RebelSIM » History » Revision 4
Revision 3 (laforge, 02/19/2016 10:49 PM) → Revision 4/6 (laforge, 02/21/2016 10:19 AM)
{{>toc}}
h1. [[RebelSIM]] Card
The [[RebelSIM]] card is a type of _Proxy SIM_ that can be put between the SIM card reader and the actual SIM card
The proxy is able to manipulate any message from the phone to the card or vice versa, as the SIM Card protocol (TS 11.11)
is not encrypted or authenticated.
The [[RebelSIM]] is typically used for SIM unlocking phones. However, as it is a general proxy SIM, it can be used for
any purpose, e.g. for filtering any STK commands between SIM and ME (to fully SIM toolkit)
[[RebelSIM]] comes in multiple flavors.
h2. [[RebelSIMCard]]
This model has not been analyzed yet.
h2. [[RebelSIMCard]] II
!rebelsim2.jpg!
[[Image(rebelsim2.jpg)]]
The [[RebelSIMCard]] II contains a "C8051F300":http://www.silabs.com/Support%20Documents/TechnicalDocs/C8051F300_Short.pdf microcontroller
with 8kBytes of Flash and 256 Bytes internal RAM. It runs at about 24 MHz internal clock rate.
h3. Wiring
The two SIM card interfaces are wired with the F300 controller the following way:
||F300 pin||SIM/socket||signal||
||P0.0||socket||I/O||
||P0.1||SIM||RESET||
||VDD||SIM/socket||Vcc||
||P0.2||NC||
||P0.3||SIM/socket||CLK||
||P0.7/C2D||testpad||
||P0.6||NC||
||C2CK/nRST||socket||RESET||
||C2CK/nRST||testpad||
||P0.5||SIM||I/O||
||P0.4||NC||
h3. Programming
The F300 controller can be programmed using a two-wire protocol known as C2.
However, the C2 programming pins are not wired to the SIM Card itself but only to test pads.
It is suggested that the official [[RebelSIM]] firmware images probably contain some alternate
(but unknown) means of flashing via the actual SIM card interface.
It is not known if any of the LOCK bits have been set on the card. Nobody has yet tried
to re-program it with custom firmware.
h3. Development
The SDCC compiler claims to support the F300.
