Using SIMtrace, you can sniff the initial communication between a 3G phone and a USIM in order to get the phone terminal profile (it should even be before the PIN check).
It is also decoded in wireshark.

The terminal profile CAT command header (CLA=80, INS=10, P1=00, P2=00) is defined in ETSI TS 102 221 §11.2.1.
The terminal profile CAT command body is defined in ETSI TS 102 223 §5.2.
It tells the USIM what it can do on the phone.

There is now a collaborative project on creating a database of terminal profile records of many different phones, you can reach it at

That page also contains instructions on how to contribute to the database - which we hope you will do, at least as long as you have a SIMtrace or other hardware to obtain it from your phones.

Updated by laforge almost 6 years ago · 6 revisions

Add picture from clipboard (Maximum size: 48.8 MB)