Project

General

Profile

softSIM

softSIM is a collection of tools to play with the SIM applications (in the SIM card or elsewhere).

It uses bluetooth profile SIM Access Profile as abstraction layer to access the SIM (but no Bluetooth is required).

Possible use cases:

  • virtual SIM, simulated in software
  • remote SIM access, using PC/SC interface
  • remote SIM access, using a Bluetooth enabled phone as reader

Requirements

All the scripts are written in Ruby:

$ sudo apt-get install ruby

To use all tools, additional libraries and gems are required (you might want to use "sudo gem install" if you have ruby smartcard package loading problems):

$ sudo apt-get install rubygems ruby-dev libdbus-ruby pcscd ruby-serialport libpcsclite1 libpcsclite-dev libruby libxml-ruby
$ gem install --user-install smartcard

detailed information is in README.

Source code

$ git clone git://git.osmocom.org/softsim.git

Tools

General description

At the moment, the following tools are available:

  • demo_server.rb - (BT)SAP Server implementation. Can either talk to a PC/SC reader, or use a stored dump. Clients can connect either via UNIX socket, or using TCP/IP.
  • demo_client.rb - (BT)SAP Client demo. Can connect to our demo_server.rb either via UNIX socket, or using TCP/IP. Alternatively can connect to a regular phone (that does support this profile) using Bluetooth. Basically executes a sequence of common APDUs.
  • apdu_forward.rb - forwards APDUs from a UNIX socket to a (BT)SAP server using TCP/IP.

SIM copy

./demo_client.rb -t copy

This file can then be used by the SIMOS server to do softSIM.

There are limitations to the copy. Only the body of the files with access condition ALWAYS or CHV1 can be read, otherwise only the header is saved. Ki (the secret key used for authentication and encryption) can not be extracted (SIM cards can not be cloned). Only some A38 triplets are saved.

Copying a card takes > 5min. Sometimes the copy hangs (the APDU traffic is blocked).
I don't know the origin of this problem (smartcard gem, pcscd, reader, card, ???).
Just wait ~30s and it will continue.

Using with OsmocomBB

The mobile application implements (BT)SAP Client, so it can connect to a (BT)SAP Server and use its SIM card.

Configuration

By default, mobile is configured to use '/tmp/osmocom_sap' as UNIX socket address. This address can be changed in the VTY configuration:

ms 1
  ...
  sap-socket /tmp/osmocom_sap
  ...

You can also configure mobile to use (BT)SAP client as a SIM card interface at start-up:

ms 1
  ...
  sap-socket /tmp/osmocom_sap
  sim sap
  ...

Running (with PC/SC reader)

First of all, make sure your PC/SC reader is connected and recognised properly:

$ pcsc_scan
PC/SC device scanner
V 1.4.22 (c) 2001-2011, Ludovic Rousseau <ludovic.rousseau@free.fr>
Compiled with PC/SC lite version: 1.8.10
SCardEstablishContext: Service not available.

this means that pcscd service is not running, start if required:

# On old systems without systemd
$ sudo service pcscd start

# ... or with systemd
$ systemctl start pcscd.service

and try again:

$ pcsc_scan
PC/SC device scanner
V 1.4.22 (c) 2001-2011, Ludovic Rousseau <ludovic.rousseau@free.fr>
Compiled with PC/SC lite version: 1.8.10
Using reader plug'n play mechanism
Scanning present readers...
Waiting for the first reader...

this means that a reader is not recognised. You're on your own to solve this.

If your reader is recognized without any issues, e.g.:

$ pcsc_scan
PC/SC device scanner
V 1.4.22 (c) 2001-2011, Ludovic Rousseau <ludovic.rousseau@free.fr>
Compiled with PC/SC lite version: 1.8.10
Using reader plug'n play mechanism
Scanning present readers...
0: OmniKey AG CardMan 3021 00 00

Mon Jan 21 10:33:36 2019
Reader 0: OmniKey AG CardMan 3021 00 00
  Card state: Card removed,

then you're ready ;)

Start the (BT)SAP Server:

$ cd softsim/src/
$ ./demo_server.rb --type pcsc --socket unix --unix /tmp/osmocom_sap

Finally, start the mobile application. If it's configured to use (BT)SAP interface, SIM reading would start immediately.
Otherwise you need to enable (BT)SAP interface manually:

$ telnet 127.0.0.1 4247
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Welcome to the OsmocomBB VTY interface

OsmocomBB> en
OsmocomBB# sim sap 1

% (MS 1)
% Connecting to the SAP interface...

Bugs & more

Please contact the author if any bug is discovered.

Add picture from clipboard (Maximum size: 48.8 MB)