Project

General

Profile

Wiki » History » Version 22

wirelesss, 10/19/2016 12:12 PM

1 4 wirelesss
{{>toc}}
2
3
h1. pySim WiKi 
4 1 laforge
5
pySim-prog is a small command line utility written in python, which is used for programming various programmable SIM/USIM cards.
6
7
h2. Supported Cards
8
9
* [[cellular-infrastructure:SysmoUSIM-SJS1]]
10
* [[cellular-infrastructure:GrcardSIM]]
11
* [[cellular-infrastructure:GrcardSIM2]]
12
* [[cellular-infrastructure:MagicSIM]]
13 5 wirelesss
14 14 wirelesss
h3. 1. Install dependencies
15 5 wirelesss
16
 sudo apt-get install pcscd pcsc-tools libccid libpcsclite-dev
17
18
h3. 2. Connected your SIM card reader
19
20 16 wirelesss
h3. 3. Plug your programmable SIM card in
21 5 wirelesss
22
h3. 4. Check the status of connection by execution of the following command:
23
24
 pcsc_scan
25
26
h3. 5. If SIM card reader is recognised then we can expect similar to the below output:
27
28
 $ pcsc_scan
29
 PC/SC device scanner
30
 V 1.4.25 (c) 2001-2011, Ludovic Rousseau ludovic.rousseau@free.fr
31
 Compiled with PC/SC lite version: 1.8.14
32
 Using reader plug'n play mechanism
33
 Scanning present readers...
34
 0: SCM Microsystems Inc. SCR 3310 [CCID Interface] 00 00 
35
 Tue Oct 18 11:48:08 2016
36
 Reader 0: SCM Microsystems Inc. SCR 3310 [CCID Interface] 00 00
37
 Card state: Card inserted, 
38
 ATR: 3B 99 18 00 11 88 22 33 44 55 66 77 60
39
 + TS = 3B --> Direct Convention
40
 + T0 = 99, Y(1): 1001, K: 9 (historical bytes)
41
  TA(1) = 18 --> Fi=372, Di=12, 31 cycles/ETU
42
  129032 bits/s at 4 MHz, fMax for Fi = 5 MHz => 161290 bits/s
43
  TD(1) = 00 --> Y(i+1) = 0000, Protocol T = 0 
44
 -----
45
 + Historical bytes: 11 88 22 33 44 55 66 77 60
46
 Category indicator byte: 11 (proprietary format)
47
 Possibly identified card (using /usr/share/pcsc/smartcard_list.txt):
48
 3B 99 18 00 11 88 22 33 44 55 66 77 60
49
 sysmocom sysmoSIM-GR1
50
51 20 wirelesss
h4. 5.1  We could expect the following output from pcsc_scan command, when we have Super SIM card plugged in
52
53
 $ pcsc_scan
54
 PC/SC device scanner
55
 V 1.4.25 (c) 2001-2011, Ludovic Rousseau ludovic.rousseau@free.fr
56
 Compiled with PC/SC lite version: 1.8.14
57
 Using reader plug'n play mechanism
58
 Scanning present readers...
59
 0: SCM Microsystems Inc. SCR 3310 [CCID Interface] 00 00
60
 Wed Oct 19 13:13:20 2016
61
 Reader 0: SCM Microsystems Inc. SCR 3310 [CCID Interface] 00 00
62
  Card state: Card inserted, 
63
  ATR: 3B 9A 94 00 92 02 75 93 11 00 01 02 02 21
64
  ATR: 3B 9A 94 00 92 02 75 93 11 00 01 02 02 21
65
 + TS = 3B --> Direct Convention
66
 + T0 = 9A, Y(1): 1001, K: 10 (historical bytes)
67
   TA(1) = 94 --> Fi=512, Di=8, 64 cycles/ETU
68
     62500 bits/s at 4 MHz, fMax for Fi = 5 MHz => 78125 bits/s
69
   TD(1) = 00 --> Y(i+1) = 0000, Protocol T = 0 
70
 -----
71
 + Historical bytes: 92 02 75 93 11 00 01 02 02 21
72
   Category indicator byte: 92 (proprietary format)
73
 Possibly identified card (using /usr/share/pcsc/smartcard_list.txt):
74
 3B 9A 94 00 92 02 75 93 11 00 01 02 02 21
75
 3B 9A 94 00 92 02 75 93 11 00 01 02 02 ..
76
	 SuperSIM (X-sim)
77
 
78
79 6 wirelesss
h3. 6. Exit pcsc_scan : _Ctrl+C_
80 5 wirelesss
81
h3. 7. Get the code of PySIM by entering command:
82
83
 git clone git://git.osmocom.org/pysim pysim
84
85
 cd pysim
86
87
h3. 8. Run the /pySim-read.py to read your SIM card:
88
89
 ./pySim-read.py -p0 or ./pySim-read.py -p1 
90
91
h3. 9. Using sysmoSIM-GR1 and if everything is done correctly, you will see something similar to:
92
 
93
 $ ./pySim-read.py -p0 
94
 Reading ...
95
 ICCID: 1791198229180000071
96
 IMSI: 001640000000071
97
 SMSP: ffffffffffffffffffffffffe1ffffffffffffffffffffffff0581005155f5ffffffffffff000000
98
 ACC: ffff
99
 MSISDN: Not available
100
 Done !
101
102 8 wirelesss
h3. 9.1. In case of sysmoUSIM-SJS1 SIM card, you will see something similar to:
103 5 wirelesss
104
 $ ./pySim-read.py -p0
105
 Reading ...
106
 ICCID: 8988211000000106594
107
 IMSI: 901700000010659
108
 SMSP: ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
109
 ACC: 0200
110
 MSISDN: Not available
111
 Done !
112
113 8 wirelesss
h3. 9.2. In case of SuperSIM/X-sim card, you will see something similar to:
114 5 wirelesss
115
 $ ./pySim-read.py -p0
116
 Reading ...
117
 ICCID: 8949901990000000184
118
 IMSI: 901990000000018
119
 SMSP: ffffffffffffffffffffffffe1ffffffffffffffffffffffff058100945555ffffffffffff000000
120
 ACC: ffff
121
 MSISDN: Not available
122
 Done !
123
124
125 17 wirelesss
h3. 10. Program your SIM card
126 5 wirelesss
127 7 wirelesss
Enter @./pySim-prog.py -help@ to get overview of possible options. 
128 5 wirelesss
129
Similar result should appear: 
130
131
 $ ./pySim-prog.py -help
132
 Usage: pySim-prog.py [options]
133
 Options:
134
   -h, --help            show this help message and exit
135
   -d DEV, --device=DEV  Serial Device for SIM access [default: /dev/ttyUSB0]
136
   -b BAUD, --baud=BAUD  Baudrate used for SIM access [default: 9600]
137
   -p PCSC, --pcsc-device=PCSC
138
                         Which PC/SC reader number for SIM access
139
   -t TYPE, --type=TYPE  Card type (user -t list to view) [default: auto]
140
   -a PIN_ADM, --pin-adm=PIN_ADM
141
                         ADM PIN used for provisioning (overwrites default)
142
   -e, --erase           Erase beforehand [default: False]
143
   -S SOURCE, --source=SOURCE
144
                         Data Source[default: cmdline]
145
   -n NAME, --name=NAME  Operator name [default: Magic]
146
   -c CC, --country=CC   Country code [default: 1]
147
   -x MCC, --mcc=MCC     Mobile Country Code [default: 901]
148
   -y MNC, --mnc=MNC     Mobile Network Code [default: 55]
149
   -m SMSC, --smsc=SMSC  SMSP [default: '00 + country code + 5555']
150
   -M SMSP, --smsp=SMSP  Raw SMSP content in hex [default: auto from SMSC]
151
   -s ID, --iccid=ID     Integrated Circuit Card ID
152
   -i IMSI, --imsi=IMSI  International Mobile Subscriber Identity
153
   -k KI, --ki=KI        Ki (default is to randomize)
154
   -o OPC, --opc=OPC     OPC (default is to randomize)
155
   --op=OP               Set OP to derive OPC from OP and KI
156
   --acc=ACC             Set ACC bits (Access Control Code). not all card types
157
                         are supported
158
   -z STR, --secret=STR  Secret used for ICCID/IMSI autogen
159
   -j NUM, --num=NUM     Card # used for ICCID/IMSI autogen
160
   --batch               Enable batch mode [default: False]
161
   --batch-state=FILE    Optional batch state file
162
   --read-csv=FILE       Read parameters from CSV file rather than command line
163
   --write-csv=FILE      Append generated parameters in CSV file
164
   --write-hlr=FILE      Append generated parameters to OpenBSC HLR sqlite3
165
   --dry-run             Perform a 'dry run', don't actually program the card
166
167 18 wirelesss
h3. 11. Example of how to program a sysmoSIM-GR1 card 
168 5 wirelesss
169
The GRcard SIM is a programmable GSM SIM card. It uses a mixture of TS11.11 / ISO7816-4 and proprietary commands for programming.
170 12 wirelesss
171 22 wirelesss
In the below example, we are changing the card’s IMSI to 901700000003080 (option -i), and we are specifying a new set of -n NAME (Operator name), -t TYPE (Card type), -c CC (Country code), -x MCC (Mobile Country Code), -y MNC (Mobile Network Code) and -s ID (Integrated Circuit Card ID) values.
172 5 wirelesss
 
173
 $ ./pySim-prog.py -p 0 -n OpenBSC -t sysmosim-gr1 -i 901700000003080 -c 001 -x 001 -y 02 -s 1791198229180000075
174
 Insert card now (or CTRL-C to cancel)
175
 Generated card parameters :
176
  > Name    : OpenBSC
177
  > SMSP    : e1ffffffffffffffffffffffff0581005155f5ffffffffffff000000
178
  > ICCID   : 1791198229180000075
179
  > MCC/MNC : 1/2
180
  > IMSI    : 901700000003080
181
  > Ki      : 7edaeb6addbd72d2b2cc6ed7bfecc9c9
182
  > OPC     : 23f075ab9b1a113d4db822d8195ea20c
183 1 laforge
  > ACC     : None
184 5 wirelesss
 Programming ...
185
 Done !
186
187 19 wirelesss
h3. 12. Example of how to program a SysmoUSIM-SJS1 (orange) card
188 5 wirelesss
189
(U)SIM cards are Java capable and there is the Globalplatform that specifies standards API. SMS can be addressed directly to the SIM card, the SIM card will get events for network selection and others, it can modify call establishment attempts.
190
191
192 13 wirelesss
Provisioning of different identities or keys.
193 5 wirelesss
 
194
If you have a variant of the card-individual ADM1 key of your sysmoUSIM-SJS1 card,  you can change any identity (IMSI, ICCID, MSISDN) stored on the (U)SIM, as well as the private key data (K, OPC).
195
196
ADM1 key can be found at:
197
198
[https://openerp.sysmocom.de/web#page=0&limit=80&view_type=list&model=sysmocom.simcard&menu_id=679&action=912]
199
200
In the below example, we are changing the card’s IMSI to 901710000011000 (it was 901700000011000 before), and specify a
201
new set of K and OPC values.
202
203 11 wirelesss
 $ ./pySim-prog.py -p 0 -t sysmoUSIM-SJS1 -a 58001006  -x 901 -y 71 -i 901700000010659 -s 8988211000000110000 -o 398153093661279FB1FC74BE07059FEF -k 1D8B2562B992549F20D0F42113EAA6FA
204 5 wirelesss
 Insert card now (or CTRL-C to cancel)
205
 Generated card parameters :
206
  > Name    : Magic
207
  > SMSP    : e1ffffffffffffffffffffffff0581005155f5ffffffffffff000000
208
  > ICCID   : 8988211000000110000
209
  > MCC/MNC : 901/71
210
  > IMSI    : 901700000010659
211
  > Ki      : 1D8B2562B992549F20D0F42113EAA6FA
212
  > OPC     : 398153093661279FB1FC74BE07059FEF
213
  > ACC     : None
214
 Programming ...
215
 Done !
216
217 7 wirelesss
h3. 13 README 
218 5 wirelesss
219
pySim comes with following README file:
220
221 1 laforge
This utility allows to :
222
223 5 wirelesss
* Program customizable SIMs. Two modes are possible:
224 1 laforge
225 5 wirelesss
- one where you specify every parameter manually :
226 6 wirelesss
_
227
./pySim-prog.py -n 26C3 -c 49 -x 262 -y 42 -i <IMSI> -s <ICCID>_
228 5 wirelesss
229
- one where they are generated from some minimal set :
230
231 6 wirelesss
_./pySim-prog.py -n 26C3 -c 49 -x 262 -y 42 -z <random_string_of_choice> -j <card_num>_
232 5 wirelesss
233
With <random_string_of_choice> and <card_num>, the soft will generate
234
'predictable' IMSI and ICCID, so make sure you choose them so as not to
235
conflict with anyone. (for eg. your name as <random_string_of_choice> and
236
0 1 2 ... for <card num>).
237
238
You also need to enter some parameters to select the device :
239
-t TYPE : type of card (supersim, magicsim, fakemagicsim or try 'auto')
240
-d DEV  : Serial port device (default /dev/ttyUSB0)
241
-b BAUD : Baudrate (default 9600)
242
243
* Interact with SIMs from a python interactive shell (ipython for eg :)
244
245
from pySim.transport.serial import SerialSimLink
246 1 laforge
from pySim.commands import SimCardCommands
247 5 wirelesss
248 1 laforge
sl = SerialSimLink(device='/dev/ttyUSB0', baudrate=9600)
249 5 wirelesss
sc = SimCardCommands(sl)
250
251
sl.wait_for_card()
252
253
# Print IMSI
254 6 wirelesss
_print sc.read_binary(['3f00', '7f20', '6f07'])_
255 5 wirelesss
256
# Run A3/A8
257 6 wirelesss
_print sc.run_gsm('00112233445566778899aabbccddeeff')_
Add picture from clipboard (Maximum size: 48.8 MB)