search

kamwar / simLAB

Smartcard editor and SIM/SAT simulator
GNU General Public License v2.0
89 stars 29 forks source link

Support for 2G SIMs? #2

Open 0ff opened 7 years ago

0ff commented 7 years ago

Hey there,

first let me start by saying thank you for sharing your work! simLAB looks really quite impressive and I'd love to get it working to emulate a 2G SIM (I have simtrace hw handy).

Unfortunately, I cannot get 2G SIMs to work with the mim_live.py, even though I've edited it to use the SIM instead of USIM type (also as parameter for SimCard()).

When starting, this will be displayed:

C-APDU0: A070000001
R-APDU0: 6D00
Incorrect SW: INVALID_INSTRUCTION_OR_NOT_SUPPORTED, expecting: NO_ERROR. SW1=UNKNOWN_INSTRUCTION_CODE
Failed to init logical channel for simId:0

C-APDU0: A070000001
R-APDU0: 6D00
Incorrect SW: INVALID_INSTRUCTION_OR_NOT_SUPPORTED, expecting: NO_ERROR. SW1=UNKNOWN_INSTRUCTION_CODE
Failed to init logical channel for simId:0

And I guess this is because it tries to open a channel (in sim_ctrl_2g.py) and for some reason this is just not supported on at least 3 SIMs I have (all 2G).

Also, note that some commands will work after that, such as ls:

ls:
status OK
data 7F10/,7F20/,2FE2

Can you tell me if this is in any way required, or if I can skip this and focus on getting backup to work?

Thanks in advance for any response!

Best, Fabian

bodziow commented 7 years ago

Hi Fabian,

Thank you for your interest in our work :)

You can try to disable INIT_CONTROL_CHANNEL for 2G here: https://github.com/kamwar/simLAB/blob/master/sim/sim_ctrl_2g.py#L19

BR, Szymon

kamwar commented 7 years ago

It might be the case that logical channels are not always supported by SIM. This is not mandatory feature and you should be able to successfully execute backup command even in this case.

Regards, Kamil

On 4 August 2017 at 09:26, bodziow notifications@github.com wrote:

Hi Fabian,

Thank you for your interest in our work :)

You can try to disable INIT_CONTROL_CHANNEL for 2G here: https://github.com/kamwar/simLAB/blob/master/sim/sim_ctrl_2g.py#L19

BR, Szymon

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/kamwar/simLAB/issues/2#issuecomment-320177811, or mute the thread https://github.com/notifications/unsubscribe-auth/AIdxPng2eKfkLnpoj9fCHTBT7ONgAfG6ks5sUseOgaJpZM4Os0DI .

0ff commented 7 years ago

Thank you both for your support! In fact, disabling INIT_CONTROL_CHANNEL does fix the error at startup, but it does not change anything about the runtime-error with backup:

Working: ls 
    $ python mim_no_simtrace.py 
    ============
    == simLAB ==
    == ver 1.1==
    ============

    ===SIM SHELL===

    />ls

    C-APDU0: A0A40000027F10
    R-APDU0: 9F17

    C-APDU0: A0A40000023F00
    R-APDU0: 9F17

    C-APDU0: A0A40000027F20
    R-APDU0: 9F17

    C-APDU0: A0A40000023F00
    R-APDU0: 9F17

    C-APDU0: A0A40000027F22
    R-APDU0: 9404

    C-APDU0: A0A40000027F23
    R-APDU0: 9404

    C-APDU0: A0A40000022FE2
    R-APDU0: 9F0F

    C-APDU0: A0A40000023F00
    R-APDU0: 9F17

    C-APDU0: A0A40000022F05
    R-APDU0: 9404

    ls:
    status OK
    data 7F10/,7F20/,2FE2

    />
Not working: backup 
    />backup

    C-APDU0: A0A40000027F20
    R-APDU0: 9F17

    C-APDU0: A0C0000017
    R-APDU0: 000000007F200200000000030A93010D0400838A838A009000

    C-APDU0: A0A40000026F07
    R-APDU0: 9F0F

    C-APDU0: A0C000000F
    R-APDU0: 000000096F070400140014010100009000

    C-APDU0: A0A40000026F07
    R-APDU0: 9F0F

    C-APDU0: A0C000000F
    R-APDU0: 000000096F070400140014010100009000

    C-APDU0: A0A40000023F00
    R-APDU0: 9F17

    C-APDU0: A0A40000027F20
    R-APDU0: 9F17

    C-APDU0: A0A40000026F07
    R-APDU0: 9F0F

    C-APDU0: A0C000000F
    R-APDU0: 000000096F070400140014010100009000

    C-APDU0: A0B0000009
    R-APDU0: 

    C-APDU0: A0A40000026F07
    R-APDU0: 9F0F

    C-APDU0: A0C000000F
    R-APDU0: 000000096F070400140014010100009000

    C-APDU0: A0B0000009
    R-APDU0: 

    readi:

    C-APDU0: A0A40000023F00
    R-APDU0: 9F17

    C-APDU0: A0C0000017
    R-APDU0: 0000419E3F000100000000030A9302080400838A838A009000

    C-APDU0: A0A40000027F10
    R-APDU0: 9F17
    Failed to select: 7F10

    C-APDU0: A0A40000027F20
    R-APDU0: 9F17
    Failed to select: 7F20

    C-APDU0: A0A40000027F22
    R-APDU0: 9404
    Failed to select: 7F22

    C-APDU0: A0A40000027F23
    R-APDU0: 9404
    Failed to select: 7F23

    C-APDU0: A0A40000022FE2
    R-APDU0: 9404
    Failed to select: 2FE2

    C-APDU0: A0A40000022F05
    R-APDU0: 9404
    Failed to select: 2F05

    backup:
    status OK
    data .../sim_backup_.xml

    /7F20/6F07/7F20>
Not working: backup with log_level 3 
    />backup

    C-APDU0: A0A40000027F20
    --> new channel 5e5ec097e30d42389330f24f0e47b574
    -x- closed channel 5e5ec097e30d42389330f24f0e47b574
    R-APDU0: 9F17
    --> new channel 5e5ec098e30d42389330f24f0e47b574
    -x- closed channel 5e5ec098e30d42389330f24f0e47b574

    C-APDU0: A0C0000017
    R-APDU0: 000000007F200200000000030A93010D0400838A838A009000

    C-APDU0: A0A40000026F07
    --> new channel 5e5ec099e30d42389330f24f0e47b574
    -x- closed channel 5e5ec099e30d42389330f24f0e47b574
    R-APDU0: 9F0F
    --> new channel 5e5ec09ae30d42389330f24f0e47b574
    -x- closed channel 5e5ec09ae30d42389330f24f0e47b574

    C-APDU0: A0C000000F
    R-APDU0: 000000096F070400140014010100009000

    C-APDU0: A0A40000026F07
    --> new channel 5e5ec09be30d42389330f24f0e47b574
    -x- closed channel 5e5ec09be30d42389330f24f0e47b574
    R-APDU0: 9F0F
    --> new channel 5e5ec09ce30d42389330f24f0e47b574
    -x- closed channel 5e5ec09ce30d42389330f24f0e47b574

    C-APDU0: A0C000000F
    R-APDU0: 000000096F070400140014010100009000

    C-APDU0: A0A40000023F00
    --> new channel 5e5ec09de30d42389330f24f0e47b574
    -x- closed channel 5e5ec09de30d42389330f24f0e47b574
    R-APDU0: 9F17
    --> new channel 5e5ec09ee30d42389330f24f0e47b574
    -x- closed channel 5e5ec09ee30d42389330f24f0e47b574

    C-APDU0: A0A40000027F20
    --> new channel 5e5ec09fe30d42389330f24f0e47b574
    -x- closed channel 5e5ec09fe30d42389330f24f0e47b574
    R-APDU0: 9F17
    --> new channel 5e5ec0a0e30d42389330f24f0e47b574
    -x- closed channel 5e5ec0a0e30d42389330f24f0e47b574

    C-APDU0: A0A40000026F07
    --> new channel 5e5ec0a1e30d42389330f24f0e47b574
    -x- closed channel 5e5ec0a1e30d42389330f24f0e47b574
    R-APDU0: 9F0F
    --> new channel 5e5ec0a2e30d42389330f24f0e47b574
    -x- closed channel 5e5ec0a2e30d42389330f24f0e47b574

    C-APDU0: A0C000000F
    R-APDU0: 000000096F070400140014010100009000

    C-APDU0: A0B0000009
    --> new channel 5e5ec0a3e30d42389330f24f0e47b574
    -x- closed channel 5e5ec0a3e30d42389330f24f0e47b574
    R-APDU0: 

    C-APDU0: A0A40000026F07
    --> new channel 5e5ec0a4e30d42389330f24f0e47b574
    -x- closed channel 5e5ec0a4e30d42389330f24f0e47b574
    R-APDU0: 9F0F
    --> new channel 5e5ec0a5e30d42389330f24f0e47b574
    -x- closed channel 5e5ec0a5e30d42389330f24f0e47b574

    C-APDU0: A0C000000F
    R-APDU0: 000000096F070400140014010100009000

    C-APDU0: A0B0000009
    --> new channel 5e5ec0a6e30d42389330f24f0e47b574
    -x- closed channel 5e5ec0a6e30d42389330f24f0e47b574
    R-APDU0: 

    readi:

    C-APDU0: A0A40000023F00
    --> new channel 5e5ec0a7e30d42389330f24f0e47b574
    -x- closed channel 5e5ec0a7e30d42389330f24f0e47b574
    R-APDU0: 9F17
    --> new channel 5e5ec0a8e30d42389330f24f0e47b574
    -x- closed channel 5e5ec0a8e30d42389330f24f0e47b574

    C-APDU0: A0C0000017
    R-APDU0: 0000419E3F000100000000030A9302080400838A838A009000

    C-APDU0: A0A40000027F10
    --> new channel 5e5ec0a9e30d42389330f24f0e47b574
    -x- closed channel 5e5ec0a9e30d42389330f24f0e47b574
    R-APDU0: 9F17
    --> new channel 5e5ec0aae30d42389330f24f0e47b574
    -x- closed channel 5e5ec0aae30d42389330f24f0e47b574
    Failed to select: 7F10

    C-APDU0: A0A40000027F20
    --> new channel 5e5ec0abe30d42389330f24f0e47b574
    -x- closed channel 5e5ec0abe30d42389330f24f0e47b574
    R-APDU0: 9F17
    --> new channel 5e5ec0ace30d42389330f24f0e47b574
    -x- closed channel 5e5ec0ace30d42389330f24f0e47b574
    Failed to select: 7F20

    C-APDU0: A0A40000027F22
    --> new channel 5e5ec0ade30d42389330f24f0e47b574
    -x- closed channel 5e5ec0ade30d42389330f24f0e47b574
    R-APDU0: 9404
    Incorrect SW1: 94, expecting: RESPONSE_DATA_AVAILABLE_2G. SW=GSM_FILE_NOT_FOUND
    Failed to select: 7F22

    C-APDU0: A0A40000027F23
    --> new channel 5e5ec0aee30d42389330f24f0e47b574
    -x- closed channel 5e5ec0aee30d42389330f24f0e47b574
    R-APDU0: 9404
    Incorrect SW1: 94, expecting: RESPONSE_DATA_AVAILABLE_2G. SW=GSM_FILE_NOT_FOUND
    Failed to select: 7F23

    C-APDU0: A0A40000022FE2
    --> new channel 5e5ec0afe30d42389330f24f0e47b574
    -x- closed channel 5e5ec0afe30d42389330f24f0e47b574
    R-APDU0: 9404
    Incorrect SW1: 94, expecting: RESPONSE_DATA_AVAILABLE_2G. SW=GSM_FILE_NOT_FOUND
    Failed to select: 2FE2

    C-APDU0: A0A40000022F05
    --> new channel 5e5ec0b0e30d42389330f24f0e47b574
    -x- closed channel 5e5ec0b0e30d42389330f24f0e47b574
    R-APDU0: 9404
    Incorrect SW1: 94, expecting: RESPONSE_DATA_AVAILABLE_2G. SW=GSM_FILE_NOT_FOUND
    Failed to select: 2F05

    backup:
    status OK
    data .../sim_backup_.xml

    /7F20/6F07/7F20>

I don't expect you to invest more time than needed into this, but I'd really appreciate if you had a pointer for me as to where I can look to find and fix that?

Thanks in advance, Fabian

PS: Also I've got simlabTrace up and running with the provided sample-sim, that does in fact seem to work OK even though the backup seems to be missing some EFs as well.

0ff commented 7 years ago

Okay so this is what I got: It seems that sim_shell.py is expecting RESPONSE_DATA_AVAILABLE_3G regardless of the type of the sim right here: https://github.com/kamwar/simLAB/blob/master/sim/sim_shell.py#L1547 This, for me, led to an error in backup because my 2G SIM would return RESPONSE_DATA_AVAILABLE_2G obviously.

But then I ran into the error here: https://github.com/kamwar/simLAB/blob/master/sim/sim_ctrl_2g.py#L507 which, after changing it to _2G again, caused some headaches. My SIM wouldn't accept APDU 00A40304 and would always return sw1: WRONG_INSTRUCTION_CLASS. When reading the specs I found that CLA 00 is not mandatory for GSM SIMs, so I implemented a new fallback to APDU A0A40304 which seems to work sometimes.

At least now I have a kind of backup. The xml only contains ~15 records when I know the SIM contains way more, but at least there's some kind of progress.

Thanks again for sharing your work! I'd like to submit some pull requests (wiki as well), would you be open to taking them?

kamwar commented 7 years ago

Sure, you are more than welcome to create a pull request.

Thanks, Kamil

On 5 August 2017 at 23:03, Fabian Off notifications@github.com wrote:

Okay so this is what I got: It seems that sim_shell.py is expecting RESPONSE_DATA_AVAILABLE_3G regardless of the type of the sim right here: https://github.com/kamwar/simLAB/blob/master/sim/sim_shell.py#L1547 This, for me, led to an error in backup because my 2G SIM would return RESPONSE_DATA_AVAILABLE_2G obviously.

But then I ran into the error here: https://github.com/kamwar/ simLAB/blob/master/sim/sim_ctrl_2g.py#L507 which, after changing it to _2G again, caused some headaches. My SIM wouldn't accept APDU 00A40304 and would always return sw1: WRONG_INSTRUCTION_CLASS. When reading the specs I found that CLA 00 is not mandatory for GSM SIMs, so I implemented a new fallback to APDU A0A40304 which seems to work sometimes.

At least now I have a kind of backup. The xml only contains ~15 records when I know the SIM contains way more, but at least there's some kind of progress.

Thanks again for sharing your work! I'd like to submit some pull requests (wiki as well), would you be open to taking them?

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/kamwar/simLAB/issues/2#issuecomment-320470292, or mute the thread https://github.com/notifications/unsubscribe-auth/AIdxPhOlORIowdpDzMUxAGMskFUkjbkVks5sVNiUgaJpZM4Os0DI .

E3V3A commented 6 years ago

@0ff Did you even get a chance to wrap up that PR? I don't see you having any fork, so just wondering what happened to your fixes?