Proactive commands with a body over 127 bytes (e.g. SET UP MENU with a
long item list) use a long-form length (0x81 NN / 0x82 NN NN) in their
D0 wrapper. Previously parse_tlv bailed on those, so the FETCH decoded
as a bare 'FETCH' without its command name or items.
Tests: 105 (long-form 1/2-byte, real SET UP MENU sample).
- pcap.py: parse_pcap (micro/nano, both byte orders) and parse_pcapng
(SHB byte-order, IDB linktype + if_tsresol, EPB/SPB) readers that
unwrap Ethernet/RAW/IPv4/NULL/SLL/SLL2 to UDP and extract GSMTAP-SIM
packets (APDU->tpdu, ATR->atr, PPS->pps), with a heuristic fallback
- database: insert_messages bulk-insert helper
- server: import endpoint reads raw body, auto-detects format, skips
non-GSMTAP packets; 400 'No GSMTAP data found in trace' (no session)
when empty, else creates a 'pcap' session named after the file
Tests: 102 (pcap round-trip, pcapng, no-GSMTAP, endpoint 200/400).
CLA 0x80 is the ETSI/3GPP-defined UICC/USIM class (TS 102 221 Table 10.3),
not ISO 7816-4 'proprietary'. Relabel 0x80 -> ETSI-defined (UICC/USIM),
0xA0 -> ETSI-defined (SIM/GSM), 0x00 -> inter-industry (ISO 7816-4);
drop the now-redundant note field.
The PCAP branch fell back to GSMTAP_SIM_APDU for every non-ATR message,
so PPS/CHANGE/FIDI were written as 'APDU'. Align with the UDP branch and
the server export: only atr→ATR and tpdu→APDU are written.
pcap.py: LINKTYPE_GSMTAP (155) was wrong — 155 is DLT_USER8, so
Wireshark showed 'USER 8 / DLT=155'. Now write Ethernet-encapsulated
PCAP (LINKTYPE 1): each GSMTAP message wrapped in Ethernet + IPv4 +
UDP (port 4729), with correct checksums — matching a real tcpdump
capture of GSMTAP-over-UDP and how Wireshark's gsmtap dissector is keyed.
gsmtap.py: GSMTAP_TYPE_SIM was 0x07 (WiMAX burst) — corrected to 0x04;
GSMTAP_SIM_APDU was 0x02 (PPS req) — corrected to 0x00; added PPS_REQ/
PPS_RSP. These match libosmocore/Wireshark packet-gsmtap.h.
Verified with tshark: PCAP now decodes as GSM SIM (SELECT/STATUS/ATR)
instead of 'USER 8'.
tests: pcap tests assert Ethernet linktype + framing + GSMTAP payload.
pcap.py: build_pcap(packets) — build PCAP bytes in memory (same format
as PcapWriter)
database.py: get_messages_raw() — raw elapsed/type/data without decode
server.py: GET /api/sessions/<id>/pcap generates a GSMTAP-encapsulated
PCAP (ATR/TPDU) with real timestamps and downloads it as
<session-name>.pcap (ASCII filename fallback + RFC 5987 UTF-8 for
spaces/unicode via _content_disposition)
tests: build_pcap + _content_disposition (67 total)
- PLI_QUALIFIERS: TS 102 223 qualifier values (Location Info, IMEI,
NMR, Date/time, Timing Advance, Access Technology, etc.)
- _command_details_name(): appends the qualifier description to
PROVIDE LOCAL INFORMATION (type 0x26) in Command Details
- decode_cat (FETCH) and decode_tr_command (TR) now use it, so both
'cat_command' and 'response_to' carry the qualifier (e.g.
'PROVIDE LOCAL INFORMATION — IMEI')
tests: PLI qualifier cases (TR/FETCH, IMEI/location/date, non-PLI)
decode.py:
- _decode_fcp: FCP/FCI/FMD template — full bit-level file descriptor
(TS 102 221 Table 11.5: file type, structure, shareable, data coding,
record length, num records), file ID (+ KNOWN_FIDS name), DF name,
SFI, life cycle
- _decode_auth: GSM SRES+Kc, or 3G tag DB (RES/CK/IK/KC) / DC (AUTS)
- _decode_tr_result: TERMINAL RESPONSE Result TLV (code + name)
- _decode_response_for(ins, data): GET RESPONSE decodes its body using
the previous command's INS (SELECT→FCP, AUTHENTICATE→auth)
- decode_message wires response decoding for TR and GET RESPONSE
database.py: prev context now carries 'ins' (INS byte) via
_context_from_decoded, used by GET RESPONSE response decoding
tests: FCP, AUTH (GSM/3G), TR result, GET RESPONSE wiring (57 total)
decode.py: split decode_tr_command() out of decode_cat(); TR (0x14)
now stores the echoed proactive command type in 'response_to' instead
of 'cat_command', so it no longer overrides the INS name.
FETCH/ENVELOPE still use cat_command as the primary label.
tests: TR now asserts response_to + no cat_command
decode.py:
- decode_cat: TERMINAL RESPONSE (0x14) now extracts the proactive
command type from its echoed Command Details (tag 81) — no history
lookup needed since TR carries its own type
- decode_message gains prev param; GET RESPONSE (0xC0) resolves
'response_for' from the previous command when its SW1 was 0x61,
else None (orphaned)
- decode_sniff_msg threads prev through
database.py:
- _row_to_message accepts prev; new _decode_rows tracks previous-TPDU
context in sequence; get_messages/get_messages_after seed context
from the message before the window/cursor
tests: TR cat_command + GET RESPONSE context/orphaned cases (49 total)
Decode errors now log to stderr instead of crashing the entire
API response. This prevents a single malformed message from hiding
all subsequent messages in the same query.
decode_sniff_msg() dispatches to type-specific decoders:
- change: 4-byte flags bitmask → card insert/eject/reset/timeout
- fidi: 1-byte Fi/Di index → decoded values
- atr/pps: raw hex value
database.py now decodes all message types, not just tpdu.
Pure Python, no dependencies. Decodes raw TPDU bytes into
structured JSON: CLA bitfield, INS->name via APDU_SPEC table,
P1/P2 field breakdown, body extraction, SW name lookup.
~40 command types, 40+ SW codes, known FID notes.
database.py: _row_to_message() calls decode_message() for tpdu
messages, adding 'decoded' field to API responses.
Decoding happens at query time, not storage time — no schema
migration, all past sessions get decode retroactively.
Add simtrace2-pysniff-server CLI — HTTP API for simtrace-analyser PWA.
Two capture modes: GSMTAP UDP listener (compatible with simtrace2-sniff)
or direct SIMtrace2 hardware capture. SQLite storage with sessions +
messages tables. REST API with CORS.
server/ sub-package: database.py, capture.py, server.py, __main__.py
README updated with server usage section.
pyproject.toml: simtrace2-pysniff-server script entry added.
UDP socket on port 4729, parses GSMTAP header, validates
GSMTAP_TYPE_SIM, returns (sub_type, data). Compatible with
simtrace2-sniff and pySim's GsmtapApduSource.
Use sys.stdin.isatty() to auto-detect: foreground sessions still
respond to SIGHUP (terminal close kills the process as expected),
background/piped processes ignore it and survive.
__main__.py: add signal.SIGHUP → SIG_IGN before setting up
SIGINT/SIGTERM handlers. Sniffer no longer dies when the terminal
closes or the shell session ends.
README: add Background / Daemon section with nohup examples.
dump.py: tpdu_timestamp_prefix(), tpdu_atr_time_prefix(),
format_message() accepts tpdu_prefix parameter,
FileDumper supports fmt + ATR time tracking
__main__.py: --format/-f flag (hex|timestamp|atr-time),
atr_time_start tracking in message loop
sniff-start.sh: pass through --format/-f and FORMAT env var
catarrh