Project

General

Profile

SIMtrace Hardware » History » Version 30

tsaitgaist, 02/19/2016 10:49 PM
v1.3 added

1 1 laforge
[[PageOutline]]
2 1 laforge
= Osmocom SIMtrace Hardware =
3 1 laforge
4 7 laforge
This page is dedicated to the Hardware for Osmocom [wiki:SIMtrace], which looks like this:
5 7 laforge
6 26 tsaitgaist
[[Image(simtrace_11_front.jpg, 33%)]][[Image(simtrace_connectors_scaled.png, 33%)]]
7 1 laforge
8 26 tsaitgaist
You can buy the device on the [http://shop.sysmocom.de/products/simtrace sysmocom shop].
9 1 laforge
10 9 tsaitgaist
== Connectors ==
11 9 tsaitgaist
12 9 tsaitgaist
 * USB: USB mini-B connector. The main connector. The host software communicates (sniffing,...) through USB with the board. It can also be used to flash the micro-controller (using DFU).
13 9 tsaitgaist
 * serial: 2.5 mm jack serial cable, as used by osmocomBB. port used to debug the device (printf goes there).
14 27 ahuemer
 * debug (P2): same as serial, but using the FTDI serial cable. '''It is recommended to cut the voltage wire of the 6pin FTDI connector before plugging the cable into the simtrace.'''
15 9 tsaitgaist
 * jtag (P1): JTAG 20 pin connector to do hardware assisted debugging.
16 28 ahuemer
 * BT1: battery connector (4.5-6V DC). normally the USB provides power, but the battery port can be used for autonomous use of SIMtrace. The sniffed data can be saved in the flash (U1).
17 9 tsaitgaist
 * FFC_SIM (P3): to connect the flat flexible cable with SIM end for the phone.
18 9 tsaitgaist
 * SIM (P4): put your SIM in there (instead of in the phone)
19 9 tsaitgaist
 * reset (SW1): to reset the board (not erasing the firmware). If your are too lazy to unplug and re-plug the USB.
20 28 ahuemer
 * bootloader (SW2): used to start the bootloader to flash the device using DFU. press when plugging in the USB.
21 19 zecke2
 * test (JP1): short circuit using a jumper to flash using [wiki:SIMtrace/Firmware#EnteringtheSAM-BAmode SAM-BA].
22 28 ahuemer
 * erase (JP2): short circuit using a jumper to completely erase the firmware.
23 9 tsaitgaist
24 4 laforge
== Schematics, Gerber & Co ==
25 4 laforge
26 1 laforge
The schematics, Gerber files, etc. can be found in the 'hardware' subdirectory of the simtrace.git repository:
27 30 tsaitgaist
 * http://cgit.osmocom.org/cgit/simtrace/tree/hardware (web browsing)
28 1 laforge
 * git://git.osmocom.org/simtrace (git clone URL)
29 1 laforge
30 2 laforge
We're using Kicad as EDA tool.  Most of the work on the schematics and Gerber files has been done by Kevin Redon,
31 1 laforge
based on the original design by Harald Welte.
32 5 laforge
33 1 laforge
The latest schematics are also available as an attachment to this page.
34 1 laforge
35 15 zecke2
== Interconnections ==
36 15 zecke2
37 15 zecke2
The hardware schematics are very, very simple:
38 15 zecke2
39 15 zecke2
 * Connect SIM-RST with PA7
40 15 zecke2
 * Connect SIM-I/O with PA6(TXD0) and PA1(TIOB0)
41 15 zecke2
 * Connect SIM-CLK with PA2(SCK0) and PA4(TCLK0)
42 15 zecke2
 * Connect SIM-GND with GND
43 15 zecke2
44 15 zecke2
== Mode of operation ==
45 15 zecke2
46 15 zecke2
The USART of the AT91SAM7S is capable of T=0. The documentation only mentions it in clock-master mode, like you
47 15 zecke2
would run it in a smart card reader to actively talk to a smart card. However, by using the USART input clock multiplexer,
48 15 zecke2
you can use an externally-generated CLK like the one from the SIM card socket of the phone.
49 15 zecke2
50 15 zecke2
Unfortunately, the Rx Timeout feature of the USART is not working in T=0 mode, so I had to re-implement Rx timeout (waiting time)
51 15 zecke2
handling by means of the TC (timer/counter) block 0.  Due to technical limitations, we will wait up to one byte (12 etu) more
52 15 zecke2
than we should.
53 15 zecke2
54 25 zecke2
== Modi ==
55 25 zecke2
56 25 zecke2
SIMtrace has the possibility to work as:
57 25 zecke2
 * sniffer
58 25 zecke2
 * card reader
59 25 zecke2
 * card emulator
60 25 zecke2
 * man-in-the-middle
61 25 zecke2
62 25 zecke2
The SAM7S offers 2 T=0 capable USART ports.
63 25 zecke2
One is connected to the phone (PA21-PA27), the other to the SIM (PA1-PA7).
64 25 zecke2
The lines goes from the phone to the SIM through a bus switch (IC4=[http://www.ti.com/lit/ds/symlink/sn74cb3q3244.pdf CB3Q3244]).
65 25 zecke2
The bus switch offer 2 buses of 4 lines:
66 25 zecke2
 * The first is used to forward RST, CLK, and VPP (between the SIM and the phone). It is controlled by SC_SW (PA20)
67 25 zecke2
 * The second is used to forward I/O (between the SIM and the phone). It is controlled by SC_I/O (PA19)
68 25 zecke2
69 25 zecke2
The various modi require to interrupt different lines:
70 25 zecke2
71 25 zecke2
|| SW_SC (PA20) || SC_I/O (PA19) || description || modus ||
72 25 zecke2
|| L || L || phone and SIM directly connected || sniffer (use any USART port) ||
73 25 zecke2
|| L || H || only I/O interrupted || MitM (use both USART port) ||
74 25 zecke2
|| H || H || phone and SIM not connected || card read, emulator (use each USART port) ||
75 25 zecke2
76 25 zecke2
As of 2012-01-12, only the sniffer is implemented
77 25 zecke2
78 25 zecke2
SIM cards support various classes (voltage levels): class A = 5.0V, class B = 3.0V, class C = 1.8V.
79 25 zecke2
SIMtrace v1.x only supports class B (3.0V), which all actual SIM cards and phone also support.
80 25 zecke2
To ensure class B is used, SIMtrace forces 3.3V (within the 3.0V±10% spec) by holding the VCC line at this voltage.
81 25 zecke2
SIMtrace v2 will support all 3 classes.
82 25 zecke2
83 25 zecke2
84 1 laforge
== Revisions ==
85 24 tsaitgaist
86 24 tsaitgaist
=== v2.0 ===
87 24 tsaitgaist
88 29 tsaitgaist
This is on going (stalled) work.
89 24 tsaitgaist
The changes compared to v1.x are:
90 24 tsaitgaist
 * ID-1 and ID-000 smart card slots (with presence detection): so to be able to also sniff credit card sized smart cards
91 24 tsaitgaist
 * through hole USB Mini-B and Serial/Jack 2.5 connector: to be more robust
92 24 tsaitgaist
 * properly support all smart card classes (A,B,C): better compatibility
93 24 tsaitgaist
 * switch from AT91SAM7S to AT91SAM3S: it has more USB endpoints
94 24 tsaitgaist
 * be able to forward voltage from phone to SIM or provide voltage from the board: ideal sniffer and reader
95 1 laforge
 * use an microSD slot instead of built-on flash: easier data transfer
96 1 laforge
 * a SWP sniffer (maybe)
97 1 laforge
98 30 tsaitgaist
=== v1.3 ===
99 30 tsaitgaist
100 30 tsaitgaist
[[Image(simtrace_v13_front.jpg, 33%)]]
101 30 tsaitgaist
102 30 tsaitgaist
Changes:
103 30 tsaitgaist
 * added a FPF2109 power switch
104 30 tsaitgaist
 * added a zener diode on LDO to SIM to provide ~3.0V to SIM (closer to ISO 7812 specified class B)
105 30 tsaitgaist
 * it is now possible to choose the power source for the SIM card: provided by the SIMtrace on-board LDO, or forwarded from the phone
106 30 tsaitgaist
 * no production customizations required
107 30 tsaitgaist
 * silkscreen redone (sadly missing on the produced batch)
108 30 tsaitgaist
109 30 tsaitgaist
'''BUG:''' because of this new feature (selecting power source for the SIM), we wanted to be able to identify the v1.3 board.
110 30 tsaitgaist
To do that, we tied PA0 to ground. But this needs to be HIGH for the AT91SAM7S to be able to enter it's SAM-BA mode (for flashing the first time).
111 30 tsaitgaist
If you produce the board yourself, you have to cut the path between the left upper pin and the capacitor.
112 30 tsaitgaist
The version is now written in flash. To flash the firmware the first time (only), follow the dedicated [wiki:ProductionFlashingV13 instructions].
113 30 tsaitgaist
114 30 tsaitgaist
Downloads:
115 30 tsaitgaist
 * [attachment:simtrace_v13_schematic.pdf]
116 30 tsaitgaist
 * [attachment:simtrace_v13_board.zip]
117 30 tsaitgaist
118 29 tsaitgaist
=== v1.2p (1.2 Production branch) ===
119 29 tsaitgaist
120 29 tsaitgaist
[[Image(simtrace_v12p_front.jpg, 33%)]]
121 29 tsaitgaist
122 29 tsaitgaist
adaptation of the v1.1p because of component availability for new batch.
123 29 tsaitgaist
124 29 tsaitgaist
Changes:
125 29 tsaitgaist
 * capacitor is even nearer to the LDO
126 29 tsaitgaist
 * one diode slightly changed place
127 29 tsaitgaist
 * quartz crystal is smaller (footprint still fits)
128 29 tsaitgaist
 * SIM slot is another (not available from Amphenol anymore). No presence switch.
129 29 tsaitgaist
130 29 tsaitgaist
Downloads:
131 29 tsaitgaist
 * [attachment:simtrace_v12_schematic.pdf]
132 29 tsaitgaist
 * [attachment:simtrace_v12p_gerber.zip]
133 1 laforge
134 24 tsaitgaist
=== v1.1p (1.1 Production branch) ===
135 26 tsaitgaist
136 26 tsaitgaist
[[Image(simtrace_11_front.jpg, 33%)]]
137 23 tsaitgaist
138 23 tsaitgaist
This is a slightly corrected version of the v1.0p.
139 23 tsaitgaist
140 23 tsaitgaist
Changes:
141 23 tsaitgaist
 * a critical capacitor is near the LDO
142 23 tsaitgaist
 * some other capacitors are nearer to the CPU
143 23 tsaitgaist
 * some power traces are wider
144 23 tsaitgaist
 * the SIM C6/VPP contact is also routed through the bus switch (sometimes used for Single Wire Protocol)
145 23 tsaitgaist
 * sysmocom is added in the copper for legal reasons
146 23 tsaitgaist
 * the FTDI Vcc is cut
147 23 tsaitgaist
148 23 tsaitgaist
Downloads:
149 23 tsaitgaist
 * [attachment:simtrace_v11p_schematic.pdf]
150 23 tsaitgaist
 * [attachment:simtrace_v11p_gerber.zip]
151 23 tsaitgaist
152 7 laforge
=== v1.0p (1.0 Production branch) ===
153 7 laforge
154 20 tsaitgaist
155 20 tsaitgaist
[[Image(simtrace_v10p_front_mid.jpg, 33%)]]
156 7 laforge
157 7 laforge
This is identical to v1.0 on the schematics side, we simply altered the footprints of some components to accommodate
158 7 laforge
whatever the SMT factory had in stock.  Specifically the LED are 0805 instead of 0603, and the shottky diodes are
159 7 laforge
in a slightly awkward looking very large package.
160 7 laforge
161 22 tsaitgaist
Downloads:
162 22 tsaitgaist
 * [attachment:simtrace_v10p_schematic.pdf]
163 7 laforge
 * [attachment:simtrace_v10p_gerber.zip]
164 7 laforge
165 7 laforge
=== v1.0 ===
166 20 tsaitgaist
167 20 tsaitgaist
168 20 tsaitgaist
[[Image(simtrace_10_front.jpg, 33%)]]
169 7 laforge
170 7 laforge
This is the first stable release.  We built some 5 prototypes from this version.
171 7 laforge
172 13 zecke2
Downloads:
173 13 zecke2
 * [attachment:simtrace_schem_v10.pdf]
174 7 laforge
 * [attachment:simtrace_10_gerber.zip]
175 7 laforge
176 7 laforge
=== v0.9 ===
177 20 tsaitgaist
178 20 tsaitgaist
[[Image(simtrace_v09_top_mid.jpg, 33%)]]
179 20 tsaitgaist
180 7 laforge
As of June 04, 2011 the components had all arrived and four PCBs were in production.  We assemble the first
181 1 laforge
units around June 14, 2011.
182 1 laforge
183 7 laforge
As of June 21st, we had four re-worked prototypes that are fully functional.
184 1 laforge
185 7 laforge
=== v0.8 ===
186 20 tsaitgaist
187 20 tsaitgaist
188 20 tsaitgaist
[[Image(simtrace_08_front_mid.jpg, 33%)]]
189 1 laforge
190 7 laforge
Never really was an official release.  However, a friend took the unfinished Gerber files and built 5 units.
191 1 laforge
192 7 laforge
Since the Gerber was not finished, we had to do lots and lots of re-work in order to make them work at all.
193 7 laforge
194 1 laforge
== License ==
195 1 laforge
196 1 laforge
Schematics and Gerber files are released under the Creative Commons CC-BY-SA (Share Alike / Attribution) license.
197 1 laforge
198 1 laforge
== Sales ==
199 1 laforge
200 12 zecke2
Sales started at the 2011 CCC Camp and the hardware can be bought through the web-shop of sysmocom GmbH ([http://shop.sysmocom.de/])
201 7 laforge
202 7 laforge
== Credits ==
203 7 laforge
204 8 laforge
 * Harald Welte
205 8 laforge
  * Original project idea, schematic design
206 8 laforge
  * Olimex SAM7-P64 based prototypes
207 8 laforge
  * Firmware and host software
208 8 laforge
 * Kevin Redon
209 8 laforge
  * KiCAD work on schematics, footprints and routing
210 8 laforge
  * Soldering of some prototypes
211 8 laforge
 * [http://sysmocom.de/ sysmocom - systems for mobile communications GmbH]
212 8 laforge
  * funding for hardware prototyping (PCB, components, etc)
213 8 laforge
 * Christian Daniel
214 8 laforge
  * post-production flashing + debugging, design + test of v1.0p rework
Add picture from clipboard (Maximum size: 48.8 MB)