- capture.py: map GSMTAP PPS request/response (0x02/0x03) to 'pps',
matching the pcap-import mapping (was decoded as TPDU live)
- decode.py: parse the optional RST CLK extension (sigrok v1.9.0+,
payload flag bit 0); ATR gains clk_hz/data_rate/etu_us derived from
TA1 Fi/Di (data_rate = clk_hz × D / F)
- database.py: CLK state is consumed by the next ATR (no stale rate
for an ATR without preceding RST); a late-arriving RST measurement
is backfilled onto the ATR it belongs to; replay context carries
the CLK across pagination/live polling
- PWA: ATR detail shows CLK/Data rate/ETU; RST event detail shows CLK
- tests: PPS mapping, CLK parse with/without flag, rate math,
DB consume + backfill round-trips
- README/RUS updated
- Bump 1.22.18, SW cache v49->v50
SIGROK-derived PCAPs have relative timestamps (0, 1.37, 15.02) rather
than epoch time. The _REAL_TS_MIN check failed, so close_session() set
ended to wall-clock (same as started → duration 0s). Now close_session
accepts an optional duration_secs param; the import handler passes
last_ts - first_ts so the session gets the correct capture duration.
Support the sigrok-iso7816-stream decoder (FX2 logic-analyzer passive
SIM sniffer, github.com/anttro/sigrok_iso7816_stream) which streams
GSMTAP-SIM on UDP 4729 and adds two custom sub-types for line events.
- gsmtap.py: GSMTAP_SIM_RST_EVENT (0x10) / GSMTAP_SIM_VCC_EVENT (0x11).
- capture.py: gsmtap_msg_type() maps 0x10→'rst', 0x11→'vcc' (shared by
the listener and tests); pcap.py _SUB_TYPE_NAMES gains the same
entries so PCAP re-imports of these captures preserve the events.
- decode.py: decode_line_event() decodes [direction, level, reserved]
into reset asserted/de-asserted or power applied/removed + level;
routed through decode_sniff_msg.
- database.py: reset-assert and power-removal invalidate the per-channel
file selection (card-level transition); de-assert / power-on are
markers only.
- frontend: RST/VCC labels (RESET ASSERTED / VCC OFF, …), a detail-view
branch (Event + Level + raw), and list styling (.apdu-type.rst/.vcc).
README notes the custom sub-type compatibility. Tests: +8 (line-event
vectors, sniff routing, subtype + PCAP round-trip mappings) — 359
total. Version 1.21.0, SW cache simtrace-analyser-v31.
User-reported: the decoded CNTR (0x1830A44E41 ≈ 104 billion) cannot
be the real counter — the OTA platform shows ~200 for that card.
Root cause: per TS 102 225 Table 2 note 1, when SPI indicates
ciphering the whole block from CNTR through the secured data
(CNTR, PCNTR, RC/CC/DS, secured data) is ENCRYPTED. Only CPI, CPL,
CHI/CHL, SPI, KIc, KID and TAR travel in the clear. Our decoder
parsed the ciphertext bytes as if they were the real CNTR/PCNTR/RC
and presented them as such — misleading (the true values are only
recoverable after 3DES decryption with the card's keys).
Fix:
- _decode_secured_packet: emit 'ciphered': True when SPI1.b3 is set
(wire hex values kept for reference); docstring documents the
ciphered block.
- _decode_response_packet: accepts ciphered (command SPI2.b5, PoR
ciphering) and flags the response likewise; database context now
carries por_ciphered from the ENVELOPE so the GET RESPONSE PoR
inherits it. Standalone SMS-SUBMIT PoRs carry no SPI — state
unknowable, defaults to False (documented).
- Frontend: CNTR/PCNTR/RC-CC-DS labels get "(encrypted)" when the
respective packet is ciphered (command, response, and ENVELOPE
response renderings).
Tests: +4 TestSecuredCiphering (ciphered flagged, unciphered plain
CNTR e.g. 200, response flag, PoR-via-context). 348 total. Version
1.18.0, SW cache simtrace-analyser-v26.
- Only update the selected-file state on a successful SELECT (SW1 in
61/62/63/90/91/92/9E/9F); a failed SELECT (e.g. 6A82) leaves the
current file unchanged.
- Track the file structure from the FCP (GET RESPONSE after SELECT).
- Skip file decoding for record ops (READ/UPDATE/SEARCH RECORD) when the
selected file is transparent/DF, marking the result 'stale' instead of
decoding garbage — this catches silently-dropped SELECTs.
- Track the currently selected file (SELECT by FID/path) across the
session and pass it to the decoder; reset on ATR/card change; seed via
a bounded backward scan on paged views.
- Decode READ BINARY/RECORD, UPDATE BINARY/RECORD and (via GET RESPONSE)
SEARCH RECORD bodies using a FILE_DECODERS registry: IMSI, ICCID,
LI/PL, ADN-format (MSISDN/SDN/FDN/...), SMS records (SMSC + TPDU),
UST/SST/IST service tables, PLMN lists (+access tech), EF_DIR,
CBMI/R, ARR, PNN, ECC, SPN, LOCI, ACC, Phase, ISIM IMPI/DOMAIN/IMPU.
- File formats verified against TS 51.011 / TS 102 221 / TS 31.102
(PLMNwAcT is 5-byte entries; EF_SMS = status + SMSC + TPDU; ISIM
identities are 0x80 TLV).
- Offset != 0 READ BINARY/UPDATE BINARY is skipped (fragment reads).
- SEARCH RECORD results (record numbers) decoded in GET RESPONSE.
- GET RESPONSE summary now shows FCP file type/structure/size.
- New 'File data' section in the detail view.
- pcap.py: _parse_tsresol now pads options to a 32-bit boundary
((-length) % 4) and uses 2** for the MSB-set (power-of-2) case, so
nanosecond if_tsresol is read correctly (was defaulting to µs and
scaling timestamps 1000x)
- database/server: set imported session started/ended from the first/last
packet timestamps (falling back to wall-clock for synthetic SPB)
- frontend: formatDuration renders hours
- tests: tsresol (ns after padded option, default µs, ns round-trip) and
session-window/fallback (119 total)
- pcap.py: parse_pcap (micro/nano, both byte orders) and parse_pcapng
(SHB byte-order, IDB linktype + if_tsresol, EPB/SPB) readers that
unwrap Ethernet/RAW/IPv4/NULL/SLL/SLL2 to UDP and extract GSMTAP-SIM
packets (APDU->tpdu, ATR->atr, PPS->pps), with a heuristic fallback
- database: insert_messages bulk-insert helper
- server: import endpoint reads raw body, auto-detects format, skips
non-GSMTAP packets; 400 'No GSMTAP data found in trace' (no session)
when empty, else creates a 'pcap' session named after the file
Tests: 102 (pcap round-trip, pcapng, no-GSMTAP, endpoint 200/400).
pcap.py: build_pcap(packets) — build PCAP bytes in memory (same format
as PcapWriter)
database.py: get_messages_raw() — raw elapsed/type/data without decode
server.py: GET /api/sessions/<id>/pcap generates a GSMTAP-encapsulated
PCAP (ATR/TPDU) with real timestamps and downloads it as
<session-name>.pcap (ASCII filename fallback + RFC 5987 UTF-8 for
spaces/unicode via _content_disposition)
tests: build_pcap + _content_disposition (67 total)
decode.py:
- _decode_fcp: FCP/FCI/FMD template — full bit-level file descriptor
(TS 102 221 Table 11.5: file type, structure, shareable, data coding,
record length, num records), file ID (+ KNOWN_FIDS name), DF name,
SFI, life cycle
- _decode_auth: GSM SRES+Kc, or 3G tag DB (RES/CK/IK/KC) / DC (AUTS)
- _decode_tr_result: TERMINAL RESPONSE Result TLV (code + name)
- _decode_response_for(ins, data): GET RESPONSE decodes its body using
the previous command's INS (SELECT→FCP, AUTHENTICATE→auth)
- decode_message wires response decoding for TR and GET RESPONSE
database.py: prev context now carries 'ins' (INS byte) via
_context_from_decoded, used by GET RESPONSE response decoding
tests: FCP, AUTH (GSM/3G), TR result, GET RESPONSE wiring (57 total)
decode.py:
- decode_cat: TERMINAL RESPONSE (0x14) now extracts the proactive
command type from its echoed Command Details (tag 81) — no history
lookup needed since TR carries its own type
- decode_message gains prev param; GET RESPONSE (0xC0) resolves
'response_for' from the previous command when its SW1 was 0x61,
else None (orphaned)
- decode_sniff_msg threads prev through
database.py:
- _row_to_message accepts prev; new _decode_rows tracks previous-TPDU
context in sequence; get_messages/get_messages_after seed context
from the message before the window/cursor
tests: TR cat_command + GET RESPONSE context/orphaned cases (49 total)
Decode errors now log to stderr instead of crashing the entire
API response. This prevents a single malformed message from hiding
all subsequent messages in the same query.
decode_sniff_msg() dispatches to type-specific decoders:
- change: 4-byte flags bitmask → card insert/eject/reset/timeout
- fidi: 1-byte Fi/Di index → decoded values
- atr/pps: raw hex value
database.py now decodes all message types, not just tpdu.
Pure Python, no dependencies. Decodes raw TPDU bytes into
structured JSON: CLA bitfield, INS->name via APDU_SPEC table,
P1/P2 field breakdown, body extraction, SW name lookup.
~40 command types, 40+ SW codes, known FID notes.
database.py: _row_to_message() calls decode_message() for tpdu
messages, adding 'decoded' field to API responses.
Decoding happens at query time, not storage time — no schema
migration, all past sessions get decode retroactively.
Add simtrace2-pysniff-server CLI — HTTP API for simtrace-analyser PWA.
Two capture modes: GSMTAP UDP listener (compatible with simtrace2-sniff)
or direct SIMtrace2 hardware capture. SQLite storage with sessions +
messages tables. REST API with CORS.
server/ sub-package: database.py, capture.py, server.py, __main__.py
README updated with server usage section.
pyproject.toml: simtrace2-pysniff-server script entry added.
catarrh