RemoteSIM on Simtrace2

Hi all, I've got my hands on a simtrace2 device - first of all thanks for your great work and thanks for making this project open source! So far I've tried out the sniffing functionality which is working flawlessly - however I struggle to get the remote-sim functionality working. I've built (make BOARD=simtrace APP=cardem) the cardemulation-firmware of the current master-branch (0.4.131-8f70) and flashed the resulting simtrace-cardem-dfu.bin using dfu-util. Furthermore I compiled the host binaries, triggered a reset on my simtrace2 device to make sure it's in runtime mode and then executed the remote-sim program (sudo ./simtrace2-remsim -V 1d50 -P 60e3 -C 1 -I 0 -A `sudo ./simtrace2-list | cut -d = -f 2 | cut -d , -f 1 | tail -1`). The simtrace2 device, as well as an USB-CCID compliant omnikey cardreader are attached to my linux computer as described in the QMOD manual. During runtime mode the red LED on the simtrace2 is blinking, while the green LED is off. I noticed that when the simtrace2-remsim program tries to send an ATR to the simtrace2 device via usb (cardem_request_set_atr), the libusb_bulk_transfer function is blocking, before returning LIBUSB_ERROR_TIMEOUT. The serial debugging-output I got on the simtrace2 doesn't show any futher information (last state is "-I- USB is now configured"). When I reset the usb-modem that is connected to the simtrace2 device I get the following messages on the debug-serial: -I- Changed to ISO 7816-3 state 1 reset de-asserted -I- WT updated to 9600 -I- Changed to ISO 7816-3 state 0 reset asserted -I- Changed to ISO 7816-3 state 1 reset de-asserted [...] while the simtrace2-remsim program is also receiving some garbage: URB: -> 03 00 00 00 00 00 0c 00 04 00 00 00 unknown simtrace msg type 0x00 URB: -> 03 00 00 00 00 00 0c 00 08 00 00 00 unknown simtrace msg type 0x00 URB: -> 03 00 00 00 00 00 0c 00 04 00 00 00 unknown simtrace msg type 0x00 [...] I've also tried several older versions/commits - however I didn't get any of them working properly. When using version 0.4.13-ba2a (from this commit: https://git.osmocom.org/simtrace2/commit/?id=ba2ad563cc0e389213a3f6f6ebe79d…) I was able to send the ATR to the simtrace and directly entered the main loop on the host program. The serial debugging-output (after a manual modem-reset) also looked somehow more promising, but didn't work either: -I- 0: VCC activated -I- 0: CLK activated -I- 0: RST released -I- 0: computed Fi(1) Di(1) ratio: 372 -I- 0: send_tpdu_header: 00 a4 00 04 02 -I- 0: VCC deactivated -I- 0: CLK deactivated -I- 0: VCC activated -I- 0: CLK activated -I- 0: VCC deactivated -I- 0: CLK deactivated [...] I've also tried a few different modems/dongles (Huawei, ZTE) which also didn't really change anything. Am I missing something? Is the remote-sim functionality supposed to work on the current master branch? If not, could anyone hint me to a version/commit that should work? Would love to get some feedback - thanks in advance and keep up the good work! Greetings from Vienna, Gabriel