RemoteSIM on Simtrace2

Gabriel K. Gegenhuber gabriel.gegenhuber at gmail.com
Thu Aug 2 13:11:47 UTC 2018


Hi all,

I've got my hands on a simtrace2 device - first of all thanks for your
great work and thanks for making this project open source!

So far I've tried out the sniffing functionality which is working
flawlessly - however I struggle to get the remote-sim functionality working.

I've built (make BOARD=simtrace APP=cardem) the cardemulation-firmware of
the current master-branch (0.4.131-8f70) and flashed the resulting
simtrace-cardem-dfu.bin using dfu-util.

Furthermore I compiled the host binaries, triggered a reset on my simtrace2
device to make sure it's in runtime mode and then executed the remote-sim
program (sudo ./simtrace2-remsim -V 1d50 -P 60e3 -C 1 -I 0 -A `sudo
./simtrace2-list | cut -d = -f 2 | cut -d , -f 1 | tail -1`). The simtrace2
device, as well as an USB-CCID compliant omnikey cardreader are attached to
my linux computer as described in the QMOD manual. During runtime mode the
red LED on the simtrace2 is blinking, while the green LED is off.

I noticed that when the simtrace2-remsim program tries to send an ATR to
the simtrace2 device via usb (cardem_request_set_atr), the
libusb_bulk_transfer function is blocking, before returning
LIBUSB_ERROR_TIMEOUT. The serial debugging-output I got on the simtrace2
doesn't show any futher information (last state is "-I- USB is now
configured").

When I reset the usb-modem that is connected to the simtrace2 device I get
the following messages on the debug-serial:
-I- Changed to ISO 7816-3 state 1
reset de-asserted
-I- WT updated to 9600
-I- Changed to ISO 7816-3 state 0
reset asserted
-I- Changed to ISO 7816-3 state 1
reset de-asserted
[...]

while the simtrace2-remsim program is also receiving some garbage:
URB:
-> 03 00 00 00 00 00 0c 00 04 00 00 00
unknown simtrace msg type 0x00
URB:
-> 03 00 00 00 00 00 0c 00 08 00 00 00
unknown simtrace msg type 0x00
URB:
-> 03 00 00 00 00 00 0c 00 04 00 00 00
unknown simtrace msg type 0x00
[...]

I've also tried several older versions/commits - however I didn't get any
of them working properly.
When using version 0.4.13-ba2a (from this commit:
https://git.osmocom.org/simtrace2/commit/?id=ba2ad563cc0e389213a3f6f6ebe79dc21dfb26a3)
I was able to send the ATR to the simtrace and directly entered the main
loop on the host program.
The serial debugging-output (after a manual modem-reset) also looked
somehow more promising, but didn't work either:
-I- 0: VCC activated
-I- 0: CLK activated
-I- 0: RST released
-I- 0: computed Fi(1) Di(1) ratio: 372
-I- 0: send_tpdu_header: 00 a4 00 04 02
-I- 0: VCC deactivated
-I- 0: CLK deactivated
-I- 0: VCC activated
-I- 0: CLK activated
-I- 0: VCC deactivated
-I- 0: CLK deactivated
[...]

I've also tried a few different modems/dongles (Huawei, ZTE) which also
didn't really change anything.

Am I missing something? Is the remote-sim functionality supposed to work on
the current master branch? If not, could anyone hint me to a version/commit
that should work?
Would love to get some feedback - thanks in advance and keep up the good
work!

Greetings from Vienna,
Gabriel
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osmocom.org/pipermail/simtrace/attachments/20180802/171ce76e/attachment.html>


More information about the simtrace mailing list