mirror of
https://gitea.osmocom.org/sim-card/simtrace2.git
synced 2026-03-16 21:28:33 +03:00
Removed unused phone.py
The SIM card emulator re-uses the mitm.py code with an implementation of SIM card requests and answers instead of phone.py.
This commit is contained in:
@@ -1,131 +0,0 @@
|
||||
#!/usr/bin/env python3
|
||||
|
||||
import usb.core
|
||||
import usb.util
|
||||
import sys
|
||||
|
||||
import time # needed for sleep()
|
||||
import traceback # Exception timeout
|
||||
|
||||
# Sniffed Phone to SIM card communication:
|
||||
# phone < sim : ATR
|
||||
# phone > sim : A0 A4 00 00 02 (Select File)
|
||||
# phone < sim : A4 (INS repeated)
|
||||
# phone > sim : 7F 02 (= ??)
|
||||
# phone < sim : 9F 16 (9F: success, can deliver 0x16 (=22) byte)
|
||||
# phone > sim : ?? (A0 C0 00 00 16)
|
||||
# phone < sim : C0 (INS repeated)
|
||||
# phone < sim : 00 00 00 00 7F 20 02 00 00 00 00 00 09 91 00 17 04 00 83 8A (data of length 22)
|
||||
# phone < sim : 90 00 (OK, everything went fine)
|
||||
# phone ? sim : 00 (??)
|
||||
|
||||
# SuperSIM ATR
|
||||
# atr= [0x3B, 0x9A, 0x94, 0x00, 0x92, 0x02, 0x75, 0x93, 0x11, 0x00, 0x01, 0x02, 0x02, 0x19]
|
||||
|
||||
# Faster sysmocom SIM
|
||||
#atr = [0x3B, 0x99, 0x18, 0x00, 0x11, 0x88, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x60]
|
||||
atr = [0x3B, 0x99, 0x11, 0x00, 0x11, 0x88, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x60]
|
||||
|
||||
RESP_OK = [0x60, 0x00]
|
||||
|
||||
def find_dev():
|
||||
dev = usb.core.find(idVendor=0x03eb, idProduct=0x6004)
|
||||
if dev is None:
|
||||
raise ValueError("Device not found")
|
||||
else:
|
||||
print("Found device")
|
||||
return dev
|
||||
|
||||
WAIT_RST = 0
|
||||
WAIT_CMD = 1
|
||||
|
||||
def handle_wait_rst(dev):
|
||||
# ATR handling
|
||||
print("Handle ATR")
|
||||
arr = dev.read(PHONE_INT, 64, 300) # Notification endpoint
|
||||
# print("arr: ", arr)
|
||||
c=arr.pop()
|
||||
# print(c)
|
||||
|
||||
if c == ord('R'):
|
||||
# We received a Reset, so we send ATR
|
||||
written = dev.write(PHONE_DATAOUT, atr, 1000)
|
||||
print("Written ATR of size: ")
|
||||
print(written)
|
||||
state = WAIT_CMD;
|
||||
return state
|
||||
|
||||
def handle_wait_cmd(dev):
|
||||
# Read phone request
|
||||
print("Wait cmd")
|
||||
cmd = dev.read(PHONE_DATAIN, 64, 1000)
|
||||
print("Received request!: ")
|
||||
print("".join("%02x " % b for b in cmd))
|
||||
|
||||
return send_response(dev, cmd);
|
||||
|
||||
handle_msg_funcs = { WAIT_RST: handle_wait_rst,
|
||||
WAIT_CMD: handle_wait_cmd }
|
||||
|
||||
def handle_phone_request(dev, state):
|
||||
if state == WAIT_CMD:
|
||||
try:
|
||||
state = handle_msg_funcs[WAIT_RST](dev)
|
||||
except usb.USBError as e:
|
||||
print(e)
|
||||
state = handle_msg_funcs[state](dev)
|
||||
return state
|
||||
|
||||
INS = 1
|
||||
CNT = 4
|
||||
|
||||
PHONE_DATAOUT = 0x04
|
||||
PHONE_DATAIN = 0x85
|
||||
PHONE_INT = 0x86
|
||||
|
||||
def send_response(dev, cmd):
|
||||
# FIXME: We could get data of length 5 as well! Implement another distinct criteria!
|
||||
state = WAIT_CMD
|
||||
if len(cmd) == 5: # Received cmd from phone
|
||||
if cmd[INS] == 0xA4:
|
||||
resp = [cmd[INS]] # Respond with INS byte
|
||||
elif cmd[INS] == 0xC0:
|
||||
data = [0x00, 0x00, 0x00, 0x00,
|
||||
0x7F, 0x20, 0x02, 0x00,
|
||||
0x00, 0x00, 0x00, 0x00,
|
||||
0x09, 0x91, 0x00, 0x17,
|
||||
0x04, 0x00, 0x83, 0x8A,
|
||||
0x83, 0x8A]
|
||||
SW = [0x90, 0x00]
|
||||
resp = [cmd[INS]] + data + SW # Respond with INS byte
|
||||
#state = WAIT_RST
|
||||
else:
|
||||
print("Unknown cmd")
|
||||
resp = [0x60, 0x00]
|
||||
elif len(cmd) == 2:
|
||||
resp = [0x9F, 0x16]
|
||||
else:
|
||||
resp = [0x60, 0x00]
|
||||
|
||||
written = dev.write(PHONE_DATAOUT, resp, 10000);
|
||||
if written > 0:
|
||||
print("Bytes written:")
|
||||
print(written)
|
||||
|
||||
print("Cmd, resp: ")
|
||||
print("".join("%02x " % b for b in cmd))
|
||||
print("".join("%02x " % b for b in resp))
|
||||
|
||||
return state
|
||||
|
||||
def emulate_sim():
|
||||
dev = find_dev()
|
||||
state = WAIT_RST;
|
||||
|
||||
while True:
|
||||
try:
|
||||
state = handle_phone_request(dev, state)
|
||||
|
||||
except usb.USBError as e:
|
||||
# print e
|
||||
pass
|
||||
Reference in New Issue
Block a user