Project

General

Profile

SIMtrace » History » Version 28

Anonymous, 02/19/2016 10:48 PM

1 1 laforge
[[PageOutline]]
2
= Osmocom SIMtrace =
3
4
Osmocom SIMtrace is a software and hardware system for passively tracing SIM-ME communication between the SIM card and the mobile phone.
5
6 18 laforge
It looks a bit like this:
7 27 laforge
[[Image(SIMtrace/Hardware:simtrace_v09_top_mid.jpg, align=right,33%)]]
8 18 laforge
{{{
9
#!graphviz
10
digraph G{
11
  //rankdir = LR;
12
  Phone -> SIMtrace [label = "Flexi-PCB cable"];
13
  SIMtrace -> SIM;
14
  SIMtrace -> PC [label = "USB cable"];
15 1 laforge
16 18 laforge
  SIMtrace [ label = "SIMtrace hardware" ];
17
}
18
}}}
19
20
It works by utilizing the T=0 capable USART of the USB-attached AT91SAM7 microcontroller.
21
22 1 laforge
The USART passively receives the bytes as they are exchanged on the ISO 7816-3 / TS 11.11 interface between SIM and phone.
23
The received bytes are sent via USB to the PC, where a program called {{{simtrace}}} on the PC gathers data from the USB device,
24
parses the APDUs and forwards them via [wiki:GSMTAP] to the [wiki:wireshark] protocol analyzer.
25
26
== Features ==
27
 * Completely passive scanner
28 17 laforge
 * RST and ATR detection
29 1 laforge
 * Auto-bauding with PPS / PTS support
30
 * Segmentation of APDUs
31
32
== TODO ==
33
 * Check for parity errors
34
 * Verify TCK / PCK check-bytes
35
36
== Hardware ==
37 17 laforge
38 1 laforge
The first implementations used an Olimex SAM7-P64 development board with some of the I/O lines hooked up to the mechanical SIM card adapters from [wiki:RebelSIM_Scanner]. If the RebelSIM scanner is used, connect the USB even if just the lines are used. It needs to be powered, else the real reader will often fail to initialize the card.
39 4 laforge
40 27 laforge
More details are available at [wiki:SIMtrace/Hardware]
41 4 laforge
42 1 laforge
== Firmware ==
43
44 28 laforge
The firmware for the AT91SAM7S device was written by reusing a lot of the code for the [http://www.openpcd.org/ OpenPCD]
45
RFID reader.  Details are available at [wiki:SIMtrace/Firmware].
46 24 tsaitgaist
47 1 laforge
48 5 laforge
== Host PC Software ==
49
50 6 tsaitgaist
The {{{simtrace}}} program is part of the git://git.osmocom.org/simtrace.git repository. It will bind to the USB device
51 5 laforge
and send GSMTAP frames using UDP/IPv4 to localhost:4729.
52 6 tsaitgaist
53 14 tsaitgaist
=== Preconditions ===
54 1 laforge
55 14 tsaitgaist
[wiki:libosmocore] and headers (simtrace_usb.h) from the firmware.
56
57
additional packages :
58 6 tsaitgaist
{{{
59 26 tsaitgaist
sudo apt-get install libusb-1.0-0-dev
60 6 tsaitgaist
}}}
61
62 7 tsaitgaist
=== Compiling it ===
63 1 laforge
64 6 tsaitgaist
Precondition:  [wiki:libosmocore] and headers (simtrace_usb.h) from the firmware.
65
66 1 laforge
{{{
67 14 tsaitgaist
git clone git://git.osmocom.org/simtrace.git
68 21 tsaitgaist
cd simtrace/host/
69 6 tsaitgaist
make
70
}}}
71
72
=== Using it ===
73
74
Simply start '''simtrace'''.
75 13 tsaitgaist
It will send the GSMTAP frames to UDP/IPv4 localhost:4729.
76 1 laforge
77
It will also print hexdumps of the frames to the console, looking like this:
78 6 tsaitgaist
{{{
79 1 laforge
sudo ./simtrace
80
APDU: (9):  a0 a4 00 00 02 6f 07 9f 0f
81
APDU: (22):  a0 c0 00 00 0f 00 00 00 09 6f 07 04 00 15 00 15 01 02 00 00 91 78
82
APDU: (9):  a0 a4 00 00 02 6f 38 9f 0f
83
APDU: (22):  a0 c0 00 00 0f 00 00 00 09 6f 38 04 00 15 00 55 01 02 00 00 91 78
84
APDU: (16):  a0 b0 00 00 09 ff 3f ff ff 00 00 3f 03 00 91 78
85
APDU: (9):  a0 a4 00 00 02 6f ad 9f 0f
86
APDU: (8):  a0 b0 00 00 01 00 91 78
87
APDU: (9):  a0 a4 00 00 02 6f 07 9f 0f
88
APDU: (16):  a0 b0 00 00 09 08 49 06 20 11 49 00 11 06 91 78
89
APDU: (9):  a0 a4 00 00 02 6f 7e 9f 0f
90
APDU: (18):  a0 b0 00 00 0b ff ff ff ff 64 f0 00 ff fe 00 03 91 78
91
APDU: (9):  a0 a4 00 00 02 6f 78 9f 0f
92
APDU: (9):  a0 b0 00 00 02 00 01 91 78
93
APDU: (9):  a0 a4 00 00 02 6f 74 9f 0f
94 2 laforge
APDU: (23):  a0 b0 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 91 78
95
APDU: (9):  a0 a4 00 00 02 6f 20 9f 0f
96
APDU: (16):  a0 b0 00 00 09 ff ff ff ff ff ff ff ff 07 91 78
97
APDU: (9):  a0 a4 00 00 02 6f 30 9f 0f
98 1 laforge
APDU: (22):  a0 c0 00 00 0f 00 00 00 f0 6f 30 04 00 11 00 55 01 02 00 00 91 78
99
}}}
100
101
== Wireshark integration ==
102
103 6 tsaitgaist
There is an experimental patch, also part of the simtrace.git package.  You will have to apply this against the latest
104 1 laforge
[wiki:wireshark] developer version.
105
106
[[Image(wireshark-sim.png)]]
107
108
Protocol parsing is far from being complete, patches are always welcome!
Add picture from clipboard (Maximum size: 48.8 MB)