catarrh/simple
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: use the card's own SimCardCommands for ADM and AUTHENTICATE (v2.7.20)

Browse Source 
/api/verify-adm sent VERIFY with CLA A0 on a UICC (SW 6E00) while
pySim-shell's verify_adm worked: fast init builds the card on its own
SimCardCommands instance, but __main__ kept server.scc at the startup
placeholder left at the SIM defaults; only an equip repointed it.

- __main__ adopts card._scc after init (cat_cla still set on it), so
  server.scc carries the card's cla_byte/sel_ctrl from startup on.
- _verify_adm prefers app.rs.lchan[0].scc / app.card._scc, exactly like
  pySim-shell's verify_adm, independent of server.scc.
- netsim AUTHENTICATE follows the card class: a UICC gets 00 88 00 81 22
  (RAND+AUTN, DB/DC response), a SIM gets A0 88 00 00 10 (RAND only,
  SRES+Kc); the 61xx GET RESPONSE uses the same CLA.
- tests: ADM with a stale placeholder scc; 2G builder/parser; SIM-CLA
  runner case; help EN/RU and AGENTS updated.
This commit is contained in:
Антон Трошин
2026-09-21 22:13:52 +03:00
parent 0446d2a93c
commit f8ba5dea2c
10 changed files with 92 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/help.html
+1 -1
View File
@@ -487,7 +487,7 @@
<li><strong>Churn</strong> — replay real → invalid EPSNSC records back-to-back (count and delay configurable).</li>
<li><strong>SMS received</strong> — bump the EF.SMSstatus counter (read-modify-write) and optionally rewrite the location files.</li>
<li><strong>CB reconfig</strong> — write the CBMI/CBMIR message-ID lists or clear them (all FF).</li>
<li><strong>AUTHENTICATE</strong> — send AUTHENTICATE (3G/EPS/5G, <code class="font-mono text-sm">00 88 00 81 22</code>) with the given or random RAND/AUTN and show the response (success <code class="font-mono text-sm">DB</code> or synchronisation failure <code class="font-mono text-sm">DC</code> with AUTS).</li>
<li><strong>AUTHENTICATE</strong> — send AUTHENTICATE with the given or random RAND/AUTN and show the response. The command follows the card class: a UICC gets the 3G/EPS/5G form (<code class="font-mono text-sm">00 88 00 81 22</code>, response <code class="font-mono text-sm">DB</code> success or <code class="font-mono text-sm">DC</code> synchronisation failure with AUTS), a SIM the 2G form (<code class="font-mono text-sm">A0 88 00 00 10</code>, RAND only, response SRES + Kc).</li>
</ul>
<p class="text-sm mb-3"><strong>Parameters</strong> (collapsed) provide the operator (searchable worldwide MCC/MNC list served from the server, plus a random roaming picker and a <strong>Home network</strong> button that fills the card&rsquo;s HPLMN from EF.HPLMNwAcT&rsquo;s first record, falling back to the IMSI), LAC/Cell ID/TAC/RAC, optional identity values (empty = random: TMSI, GUTI, KSI, KASME, Kc, NAS counts, algorithm, RAND/AUTN), the scenario toggles (including <strong>Rejection: write FPLMN</strong>) and the churn count/delay. The step log lists every write, ENVELOPE and AUTHENTICATE with its SW. Only UPDATE BINARY/RECORD, ENVELOPE and AUTHENTICATE are sent — FPLMN is appended only by the permanent rejection scenario (TS 31.102 §4.2.16, never duplicated) and an attach to a listed PLMN clears its entry first (successful manual selection, TS 23.122), and the 5GS location files are never written; the writes change the card and are visible to later snapshot comparisons.</p>