simtrace

simtrace@lists.osmocom.org

347 discussions

SIM FPC cable layout pcb and garter files
by siddhesh bobhate 22 Oct '23

22 Oct '23

Dear Osmocom team, First of a big thank you for all your effort putting into SIM/eUICC/eSIM open source projects which help some or other way to sim card enthusiasts !!! I wanted to check with you if SIM FPC cable 2FF/3FF/4FF flex pcb design files are also available as open source to the community similar to SIM trace design files? If yes, could you please help me to share the git repo link as I am unable to find the same. I am from India. Initially I tried ordering the same from Sysmocom webshop with help of some vendors but customs rules in India are very strict and it would cost more than 10 times the actual flex cable cost. as I need to for personal use, it's not feasible to afford. Thanks, Siddhesh

2 1

FC SIMsniff works in first prototype version
by Mychaela Falconia 04 Oct '23

04 Oct '23

Hello SIMtrace enthusiasts, As mentioned previously on various occasions, FreeCalypso SIMsniff is a hardware+FPGA+software solution I put together to serve as a partial replacement for Osmocom SIMtrace. I call it a partial rather than complete replacement for SIMtrace because the piece which I consider to be the essence of SIMtrace (the Sysmocom-made, webshop-sold piece that goes into the phone's SIM socket) stays the same in my SIMsniff solution, only the active component changes: instead of using a SIMtrace1 or SIMtrace2 board, I use my own little hw contraption (currently a mess, needs to be simplified) to sniff and level-shift the electrical signals, followed by an iCE40 FPGA for ISO 7816-3 character sniffing. The whole project lives here: https://www.freecalypso.org/hg/fc-sim-sniff/ Earlier this week I got the last required hw piece assembled (the mv-sniffer board that hosts my choice of level shifter IC, Nexperia 74LVC4T3144), and I am happy to report that the whole solution works as designed! The two principal design objectives, which are also principal differences from SIMtrace1/2, are as follows: * Make a strictly non-invasive Hi-Z connection to the SIM bus being traced or sniffed, without Heisenbug-inducing pull resistors or switches or other artifacts; * Hi-Z-sniff ME-to-SIM interfaces that can operate at any voltage from 1.8V to 5V. With my current messy hw setup of two tiny boards (sim-fpc-pasv and mv-sniffer) inserted between the original SIMtrace FPC cable and the Icestick FPGA board, the just-stated objectives are met: I can successfully sniff ME-to-SIM sessions at all 3 voltage classes, *without* the tracing apparatus altering any electrical aspects of the interface under study in any way. Here are some examples of what SIMsniff trace logs look like: https://www.freecalypso.org/members/falcon/SIMsniff-traces/ The 3 log files in the above directory are: 2190-fcsim1.log: Nokia 2190E talking to FCSIM1 2190-sjs1.log: Nokia 2190E talking to sysmoUSIM-SJS1 fcdev3b-sjs1.log: FCDEV3B (standard fw) talking to sysmoUSIM-SJS1 Nokia 2190E always puts out 5V toward the SIM, hence those two logs are proof of working 5V sniffing. Calypso+Iota chipset supports 3V and 1.8V and FreeCalypso fw talks to the SIM at 1.8V by default, thus the last log is proof of working 1.8V sniffing. The last log also exhibits switching from F/D=372 to F/D=64 (F=512 D=8), demonstrating how my sniffer FPGA handles such sessions. These are very raw, low-level trace logs: each line in the log file is one 16-bit word received from the FPGA, corresponding to one character (in the ISO 7816-3 sense) captured on the SIM-ME interface. More details here: https://www.freecalypso.org/hg/fc-sim-sniff/file/tip/doc/Sniffer-FPGA-design To get a human-readable trace of ME-to-SIM interface activity, each raw log needs to be passed through higher-level decoding utility simsniff-dec, residing in fc-sim-sniff Hg repository. I invite interested parties to compile that utility, run it on the raw log files I posted, and see what kind of trace logs you then get for human study. Note of course my very different technology preferences: I don't use Wireshark, hence I never developed any tools for feeding SIM interface traces into that world, and I never succeeded in getting the current incarnation of pySim to run on my system (too much dependency hell, and Python is too alien to me), hence no integration with pySim-trace.py either. But just because I haven't developed those pieces doesn't mean that no one else can! If anyone in the wider Osmocom+FC community superset likes what I did in electrical terms, but also likes the original Osmocom SIMtrace high-level sw design better than my concoction, you should be able to take my simsniff-rx program (the one that receives traces from the FPGA by way of FT2232H UART channel) and modify it to emit traces in a way that fits into Osmocom SIMtrace sw paradigm - why not? The hardware part also needs polishing: the current arrangement of separate sim-fpc-pasv and mv-sniffer boards connected with jumper wires is a mess. My plan is to make a proper FC SIMsniff "pod" board: put the SIMtrace FPC connector, a physical SIM socket, 2.54 mm headers for o'scope probing and the 74LVC4T3144 buffer on the same PCB, interconnected together on the "SIM bus" side, plus a 6-pin header on the 'B' side of 74LVC4T3144 for connecting to the Icestick FPGA board. I am also now thinking (counter to my original plans) about making a combined SIMsniff+SIMemu pod, i.e., making just one hw setup that can work for either sniffing or card emulation by loading different FPGA gateware and opening/closing a jumper on the "pod" board. How does card emulation fit into my SIMsniff hw architecture? Answer: it will be almost the same as sniffing, with only one little hw component (an OD driver IC) added. The same hw path that passively sniffs SIM RST, CLK and I/O lines (via 74LVC4T3144) will also work for cardem, but one more component needs to be added: a 74LVC1G07 OD buffer, driven by an FPGA output, with the output side of this OD buffer connected to the physical SIM I/O line. The only active driving done by real SIM cards is driving the I/O line low in the manner of an OD output, there is no high drive (the pull-up resistor in the ME is responsible for making the line go high), and on all other interface lines the SIM only receives - hence the combination of a Hi-Z receiver like current SIMsniff plus an OD driver on the I/O line would be a fully proper emulation of a real SIM card. My original hesitation against combining SIMsniff and SIMemu pods into one was that I don't like the idea of the OD driver turning on by mistake (wrong FPGA loaded perhaps) and fighting with the physical SIM card in the socket. But my current plan is to insert a jumper (or more precisely, a pair of 2.54 mm header pins onto which a shorting block may be placed) between the "SIM bus" I/O line and the output pin of 74LVC1G07 OD buffer: this way if you insert a physical SIM into the socket for tracing, remove the jumper, and if you leace the SIM socket empty for cardem, install the jumper. Why jumper and not a little slide switch? With the switch there would be the extra cognitive load of looking at the switch carefully and remembering which position is which, whereas presence or absence of a shorting jumper on a pair of pins is an immediate, almost subconscious visual indicator. Any feedback ideas would be appreciated. When I design my new SIMsniff+SIMemu "pod" board, I would like to make a large-ish batch (maybe 20 boards), thus it would be really nice if the same hardware could be made palatable to both FC and Osmocom communities. Hasta la Victoria, Siempre, Mychaela aka The Mother

1 0

Introducing SIMtrace3 aka SIMtrace-ice
by Mychaela Falconia 26 Sep '23

26 Sep '23

Hello fellow SIM tracers, I have my new incarnation of SIMtrace mostly working: https://www.freecalypso.org/hg/simtrace-ice/ The Hg repository is named simtrace-ice, but the host program binaries installed by the sw package are named simtrace3-*, following the installed binary namespace usage convention established by previously existing simtrace2-*. Quoting from the README file at the top of the just-linked source repository, FreeCalypso SIMtrace3 (aka SIMtrace-ice) is an alternative implementation of Osmocom SIMtrace principal idea, using an iCE40 FPGA instead of AT91SAMx MCU as the ISO 7816-3 sniffing receiver. The signals going to the FPGA are outputs from a unidirectional voltage- translating buffer (Nexperia 74LVC4T3144) whose inputs are connected to the SIM interface being sniffed. The sniffing apparatus is thus electrically clean, making only a Hi-Z connection to the SIM interface being sniffed, and I expect it to work correctly with all voltages from 1.8 to 5 V. This new SIMtrace3 gadget is more than just a proposal - most parts of it have already been implemented and proven working. The multivolt sniffer board remains to be assembled/populated (I got the PCB and the components on hand, I just need to make a visit to Technotronix to get it assembled), but the FPGA gateware and the host programs receiving and decoding the sniffed bits have already been proven working, using an FCDEV3B forced into Class B voltage mode to work without the mv-sniffer component. The hardware setup is quite minimal: the FPGA board is off-the-shelf Lattice iCEstick, readily available from various distributors, and the SIMtrace3-specific custom hw bit will be reduced to just one very simple board in the final version. The SIMtrace3 sniffer pod will passively interconnect the SIM interface under study between the FPC connector (existing SIMtrace FPC cables), a physical 2FF SIM socket and the Hi-Z input pins of the dual-supply buffer, while the output side of that buffer will go to header pins, to be connected to the Icestick board. The 74LVC4T3144 buffer IC will be the only active component on this board! My initial emphasis is on sniffing, but my longer plans include cardem too. I prefer having separate hw setups for the two functions, hence my design calls for two separate "pod" boards, a sniffing pod and a cardem pod. The cardem pod will be the sniffing pod (same multivolt buffer, supporting all voltages) minus the SIM socket, plus a 74LVC1G07 OD buffer for driving the SIM I/O line from the FPGA-emulated card. The FPGA gateware will of course be different too, but I expect it to fit into the HX1K FPGA on the same iCEstick board. It should also be noted that whether people like my design or not, the name SIMtrace3 is now effectively claimed for this design whose gateware and host software have already been implemented and whose hw components are in the process of being finished and polished. If the people behind SIMtrace1/2 (the original) totally dislike my idea and would rather build some other successor to SIMtrace2, please call your version SIMtrace4 - otherwise there will be two different designs each claiming to be SIMtrace3, which won't help anyone. M~

4 4

Phone locks up on boot with simtrace cable attached
by Adrian Popa 01 Aug '23

01 Aug '23

Again, with my client-server remsim setup. The client starts correctly: DRSPRO INFO ../rspro_client_fsm.c:307 RSPRO_CLIENT(bankd){REESTABLISH}: Creating TCP connection to server at 192.168.1.111:9999 DLINP NOTICE input/ipa.c:141 192.168.1.111:9999 connection done DRSPRO NOTICE ../rspro_client_fsm.c:127 RSPRO_CLIENT(bankd){REESTABLISH}: RSPRO link to 192.168.1.111:9999 UP DLINP NOTICE simtrace2_api.c:172 [0] <= osmo_st2_cardem_request_card_insert(inserted=1) DLINP NOTICE simtrace2_api.c:321 [0] <= _modem_sim_select(remote_sim=1) DLINP NOTICE simtrace2_api.c:254 [0] <= osmo_st2_cardem_request_set_atr(3b 00 ) DLINP NOTICE simtrace2_api.c:288 [0] <= _modem_reset(asserted=2, pulse_ms=300) DLINP NOTICE simtrace2_api.c:254 [0] <= osmo_st2_cardem_request_set_atr(3b 9f 96 80 1f c7 80 31 e0 73 fe 21 13 67 98 07 02 10 01 01 01 54 ) The bankd sees the card correctly: Jul 12 14:54:43 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_main.c:955 [000 ACCEPTING] Accepted connection from 192.168.1.9:45513 Jul 12 14:54:43 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_main.c:442 [000 ACCEPTING] Changing state to CONN_WAIT_ID Jul 12 14:54:43 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_main.c:655 [000 CONN_WAIT_ID] Rx RSPRO connectClientReq(T=0, N='rpi-cardem-2', SW='remsim-client', VER='1.0.0') Jul 12 14:54:43 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_main.c:442 [000 CONN_WAIT_ID] Changing state to CONN_CLIENT Jul 12 14:54:43 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_main.c:625 [000 CONN_CLIENT] slotmap found: C(1:1) -> B(1:1) Jul 12 14:54:43 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_main.c:450 [000 CONN_CLIENT] Changing state to CONN_CLIENT_MAPPED (timeout=10) Jul 12 14:54:43 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_pcsc.c:261 [000 CONN_CLIENT_MAPPED] Attempting to open PC/SC context Jul 12 14:54:44 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_pcsc.c:264 [000 CONN_CLIENT_MAPPED] SCardEstablishContext: OK Jul 12 14:54:44 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_pcsc.c:215 [000 CONN_CLIENT_MAPPED] Attempting to find card/slot using regex 'SCM Microsystems Inc. SCR 3310' Jul 12 14:54:44 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_pcsc.c:234 [000 CONN_CLIENT_MAPPED] Attempting to open card/slot 'SCM Microsystems Inc. SCR 3310 [CCID Interface] (53312144266274) 00 00' Jul 12 14:54:44 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_pcsc.c:198 [000 CONN_CLIENT_MAPPED] SCardStatus: OK Jul 12 14:54:44 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_pcsc.c:200 [000 CONN_CLIENT_MAPPED] Card ATR: 3b9f96801fc78031e073fe2113679807021001010154 Jul 12 14:54:44 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_main.c:442 [000 CONN_CLIENT_MAPPED] Changing state to CONN_CLIENT_MAPPED_CARD Jul 12 14:54:44 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_main.c:780 [000 CONN_CLIENT_MAPPED_CARD] Rx RSPRO setAtrRes Once the phone powers on, the client starts showing such messages: DST2 INFO user_simtrace2.c:180 SIMtrace IRQ STATUS: flags=0x12, fi=1, di=1, wi=10 wtime=9600 DST2 INFO user_simtrace2.c:193 SIMtrace IRQ 01 04 00 00 00 00 15 00 00 00 00 00 00 00 01 01 0a 80 25 00 00 DST2 INFO user_simtrace2.c:180 SIMtrace IRQ STATUS: flags=0x0, fi=1, di=1, wi=10 wtime=9600 DST2 INFO user_simtrace2.c:193 SIMtrace IRQ 01 04 00 00 00 00 15 00 01 00 00 00 00 00 01 01 0a 80 25 00 00 DST2 INFO user_simtrace2.c:180 SIMtrace IRQ STATUS: flags=0x1, fi=1, di=1, wi=10 wtime=9600 DST2 INFO user_simtrace2.c:193 SIMtrace IRQ 01 04 00 00 00 00 15 00 03 00 00 00 00 00 01 01 0a 80 25 00 00 DST2 INFO user_simtrace2.c:180 SIMtrace IRQ STATUS: flags=0x3, fi=1, di=1, wi=10 wtime=9600 DST2 INFO user_simtrace2.c:193 SIMtrace IRQ 01 04 00 00 00 00 15 00 13 00 00 00 00 00 01 01 0a 80 25 00 00 DST2 INFO user_simtrace2.c:180 SIMtrace IRQ STATUS: flags=0x13, fi=1, di=1, wi=10 wtime=9600 DST2 INFO user_simtrace2.c:193 SIMtrace IRQ 01 04 00 00 00 00 15 00 03 00 00 00 00 00 01 01 0a 80 25 00 00 DST2 INFO user_simtrace2.c:180 SIMtrace IRQ STATUS: flags=0x3, fi=1, di=1, wi=10 wtime=9600 DST2 INFO user_simtrace2.c:193 SIMtrace IRQ 01 04 00 00 00 00 15 00 13 00 00 00 00 00 01 01 0a 80 25 00 00 DST2 INFO user_simtrace2.c:180 SIMtrace IRQ STATUS: flags=0x13, fi=1, di=1, wi=10 wtime=9600 DST2 INFO user_simtrace2.c:193 SIMtrace IRQ 01 04 00 00 00 00 15 00 12 00 00 00 00 00 01 01 0a 80 25 00 00 But the phone never completes the boot (shows just the splash screen). The bankd daemon shows in an infinite loop: Jul 12 15:38:29 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_pcsc.c:288 [000 CONN_CLIENT_MAPPED_CARD] SCardReconnect: OK Jul 12 15:38:29 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_pcsc.c:198 [000 CONN_CLIENT_MAPPED_CARD] SCardStatus: OK Jul 12 15:38:29 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_pcsc.c:200 [000 CONN_CLIENT_MAPPED_CARD] Card ATR: 3b9f96801fc78031e073fe2113679807021001010154 Jul 12 15:38:29 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_main.c:749 [000 CONN_CLIENT_MAPPED_CARD] Rx RSPRO clientSlotStatusInd(RST=INACTIVE, VCC=PRESENT, CLK=INACTIVE) Jul 12 15:38:29 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_main.c:749 [000 CONN_CLIENT_MAPPED_CARD] Rx RSPRO clientSlotStatusInd(RST=INACTIVE, VCC=PRESENT, CLK=ACTIVE) Jul 12 15:38:29 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_main.c:749 [000 CONN_CLIENT_MAPPED_CARD] Rx RSPRO clientSlotStatusInd(RST=INACTIVE, VCC=ABSENT, CLK=ACTIVE) Jul 12 15:38:29 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_pcsc.c:284 [000 CONN_CLIENT_MAPPED_CARD] Resetting card in 'SCM Microsystems Inc. SCR 3310' (cold reset) Jul 12 15:38:29 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_pcsc.c:288 [000 CONN_CLIENT_MAPPED_CARD] SCardReconnect: OK Jul 12 15:38:29 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_pcsc.c:198 [000 CONN_CLIENT_MAPPED_CARD] SCardStatus: OK Jul 12 15:38:29 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_pcsc.c:200 [000 CONN_CLIENT_MAPPED_CARD] Card ATR: 3b9f96801fc78031e073fe2113679807021001010154 Jul 12 15:38:29 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_main.c:749 [000 CONN_CLIENT_MAPPED_CARD] Rx RSPRO clientSlotStatusInd(RST=INACTIVE, VCC=ABSENT, CLK=INACTIVE) Jul 12 15:38:29 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_pcsc.c:284 [000 CONN_CLIENT_MAPPED_CARD] Resetting card in 'SCM Microsystems Inc. SCR 3310' (cold reset) Jul 12 15:38:29 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_pcsc.c:288 [000 CONN_CLIENT_MAPPED_CARD] SCardReconnect: OK Jul 12 15:38:29 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_pcsc.c:198 [000 CONN_CLIENT_MAPPED_CARD] SCardStatus: OK Jul 12 15:38:29 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_pcsc.c:200 [000 CONN_CLIENT_MAPPED_CARD] Card ATR: 3b9f96801fc78031e073fe2113679807021001010154 Jul 12 15:38:29 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_main.c:749 [000 CONN_CLIENT_MAPPED_CARD] Rx RSPRO clientSlotStatusInd(RST=INACTIVE, VCC=PRESENT, CLK=INACTIVE) Jul 12 15:38:29 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_main.c:749 [000 CONN_CLIENT_MAPPED_CARD] Rx RSPRO clientSlotStatusInd(RST=INACTIVE, VCC=PRESENT, CLK=ACTIVE) Jul 12 15:38:29 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_main.c:749 [000 CONN_CLIENT_MAPPED_CARD] Rx RSPRO clientSlotStatusInd(RST=INACTIVE, VCC=ABSENT, CLK=ACTIVE) Jul 12 15:38:29 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_pcsc.c:284 [000 CONN_CLIENT_MAPPED_CARD] Resetting card in 'SCM Microsystems Inc. SCR 3310' (cold reset) Jul 12 15:38:29 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_pcsc.c:288 [000 CONN_CLIENT_MAPPED_CARD] SCardReconnect: OK Jul 12 15:38:29 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_pcsc.c:198 [000 CONN_CLIENT_MAPPED_CARD] SCardStatus: OK Jul 12 15:38:29 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_pcsc.c:200 [000 CONN_CLIENT_MAPPED_CARD] Card ATR: 3b9f96801fc78031e073fe2113679807021001010154 Jul 12 15:38:29 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_main.c:749 [000 CONN_CLIENT_MAPPED_CARD] Rx RSPRO clientSlotStatusInd(RST=INACTIVE, VCC=ABSENT, CLK=INACTIVE) Jul 12 15:38:29 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_pcsc.c:284 [000 CONN_CLIENT_MAPPED_CARD] Resetting card in 'SCM Microsystems Inc. SCR 3310' (cold reset) Jul 12 15:38:29 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_pcsc.c:288 [000 CONN_CLIENT_MAPPED_CARD] SCardReconnect: OK Jul 12 15:38:29 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_pcsc.c:198 [000 CONN_CLIENT_MAPPED_CARD] SCardStatus: OK Jul 12 15:38:29 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_pcsc.c:200 [000 CONN_CLIENT_MAPPED_CARD] Card ATR: 3b9f96801fc78031e073fe2113679807021001010154 Jul 12 15:38:29 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_main.c:749 [000 CONN_CLIENT_MAPPED_CARD] Rx RSPRO clientSlotStatusInd(RST=INACTIVE, VCC=PRESENT, CLK=INACTIVE) Jul 12 15:38:29 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_main.c:749 [000 CONN_CLIENT_MAPPED_CARD] Rx RSPRO clientSlotStatusInd(RST=INACTIVE, VCC=PRESENT, CLK=ACTIVE) Jul 12 15:38:29 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_main.c:749 [000 CONN_CLIENT_MAPPED_CARD] Rx RSPRO clientSlotStatusInd(RST=INACTIVE, VCC=ABSENT, CLK=ACTIVE) Jul 12 15:38:29 rpi-cardem-1 osmo-remsim-bankd[19847]: 19848 DBANKDW INFO bankd_pcsc.c:284 [000 CONN_CLIENT_MAPPED_CARD] Resetting card in 'SCM Microsystems Inc. SCR 3310' (cold reset) So, something seems to cause the card reader to reset and it looks like the phone is waiting for the sim card to initialize. How should I try to troubleshoot further? Does it look like a card reader problem? A misplaced/poor contact SIM FPC cable? A problem with the SIM in the reader? Should I try with a different phone (hard to get phones with fullsized SIM), or a different reader? How should I proceed further? Perhaps try a trace (but that doesn't use an external reader)? Thanks for any suggestions. Cheers!

5 14

osmo-remsim unknown simtrace msg type 0x00
by gmaillee＠126.com 30 Jul '23

30 Jul '23

Der Harald Welte root@debian:~# osmo-remsim-client-st2 -i 192.168.2.122 -V 1d50 -P 60e3 -C 1 -I 0 -H 2-2 -c 0 -n 0 DRSPRO INFO ../rspro_client_fsm.c:307 RSPRO_CLIENT(server){REESTABLISH}: Creating TCP connection to server at 192.168.2.122:9998 DLINP NOTICE simtrace2_api.c:271 [0] <= osmo_st2_cardem_request_config(features=00000001) DLINP NOTICE input/ipa.c:141 192.168.2.122:9998 connection done DRSPRO NOTICE ../rspro_client_fsm.c:127 RSPRO_CLIENT(server){REESTABLISH}: RSPRO link to 192.168.2.122:9998 UP DRSPRO INFO ../rspro_client_fsm.c:307 RSPRO_CLIENT(bankd){REESTABLISH}: Creating TCP connection to server at 192.168.2.105:9999 DLINP NOTICE input/ipa.c:141 192.168.2.105:9999 connection done DRSPRO NOTICE ../rspro_client_fsm.c:127 RSPRO_CLIENT(bankd){REESTABLISH}: RSPRO link to 192.168.2.105:9999 UP DLINP NOTICE simtrace2_api.c:172 [0] <= osmo_st2_cardem_request_card_insert(inserted=1) DLINP NOTICE simtrace2_api.c:321 [0] <= _modem_sim_select(remote_sim=1) DLINP NOTICE simtrace2_api.c:254 [0] <= osmo_st2_cardem_request_set_atr(3b 00 ) DLINP NOTICE simtrace2_api.c:288 [0] <= _modem_reset(asserted=2, pulse_ms=300) DLINP NOTICE simtrace2_api.c:254 [0] <= osmo_st2_cardem_request_set_atr(3b 9c 95 80 1f c7 80 31 e0 73 fe 21 13 64 10 c0 c0 0f c4 ) when my phone turns on DST2 ERROR user_simtrace2.c:152 unknown simtrace msg type 0x00 DST2 ERROR user_simtrace2.c:152 unknown simtrace msg type 0x00 DST2 ERROR user_simtrace2.c:152 unknown simtrace msg type 0x00 DST2 ERROR user_simtrace2.c:152 unknown simtrace msg type 0x00

1 1

Package installation failing
by Steven Robertson 21 Jul '23

21 Jul '23

Hi I have a raspberry pi with Debian 12 installed which I am trying to setup to use the simtrace2 hardware. I am having difficulty installing the simtrace2-util package – even though I believe I have followed the installation instructions (https://osmocom.org/projects/cellular-infrastructure/wiki/Nightly_Builds) I can see the repo in the sources list following the provided instructions: steven@simtrace:~$ cat /etc/apt/sources.list.d/osmocom-nightly.list deb [signed-by=/etc/apt/trusted.gpg.d/osmocom-nightly.asc] https://downloads.osmocom.org/packages/osmocom:/nightly/Debian_12/ ./ If I apt list – I can see the package steven@simtrace:~$ sudo apt list simtrace2-utils [sudo] password for steven: Listing... Done simtrace2-utils/unknown 0.8.1.64.da07.202307200026 amd64 simtrace2-utils/unknown 0.8.1.64.da07.202307200026 i386 However if I try to install steven@simtrace:~$ sudo apt install simtrace2-utils Reading package lists... Done Building dependency tree... Done Reading state information... Done E: Unable to locate package simtrace2-utils Yet – I know the package is accessible. steven@simtrace:~$ wget https://downloads.osmocom.org/packages/osmocom:/nightly/Debian_12/simtrace2… --2023-07-20 10:29:55-- https://downloads.osmocom.org/packages/osmocom:/nightly/Debian_12/simtrace2… Resolving downloads.osmocom.org (downloads.osmocom.org)... 148.251.236.141, 2a01:4f8:201:344a::2 Connecting to downloads.osmocom.org (downloads.osmocom.org)|148.251.236.141|:443... connected. HTTP request sent, awaiting response... 200 OK Length: 276884 (270K) [application/x-xz] Saving to: ‘simtrace2_0.8.1.64.da07.202307200026.tar.xz’ simtrace2_0.8.1.64.da07.202307200026.tar.x 100%[========================================================================================>] 270.39K 140KB/s in 1.9s 2023-07-20 10:29:59 (140 KB/s) - ‘simtrace2_0.8.1.64.da07.202307200026.tar.xz’ saved [276884/276884] I have also tried forcing https to no avail steven@simtrace:~$ sudo apt-get install -f apt-transport-https simtrace2-utils Reading package lists... Done Building dependency tree... Done Reading state information... Done E: Unable to locate package simtrace2-utils Nothing seems to work. Any help would be appreciated. Best Regards -Steven ****************************************************************************** CSL DualCom Ltd Registered Office: Building 4, Croxley Park, Hatters Lane, Watford, WD18 8YF Registered in England No. 3155883 This e-mail is only intended for the person(s) to whom it is addressed and may contain confidential information. Unless stated to the contrary, any opinions or comments are personal to the writer and do not represent the official view of the company. If you have received this e-mail in error, please notify us immediately by reply e-mail and then delete this message from your system. Please do not copy it or use it for any purposes, or disclose its contents to any other person. Thank you for your co-operation. ******************************************************************************

2 2

osmo-remsim-bankd doesn't handle special (regex) characters in the name
by Adrian Popa 19 Jul '23

19 Jul '23

Hello, I'm playing with a networked remsim setup. The remsim server, sim card reader and banks daemon sit on a RPI (rpi-cardem-1), while the client (and the simtrace2) sit on a different RPI (rpi-cardem-2). The client is started like this, and keeps producing this output: root@rpi-cardem-2:~# osmo-remsim-client-st2 --server-ip remsim-server --server-port 9998 --client-id 1 --client-slot 1 --usb-vendor 1d50 --usb-product 60e3 --usb-config 1 --usb-interface 0 --usb-path "1-1.4" DRSPRO INFO ../rspro_client_fsm.c:307 RSPRO_CLIENT(server){REESTABLISH}: Creating TCP connection to server at remsim-server:9998 DLINP NOTICE simtrace2_api.c:271 [0] <= osmo_st2_cardem_request_config(features=00000001) DLINP NOTICE input/ipa.c:141 remsim-server:9998 connection done DRSPRO NOTICE ../rspro_client_fsm.c:127 RSPRO_CLIENT(server){REESTABLISH}: RSPRO link to remsim-server:9998 UP DRSPRO INFO ../rspro_client_fsm.c:307 RSPRO_CLIENT(bankd){REESTABLISH}: Creating TCP connection to server at 192.168.1.111:9999 DLINP NOTICE input/ipa.c:141 192.168.1.111:9999 connection done DRSPRO NOTICE ../rspro_client_fsm.c:127 RSPRO_CLIENT(bankd){REESTABLISH}: RSPRO link to 192.168.1.111:9999 UP DRSPRO ERROR ../rspro_client_fsm.c:297 RSPRO_CLIENT(bankd){REESTABLISH}: Event SRVC_E_KA_TERMINATED not permitted DRSPRO INFO ../rspro_client_fsm.c:302 RSPRO_CLIENT(bankd){REESTABLISH}: Destroying existing connection to server DRSPRO INFO ../rspro_client_fsm.c:307 RSPRO_CLIENT(bankd){REESTABLISH}: Creating TCP connection to server at 192.168.1.111:9999 DLINP NOTICE input/ipa.c:141 192.168.1.111:9999 connection done DRSPRO NOTICE ../rspro_client_fsm.c:127 RSPRO_CLIENT(bankd){REESTABLISH}: RSPRO link to 192.168.1.111:9999 UP DRSPRO ERROR ../rspro_client_fsm.c:297 RSPRO_CLIENT(bankd){REESTABLISH}: Event SRVC_E_KA_TERMINATED not permitted DRSPRO INFO ../rspro_client_fsm.c:302 RSPRO_CLIENT(bankd){REESTABLISH}: Destroying existing connection to server This looks like bankd sends back an wrong state/event: DRSPRO ERROR ../rspro_client_fsm.c:297 RSPRO_CLIENT(bankd){REESTABLISH}: Event SRVC_E_KA_TERMINATED not permitted On the bankd side, this is what I get: Jul 12 14:33:20 rpi-cardem-1 osmo-remsim-bankd[15203]: 15208 DBANKDW INFO bankd_main.c:955 [004 ACCEPTING] Accepted connection from 192.168.1.9:46281 Jul 12 14:33:20 rpi-cardem-1 osmo-remsim-bankd[15203]: 15208 DBANKDW INFO bankd_main.c:442 [004 ACCEPTING] Changing state to CONN_WAIT_ID Jul 12 14:33:20 rpi-cardem-1 osmo-remsim-bankd[15203]: 15208 DBANKDW INFO bankd_main.c:655 [004 CONN_WAIT_ID] Rx RSPRO connectClientReq(T=0, N='rpi-cardem-2', SW='remsim-client', VER='1.0.0') Jul 12 14:33:20 rpi-cardem-1 osmo-remsim-bankd[15203]: 15208 DBANKDW INFO bankd_main.c:442 [004 CONN_WAIT_ID] Changing state to CONN_CLIENT Jul 12 14:33:20 rpi-cardem-1 osmo-remsim-bankd[15203]: 15208 DBANKDW INFO bankd_main.c:625 [004 CONN_CLIENT] slotmap found: C(1:1) -> B(1:1) Jul 12 14:33:20 rpi-cardem-1 osmo-remsim-bankd[15203]: 15208 DBANKDW INFO bankd_main.c:450 [004 CONN_CLIENT] Changing state to CONN_CLIENT_MAPPED (timeout=10) Jul 12 14:33:20 rpi-cardem-1 osmo-remsim-bankd[15203]: 15208 DBANKDW INFO bankd_pcsc.c:261 [004 CONN_CLIENT_MAPPED] Attempting to open PC/SC context Jul 12 14:33:20 rpi-cardem-1 osmo-remsim-bankd[15203]: 15208 DBANKDW INFO bankd_pcsc.c:264 [004 CONN_CLIENT_MAPPED] SCardEstablishContext: OK Jul 12 14:33:20 rpi-cardem-1 osmo-remsim-bankd[15203]: 15208 DBANKDW INFO bankd_pcsc.c:215 [004 CONN_CLIENT_MAPPED] Attempting to find card/slot using regex 'SCM Microsystems Inc. SCR 3310 [CCID Interface] (53312144266274) 00 00' Jul 12 14:33:20 rpi-cardem-1 osmo-remsim-bankd[15203]: 15208 DBANKDW INFO bankd_main.c:967 [004 CONN_CLIENT_MAPPED] Error -2 occurred: Cleaning up state Jul 12 14:33:20 rpi-cardem-1 osmo-remsim-bankd[15203]: 15208 DBANKDW INFO bankd_main.c:442 [004 CONN_CLIENT_MAPPED] Changing state to ACCEPTING Jul 12 14:33:20 rpi-cardem-1 osmo-remsim-bankd[15203]: 15205 DBANKDW INFO bankd_main.c:955 [001 ACCEPTING] Accepted connection from 192.168.1.9:40007 Jul 12 14:33:20 rpi-cardem-1 osmo-remsim-bankd[15203]: 15205 DBANKDW INFO bankd_main.c:442 [001 ACCEPTING] Changing state to CONN_WAIT_ID Jul 12 14:33:20 rpi-cardem-1 osmo-remsim-bankd[15203]: 15205 DBANKDW INFO bankd_main.c:655 [001 CONN_WAIT_ID] Rx RSPRO connectClientReq(T=0, N='rpi-cardem-2', SW='remsim-client', VER='1.0.0') Jul 12 14:33:20 rpi-cardem-1 osmo-remsim-bankd[15203]: 15205 DBANKDW INFO bankd_main.c:442 [001 CONN_WAIT_ID] Changing state to CONN_CLIENT Jul 12 14:33:20 rpi-cardem-1 osmo-remsim-bankd[15203]: 15205 DBANKDW INFO bankd_main.c:625 [001 CONN_CLIENT] slotmap found: C(1:1) -> B(1:1) Jul 12 14:33:20 rpi-cardem-1 osmo-remsim-bankd[15203]: 15205 DBANKDW INFO bankd_main.c:450 [001 CONN_CLIENT] Changing state to CONN_CLIENT_MAPPED (timeout=10) Jul 12 14:33:20 rpi-cardem-1 osmo-remsim-bankd[15203]: 15205 DBANKDW INFO bankd_pcsc.c:261 [001 CONN_CLIENT_MAPPED] Attempting to open PC/SC context Jul 12 14:33:20 rpi-cardem-1 osmo-remsim-bankd[15203]: 15205 DBANKDW INFO bankd_pcsc.c:264 [001 CONN_CLIENT_MAPPED] SCardEstablishContext: OK Jul 12 14:33:20 rpi-cardem-1 osmo-remsim-bankd[15203]: 15205 DBANKDW INFO bankd_pcsc.c:215 [001 CONN_CLIENT_MAPPED] Attempting to find card/slot using regex 'SCM Microsystems Inc. SCR 3310 [CCID Interface] (53312144266274) 00 00' Jul 12 14:33:20 rpi-cardem-1 osmo-remsim-bankd[15203]: 15205 DBANKDW INFO bankd_main.c:967 [001 CONN_CLIENT_MAPPED] Error -2 occurred: Cleaning up state Jul 12 14:33:20 rpi-cardem-1 osmo-remsim-bankd[15203]: 15205 DBANKDW INFO bankd_main.c:442 [001 CONN_CLIENT_MAPPED] Changing state to ACCEPTING Here, this seems relevant: Jul 12 14:33:20 rpi-cardem-1 osmo-remsim-bankd[15203]: 15205 DBANKDW INFO bankd_pcsc.c:215 [001 CONN_CLIENT_MAPPED] Attempting to find card/slot using regex 'SCM Microsystems Inc. SCR 3310 [CCID Interface] (53312144266274) 00 00' Jul 12 14:33:20 rpi-cardem-1 osmo-remsim-bankd[15203]: 15205 DBANKDW INFO bankd_main.c:967 [001 CONN_CLIENT_MAPPED] Error -2 occurred: Cleaning up state It searches for the reader but returns error -2. This is the head of pcsc_scan: root@rpi-cardem-1:~# pcsc_scan | head Using reader plug'n play mechanism Scanning present readers... 0: SCM Microsystems Inc. SCR 3310 [CCID Interface] (53312144266274) 00 00 Wed Jul 12 14:36:26 2023 Reader 0: SCM Microsystems Inc. SCR 3310 [CCID Interface] (53312144266274) 00 00 Event number: 0 Card state: Card inserted, ATR: 3B 9F 96 80 1F C7 80 31 E0 73 FE 21 13 67 98 07 02 10 01 01 01 54 ATR: 3B 9F 96 80 1F C7 80 31 E0 73 FE 21 13 67 98 07 02 10 01 01 01 54 Now - if it's using a regex to search for the reader string, the fact that my reader has [] and () in it will break the regex search, right? I've changed /etc/osmocom/bankd_pcsc_slots.csv, and set just: "1","1","SCM Microsystems Inc. SCR 3310" as the reader name/mapping, leaving out the special characters, and it started ok. I suggest making a note of this in the documentation, that special characters in the reader name are checked via regular expressions. Cheers!

3 3

There is a bug that is giving me a headache!
by gmaillee＠126.com 19 Jul '23

19 Jul '23

Hello，guys I use the official card reader， root@debian:/usr/bin# pcsc_scan Using reader plug'n play mechanism Scanning present readers... Waiting for the first reader...found one Scanning present readers... 0: HID Global OMNIKEY 6121 Smart Card Reader [OMNIKEY 6121 Smart Card Reader] 00 00 Sat Jul 15 14:24:05 2023 Reader 0: HID Global OMNIKEY 6121 Smart Card Reader [OMNIKEY 6121 Smart Card Reader] 00 00 Event number: 0 Card state: Card inserted, Unresponsive card, Because there are special symbols in the name of the card reader, so I set this in the bankd configuration file csv "1","0","HID Global OMNIKEY 6121 Smart Card Reader \[OMNIKEY 6121 Smart Card Reader\] 00 00" And set up bankd like this. osmo-remsim-bankd -i 192.168.2.128 -n 1 -b 1 Because my server has a fixed ip I put the simtrace2 link on the linux of client-st2, and set up client-st2. As follows osmo-remsim-client-st2 --usb-vendor 1d50 --usb-product 60e3 --usb-interface 0 --usb-altsetting 0 --usb-address 3 --usb-path 1-1.1 --usb-config 1 --client-id 0 --client-slot 0 --server-ip 192.168.2.128 --server-port 9998 I saw them separately on sever. I tried to make their link. osmo-remsim-apitool -m 1 1 0 0 Because I read the instructions, when linking 1 simtrace2, our client-id and client-slot need to be set to 0 When I link successfully, both bankd and client-st2 have wrong information. as follows 1987 DBANKDW INFO bankd_main.c:655 [000 CONN_WAIT_ID] Rx RSPRO connectClientReq(T=0, N='openstick', SW='remsim-client', VER='1.0.0') 1987 DBANKDW INFO bankd_main.c:442 [000 CONN_WAIT_ID] Changing state to CONN_CLIENT 1987 DBANKDW INFO bankd_main.c:619 [000 CONN_CLIENT] No slotmap (yet) for client C(0:0) 1987 DBANKDW INFO bankd_main.c:450 [000 CONN_CLIENT] Changing state to CONN_CLIENT_WAIT_MAP (timeout=10) 1987 DBANKDW INFO bankd_main.c:967 [000 CONN_CLIENT_WAIT_MAP] Error -2 occurred: Cleaning up state 1987 DBANKDW INFO bankd_main.c:442 [000 CONN_CLIENT_WAIT_MAP] Changing state to ACCEPTING TCP connection to server at 192.168.2.131:9999 DLINP NOTICE input/ipa.c:141 192.168.2.131:9999 connection done DRSPRO NOTICE ../rspro_client_fsm.c:127 RSPRO_CLIENT(bankd){REESTABLISH}: RSPRO link to 192.168.2.131:9999 UP DRSPRO ERROR ../rspro_client_fsm.c:297 RSPRO_CLIENT(bankd){REESTABLISH}: Event SRVC_E_KA_TERMINATED not permitted DRSPRO INFO ../rspro_client_fsm.c:302 RSPRO_CLIENT(bankd){REESTABLISH}: Destroying existing connection to server DRSPRO INFO ../rspro_client_fsm.c:307 RSPRO_CLIENT(bankd){REESTABLISH}: Creating TCP connection to server at 192.168.2.131:9999 I'm wondering if I'm doing something wrong? What is the reason that led to such a result! I'm looking forward to someone pointing out my mistakes. and help me. Thank you so much. guys

3 10

osmo-remsim-client-st2 tries to contact bankd at 127.0.0.1
by Adrian Popa 19 Jul '23

19 Jul '23

Hello everyone! I'm new to simtrace and I'm trying to set up a test with a Simtrace2 board connected to a RPI (which I'll call the client from now on) and a different RPI with an attached card reader (which I'll call the server). The server runs osmo-remsim-bankd and osmo-remsim-server (installed from your debian repo). The bankd server has its configuration csv file filled with the correct reader information. The osmo-remsim-server runs on the same machine and has a mapping configured via the python api tool to map client 1 to bank 1, like so: root@rpi-cardem-1:~# python3 /etc/osmocom/osmo-remsim-apitool -a /clients: {'clients': []} /banks: {'banks': [{'peer': 'B1', 'state': 'CONNECTED_BANKD', 'component_id': {'type_': 'remsimBankd', 'name': 'fixme-name', 'software': 'remsim-bankd', 'swVersion': '1.0.0'}, 'bankId': 1, 'numberOfSlots': 5}]} /slotmaps: {'slotmaps': [{'bank': {'bankId': 1, 'slotNr': 1}, 'client': {'clientId': 1, 'slotNr': 1}, 'state': 'ACTIVE'}]} The client runs osmo-remsim-client-st2 like this: root@rpi-cardem-2:~# osmo-remsim-client-st2 --server-ip remsim-server --server-port 9998 --client-id 1 --client-slot 1 --usb-vendor 1d50 --usb-product 60e3 --usb-config 1 --usb-interface 0 --usb-path "1-1.4" However, based on the logs, it tries to contact the bankd server at 127.0.0.1:9999 instead of remsim-server:9999: DRSPRO INFO ../rspro_client_fsm.c:307 RSPRO_CLIENT(server){REESTABLISH}: Creating TCP connection to server at remsim-server:9998 DLINP NOTICE simtrace2_api.c:271 [0] <= osmo_st2_cardem_request_config(features=00000001) DLINP NOTICE input/ipa.c:141 remsim-server:9998 connection done DRSPRO NOTICE ../rspro_client_fsm.c:127 RSPRO_CLIENT(server){REESTABLISH}: RSPRO link to remsim-server:9998 UP DRSPRO INFO ../rspro_client_fsm.c:307 RSPRO_CLIENT(bankd){REESTABLISH}: Creating TCP connection to server at 127.0.0.1:9999 DRSPRO NOTICE ../rspro_client_fsm.c:127 RSPRO_CLIENT(bankd){REESTABLISH}: RSPRO link to 127.0.0.1:9999 DOWN The bankd server listens on 0.0.0.0 on the server side: root@rpi-cardem-1:~# netstat -tpan | grep osmo | grep LISTEN tcp 0 0 0.0.0.0:9997 0.0.0.0:* LISTEN 409/osmo-remsim-ser tcp 0 0 0.0.0.0:9998 0.0.0.0:* LISTEN 409/osmo-remsim-ser tcp 0 0 0.0.0.0:9999 0.0.0.0:* LISTEN 405/osmo-remsim-ban My question is - how is osmo-remsim-client-st2 getting the IP address of the bankd server? What did I do wrong? I've tried a few tricks to redirect traffic from 127.0.0.1:9999 to remsim-server:9999, but so far have failed. This is what I've tried as a proxy, but the connection seems to get garbled because netcat expects LF terminated strings: nc -l 127.0.0.1 9999 | nc remsim-server 9999 Thanks for the help Cheers, Adrian

3 4

Some questions about osmo-remsim-bankd
by bianfang85＠163.com 17 Jun '23

17 Jun '23

First of all, I installed osmo-remsim-bankd, server, and client-st2 on different virtual machines through the binary package. I inserted the officially purchased card reader and can also read my card

4 7

← Newer
1
2
3
4
5
6
7
...
35
Older →

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

simtrace