search

herlesupreeth / CoIMS_Wiki

Wiki for overriding IMS settings to enable VoLTE/VoWiFi using Carrier Privileges in Android phones
BSD 2-Clause "Simplified" License
81 stars 25 forks source link

Cannot program on new Sysmocom SIM card #7

Closed miaoski closed 4 years ago

miaoski commented 4 years ago

Hi @herlesupreeth , I have order a 10-pack SIM cards. It's green in color. I have tried 2 cards. KIC/KID/KIK are good. However, there are problem when trying --acr-list and the CoIMS cannot get carrier privileges.

alice@epc01:~/CoIMS_Wiki$ gp --key-enc 317C18BCF0280843523E28F2E8B51359 --key-mac B425A29FECD06BAC830FBB9769E50228 --key-dek 1A608E60F78F52DC56E203130A1BDE51 -lvi
GlobalPlatformPro 19.06.16-8-g9639eb9
Running on Linux 4.15.0-112-lowlatency amd64, Java 9-internal by Oracle Corporation
Reader: Alcor Micro AU9560 00 00
ATR: 3B9F96801FC78031A073BE21136743200718000001A5
More information about your card:
    http://smartcard-atr.appspot.com/parse?ATR=3B9F96801FC78031A073BE21136743200718000001A5

[DEBUG] GPSession - Auto-detected ISD: A000000003000000
[WARN] GPData - Invalid CPLC date: FFFF
[WARN] GPData - Invalid CPLC date: FFFF
[WARN] GPData - Invalid CPLC date: FFFF
[WARN] GPData - Invalid CPLC date: FFFF
[WARN] GPData - Invalid CPLC date: FFFF
[WARN] GPData - Invalid CPLC date: FFFF
CPLC: ICFabricator=FFFF
      ICType=FFFF
      OperatingSystemID=FFFF
      OperatingSystemReleaseDate=FFFF (invalid date format)
      OperatingSystemReleaseLevel=FFFF
      ICFabricationDate=FFFF (invalid date format)
      ICSerialNumber=FFFFFFFF
      ICBatchIdentifier=FFFF
      ICModuleFabricator=FFFF
      ICModulePackagingDate=FFFF (invalid date format)
      ICCManufacturer=FFFF
      ICEmbeddingDate=FFFF (invalid date format)
      ICPrePersonalizer=FFFF
      ICPrePersonalizationEquipmentDate=FFFF (invalid date format)
      ICPrePersonalizationEquipmentID=FFFFFFFF
      ICPersonalizer=FFFF
      ICPersonalizationDate=FFFF (invalid date format)
      ICPersonalizationEquipmentID=FFFFFFFF

IIN: 42020102
CIN: 45020506
Card Data: 
Tag 6: 1.2.840.114283.1
-> Global Platform card
Tag 60: 1.2.840.114283.2.2.1.1
-> GP Version: 2.1.1
Tag 63: 1.2.840.114283.3
Tag 64: 1.2.840.114283.4.2.21
-> GP SCP02 i=15
Card Capabilities: 
[DEBUG] GPData - GET DATA(Card Capabilities): N/A
Version:   1 (0x01) ID:   1 (0x01) type: DES3 length:  16 
Version:   1 (0x01) ID:   2 (0x02) type: DES3 length:  16 
Version:   1 (0x01) ID:   3 (0x03) type: DES3 length:  16 
Version:   2 (0x02) ID:   1 (0x01) type: DES3 length:  16 
Version:   2 (0x02) ID:   2 (0x02) type: DES3 length:  16 
Version:   2 (0x02) ID:   3 (0x03) type: DES3 length:  16 
Version:   3 (0x03) ID:   1 (0x01) type: DES3 length:  16 
Version:   3 (0x03) ID:   2 (0x02) type: DES3 length:  16 
Version:   3 (0x03) ID:   3 (0x03) type: DES3 length:  16 
[WARN] PlaintextKeys - Don't know how to calculate KCV, defaulting to SCP02
[WARN] PlaintextKeys - Don't know how to calculate KCV, defaulting to SCP02
[WARN] PlaintextKeys - Don't know how to calculate KCV, defaulting to SCP02
[INFO] GPSession - Using card master keys: ENC=317C18BCF0280843523E28F2E8B51359 (KCV: 6321E8) MAC=B425A29FECD06BAC830FBB9769E50228 (KCV: 579523) DEK=1A608E60F78F52DC56E203130A1BDE51 (KCV: 4B4A5C) for null
[DEBUG] GPSession - Host challenge: 376FD0E4625181B5
[DEBUG] GPSession - Card challenge: 0000674B15450B12
[DEBUG] GPSession - Card reports SCP02 with key version 1 (0x01)
[INFO] GPSession - Diversified card keys: ENC=317C18BCF0280843523E28F2E8B51359 (KCV: 6321E8) MAC=B425A29FECD06BAC830FBB9769E50228 (KCV: 579523) DEK=1A608E60F78F52DC56E203130A1BDE51 (KCV: 4B4A5C) for SCP02
[INFO] GPSession - Session keys: ENC=F2A5DAE78BF61BC58BBA5DF57D6426A8 MAC=4FB30C997B5D4D9D6F166CD02F8054B7 RMAC=844C13874BECBD25DDAB1075D2E44237, card keys=ENC=317C18BCF0280843523E28F2E8B51359 (KCV: 6321E8) MAC=B425A29FECD06BAC830FBB9769E50228 (KCV: 579523) DEK=1A608E60F78F52DC56E203130A1BDE51 (KCV: 4B4A5C) for SCP02
[DEBUG] GPSession - Verified card cryptogram: ACE8B72EE9F5F381
[DEBUG] GPSession - Calculated host cryptogram: 1964D2688BFB4856
[DEBUG] GPRegistry - Registry already contains PKG: A0000000090001FFFFFFFF8900, 1
ISD: A000000003000000 (INITIALIZED)
     Privs:   SecurityDomain, CardLock, CardTerminate, CVMManagement

APP: A0000000090001FFFFFFFF8900000000 (SELECTABLE) (|................|)
     Privs:   CardReset

PKG: A0000000090001FFFFFFFF8900 (LOADED) (|.............|)
     Applet:  A0000000090001FFFFFFFF8900000000 (|................|)
     Applet:  A0000000090001FFFFFFFF89B00010 (|...............|)
     Applet:  A0000000871002FF49FFFF89040B0000 (|........I.......|)
     Applet:  FF434E52581040040203000000000000 (|.CNRX.@.........|)

alice@epc01:~/CoIMS_Wiki$ gp --key-enc 317C18BCF0280843523E28F2E8B51359 --key-mac B425A29FECD06BAC830FBB9769E50228 --key-dek 1A608E60F78F52DC56E203130A1BDE51 --install applet.cap
CAP loaded
alice@epc01:~/CoIMS_Wiki$ gp --key-enc 317C18BCF0280843523E28F2E8B51359 --key-mac B425A29FECD06BAC830FBB9769E50228 --key-dek 1A608E60F78F52DC56E203130A1BDE51 -a 00A4040009A00000015141434C0000 -a 80E2900033F031E22FE11E4F06FFFFFFFFFFFFC114E46872F28B350B7E1F140DE535C2A8D5804F0BE3E30DD00101DB080000000000000001
alice@epc01:~/CoIMS_Wiki$ gp --key-enc 317C18BCF0280843523E28F2E8B51359 --key-mac B425A29FECD06BAC830FBB9769E50228 --key-dek 1A608E60F78F52DC56E203130A1BDE51 --acr-list-aram
Could not read A00000015141434C00
alice@epc01:~/CoIMS_Wiki$ gp --key-enc 317C18BCF0280843523E28F2E8B51359 --key-mac B425A29FECD06BAC830FBB9769E50228 --key-dek 1A608E60F78F52DC56E203130A1BDE51 --acr-list
STORE DATA failed: 0x6D00 (Invalid INStruction)

Any debugging ideas? Thanks!

herlesupreeth commented 4 years ago

can you print the send me the output of the below command after you have loaded the applet?

gp --key-enc 317C18BCF0280843523E28F2E8B51359 --key-mac B425A29FECD06BAC830FBB9769E50228 --key-dek 1A608E60F78F52DC56E203130A1BDE51 -lvi

miaoski commented 4 years ago 
alice@epc01:~/CoIMS_Wiki$ gp --key-enc 317C18BCF0280843523E28F2E8B51359 --key-mac B425A29FECD06BAC830FBB9769E50228 --key-dek 1A608E60F78F52DC56E203130A1BDE51 -lvi
GlobalPlatformPro 19.06.16-8-g9639eb9
Running on Linux 4.15.0-112-lowlatency amd64, Java 9-internal by Oracle Corporation
Reader: Alcor Micro AU9560 00 00
ATR: 3B9F96801FC78031A073BE21136743200718000001A5
More information about your card:
    http://smartcard-atr.appspot.com/parse?ATR=3B9F96801FC78031A073BE21136743200718000001A5

[DEBUG] GPSession - Auto-detected ISD: A000000003000000
[WARN] GPData - Invalid CPLC date: FFFF
[WARN] GPData - Invalid CPLC date: FFFF
[WARN] GPData - Invalid CPLC date: FFFF
[WARN] GPData - Invalid CPLC date: FFFF
[WARN] GPData - Invalid CPLC date: FFFF
[WARN] GPData - Invalid CPLC date: FFFF
CPLC: ICFabricator=FFFF
      ICType=FFFF
      OperatingSystemID=FFFF
      OperatingSystemReleaseDate=FFFF (invalid date format)
      OperatingSystemReleaseLevel=FFFF
      ICFabricationDate=FFFF (invalid date format)
      ICSerialNumber=FFFFFFFF
      ICBatchIdentifier=FFFF
      ICModuleFabricator=FFFF
      ICModulePackagingDate=FFFF (invalid date format)
      ICCManufacturer=FFFF
      ICEmbeddingDate=FFFF (invalid date format)
      ICPrePersonalizer=FFFF
      ICPrePersonalizationEquipmentDate=FFFF (invalid date format)
      ICPrePersonalizationEquipmentID=FFFFFFFF
      ICPersonalizer=FFFF
      ICPersonalizationDate=FFFF (invalid date format)
      ICPersonalizationEquipmentID=FFFFFFFF

IIN: 42020102
CIN: 45020506
Card Data: 
Tag 6: 1.2.840.114283.1
-> Global Platform card
Tag 60: 1.2.840.114283.2.2.1.1
-> GP Version: 2.1.1
Tag 63: 1.2.840.114283.3
Tag 64: 1.2.840.114283.4.2.21
-> GP SCP02 i=15
Card Capabilities: 
[DEBUG] GPData - GET DATA(Card Capabilities): N/A
Version:   1 (0x01) ID:   1 (0x01) type: DES3 length:  16 
Version:   1 (0x01) ID:   2 (0x02) type: DES3 length:  16 
Version:   1 (0x01) ID:   3 (0x03) type: DES3 length:  16 
Version:   2 (0x02) ID:   1 (0x01) type: DES3 length:  16 
Version:   2 (0x02) ID:   2 (0x02) type: DES3 length:  16 
Version:   2 (0x02) ID:   3 (0x03) type: DES3 length:  16 
Version:   3 (0x03) ID:   1 (0x01) type: DES3 length:  16 
Version:   3 (0x03) ID:   2 (0x02) type: DES3 length:  16 
Version:   3 (0x03) ID:   3 (0x03) type: DES3 length:  16 
[WARN] PlaintextKeys - Don't know how to calculate KCV, defaulting to SCP02
[WARN] PlaintextKeys - Don't know how to calculate KCV, defaulting to SCP02
[WARN] PlaintextKeys - Don't know how to calculate KCV, defaulting to SCP02
[INFO] GPSession - Using card master keys: ENC=317C18BCF0280843523E28F2E8B51359 (KCV: 6321E8) MAC=B425A29FECD06BAC830FBB9769E50228 (KCV: 579523) DEK=1A608E60F78F52DC56E203130A1BDE51 (KCV: 4B4A5C) for null
[DEBUG] GPSession - Host challenge: E8390C1D8ECAE452
[DEBUG] GPSession - Card challenge: 0003A018A035A13B
[DEBUG] GPSession - Card reports SCP02 with key version 1 (0x01)
[INFO] GPSession - Diversified card keys: ENC=317C18BCF0280843523E28F2E8B51359 (KCV: 6321E8) MAC=B425A29FECD06BAC830FBB9769E50228 (KCV: 579523) DEK=1A608E60F78F52DC56E203130A1BDE51 (KCV: 4B4A5C) for SCP02
[INFO] GPSession - Session keys: ENC=0AAE494D0B900E8ED5ADB7EB4ADF4FD9 MAC=F969CCAF9112C53CCA00BFE608CA4C50 RMAC=1C03CA96C53C648F12F654615796137F, card keys=ENC=317C18BCF0280843523E28F2E8B51359 (KCV: 6321E8) MAC=B425A29FECD06BAC830FBB9769E50228 (KCV: 579523) DEK=1A608E60F78F52DC56E203130A1BDE51 (KCV: 4B4A5C) for SCP02
[DEBUG] GPSession - Verified card cryptogram: 533DCD15B7BC586C
[DEBUG] GPSession - Calculated host cryptogram: 205AECD3F16828E2
[DEBUG] GPRegistry - Registry already contains PKG: A0000000090001FFFFFFFF8900, 1
ISD: A000000003000000 (INITIALIZED)
     Privs:   SecurityDomain, CardLock, CardTerminate, CVMManagement

APP: A0000000090001FFFFFFFF8900000000 (SELECTABLE) (|................|)
     Privs:   CardReset

PKG: A0000000090001FFFFFFFF8900 (LOADED) (|.............|)
     Applet:  A0000000090001FFFFFFFF8900000000 (|................|)
     Applet:  A0000000090001FFFFFFFF89B00010 (|...............|)
     Applet:  A0000000871002FF49FFFF89040B0000 (|........I.......|)
     Applet:  FF434E52581040040203000000000000 (|.CNRX.@.........|)
     Applet:  A00000015141434C00 (|....QACL.|)
herlesupreeth commented 4 years ago

Strange, can you use an older gp.jar (GlobalPlatformPro 19.06.16-8-g9639eb9) and give it a try? Here is the download location https://github.com/martinpaljak/GlobalPlatformPro/releases/download/19.06.16/gp.jar

miaoski commented 4 years ago

With the old gp.jar, it said

$ gp --key-enc 317C18BCF0280843523E28F2E8B51359 --key-mac B425A29FECD06BAC830FBB9769E50228 --key-dek 1A608E60F78F52DC56E203130A1BDE51 --install applet.cap 
Applet loading not allowed. Are you sure the domain can accept it?
INSTALL [for load] failed: 0x6985 (Conditions of use not satisfied)
herlesupreeth commented 4 years ago

just read the acr-list, dont load the applet if its already loaded

herlesupreeth commented 4 years ago

@laf0rge : any help here is highly appreciated :)

miaoski commented 4 years ago

With the old gp.jar:

alice@epc01:~/CoIMS_Wiki$ gp --key-enc 317C18BCF0280843523E28F2E8B51359 --key-mac B425A29FECD06BAC830FBB9769E50228 --key-dek 1A608E60F78F52DC56E203130A1BDE51 --acr-list
STORE DATA failed: 0x6D00 (Invalid INStruction)
herlesupreeth commented 4 years ago

the command is with -acr-list not --acr-list

miaoski commented 4 years ago

Same result ...

alice@epc01:~/CoIMS_Wiki$ gp --key-enc 317C18BCF0280843523E28F2E8B51359 --key-mac B425A29FECD06BAC830FBB9769E50228 --key-dek 1A608E60F78F52DC56E203130A1BDE51 -acr-list
STORE DATA failed: 0x6D00 (Invalid INStruction)
herlesupreeth commented 4 years ago

can you run a -h to see list of options supported and paste here ?

miaoski commented 4 years ago 
alice@epc01:~/CoIMS_Wiki$ /usr/lib/jvm/java-9-openjdk-amd64/bin/java -jar old-gp.jar -h
Option                             Description                                 
------                             -----------                                 
-?, -h, --help                     Shows this help                             
-V, --version                      Show information about the program          
-a, --apdu <String: APDU>          Send raw APDU (hex)                         
--acr-add                          Add an access rule                          
--acr-aid <String: AID>            ARA-C applet AID                            
--acr-delete                       Delete an access rule                       
--acr-hash <String: SHA1>          Certificate hash                            
--acr-list                         List access rules                           
--acr-list-aram                    List access rules from ARA-M                
--acr-rule <String>                Access control rule (can be 0x00(NEVER),0x01
                                     (ALWAYS) or an APDU filter                
--allow-from                       Allow moving from created SSD               
--allow-to                         Allow moving to created SSD                 
--applet <String: AID>             Applet AID                                  
--bs <Integer: bytes>              maximum APDU payload size                   
--cap <File>                       Use a CAP file as source                    
--create <String: AID>             Create new instance of an applet            
-d, --debug                        Show PC/SC and APDU trace                   
--dap-domain <String: AID>         Domain to use for DAP verification          
--default                          Indicate Default Selected privilege         
--delete [String: AID]             Delete applet/package                       
--delete-key <String>              Delete key with version                     
--domain <String: AID>             Create supplementary security domain        
--dump <File>                      Dump APDU communication to <File>           
--emv                              Use EMV KDF                                 
-f, --force                        Force operation                             
-i, --info                         Show information                            
--initialize-card                  Transition ISD to INITIALIZED state         
--install [File]                   Install applet(s) from CAP                  
--kcv <String: KCV>                Specify master key check value              
--kdf <String: kdf>                Use KDF with master key                     
--kdf3                             Use SCP03 KDF KDF                           
--key <String: key>                Specify master key                          
--key-dek <String: key>            Specify card DEK key                        
--key-enc <String: key>            Specify card ENC key                        
--key-id <String>                  Specify key ID                              
--key-mac <String: key>            Specify card MAC key                        
--key-ver <String>                 Specify key version                         
-l, --list                         List the contents of the card               
--list-privs                       List known privileges                       
--load <File>                      Load a CAP file                             
--lock <String: key>               Set new key                                 
--lock-applet <String: AID>        Lock applet                                 
--lock-card                        Lock card                                   
--lock-dek <String: key>           Set new DEK key                             
--lock-enc <String: key>           Set new ENC key                             
--lock-kdf <String: kdf>           Use KDF with lock key                       
--lock-mac <String: key>           Set new MAC key                             
--make-default <String: AID>       Make AID the default                        
--mode <String: mac/enc/clr>       Secure channel to use (mac/enc/clr)         
--move <String: AID>               Move something                              
--new-keyver <String>              Key version for the new key                 
--op201                            Enable OpenPlatform 2.0.1 mode              
--oracle [String: URL]             Use an oracle for keying information        
--package, --pkg <String: AID>     Package AID                                 
--params <String: HEX>             Installation parameters                     
--privs <String>                   Specify privileges for installation         
--put-key <String: PEM file>       Put a new key                               
-r, --reader <String>              Use specific reader                         
--rename-isd <String: new AID>     Rename ISD                                  
--replay <File>                    Replay APDU responses from <File>           
-s, --secure-apdu <String: APDU>   Send raw APDU (hex) via SCP                 
--sdaid <String: AID>              ISD AID                                     
--secure-card                      Transition ISD to SECURED state             
--set-perso <String: data>         Set Perso data in CPLC                      
--set-pre-perso <String: data>     Set PrePerso data in CPLC                   
--sha256                           Use SHA-256 for LFDB hash                   
--store-data <String: data>        STORE DATA blob                             
--store-data-chunk <String: data>  Send STORE DATA commands                    
--terminals <String>               Use PC/SC provider from <jar:class>         
--terminate                        Indicate Card Lock+Terminate privilege      
--to <String: AID>                 Destination security domain                 
--today                            Set date to today when updating CPLC        
--token-key <String: path>         Path to private key used in Delegated       
                                     Management token generation               
--uninstall <File>                 Uninstall applet/package                    
--unlock                           Set default key for card key                
--unlock-applet <String: AID>      Unlock applet                               
--unlock-card                      Unlock card                                 
-v, --verbose                      Be verbose about operations                 
--visa2                            Use VISA2 KDF
herlesupreeth commented 4 years ago

then the command to list is with --acr-list-aram

miaoski commented 4 years ago 
alice@epc01:~/CoIMS_Wiki$ /usr/lib/jvm/java-9-openjdk-amd64/bin/java -jar old-gp.jar --key-enc 317C18BCF0280843523E28F2E8B51359 --key-mac B425A29FECD06BAC830FBB9769E50228 --key-dek 1A608E60F78F52DC56E203130A1BDE51 --acr-list
STORE DATA failed: 0x6D00 (Invalid INStruction)
herlesupreeth commented 4 years ago

you used --acr-list but its --acr-list-aram

miaoski commented 4 years ago 
alice@epc01:~/CoIMS_Wiki$ /usr/lib/jvm/java-9-openjdk-amd64/bin/java -jar old-gp.jar --key-enc 317C18BCF0280843523E28F2E8B51359 --key-mac B425A29FECD06BAC830FBB9769E50228 --key-dek 1A608E60F78F52DC56E203130A1BDE51 --acr-list-aram
Could not read A00000015141434C00
herlesupreeth commented 4 years ago

thats quite strange indeed, as a one last try you could delete the applet on the SIM as follows:

/usr/lib/jvm/java-9-openjdk-amd64/bin/java -jar old-gp.jar --key-enc 317C18BCF0280843523E28F2E8B51359 --key-mac B425A29FECD06BAC830FBB9769E50228 --key-dek 1A608E60F78F52DC56E203130A1BDE51 -delete A00000015141434C -f

then, re-install the applet and give it a try again.

Even after the above step if it doesnt work then I would suggest to contact Sysmocom, they are quite responsive

miaoski commented 4 years ago

Looks OK to delete the app:

alice@epc01:~/CoIMS_Wiki$ /usr/lib/jvm/java-9-openjdk-amd64/bin/java -jar old-gp.jar --key-enc 317C18BCF0280843523E28F2E8B51359 --key-mac B425A29FECD06BAC830FBB9769E50228 --key-dek 1A608E60F78F52DC56E203130A1BDE51 -delete A00000015141434C -f -v
GlobalPlatformPro 19.06.16-0-gbaccf34
Running on Linux 4.15.0-112-lowlatency amd64, Java 9-internal by Oracle Corporation
Reader: Alcor Micro AU9560 00 00
ATR: 3B9F96801FC78031A073BE21136743200718000001A5
More information about your card:
    http://smartcard-atr.appspot.com/parse?ATR=3B9F96801FC78031A073BE21136743200718000001A5

[DEBUG] GPSession - Auto-detected ISD: A000000003000000
[WARN] PlaintextKeys - Don't know how to calculate KCV, defaulting to SCP02
[WARN] PlaintextKeys - Don't know how to calculate KCV, defaulting to SCP02
[WARN] PlaintextKeys - Don't know how to calculate KCV, defaulting to SCP02
[INFO] GPSession - Using card master keys: ENC=317C18BCF0280843523E28F2E8B51359 (KCV: 6321E8) MAC=B425A29FECD06BAC830FBB9769E50228 (KCV: 579523) DEK=1A608E60F78F52DC56E203130A1BDE51 (KCV: 4B4A5C) for null
[DEBUG] GPSession - Host challenge: 6928682DEEB3E588
[DEBUG] GPSession - Card challenge: 000D9328F127C504
[DEBUG] GPSession - Card reports SCP02 with key version 1 (0x01)
[INFO] GPSession - Diversified card keys: ENC=317C18BCF0280843523E28F2E8B51359 (KCV: 6321E8) MAC=B425A29FECD06BAC830FBB9769E50228 (KCV: 579523) DEK=1A608E60F78F52DC56E203130A1BDE51 (KCV: 4B4A5C) for SCP02
[INFO] GPSession - Session keys: ENC=24AC52898F3D8BA996660788EF6633EE MAC=C78E44540E11B85E8A84031ED6AEACA6 RMAC=0485EA0CAC8EF0DD53290198EE4A0337, card keys=ENC=317C18BCF0280843523E28F2E8B51359 (KCV: 6321E8) MAC=B425A29FECD06BAC830FBB9769E50228 (KCV: 579523) DEK=1A608E60F78F52DC56E203130A1BDE51 (KCV: 4B4A5C) for SCP02
[DEBUG] GPSession - Verified card cryptogram: CBF700774C498B27
[DEBUG] GPSession - Calculated host cryptogram: CA81F05ED1006C8A
[DEBUG] SCP02Wrapper - MAC input: 8482010010CA81F05ED1006C8A
[DEBUG] SCP02Wrapper - MAC input: 84F280020A4F00
[DEBUG] SCP02Wrapper - MAC input: 84F240020A4F00
[DEBUG] SCP02Wrapper - MAC input: 84F220020A4F00
[DEBUG] SCP02Wrapper - MAC input: 84F210020A4F00
[DEBUG] SCP02Wrapper - MAC input: 84E40080124F08A00000015141434C

-lvi shows that the app has been deleted:

alice@epc01:~/CoIMS_Wiki$ gp --key-enc 317C18BCF0280843523E28F2E8B51359 --key-mac B425A29FECD06BAC830FBB9769E50228 --key-dek 1A608E60F78F52DC56E203130A1BDE51 -lvi
GlobalPlatformPro 19.06.16-0-gbaccf34
Running on Linux 4.15.0-112-lowlatency amd64, Java 9-internal by Oracle Corporation
Reader: Alcor Micro AU9560 00 00
ATR: 3B9F96801FC78031A073BE21136743200718000001A5
More information about your card:
    http://smartcard-atr.appspot.com/parse?ATR=3B9F96801FC78031A073BE21136743200718000001A5

[DEBUG] GPSession - Auto-detected ISD: A000000003000000
[WARN] GPData - Invalid CPLC date: FFFF
[WARN] GPData - Invalid CPLC date: FFFF
[WARN] GPData - Invalid CPLC date: FFFF
[WARN] GPData - Invalid CPLC date: FFFF
[WARN] GPData - Invalid CPLC date: FFFF
[WARN] GPData - Invalid CPLC date: FFFF
CPLC: ICFabricator=FFFF
      ICType=FFFF
      OperatingSystemID=FFFF
      OperatingSystemReleaseDate=FFFF (invalid date format)
      OperatingSystemReleaseLevel=FFFF
      ICFabricationDate=FFFF (invalid date format)
      ICSerialNumber=FFFFFFFF
      ICBatchIdentifier=FFFF
      ICModuleFabricator=FFFF
      ICModulePackagingDate=FFFF (invalid date format)
      ICCManufacturer=FFFF
      ICEmbeddingDate=FFFF (invalid date format)
      ICPrePersonalizer=FFFF
      ICPrePersonalizationEquipmentDate=FFFF (invalid date format)
      ICPrePersonalizationEquipmentID=FFFFFFFF
      ICPersonalizer=FFFF
      ICPersonalizationDate=FFFF (invalid date format)
      ICPersonalizationEquipmentID=FFFFFFFF

IIN: 42020102
CIN: 45020506
Card Data: 
Tag 6: 1.2.840.114283.1
-> Global Platform card
Tag 60: 1.2.840.114283.2.2.1.1
-> GP Version: 2.1.1
Tag 63: 1.2.840.114283.3
Tag 64: 1.2.840.114283.4.2.21
-> GP SCP02 i=15
Card Capabilities: 
[DEBUG] GPData - GET DATA(Card Capabilities): N/A
Version:   1 (0x01) ID:   1 (0x01) type: DES3 length:  16 
Version:   1 (0x01) ID:   2 (0x02) type: DES3 length:  16 
Version:   1 (0x01) ID:   3 (0x03) type: DES3 length:  16 
Version:   2 (0x02) ID:   1 (0x01) type: DES3 length:  16 
Version:   2 (0x02) ID:   2 (0x02) type: DES3 length:  16 
Version:   2 (0x02) ID:   3 (0x03) type: DES3 length:  16 
Version:   3 (0x03) ID:   1 (0x01) type: DES3 length:  16 
Version:   3 (0x03) ID:   2 (0x02) type: DES3 length:  16 
Version:   3 (0x03) ID:   3 (0x03) type: DES3 length:  16 
[WARN] PlaintextKeys - Don't know how to calculate KCV, defaulting to SCP02
[WARN] PlaintextKeys - Don't know how to calculate KCV, defaulting to SCP02
[WARN] PlaintextKeys - Don't know how to calculate KCV, defaulting to SCP02
[INFO] GPSession - Using card master keys: ENC=317C18BCF0280843523E28F2E8B51359 (KCV: 6321E8) MAC=B425A29FECD06BAC830FBB9769E50228 (KCV: 579523) DEK=1A608E60F78F52DC56E203130A1BDE51 (KCV: 4B4A5C) for null
[DEBUG] GPSession - Host challenge: 3D684BE2D1C9D31C
[DEBUG] GPSession - Card challenge: 000E418B9983CD45
[DEBUG] GPSession - Card reports SCP02 with key version 1 (0x01)
[INFO] GPSession - Diversified card keys: ENC=317C18BCF0280843523E28F2E8B51359 (KCV: 6321E8) MAC=B425A29FECD06BAC830FBB9769E50228 (KCV: 579523) DEK=1A608E60F78F52DC56E203130A1BDE51 (KCV: 4B4A5C) for SCP02
[INFO] GPSession - Session keys: ENC=1CAE88E6D5A1DA4DA19E6BD4594FA96A MAC=B44CE3BA0F34A22141D37AEA32E8623C RMAC=E8414BAEF32425EE8A1237A2BC7A0CBD, card keys=ENC=317C18BCF0280843523E28F2E8B51359 (KCV: 6321E8) MAC=B425A29FECD06BAC830FBB9769E50228 (KCV: 579523) DEK=1A608E60F78F52DC56E203130A1BDE51 (KCV: 4B4A5C) for SCP02
[DEBUG] GPSession - Verified card cryptogram: 616E9DB77172B929
[DEBUG] GPSession - Calculated host cryptogram: 20487039B24BAE19
[DEBUG] SCP02Wrapper - MAC input: 848201001020487039B24BAE19
[DEBUG] SCP02Wrapper - MAC input: 84F280020A4F00
[DEBUG] SCP02Wrapper - MAC input: 84F240020A4F00
[DEBUG] SCP02Wrapper - MAC input: 84F220020A4F00
[DEBUG] SCP02Wrapper - MAC input: 84F210020A4F00
ISD: A000000003000000 (INITIALIZED)
     Privs:   SecurityDomain, CardLock, CardTerminate, CVMManagement

APP: A0000000090001FFFFFFFF8900000000 (SELECTABLE) (|................|)
     Privs:   CardReset

PKG: A0000000090001FFFFFFFF8900 (LOADED) (|.............|)

PKG: A0000000090001FFFFFFFF8900 (LOADED) (|.............|)
     Applet:  A0000000090001FFFFFFFF8900000000 (|................|)
     Applet:  A0000000090001FFFFFFFF89B00010 (|...............|)
     Applet:  A0000000871002FF49FFFF89040B0000 (|........I.......|)
     Applet:  FF434E52581040040203000000000000 (|.CNRX.@.........|)

CAP loaded:

alice@epc01:~/CoIMS_Wiki$ /usr/lib/jvm/java-9-openjdk-amd64/bin/java -jar old-gp.jar --key-enc 317C18BCF0280843523E28F2E8B51359 --key-mac B425A29FECD06BAC830FBB9769E50228 --key-dek 1A608E60F78F52DC56E203130A1BDE51 --install applet.cap -v
GlobalPlatformPro 19.06.16-0-gbaccf34
Running on Linux 4.15.0-112-lowlatency amd64, Java 9-internal by Oracle Corporation
Reader: Alcor Micro AU9560 00 00
ATR: 3B9F96801FC78031A073BE21136743200718000001A5
More information about your card:
    http://smartcard-atr.appspot.com/parse?ATR=3B9F96801FC78031A073BE21136743200718000001A5

[DEBUG] GPSession - Auto-detected ISD: A000000003000000
[WARN] PlaintextKeys - Don't know how to calculate KCV, defaulting to SCP02
[WARN] PlaintextKeys - Don't know how to calculate KCV, defaulting to SCP02
[WARN] PlaintextKeys - Don't know how to calculate KCV, defaulting to SCP02
[INFO] GPSession - Using card master keys: ENC=317C18BCF0280843523E28F2E8B51359 (KCV: 6321E8) MAC=B425A29FECD06BAC830FBB9769E50228 (KCV: 579523) DEK=1A608E60F78F52DC56E203130A1BDE51 (KCV: 4B4A5C) for null
[DEBUG] GPSession - Host challenge: 3392EF120FC7AC0D
[DEBUG] GPSession - Card challenge: 000F7BBF0F610EAF
[DEBUG] GPSession - Card reports SCP02 with key version 1 (0x01)
[INFO] GPSession - Diversified card keys: ENC=317C18BCF0280843523E28F2E8B51359 (KCV: 6321E8) MAC=B425A29FECD06BAC830FBB9769E50228 (KCV: 579523) DEK=1A608E60F78F52DC56E203130A1BDE51 (KCV: 4B4A5C) for SCP02
[INFO] GPSession - Session keys: ENC=33769D8692EAF3E7C907CE7D6741B2E1 MAC=D69392A2C01CC9152BED46ABDD2FB5C7 RMAC=3A72B585B52397D08AF8D65FAB83C1E5, card keys=ENC=317C18BCF0280843523E28F2E8B51359 (KCV: 6321E8) MAC=B425A29FECD06BAC830FBB9769E50228 (KCV: 579523) DEK=1A608E60F78F52DC56E203130A1BDE51 (KCV: 4B4A5C) for SCP02
[DEBUG] GPSession - Verified card cryptogram: 3A43C382ABA7E557
[DEBUG] GPSession - Calculated host cryptogram: D1DCA2B698F8A6C6
[DEBUG] SCP02Wrapper - MAC input: 8482010010D1DCA2B698F8A6C6
CAP file (v2.1), contains: applets for JavaCard 2.2.1
Package: fr.bmartel.aram A00000015141434C v0.1
Applet:  A00000015141434C00
Import:  A0000000620101                   v1.2 javacard.framework
Import:  A0000000620102                   v1.2 javacard.security
Import:  A0000000620001                   v1.0 java.lang
Generated by Sun Microsystems Inc. converter 1.3
On Tue Oct 22 15:41:21 CEST 2019 with JDK 1.8.0_222 (Private Build)
Code size 3373 bytes (4285 with debug)
SHA-256 80f0feedd36f0017f1765e8c37a1cad4c6ec4b830339e072e379a5b9ef8bbfaf
SHA-1   d85e692866b4e1447c1e36239552e5c32db174c9
[DEBUG] SCP02Wrapper - MAC input: 84F280020A4F00
[DEBUG] SCP02Wrapper - MAC input: 84F240020A4F00
[DEBUG] SCP02Wrapper - MAC input: 84F220020A4F00
[DEBUG] SCP02Wrapper - MAC input: 84F210020A4F00
[DEBUG] SCP02Wrapper - MAC input: 84E602001D08A00000015141434C08A000000003000000000000
[DEBUG] SCP02Wrapper - MAC input: 84E80000FFC4820D2D010012DECAFFED010204010008A00000015141434C02001F0012001F000D001F011A00400A4B000A01060000038D00040000000003010004001F03020107A0000000620101020107A0000000620102000107A000000062000103000D0109A00000015141434C00000F06004000800304000107020001001C05E005B600820000FF0001000000008200070004010700070A040A090A0E0A130A180A290A3A093E0950096009720982099409A4070A4B000210188C0013181008900B87007A02308F00163D8C00178B00377A0321188B003860037A198B00392D1A032510FC5310806A08116E008D003B1A042575002F0002FFCA
[DEBUG] SCP02Wrapper - MAC input: 84E80001FF0029FFE2000D198B003F1A07251100FF536A081167008D003B188D00418C0042700E188C000B7008116D008D003B7A02118D00412C190525026B0F19062510406B08188C000C7042190525026B0F19062510506B08188C000D702F19052510DF6B0F19062510206B08188C000E701B190525026B0F19062510606B08188C000F7008116A868D003B7A06148D00412C1903023819041040388D00102D05321A6714191F59030103388D001103068B0012A800CA180389011A6620AF01AF011100FF41191F04411A8D001429041F160441321A8B00152D70E15903011F0643290418048902181604890316041100806D17190516045B3818
[DEBUG] SCP02Wrapper - MAC input: 84E80002FF10FD89018D0011031F8B0012707716041100FF6D2A19061907199207438D00183B1905108138190616045B381810FC89018D0011031F04418B001270481604117FFF6D3B19051907199207438D00183B19051082381906160410084F1100FF535B38190716041100FF535B381810FB89018D0011031100FF8B001270081169848D003B7A07178D00412C8D00112D1A8B003F1907251100FF536A081167008D003B083218191F044110E110288B00193B1F0641290418191F0641104F10108B001929051819160510C110148B00193B1916040541191604044125160505411916050441258D001A280615066708116A888D003B19030238
[DEBUG] SCP02Wrapper - MAC input: 84E80003FF1904105038031100FF190615068D00142907190516075B388D001103160706418B00127A05118D00412C190310DF3819041020381905100838AD0003190610088D00183B8D001103100B8B00127A0517AF031100FF4730AF031100FF496005590101AF021DA5007C8D00412D8D00102E032904183D85011100FF418901032905AF03AF021100FF4543290616061100FF6F091100FF290570151100FFAF011100FF49432907160616074129051B6621AF01AF011100FF411A16041B8D00142907160416074129041B8B00152E70E0183D8502044189028D00110316058B00127008116A888D003B7A022119052510906B3A190625613508
[DEBUG] SCP02Wrapper - MAC input: 84E80004FF31191E2510F06B0918198C001B7023191E2510F16B0918198C001C7015191E2510F26B08188C001D70081169848D003B7008116A868D003B7A0625083118191E10F01100CE8B00193B18191E054110E21100CC8B00193B18191E074110E110288B00193B1E1006413218191E100641104F10108B001929041819160410C110148B001929051819160510E31100A28B00193B8D001E8D001F28061506191F0541191F0441258B0020150619160405411916040441258B0021150619160505411916050441258B00228D00237A0925083118191E10F11100CC8B00193B191E04412561088D0024A80195191E054125104F6B3A18191E0541
[DEBUG] SCP02Wrapper - MAC input: 84E80005FF104F10108B00193B1E054132191F0541191F0441258D0025280415046708116A888D003B191F0541191F0441258D0026A80154191E05412510E16B6818191E054110E110288B00193B1E07413218191E0741104F10108B001929041819160410C110148B00193B191F0541191F044125160405411916040441258D001A280515056708116A888D003B191F0541191F044125160405411916040441258D0027A800E5191E05412510E2A300DB18191E054110E21100CC8B00193B18191E074110E110288B00193B1E1006413218191E100641104F10108B001929041819160410C110148B001929051819160510E31100A28B00193B1916
[DEBUG] SCP02Wrapper - MAC input: 84E80006FF05044125056F50191F0541191F04412516040541191604044125160505411916050441258D0028280615066708116A888D003B191F0541191F04412516040541191604044125160505411916050441258D0029703A191F0541191F044125160405411916040441258D001A280615066708116A888D003B191F0541191F044125160405411916040441258D00277A0411058D002A2C19AD000310088B002B7A0451191E590201251F6A081169848D003B191E590201252905160516046F081169848D003B1E16054178024018198C00427A0110188C002C7A05521F1C6C0D1F1D6D091A1F1C4310E2385903011C1D1A1F044115048D002D
[DEBUG] SCP02Wrapper - MAC input: 84E80007FF29051C1D1A1F160541044115048D002E29061F1C6C111F1D6D0D1A1F1C4316051606415B38160516064105415B7805521F1C6C0D1F1D6D091A1F1C4310E1385903011C1D1A1F044115048D002F29051C1D1A1F160541044115048D003029061F1C6C111F1D6D0D1A1F1C4316051606415B38160516064105415B7805501F1C6C0D1F1D6D091A1F1C4310E3385903011F1C6C101F1D6D0C1A1F1C4315048B00313859030115041A1F1C1D8B00323B15048B003105415B7805501F1C6C0D1F1D6D091A1F1C43104F385903011F1C6C101F1D6D0C1A1F1C4315048B00333859030115041A1F1C1D8B00343B15048B003305415B7805501F1C
[DEBUG] SCP02Wrapper - MAC input: 84E80008FF6C0D1F1D6D091A1F1C4310C1385903011F1C6C101F1D6D0C1A1F1C4315048B00353859030115041A1F1C1D8B00363B15048B003505415B780210188C002C181010900B8704181014900B8705181100A2900B8706187B003A8707187F003A7A02017B003C670A8F003D3D8C003E777B003C2B1883077F003C187B003A8707187F003A187705317B003A2E1B661E1B84081E6A0470101B830403181D1E8D004061041B771B83072E70E3017705517B003A280515056639150584081E6B2A1505840916046A0470201505830403181D1E8D004061131505830503181F16048D0040610515057715058307280570C7017705717B003A280715
[DEBUG] SCP02Wrapper - MAC input: 84E80009FF076650150784081E6B411507840916046B391507840A16066A04702F1507830403181D1E8D004061221507830503181F16048D00406114150783060318160516068D0040610515077715078307280770B0017701007B003A7702117B003A186909AD077F003A701A7B003A2C19661319830718690719AD0787071983072C70EE7A0210187B003C870718038808180388091803880A187F003C7A01017B003A2B1866168D001E188C0043188C00448D00237B003A2B70EB7A0331181D1E8D00252E1B66198D001E1B8C00431B8C00448D0023181D1E8D00252E70E87A0551181D1E1F16048D001A28051505661F8D001E15058C00431505
[DEBUG] SCP02Wrapper - MAC input: 84E8000AFF8C00448D0023181D1E1F16048D001A280570E17A0771181D1E1F1604160516068D00282807150766238D001E15078C004315078C00448D0023181D1E1F1604160516068D0028280770DD7A0530AD0403191EAE088D00183B1EAE084178075018AE08AD04191E1F16048B0045780530AD0503191EAE098D00183B1EAE094178075018AE09AD05191E1F16048B0045780530AD0603191EAE0A8D00183B1EAE0A4178075018AE0AAD06191E1F16048B0045780770160416056C32160416066D2C1D16061604436E111A031B16041605431D8D00183B70381A031B160416054316061604438D00183B702516041D4116056F1D16041D411606
[DEBUG] SCP02Wrapper - MAC input: 84E8000BFF6D151A16051604431B031D1605160443438D00183B16041D41780110AE08780110AE09780110AE0A780110AD07770540191EAD04031F8D00183B181F88087A0540191EAD05031F8D00183B181F88097A0540191EAD06031F8D00183B181F880A7A08000A0004000200000000000005011A00460200000002000001020000030200000202001A0102001A0202001A0302001A0002001A0402001A0502001A0606000073060000CD060001BF06000256060002800600084F06800A0403800A0806800300060005EF03001A0401000000060000010680100103000080060007B006000362060003F5060005A5068008010600076403001A05
[DEBUG] SCP02Wrapper - MAC input: 84E8000CFF03001A0603001A07068008020600089606000789060008B4060008D8060007F40600090706810E0003810E01068200000600063C06000689060006C50600070103001A0303001A8503001A0103001A8103001A0203001A83038003010380030303800A0105000000068007010500000201001A000600073D03800A060680100006800A050600031A060008550600087D03001A8609010600510DED05022605122D40C117070B130605021A13021F04FFFFA9FF9C0708061B0912080E14070A0D111507080A0D0E12160F0602030C040404B1050707020D050707020D050707026D050505070A070A070A00B1050D0403070711140F0403
[DEBUG] SCP02Wrapper - MAC input: 84E8800DAE0608061213141308060D10051A0B2905141407142507080604050F0E120D190C140B08061A04061E044F0D0E06081D0E0D0808100E0D130D0E040310101003100B18110C0C18110D170C161A0D130D0E2A0C20180C16070A12140C0720103D10430D06290D06290D060A1A0606050404070406071611220E142A0E0F140608051C120607040403030C07040403060F090505030914090505030D11150D150D15231325251111
CAP loaded
[DEBUG] SCP02Wrapper - MAC input: 84F280020A4F00
[DEBUG] SCP02Wrapper - MAC input: 84F240020A4F00
[DEBUG] SCP02Wrapper - MAC input: 84F220020A4F00
[DEBUG] SCP02Wrapper - MAC input: 84F210020A4F00
[DEBUG] SCP02Wrapper - MAC input: 84E60C002B08A00000015141434C09A00000015141434C0009A00000015141434C00010002C90000
alice@epc01:~/CoIMS_Wiki$ /usr/lib/jvm/java-9-openjdk-amd64/bin/java -jar old-gp.jar --key-enc 317C18BCF0280843523E28F2E8B51359 --key-mac B425A29FECD06BAC830FBB9769E50228 --key-dek 1A608E60F78F52DC56E203130A1BDE51 -v  -a 00A4040009A00000015141434C0000 -a 80E2900033F031E22FE11E4F06FFFFFFFFFFFFC114E46872F28B350B7E1F140DE535C2A8D5804F0BE3E30DD00101DB080000000000000001
GlobalPlatformPro 19.06.16-0-gbaccf34
Running on Linux 4.15.0-112-lowlatency amd64, Java 9-internal by Oracle Corporation
Reader: Alcor Micro AU9560 00 00
ATR: 3B9F96801FC78031A073BE21136743200718000001A5
More information about your card:
    http://smartcard-atr.appspot.com/parse?ATR=3B9F96801FC78031A073BE21136743200718000001A5

[DEBUG] GPSession - Auto-detected ISD: A000000003000000

But cannot --acr-list-aram

alice@epc01:~/CoIMS_Wiki$ /usr/lib/jvm/java-9-openjdk-amd64/bin/java -jar old-gp.jar --key-enc 317C18BCF0280843523E28F2E8B51359 --key-mac B425A29FECD06BAC830FBB9769E50228 --key-dek 1A608E60F78F52DC56E203130A1BDE51 --acr-list-aram -v
GlobalPlatformPro 19.06.16-0-gbaccf34
Running on Linux 4.15.0-112-lowlatency amd64, Java 9-internal by Oracle Corporation
Reader: Alcor Micro AU9560 00 00
ATR: 3B9F96801FC78031A073BE21136743200718000001A5
More information about your card:
    http://smartcard-atr.appspot.com/parse?ATR=3B9F96801FC78031A073BE21136743200718000001A5

[DEBUG] GPSession - Auto-detected ISD: A000000003000000
Could not read A00000015141434C00

I will contact with Sysmocom in a few hours.

herlesupreeth commented 4 years ago

@miaoski Can you try with some other card reader (like Gemalto)?

herlesupreeth commented 4 years ago

@miaoski can you please update here what the issue was and what response you got from sysmocom so that it could help others facing similar issue?

miaoski commented 4 years ago

@herlesupreeth , sorry for the delay. I've been busy with other things recently. Please hold on. I'm asking around.

miaoski commented 4 years ago

Per the discussion with Laf0rge in #osmocom, he thought someone needs to work on a tool that uses OTA / GSM 03.48 instead of SCP02. I've Google'd a bit, and I'm quite confused, e.g., https://github.com/thomascannon/sim-ota-updates is using a smart card reader to send OTA message?

If you know more tools on OTA, I'm willing to test them. Thank you!

herlesupreeth commented 4 years ago

alright..then I will soon push the changes I have to use OTA method to install and update ARA-M and let you know

laf0rge commented 4 years ago

Of course you can send OTA messages from a smart card reader. This is what shadytel uses, for example. The APDUs are encrypted/signed and then wrapped in SMS with User Data Header, which finally is wrapped into ENVELOPE APDUs. Basically the smart card reader is emulating what a phone is doing when receiving SMS for the SIM.

There are security related tools like https://opensource.srlabs.de/projects/simtester that use the same mechanism.

What's needed is some proper command line tool that exports all/most of the OTA RAM (Remote Applet Management) + RFM (Remote File Management) capabilities and which then uses the ENVELOPE-wrapped-SMS-wrapped-OTA-APDU transport mechanism to talk to the card.

herlesupreeth commented 4 years ago

@miaoski I have updated the README with OTA+RFM method of installing the applet + adding the certificate, let me know if that fixes this issue

laf0rge commented 4 years ago

I am seeing the same problem on another type of SIM (upcoming sysmoISIM-SJA2). My guess is that somehow the applet is not marked as "SELECTABLE" and hence the instruction A4 (SELECT) fails. I removed and re-installed the applet. gp.jar uses "INSTALL for install and make selectable" according to it source code. I have the feeling that the applet maybe is missing some property/attribute that it can actually be selected?

laf0rge commented 4 years ago

Nevermind, it actually is marked as selectable:

APP: A00000015141434C00 (SELECTABLE) (|....QACL.|) Privs:

herlesupreeth commented 4 years ago

@laf0rge for the sysmoISIM-SJA2 dont use the pysim which is inside shadysim folder. Dieter gave me an older pysim and shadyisim python script to use, i have shared with in email, please use that

laf0rge commented 4 years ago

Actually, I think it is a bug in GlobalPlatformPro.

GlobalPlatformPro v20.01.23-0-g5ad373b
Running on Linux 5.7.0-2-amd64 amd64, Java 1.8.0_265 by Debian
# Detected readers from JNA2PCSC
[*] Alcor Micro AU9560 00 00
SCardConnect("Alcor Micro AU9560 00 00", T=*) -> T=0, 3B9F96801F878031E073FE211B674A4C753034054BA9
SCardBeginTransaction("Alcor Micro AU9560 00 00")
A>> T=0 (4+0000) 00A40400 00 
A<< (0018+2) (7ms) 6F108408A000000003000000A5049F6501FF 9000
[TRACE] GPSession -  [6F]
[TRACE] GPSession -      [84] A000000003000000
[TRACE] GPSession -      [A5]
[TRACE] GPSession -          [9F65] FF
[DEBUG] GPSession - Auto-detected ISD: A000000003000000
A>> T=0 (4+0009) 00A40400 09 A00000015141434C00 00
A<< (0000+2) (7ms) 6E00
Could not read A00000015141434C00

Specifically

A>> T=0 (4+0009) 00A40400 09 A00000015141434C00 00

00 = class a4 = select 04 = select by name (GlobalPlatform Spec 2.2.1 Section 11.9.2.1) 00 = first or only occurrence 09 = length A00000015141434C00 = AID

but then there is this extra '00' at the end. If you remove it when issuing the APDU manually, the APDU succeeds.

laf0rge commented 4 years ago

I'm not a java developer and I'm running out of time, but I'm convinced it's a bug in GlobalPlatformPro. I'll stop my analsis here.

laf0rge commented 4 years ago

Manually executing the SELET and the GET DATA for the ARA-M works from a shell:

(ISO 7816-4) > 00A40400 09 A00000015141434C00
--------------------------------------------------------------------------------
Beginning transaction 6
>> 0000:  00 a4 04 00 09 a0 00 00 01 51 41 43 4c 00         .........QACL.  
<< 0000:  90 00                                             ..              
Ending transaction 6
--------------------------------------------------------------------------------
Normal execution (SW 9000), 0.00539s

(ISO 7816-4) > 80CAFF4034
--------------------------------------------------------------------------------
Beginning transaction 9
>> 0000:  80 ca ff 40 34                                    ...@4           
<< 0000:  ff 40 31 e2 2f e1 1e 4f 06 ff ff ff ff ff ff c1   .@1./..O........
   0010:  14 e4 68 72 f2 8b 35 0b 7e 1f 14 0d e5 35 c2 a8   ..hr..5.~....5..
   0020:  d5 80 4f 0b e3 e3 0d d0 01 01 db 08 00 00 00 00   ..O.............
   0030:  00 00 00 01 90 00                                 ......          
Ending transaction 9
--------------------------------------------------------------------------------

0000:  ff 40 31 e2 2f e1 1e 4f 06 ff ff ff ff ff ff c1   .@1./..O........
0010:  14 e4 68 72 f2 8b 35 0b 7e 1f 14 0d e5 35 c2 a8   ..hr..5.~....5..
0020:  d5 80 4f 0b e3 e3 0d d0 01 01 db 08 00 00 00 00   ..O.............
0030:  00 00 00 01                                       ....            
Normal execution (SW 9000), 0.007s

In the hexdump you can find the encoded access rules

herlesupreeth commented 4 years ago

Can you please install the applet attached and give it a try? It looks like a mistake from my side, i didnt notice the extra 00

applet.zip

herlesupreeth commented 4 years ago

Nevermind, its a bug in GP, its appending the extra 00

miaoski commented 4 years ago

Many thanks to @laf0rge & @herlesupreeth . I tried to install the applet with the latest GP (20.08.12). Interestingly, GP has removed --acr-list-aram and --acr-list, but I can use the old version (19.06.16-8) to dump the rules.

$ /usr/lib/jvm/java-9-openjdk-amd64/bin/java -jar gp-20.08.12.jar --install applet.cap 
Warning: no keys given, defaulting to 404142434445464748494A4B4C4D4E4F
CAP loaded

alice@epc01:~/CoIMS_Wiki$ /usr/lib/jvm/java-9-openjdk-amd64/bin/java -jar gp-20.08.12.jar  -a 00A4040009A00000015141434C0000 -a 80E2900033F031E22FE11E4F06FFFFFFFFFFFFC114E46872F28B350B7E1F140DE535C2A8D5804F0BE3E30DD00101DB080000000000000001

alice@epc01:~/CoIMS_Wiki$ /usr/lib/jvm/java-9-openjdk-amd64/bin/java -jar gp-19.06.16-8.jar --acr-list-aram
[WARN] GPSession - No FCI returned to SELECT
RULE #0 :
       AID  : FFFFFFFFFFFF
       HASH : E46872F28B350B7E1F140DE535C2A8D5804F0BE3
       APDU rule   : ALWAYS(0x01)

Looks good, and I have checked the carrier privilege on Xiaomi 9 Pro. It's working. Thanks again!

miaoski commented 4 years ago

The extra 00 is still there. I guess the bug is somewhere else and not on SJS1-4FF SIM cards.

herlesupreeth commented 4 years ago

@miaoski So do you think it makes sense to use the older GP tool (19.06.16-8)?

miaoski commented 4 years ago

@herlesupreeth , yes, TBH the applet was installed and carrier priv is granted. It is in fact not an issue of SJS1-4FF cards nor an issue of CoIMS.

Let me recap @laf0rge 's experiment:

alice@epc01:~/CoIMS_Wiki$ /usr/lib/jvm/java-9-openjdk-amd64/bin/java -jar gp-19.06.16-8.jar --acr-list-aram -v -d
GlobalPlatformPro 19.06.16-8-g9639eb9
Running on Linux 4.15.0-112-lowlatency amd64, Java 9-internal by Oracle Corporation
# Detected readers from JNA2PCSC
[*] HID Global OMNIKEY 3x21 Smart Card Reader [OMNIKEY 3x21 Smart Card Reader] (KJ0I4101SK12783111) 00 00
SCardConnect("HID Global OMNIKEY 3x21 Smart Card Reader [OMNIKEY 3x21 Smart Card Reader] (KJ0I4101SK12783111) 00 00", T=*) -> T=0, 3B9F96801FC78031A073BE21136743200718000001A5
SCardBeginTransaction("HID Global OMNIKEY 3x21 Smart Card Reader [OMNIKEY 3x21 Smart Card Reader] (KJ0I4101SK12783111) 00 00")
Reader: HID Global OMNIKEY 3x21 Smart Card Reader [OMNIKEY 3x21 Smart Card Reader] (KJ0I4101SK12783111) 00 00
ATR: 3B9F96801FC78031A073BE21136743200718000001A5
More information about your card:
    http://smartcard-atr.appspot.com/parse?ATR=3B9F96801FC78031A073BE21136743200718000001A5

A>> T=0 (4+0000) 00A40400 00 
A<< (0071+2) (189ms) 6F458408A000000003000000A539732F06072A864886FC6B01600C060A2A864886FC6B02020101630906072A864886FC6B03640B06092A864886FC6B0402159F6E01079F6501FE 9000
[TRACE] GPSession -  [6F]
[TRACE] GPSession -      [84] A000000003000000
[TRACE] GPSession -      [A5]
[TRACE] GPSession -          [73]
[TRACE] GPSession -              [06] 2A864886FC6B01
[TRACE] GPSession -              [60]
[TRACE] GPSession -                  [06] 2A864886FC6B02020101
[TRACE] GPSession -              [63]
[TRACE] GPSession -                  [06] 2A864886FC6B03
[TRACE] GPSession -              [64]
[TRACE] GPSession -                  [06] 2A864886FC6B040215
[TRACE] GPSession -          [9F6E] 07
[TRACE] GPSession -          [9F65] FE
[DEBUG] GPSession - Auto-detected ISD: A000000003000000
A>> T=0 (4+0009) 00A40400 09 A00000015141434C00 00
A<< (0000+2) (56ms) 9000
[WARN] GPSession - No FCI returned to SELECT
A>> T=0 (4+0000) 80CAFF40 00 
A<< (0052+2) (44ms) FF4031E22FE11E4F06FFFFFFFFFFFFC114E46872F28B350B7E1F140DE535C2A8D5804F0BE3E30DD00101DB080000000000000001 9000
RULE #0 :
       AID  : FFFFFFFFFFFF
       HASH : E46872F28B350B7E1F140DE535C2A8D5804F0BE3
       APDU rule   : ALWAYS(0x01)
SCardEndTransaction("HID Global OMNIKEY 3x21 Smart Card Reader [OMNIKEY 3x21 Smart Card Reader] (KJ0I4101SK12783111) 00 00")

Without that 00, the command succeeded.

alice@epc01:~/CoIMS_Wiki$ /usr/lib/jvm/java-9-openjdk-amd64/bin/java -jar gp-19.06.16-8.jar -v -d -a 00A4040009A00000015141434C00
GlobalPlatformPro 19.06.16-8-g9639eb9
Running on Linux 4.15.0-112-lowlatency amd64, Java 9-internal by Oracle Corporation
# Detected readers from JNA2PCSC
[*] HID Global OMNIKEY 3x21 Smart Card Reader [OMNIKEY 3x21 Smart Card Reader] (KJ0I4101SK12783111) 00 00
SCardConnect("HID Global OMNIKEY 3x21 Smart Card Reader [OMNIKEY 3x21 Smart Card Reader] (KJ0I4101SK12783111) 00 00", T=*) -> T=0, 3B9F96801FC78031A073BE21136743200718000001A5
SCardBeginTransaction("HID Global OMNIKEY 3x21 Smart Card Reader [OMNIKEY 3x21 Smart Card Reader] (KJ0I4101SK12783111) 00 00")
Reader: HID Global OMNIKEY 3x21 Smart Card Reader [OMNIKEY 3x21 Smart Card Reader] (KJ0I4101SK12783111) 00 00
ATR: 3B9F96801FC78031A073BE21136743200718000001A5
More information about your card:
    http://smartcard-atr.appspot.com/parse?ATR=3B9F96801FC78031A073BE21136743200718000001A5

A>> T=0 (4+0009) 00A40400 09 A00000015141434C00
A<< (0000+2) (172ms) 9000
A>> T=0 (4+0000) 00A40400 00 
A<< (0071+2) (84ms) 6F458408A000000003000000A539732F06072A864886FC6B01600C060A2A864886FC6B02020101630906072A864886FC6B03640B06092A864886FC6B0402159F6E01079F6501FE 9000
[TRACE] GPSession -  [6F]
[TRACE] GPSession -      [84] A000000003000000
[TRACE] GPSession -      [A5]
[TRACE] GPSession -          [73]
[TRACE] GPSession -              [06] 2A864886FC6B01
[TRACE] GPSession -              [60]
[TRACE] GPSession -                  [06] 2A864886FC6B02020101
[TRACE] GPSession -              [63]
[TRACE] GPSession -                  [06] 2A864886FC6B03
[TRACE] GPSession -              [64]
[TRACE] GPSession -                  [06] 2A864886FC6B040215
[TRACE] GPSession -          [9F6E] 07
[TRACE] GPSession -          [9F65] FE
[DEBUG] GPSession - Auto-detected ISD: A000000003000000
SCardEndTransaction("HID Global OMNIKEY 3x21 Smart Card Reader [OMNIKEY 3x21 Smart Card Reader] (KJ0I4101SK12783111) 00 00")
SCardDisconnect("HID Global OMNIKEY 3x21 Smart Card Reader [OMNIKEY 3x21 Smart Card Reader] (KJ0I4101SK12783111) 00 00", true) tx:19/rx:75

Since --acr-list-aram was removed from GP 20.08.12, I can't even submit a pull request. :)

miaoski commented 4 years ago

But for a mysterious reason (if you really want to dig in), the command with the extra 00 succeeded today:

A>> T=0 (4+0009) 00A40400 09 A00000015141434C00 00
A<< (0000+2) (56ms) 9000
herlesupreeth commented 4 years ago

thanks a lot for the feedback, I have removed the commit which updated the GP tool to 20.08.12

miaoski commented 4 years ago

acr options were moved to "a separate utility". Maybe it's not made public yet.

commit e41c8e9e54eb59ae190ea0525228e865b10f017d
Author: Martin Paljak <martin@martinpaljak.net>
Date:   Wed Jun 17 14:34:07 2020 +0300

    Extract SEAC into a separate utility.

    Available from https://github.com/martinpaljak/seac
herlesupreeth commented 4 years ago

Ah i see. Good to know