FILE_ID] [--offset OFFSET] [--length LENGTH] [--record-nr RECORD_NR] Read binary data from a transparent EF optional arguments: -h, --help show this help message and exit --file-id FILE_ID File ID --offset OFFSET Byte offset for start of read --length LENGTH Number of bytes to read --record-nr RECORD_NR Number of record to read ---------------------------------------------------------------------- ===> navigating the FS and reading files ---------------------------------------------------------------------- pySIM-shell (3f00)> select_file 7f20 ['622c8202782183027f20a509800171830400018d088a01058b032f0601c60f90017083010183018183010a83010b'] pySIM-shell (3f00/7f20)> read_binary --file-id 6f07 089910070000400310 ---------------------------------------------------------------------- ===> interaction with local filesystem, i.e. I/O redirect + shell commands ---------------------------------------------------------------------- pySIM-shell (3f00)> select_adf a0000000871002 pySIM-shell (a0000000871002)> select_file 5f3b pySIM-shell (a0000000871002/5f3b)> read_binary --file-id 4f20 > /tmp/f pySIM-shell (a0000000871002/5f3b)> !cat /tmp/f ffffffffffffffff07 ---------------------------------------------------------------------- ===> piping output through shell tools like grep ---------------------------------------------------------------------- pySIM-shell (3f00)> read_ust | grep 86 Service 86 - Allowed CSG Lists and corresponding indications ---------------------------------------------------------------------- ===> enabling/disabling services ---------------------------------------------------------------------- pySIM-shell (3f00/7f20)> ust_service_activate 123 pySIM-shell (3f00/7f20)> ust_service_deactivate 123 ---------------------------------------------------------------------- It's a very first prototype, but it is really promising. The major tasks I see to make this go anywhere is: * have "File" class with encoder/decoder methods, which are registered automatically with a 'file system' layer that knows about the DF/ADF hierarchy ** this allows us to have a "read-decoded" command, which will call the decode method of the file, automatically resolved by the selected FID/path * automatic mapping of file-name -> FID and FID -> file name ** when printing (like in the path), use the human-readable names ** allow users to use human-readable names in SELECT * decode + display the TLVs / FCPs after a SELECT (like cyberflex-shell * ability to enable/disable APDU trace * dynamically register/deregster commands based on the path, i.e. offer USIM commands only when in ADF_USIM We have quite a bit of that infrastructure in the c-language libosmosim, (part of libosmocore.git), but unfortunately not in python :/ Let me know if anyone is interested in joining this effort. Regards, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

5 7

Osmocom Mailing List re-organization
by Harald Welte 03 Mar '21

03 Mar '21

Dear Osmocom community, This topic has been past due for way too many years by now: A re-organization of our major mailing lists. I would like to propose the following changes. Pleas let me know if you have any comments or feedback. I'm aware that renaming will mean people have to update their mail filter rules, but I think we're long past the point where the names of some of our lists started to confuse users. == openbsc(a)lists.osmocom.org == * openbsc doesn't exist anymore since OsmoNITB, which is also obsolete * does already cover anything "Osmocom CNI" related * Proposed new name: osmocom-cni(a)lists.osmocom.org == osmocom-net-gprs(a)lists.osmocom.org == This date back to when GPRS was a highly experimental add-on to our GSM code base. This list should simply be merged with openbsc@ as osmocom-cni(a)lists.osmocom.org == simtrace(a)lists.osmocom.org == Historically was created to cover only the simtrace project. We should rename this to osmocom-simcard(a)lists.osmocom.org or something along those lines. I would like to suggest it covers * SIMtrace / SIMtrace2 hardware + firmware * pySim and related tools for working with SIM/USIM/UICC cards * any other information / discussion related to SIM/USIM/UICC cards, like OTA, ARA-M, ... == osmodevcon(a)lists.osmocom.org == This has been a private list for people attending OsmoDevCon I would like to open up list membership to the general public, and ensure it also covers the new OsmoDevCall. We could then have discussions regarding feedback, topics, scheduling, etc. on that list. Maybe rename it to osmocom-events(a)lists.osmocom.org instead? To differentiate: osmocom-event-orga(a)lists.osmocom.org should remain a private list related to organizational / administrative topics of those involved with organizing future events. == nextepc(a)lists.osmocom.org == Should have been renamed to open5gs(a)lists.osmocom.org quite some time ago, I simply forgot about it. My apologies. -- - Harald Welte <laforge(a)osmocom.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

2 1

remsim: SIM inventory, mapping by IMSI
by merlin.chlosta+simtrace＠rub.de 06 Feb '21

06 Feb '21

Hi everybody, we try to use remsim for sharing SIMs across teams (multiple locations). We already set up the basic SIM sharing in a VPN. From a usability perspective, we’d like to have something like a SIM inventory and select SIMs by ICCID/IMSI rather than slots. We drafted some over-the-top service with a simple web application. pySim reads available cards, sends them to the service and generates a config for bankd. Kinda works, not really nice though. So before going much further, we’d like to ask: * is there something similar already? * are there similar features planned, like * automatically reading ICCID, IMSI and sharing them through remsim service directly? * mapping by card properties (IMSI/ICCID) instead of slot maps? We found it challenging to preserve the mappings across reboots, as PCSC indices change. We might just use remsim wrong, so any thoughts and feedback welcome. Besides, do you see any major blockers? Like… sharing across locations doesn’t really make sense if plugging-in-and-out is required, and we’re not sure if e.g. connection issues would require that. Happy for any thoughts! Merlin

2 1

simtrace2 Windows host
by Jérome Dufour 05 Jan '21

05 Jan '21

Hi all, Is there a Windows version of the simtrace2 host software? Regards, Jerome. ᐧ

3 2

Laser Cut SIMtrace Case
by Nick 29 Dec '20

29 Dec '20

Hi all, Had some free time this afternoon so I put together a laser cut case for the SIMtrace (photos attached), It's just cut out of 2mm perspex, with openings for the cards, flexible SIM adapter, USB and 2.5mm jack. They open up from the top for changing the flexible SIM adapters and accessing the buttons / flashing, The designs are attached for anyone who has got access to a makerspace or laser cutter wants to make one, - *SimTrace_2mm_box_version_7.dxf *is the DXF for the design, should work with any cutting software, file is in MM - *Simtrace_Final.rld *is the RDworks layout with the logo in it (most low end lasers use this software) and it has the nesting & logo baked in (DXF does not have the logo embedded) - *Osmocom_Logo_No_Gradient.jpg* is an adjusted version of the Osmocom logo as the laser CAM software doesn't deal with gradients I'm not sure where the best place to put the files are, so others can make their own - on the SIMtrace page on the Wiki or in the Repo itself? Cheers, Nick [image: image.png] [image: SIMtrace.png]

2 1

[PATCH] remsim: adding cli argument to set the atr
by Leonard Hübner 27 Oct '20

27 Oct '20

--- host/src/simtrace2-remsim.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/host/src/simtrace2-remsim.c b/host/src/simtrace2-remsim.c index 201ff71..48186d8 100644 --- a/host/src/simtrace2-remsim.c +++ b/host/src/simtrace2-remsim.c @@ -50,6 +50,8 @@ #include <osmocom/sim/class_tables.h> #include <osmocom/sim/sim.h> +#define ATR_MAX_LEN 33 + static void atr_update_csum(uint8_t *atr, unsigned int atr_len) { uint8_t csum = 0; @@ -181,6 +183,7 @@ static void print_help(void) "\t-h\t--help\n" "\t-i\t--gsmtap-ip\tA.B.C.D\n" "\t-a\t--skip-atr\n" + "\t-t\t--set-atr\tATR-STRING in HEX\n" "\t-k\t--keep-running\n" "\t-n\t--pcsc-reader-num\n" "\t-V\t--usb-vendor\tVENDOR_ID\n" @@ -199,6 +202,7 @@ static const struct option opts[] = { { "remote-udp-port", 1, 0, 'p' }, { "gsmtap-ip", 1, 0, 'i' }, { "skip-atr", 0, 0, 'a' }, + { "set-atr", 1, 0, 't' }, { "help", 0, 0, 'h' }, { "keep-running", 0, 0, 'k' }, { "pcsc-reader-num", 1, 0, 'n' }, @@ -283,6 +287,9 @@ int main(int argc, char **argv) int rc; int c, ret = 1; int skip_atr = 0; + char *atr = "3b00"; + uint8_t real_atr[ATR_MAX_LEN]; + int atr_len; int keep_running = 0; int remote_udp_port = 52342; int if_num = 0, vendor_id = -1, product_id = -1; @@ -298,7 +305,7 @@ int main(int argc, char **argv) while (1) { int option_index = 0; - c = getopt_long(argc, argv, "r:p:hi:V:P:C:I:S:A:H:akn:", opts, &option_index); + c = getopt_long(argc, argv, "r:p:hi:V:P:C:I:S:A:H:akn:t:", opts, &option_index); if (c == -1) break; switch (c) { @@ -318,6 +325,9 @@ int main(int argc, char **argv) case 'a': skip_atr = 1; break; + case 't': + atr = optarg; + break; case 'k': keep_running = 1; break; @@ -348,6 +358,12 @@ int main(int argc, char **argv) } } + atr_len = osmo_hexparse(atr,real_atr,ATR_MAX_LEN); + if(atr_len < 2) { + fprintf(stderr, "Invalid ATR - please omit a leading 0x and only use valid hex digits and whitespace. ATRs need to be between 2 and 33 bytes long.\n"); + goto do_exit; + } + if (!remote_udp_host && (vendor_id < 0 || product_id < 0)) { fprintf(stderr, "You have to specify the vendor and product ID\n"); goto do_exit; @@ -438,9 +454,8 @@ int main(int argc, char **argv) if (!skip_atr) { /* set the ATR */ - uint8_t real_atr[] = { 0x3B, 0x00 }; // the simplest ATR - atr_update_csum(real_atr, sizeof(real_atr)); - osmo_st2_cardem_request_set_atr(ci, real_atr, sizeof(real_atr)); + atr_update_csum(real_atr, atr_len); + osmo_st2_cardem_request_set_atr(ci, real_atr, atr_len); } /* select remote (forwarded) SIM */ -- 2.26.2

2 5

simtrace2-remsim set-atr flag - code offer
by Leonard Hübner 26 Oct '20

26 Oct '20

Hey there SIMTrace-Community! In the context of my current project I needed to set the ATR, which the SIMTrace2(cardem firmware) sends to the SIM-Terminal. To this end I added a cli flag (--set-atr) to the simtrace2-remsim host software which takes an ATR and signals to the cardem firmware to use this ATR. The later functionality is already present and therefore I only implemented the cli flag and the string to hex transformation (using osmo_hexparse). Would you be interested in this code? If you are, how can I contribute it? It currently lives inside a git branch on my machine. Thank you very much for making the code freely available! Leonard Hübner

2 2

← Newer
1
...
8
9
10
11
12
13
14
...
35
Older →

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

simtrace