Project

General

Profile

SIMtrace » History » Version 54

gnutoo, 03/09/2018 04:09 PM
Import TODO items from the mailing list "New hardware support or replacement proposal" thread

1 41 tsaitgaist
{{>toc}}
2 1 laforge
3 41 tsaitgaist
h1. Osmocom SIMtrace
4 41 tsaitgaist
5 41 tsaitgaist
6 1 laforge
Osmocom SIMtrace is a software and hardware system for passively tracing SIM-ME communication between the SIM card and the mobile phone.
7 1 laforge
8 18 laforge
It looks a bit like this:
9 42 laforge
{{graphviz_link()
10 18 laforge
digraph G{
11 18 laforge
  //rankdir = LR;
12 18 laforge
  Phone -> SIMtrace [label = "Flexi-PCB cable"];
13 1 laforge
  SIMtrace -> SIM;
14 18 laforge
  SIMtrace -> PC [label = "USB cable"];
15 1 laforge
16 1 laforge
  SIMtrace [ label = "SIMtrace hardware" ];
17 18 laforge
}
18 42 laforge
}}
19 18 laforge
20 29 laforge
When connected to a phone, it looks like this:
21 29 laforge
22 1 laforge
23 43 laforge
!{width:50%}simtrace_and_phone.jpg!
24 43 laforge
25 43 laforge
!{width:33%}simtrace_functions.png!
26 1 laforge
27 1 laforge
It works by utilizing the T=0 capable USART of the USB-attached AT91SAM7 microcontroller.
28 1 laforge
29 46 zecke
The USART passively receives the bytes as they are exchanged on the ISO 7816-3 / TS 11.11 interface between SIM and phone. The received bytes are sent via USB to the PC, where a program called simtrace on the PC gathers data from the USB device, parses the APDUs and forwards them via GSMTAP to the wireshark protocol analyzer.
30 38 tsaitgaist
31 1 laforge
32 41 tsaitgaist
h2. Features
33 1 laforge
34 1 laforge
35 41 tsaitgaist
* Completely passive scanner
36 41 tsaitgaist
* RST and ATR detection
37 41 tsaitgaist
* Auto-bauding with PPS / PTS support
38 41 tsaitgaist
* Segmentation of APDUs
39 41 tsaitgaist
40 41 tsaitgaist
41 38 tsaitgaist
SIMtrace can be used to monitor the ME-SIM communication, but also emulate a phone or SIM, or be MitM.
42 38 tsaitgaist
While the hardware supports all these modes, only the monitoring aspect has been implemented in software.
43 1 laforge
44 41 tsaitgaist
h2. TODO
45 1 laforge
46 53 gnutoo
SIMtrace is a community project, and help is more than welcome.
47 1 laforge
48 54 gnutoo
Some tasks do and require no knowledge of electronics or SIM cards protocols, and only require very basic C programming skills:
49 54 gnutoo
* Use libusb hot-plugging API to keep the program running across SIMrtace disconnects
50 54 gnutoo
51 54 gnutoo
Here's some of the other things that could be improved:
52 41 tsaitgaist
* Check for parity errors
53 41 tsaitgaist
* Verify TCK / PCK check-bytes
54 1 laforge
* Implement MITM
55 54 gnutoo
56 1 laforge
57 41 tsaitgaist
h2. Hardware
58 41 tsaitgaist
59 41 tsaitgaist
The first implementations used an Olimex SAM7-P64 development board with some of the I/O lines hooked up to the mechanical SIM card adapters from [[RebelSIM_Scanner]]. If the [[RebelSIM]] scanner is used, connect the USB even if just the lines are used. It needs to be powered, else the real reader will often fail to initialize the card.
60 41 tsaitgaist
61 31 laforge
Now we have a dedicated PCB design.  The schematics and Gerber files are released as open source hardware and can be produced by everyone.
62 1 laforge
63 1 laforge
However, those of you who are not interested in building it from scratch can buy a complete factory-produced, tested and flashed PCB assembly from http://shop.sysmocom.de/products/simtrace
64 51 gnutoo
65 52 gnutoo
It could also be interfaced with full size SIM card "with a separate adapter":http://shop.sysmocom.de/products/fullsize-sim-fpc
66 1 laforge
67 47 laforge
More details are available at [[SIMtrace_Hardware]]
68 1 laforge
69 41 tsaitgaist
h2. Firmware
70 1 laforge
71 1 laforge
72 41 tsaitgaist
The firmware for the AT91SAM7S device was written by reusing a lot of the code for the "OpenPCD":http://www.openpcd.org/
73 48 laforge
RFID reader.  Details are available at [[SIMtrace Firmware]].
74 41 tsaitgaist
75 41 tsaitgaist
h2. Documentation
76 41 tsaitgaist
77 41 tsaitgaist
78 1 laforge
Please check the attachments for a usermanual. In there you will find some hints to install ready made packages for
79 1 laforge
your favorite Linux Distribution.
80 39 zecke2
81 1 laforge
82 1 laforge
h2. Host PC Software
83 41 tsaitgaist
84 41 tsaitgaist
85 46 zecke
The simtrace program is part of the ​git://git.osmocom.org/simtrace.git repository. It will bind to the USB device and send GSMTAP frames using UDP/IPv4 to localhost:4729.
86 5 laforge
87 41 tsaitgaist
h3. Preconditions
88 14 tsaitgaist
89 1 laforge
90 49 laforge
[[libosmocore:]] and headers (simtrace_usb.h) from the firmware.
91 41 tsaitgaist
92 1 laforge
additional packages :
93 41 tsaitgaist
<pre>
94 14 tsaitgaist
sudo apt-get install libusb-1.0-0-dev
95 1 laforge
</code></pre>
96 7 tsaitgaist
97 41 tsaitgaist
h3. Compiling it
98 41 tsaitgaist
99 41 tsaitgaist
100 41 tsaitgaist
<pre>
101 35 tsaitgaist
git clone git://git.osmocom.org/simtrace.git
102 35 tsaitgaist
cd simtrace/host/
103 35 tsaitgaist
make
104 41 tsaitgaist
</code></pre>
105 35 tsaitgaist
106 35 tsaitgaist
107 41 tsaitgaist
h3. Accessing it
108 41 tsaitgaist
109 41 tsaitgaist
110 35 tsaitgaist
Add udev rules so to be able to use simtrace and access the device as non-root user (only need to be in the osmocom group)
111 35 tsaitgaist
112 41 tsaitgaist
<pre>
113 6 tsaitgaist
sudo groupadd osmocom
114 6 tsaitgaist
sudo adduser $USERNAME osmocom
115 1 laforge
sudo tee /etc/udev/rules.d/10-osmocom.rules << EOF
116 1 laforge
# to use, install this file in /etc/udev/rules.d as 10-osmocom.rules
117 6 tsaitgaist
# rule to grant read/write access on SIMtrace to group named osmocom.
118 1 laforge
SUBSYSTEM=="usb", ATTR{idProduct}=="0762", ATTRS{idVendor}=="16c0", MODE="0660", GROUP="osmocom"
119 1 laforge
EOF
120 1 laforge
sudo service udev reload
121 41 tsaitgaist
</code></pre>
122 1 laforge
123 1 laforge
you must log out and back in so to take effect.
124 13 tsaitgaist
125 1 laforge
126 41 tsaitgaist
h3. Using it
127 41 tsaitgaist
128 41 tsaitgaist
129 41 tsaitgaist
Simply start *simtrace*.
130 1 laforge
It will send the GSMTAP frames to UDP/IPv4 localhost:4729.
131 1 laforge
132 1 laforge
It will also print hexdumps of the frames to the console, looking like this:
133 41 tsaitgaist
<pre>
134 1 laforge
sudo ./simtrace
135 1 laforge
APDU: (9):  a0 a4 00 00 02 6f 07 9f 0f
136 1 laforge
APDU: (22):  a0 c0 00 00 0f 00 00 00 09 6f 07 04 00 15 00 15 01 02 00 00 91 78
137 1 laforge
APDU: (9):  a0 a4 00 00 02 6f 38 9f 0f
138 1 laforge
APDU: (22):  a0 c0 00 00 0f 00 00 00 09 6f 38 04 00 15 00 55 01 02 00 00 91 78
139 1 laforge
APDU: (16):  a0 b0 00 00 09 ff 3f ff ff 00 00 3f 03 00 91 78
140 1 laforge
APDU: (9):  a0 a4 00 00 02 6f ad 9f 0f
141 1 laforge
APDU: (8):  a0 b0 00 00 01 00 91 78
142 1 laforge
APDU: (9):  a0 a4 00 00 02 6f 07 9f 0f
143 1 laforge
APDU: (16):  a0 b0 00 00 09 08 49 06 20 11 49 00 11 06 91 78
144 1 laforge
APDU: (9):  a0 a4 00 00 02 6f 7e 9f 0f
145 1 laforge
APDU: (18):  a0 b0 00 00 0b ff ff ff ff 64 f0 00 ff fe 00 03 91 78
146 1 laforge
APDU: (9):  a0 a4 00 00 02 6f 78 9f 0f
147 2 laforge
APDU: (9):  a0 b0 00 00 02 00 01 91 78
148 2 laforge
APDU: (9):  a0 a4 00 00 02 6f 74 9f 0f
149 2 laforge
APDU: (23):  a0 b0 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 91 78
150 2 laforge
APDU: (9):  a0 a4 00 00 02 6f 20 9f 0f
151 1 laforge
APDU: (16):  a0 b0 00 00 09 ff ff ff ff ff ff ff ff 07 91 78
152 1 laforge
APDU: (9):  a0 a4 00 00 02 6f 30 9f 0f
153 1 laforge
APDU: (22):  a0 c0 00 00 0f 00 00 00 f0 6f 30 04 00 11 00 55 01 02 00 00 91 78
154 41 tsaitgaist
</code></pre>
155 1 laforge
156 41 tsaitgaist
h2. Wireshark integration
157 34 tsaitgaist
158 41 tsaitgaist
159 41 tsaitgaist
There is an experimental patch, also part of the simtrace.git package.  It is also included in the [[wireshark]] developer version (since wireshark 1.7.1).
160 41 tsaitgaist
161 34 tsaitgaist
To see the APDUs in wireshark:
162 41 tsaitgaist
* on localhost SIMtrace automatically opens a UDP sink locally, no need to do any anything
163 41 tsaitgaist
* to get the data on another machine
164 41 tsaitgaist
** start an UDP sink for GSMTAP on the other machine (do not use netcat as it "connects" back)
165 41 tsaitgaist
<pre>
166 37 tsaitgaist
socat -u udp-recv:4729 /dev/null
167 41 tsaitgaist
</code></pre>
168 41 tsaitgaist
** tell SIMtrace on which machine to forward
169 41 tsaitgaist
<pre>
170 1 laforge
./simtrace -i 192.168.0.1
171 41 tsaitgaist
</code></pre>
172 1 laforge
173 44 laforge
!wireshark-sim.png!
174 31 laforge
175 31 laforge
Protocol parsing is far from being complete, patches are always welcome!
176 31 laforge
177 50 gnutoo
h2. Other software
178 50 gnutoo
179 50 gnutoo
* "simlabTrace":https://github.com/kamwar/simlabTrace/wiki seem to be capable of MITM and also seem to have a CCID driver to use SIMtrace as a card reader.
180 50 gnutoo
181 41 tsaitgaist
h2. Contact / Mailing List
182 41 tsaitgaist
183 41 tsaitgaist
184 1 laforge
For any development or usage related questions, there is a mailinglist [mailto:simtrace@lists.osmocom.org], you can subscribe/unsubscribe to it at http://lists.osmocom.org/mailman/listinfo/simtrace and read the archives at http://lists.osmocom.org/pipermail/simtrace/
185 1 laforge
186 45 laforge
Please make sure you read the [[cellular-infrastructure:MailingListRules]] before you start posting.
Add picture from clipboard (Maximum size: 48.8 MB)