SIMple

Administrative session trigger (Push SMS)

Connection parameters ('84')

Security parameters ('85')

Retry policy ('86')

HTTP POST ('89', 8A=host,8B=agent,8C=URI)

Card presets Key version (keyset)

SPI1 (Security Parameter Indicator)

SPI2 (PoR settings)

KIc (Ciphering Key Identifier)

KID (MAC Key Identifier)

KIc Key (hex)

KID Key (hex)

TAR (3 bytes)

Counter (5 bytes)

Padding byte

APDU (hex)

Server URL

To access local card reader, you need pysim-simple-server running locally.

To connect, install pysim-simple-server: git clone https://github.com/anttro/simple.git and start it.
Refer to pysim-simple-server README files for details. Click Connect when pysim-simple-server is ready

STK menu

STATUS and Polling

| Polling

TERMINAL PROFILE

Events that the card monitors (SET UP EVENT LIST):

Network simulation

Replays the write patterns a real phone performs on network-condition changes (EPS attach, service loss, roaming denial, 2G fallback, SMS delivery, cell-broadcast reconfiguration, AUTHENTICATE). Only UPDATE BINARY/RECORD, ENVELOPE and AUTHENTICATE are sent; FPLMN is appended only by the permanent "PLMN not allowed" rejection (TS 31.102 4.2.16, never duplicated), an attach to a listed PLMN clears its entry first (successful manual selection, TS 23.122), and the 5GS location files are never touched.

Parameters

Operator search (country / brand / MCC-MNC)

MCC

MNC

Sets the PLMN written to LOCI/PSLOCI/EPSLOCI. Used by EPS attach, 2G attach and SMS received (real LAI/RAI/TAI; SMS only when its location rewrite is enabled), and by Cold boot, Service lost, Limited service and Roaming denied (the dummy LOCI/PSLOCI keep this PLMN, the EPSLOCI dummy wipes the TAI PLMN). Churn, CB reconfig and AUTHENTICATE don't use it.

LAC

Cell ID

TAC

RAC

Advanced identity (empty = random)

TMSI

GUTI

KSI

KASME

Algorithm

RAND

AUTN

Send Location status event (if subscribed) Dummy location files Invalidate EPSNSC Keep KASME (KSI 07 only) Write/invalidate Kc Rejection: write FPLMN SMS: rewrite location too CB: clear lists instead of writing IDs Churn count Delay ms

Network state

Last refresh:

Fetched proactive commands:

HTTP OTA listener

Mode

Host

Port

Script

PSK keys come from the card presets (Cards tab): the listener picks the key by the identity the card sends in the TLS handshake.

Options (applied at Start)

HTTP framing

Chunked body (Transfer-Encoding: chunked)

Chunk size (bytes, 0 = one TLS record)

Connection header

Compact headers (omit the optional space after ':') Send X-Admin-Next-URI (required to continue the session)

Unchecked = one-shot: per GP Am. B §4.4.2 the card executes the command, returns no response string and closes the session.

Script framing

Comprehension-required tags

Send X-Admin-Targeted-Application

Show link events (Channel status ENVELOPEs, TS 102 223 7.5.11)

Script results (R-APDUs)

HTTP OTA log

New script from

Scripts are stored locally in your browser and sent to the server when a listener starts.

Name	Kind	APDUs	Created

Card presets are stored on the server. JSON export/import buttons are below the card list; a preset carries one keyset per key version, each with its own counter.

SCP80 (GSM 03.48, ETSI TS 102 225)

ISD TAR

UICC RFM TAR

ADF RFM TAR

OTA keysets — one per key version, each with its own counter

KIc and KID must carry the same key version (their high nibble) in the range 01-0F — TS 102 225 A.2; each key version has its own counter on the card (Annex A.1).

SCP81 (HTTP OTA)

SCP81 HTTP OTA: the listener picks the key by the PSK identity the card sends in the TLS handshake. Cards without a PSK are ignored by the listener.

Name	ICCID	Keysets (key version: KIc/KID \u2014 counter)	SPI1	SPI2	TAR (ISD/UICC RFM/ADF RFM)	SCP81

SIMple

Administrative session trigger (Push SMS)

Administrative session store data (SD admin params)

Channel / link establishment (TS 102 226 §9)

SIMple

Administrative session trigger (Push SMS)

Administrative session store data (SD admin params)

Channel / link establishment (TS 102 226 §9)

TERMINAL PROFILE

Profile from card

Select card snapshot

Compare snapshots