On 09/09/2014 09:58 PM, [email protected] wrote:
for the client software, you'll also need the changes indicated here:
http://lists.osmocom.org/pipermail/simtrace/2014-January/000586.html
I have attached a patch for simtrace that actually compiles.
FYI:
With the new firmware failing SIM card is being traced much farther,
however,
in the middle of tracing simtrace disconnects (also using SIM card which
worked with firmware v5 without problems):
...
APDU: a0 b2 82 04 28 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 90 00
APDU: a0 b2 83 04 28 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 90 00
APDU: a0 a4 00 00 02 3f 00 9f 16
APDU: a0 a4 00 00 02 7f 20 9f 16
APDU: a0 a4 00 00 02 6f 7e 9f 0f
APDU: a0 d6 00 00 0b bb 84 d3 af 42 f8 30 00 5a ff 00 90 00
APDU: a0 a4 00 00 02 3f 00 9f 16
APDU: a0 a4 00 00 02 7f 10 9f 16
BULK IN transfer error; rc=-8
Or trace suddenly stops with this output in debugging log:
[00004C] Heart beat 0000001A
[00004D] ATR 3B BE 94 00 40 14 47 47 33 53 33 45 48 41 54 4C 39 31 30 00
[00004E] found Fi=9 Di=4
[00004F] ATR 3B BE 94 00 40 14 47 47 33 53 33 45 48 41 54 4C 39 31 30 00
[000050] found Fi=9 Di=4
[000051] ATR 3B BE 94 00 40 14 47 47 33 53 33 45 48 41 54 4C 39 31 30 00
[000052] found Fi=9 Di=4
[000053] Heart beat 0000001B
[000054] Heart beat 0000001C
[000055] Heart beat 0000001D
[000056] Heart beat 0000001E
[000057] Heart beat 0000001F
[000058] Heart beat 00000020
[000059] Heart beat 00000021
[00005A] Heart beat 00000022
[00005B] Heart beat 00000023
[00005C] Heart beat 00000024
[00005D] Heart beat 00000025
[00005E] Heart beat 00000026
[00005F] Heart beat 00000027
[000060] Heart beat 00000028
[000061] SPURRIOUS IRQ 1 [Old PC = 0010656C]
[000062] Heart beat 00000029
[000063] Heart beat 0000002A
[000064] Heart beat 0000002B
[000065] Heart beat 0000002C
...
[00007E] Heart beat 00000045
[00007F] Heart beat 00000046
[000080] Heart beat 00000047
[000081] Heart beat 00000048
[000082] Heart beat 00000049
[000083] found Fi=5 Di=10
[000084] update_fidi(273): computed FiDi ratio 2976 unsupported
[000085] Heart beat 0000004A
[000086] Heart beat 0000004B
[000087] Heart beat 0000004C
[000088] Heart beat 0000004D
[000089] Heart beat 0000004E
Subject: Re: Fast SIM cards loosing bytes
From: Dean Chester <[email protected]>
To: Min Xu <[email protected]>
Cc: "[email protected]" <[email protected]>
Content-Type: multipart/alternative; boundary=001a11c2bdaaa8ae9104fedd1d85
--001a11c2bdaaa8ae9104fedd1d85
Content-Type: text/plain; charset=UTF-8
Hi Min,
Sorry for the delay, i've been travelling with work and been unable to test
this.
I can confirm this is fixes the issues I was having earlier this year. I
believe this firmware should be the default firmware on the simtrace
devices.
The company I work for are currently going through quality control on a
java implementation of the simtrace software to complement this new
firmware once this has been released I'll publish a link to it so then
there is a complete solution for a user to use an improved simtrace device.
Many Thanks,
Dean Chester
On 24 June 2014 22:26, Min Xu <[email protected]> wrote:
Hi Dean
I recently worked on the firmware again and believe I have fixed the
issues with the parity errors (at least for my SGS 2 and SGS 4 with ATT
4G/LTE cards)
Can you try the attached firmware and let me know your results?
Thanks
On Mon, Mar 10, 2014 at 8:23 AM, Min Xu <[email protected]> wrote:
.....
-----Original Message-----
Date: Mon, 8 Sep 2014 20:11:22 +0200
From: Lukas Kuzmiak <[email protected]>
To: "[email protected]" <[email protected]>
Subject: sniffing hangs / too fast sim? / parsing problem?
Message-ID:
<cabv5etfbgr8ykz8kwbdpdv424zgemvbq4aarxzews0z1hof...@mail.gmail.com>
Content-Type: text/plain; charset="utf-8"
Hey guys,
this problem has been around for ages (from my perspective) .. and I don't
seem to understand if it's a SW issue or a HW issue.
I start the ./simtrace .. and then insert the SIM into the phone (or vice
versa), boot up the phone and start sniffing (log below).
It works for a second or two and then the stuff get broken into weird parts
.. I could probably fix that in apdu_split.c
but the other issue is that it stops sniffing completely at that point for
some reason.
Any idea why that happens?
Thanks!
Lukas
Entering main loop
ATR APDU: 3b 9e 96 80 1f c7 80 31 e0 73 fe 21 1b 66 d0 01 7b 8f 0d 00 f8
PPS(Fi=9/Di=6) APDU: 00 a4 00 04 02 3f 00 61 2e
APDU: 00 c0 00 00 2e 62 2c 82 02 78 21 83 02 3f 00 a5 09 80 01 71 83 04 00
00 95 d5 8a 01 05 8b 03 2f 06 02 c6 09 90 01 40 83 01 01 83 01 81 81 04 00
01 50 f2 90 00
APDU: 00 a4 08 04 02 2f e2 61 1b
APDU: 00 c0 00 00 1b 62 19 82 02 41 21 83 02 2f e2 a5 03 80 01 71 8a 01 05
8b 03 2f 06 01 80 02 00 0a 90 00
APDU: 00 b0 00 00 0a 98 94 22 14 51 02 31 21 51 f0 90 00
APDU: 00 a4 00 04 02 2f 05 61 1b
APDU: 00 c0 00 00 1b 62 19 82 02 41 21 83 02 2f 05 a5 03 80 01 71 8a 01 05
8b 03 2f 06 05 80 02 00 08 90 00
APDU: 00 b0 00 00 08 64 65 65 6e 66 72 ff ff 90 00
APDU: 80 10 00 00 1e ff ff ff ff 7f 9f 00 df ff 00 00 1f e2 00 00 00 83 fb
00 07 06 01 60 00 11 00 00 00 00 18 91 44
APDU: 80 12 00 00 44 d0 42 81 03 01 25 00 82 02 81 82 05 0c 53 4d 53 20 53
65 72 76 69 63 65 73 8f 0e 01 49 6e 66 6f 20 53 65 72 76 69 63 65 73 8f 0b
02 57 7c 72 74 65 72 62 75 63 68 8f 06 03 45 4d 61 69 6c 8f 04 04 46 61 78
90 00
APDU: 00 a4 00 04 02 2f 00 61 21
APDU: 00 c0 00 00 21 62 1f 82 05 42 21 00 26 02 83 02 2f 00 a5 03 80 01 71
8a 01 05 8b 03 2f 06 04 80 02 00 4c 88 01 f0 00 00
APDU: b2 01 04 26 b2 61 1e
APDU: 4f 10 a0 00 00 00 87
APDU: 10 02 ff 33 ff ff 89
APDU: 01 01 01 00 50 0a 4f
APDU: 32 2d 47 65 72 6d 61
APDU: 6e 79 ff ff ff ff ff
APDU: ff 90 00 00 b2 02 04
APDU: 26 b2 ff ff ff ff ff
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.osmocom.org/pipermail/simtrace/attachments/20140908/db785090/attachment-0001.html>
------------------------------
Message: 2
Date: Mon, 8 Sep 2014 20:27:05 +0200
From: Lukas Kuzmiak <[email protected]>
To: "[email protected]" <[email protected]>
Subject: Re: sniffing hangs / too fast sim? / parsing problem?
Message-ID:
<cabv5ethbguauxrkintg+yk1xd6dny1f8fmt3-1ead9hf2gu...@mail.gmail.com>
Content-Type: text/plain; charset="utf-8"
oh, I forgot to mention.. I still have SIMTrace v1.0 (from CCC camp when
it was first time available).
were there improvements I did not notice?
On Mon, Sep 8, 2014 at 8:11 PM, Lukas Kuzmiak <[email protected]> wrote:
Hey guys,
this problem has been around for ages (from my perspective) .. and I don't
seem to understand if it's a SW issue or a HW issue.
I start the ./simtrace .. and then insert the SIM into the phone (or vice
versa), boot up the phone and start sniffing (log below).
It works for a second or two and then the stuff get broken into weird
parts .. I could probably fix that in apdu_split.c
but the other issue is that it stops sniffing completely at that point for
some reason.
Any idea why that happens?
Thanks!
Lukas
Entering main loop
ATR APDU: 3b 9e 96 80 1f c7 80 31 e0 73 fe 21 1b 66 d0 01 7b 8f 0d 00 f8
PPS(Fi=9/Di=6) APDU: 00 a4 00 04 02 3f 00 61 2e
APDU: 00 c0 00 00 2e 62 2c 82 02 78 21 83 02 3f 00 a5 09 80 01 71 83 04 00
00 95 d5 8a 01 05 8b 03 2f 06 02 c6 09 90 01 40 83 01 01 83 01 81 81 04 00
01 50 f2 90 00
APDU: 00 a4 08 04 02 2f e2 61 1b
APDU: 00 c0 00 00 1b 62 19 82 02 41 21 83 02 2f e2 a5 03 80 01 71 8a 01 05
8b 03 2f 06 01 80 02 00 0a 90 00
APDU: 00 b0 00 00 0a 98 94 22 14 51 02 31 21 51 f0 90 00
APDU: 00 a4 00 04 02 2f 05 61 1b
APDU: 00 c0 00 00 1b 62 19 82 02 41 21 83 02 2f 05 a5 03 80 01 71 8a 01 05
8b 03 2f 06 05 80 02 00 08 90 00
APDU: 00 b0 00 00 08 64 65 65 6e 66 72 ff ff 90 00
APDU: 80 10 00 00 1e ff ff ff ff 7f 9f 00 df ff 00 00 1f e2 00 00 00 83 fb
00 07 06 01 60 00 11 00 00 00 00 18 91 44
APDU: 80 12 00 00 44 d0 42 81 03 01 25 00 82 02 81 82 05 0c 53 4d 53 20 53
65 72 76 69 63 65 73 8f 0e 01 49 6e 66 6f 20 53 65 72 76 69 63 65 73 8f 0b
02 57 7c 72 74 65 72 62 75 63 68 8f 06 03 45 4d 61 69 6c 8f 04 04 46 61 78
90 00
APDU: 00 a4 00 04 02 2f 00 61 21
APDU: 00 c0 00 00 21 62 1f 82 05 42 21 00 26 02 83 02 2f 00 a5 03 80 01 71
8a 01 05 8b 03 2f 06 04 80 02 00 4c 88 01 f0 00 00
APDU: b2 01 04 26 b2 61 1e
APDU: 4f 10 a0 00 00 00 87
APDU: 10 02 ff 33 ff ff 89
APDU: 01 01 01 00 50 0a 4f
APDU: 32 2d 47 65 72 6d 61
APDU: 6e 79 ff ff ff ff ff
APDU: ff 90 00 00 b2 02 04
APDU: 26 b2 ff ff ff ff ff
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.osmocom.org/pipermail/simtrace/attachments/20140908/e8c679ca/attachment-0001.html>
------------------------------
_______________________________________________
simtrace mailing list
[email protected]
https://lists.osmocom.org/mailman/listinfo/simtrace
End of simtrace Digest, Vol 39, Issue 2
***************************************
diff --git a/host/main.c b/host/main.c
index 8ab7d2d..f606b63 100644
--- a/host/main.c
+++ b/host/main.c
@@ -80,40 +80,68 @@ static void apdu_out_cb(uint8_t *buf, unsigned int len, void *user_data)
gsmtap_send_sim(buf, len);
}
-static int process_usb_msg(uint8_t *buf, int len)
-{
- struct simtrace_hdr *sh = (struct simtrace_hdr *)buf;
- uint8_t *payload = buf += sizeof(*sh);
- int payload_len = len - sizeof(*sh);
-
- if (payload_len < 0)
- return -EINVAL;
-
- switch (sh->cmd) {
- case SIMTRACE_MSGT_DATA:
- /* special treatment for ATR */
- if (sh->flags & SIMTRACE_FLAG_ATR) {
- printf("ATR ");
- apdu_out_cb(payload, payload_len, NULL);
- break;
- }
- if (sh->flags & SIMTRACE_FLAG_PPS_FIDI) {
- printf("PPS(Fi=%u/Di=%u) ",
- sh->res[0], sh->res[1]);
- }
- /* everything else goes into APDU splitter */
- apdu_split_in(as, payload, payload_len);
-#if 0
- /* If waiting time has expired, signal explicit boundary */
- if (sh->flags & SIMTRACE_FLAG_WTIME_EXP)
- apdu_split_boundary(as);
-#endif
- break;
- case SIMTRACE_MSGT_RESET:
- default:
- printf("unknown simtrace msg type 0x%02x\n", sh->cmd);
- break;
- }
+static char usb_buffer[66000];
+static unsigned usb_remainder = 0;
+
+int process_usb_msg(uint8_t *buf, int len) {
+ struct simtrace_hdr *sh;
+ uint8_t *payload;
+ int payload_len, sh_offset, i;
+
+ //sendto(s, buf, len, 0, (struct sockaddr*)&destUSB, sizeof(struct sockaddr_in));
+
+ memcpy(usb_buffer + usb_remainder, buf, len);
+ len += usb_remainder;
+ usb_remainder = len;
+ sh_offset = 0;
+ sh = (struct simtrace_hdr*) usb_buffer;
+ payload = (char*)sh + sizeof(struct simtrace_hdr);
+ payload_len = sh->tot_len - sizeof(struct simtrace_hdr);
+ if (usb_remainder < sh->tot_len)
+ sh = NULL;
+
+ while (sh) {
+ switch (sh->cmd) {
+ case SIMTRACE_MSGT_DATA:
+ /* special treatment for ATR */
+ if (sh->flags & SIMTRACE_FLAG_ATR) {
+ apdu_split_reset(as);
+ break;
+ }
+ if (sh->flags & SIMTRACE_FLAG_PPS_FIDI) {
+ //module_out("PPS(Fi=%u/Di=%u)\n",
+ // sh->res[0], sh->res[1]);
+ }
+ /* everything else goes into APDU splitter */
+ apdu_split_in(as, payload, payload_len);
+ #if 0
+ /* If waiting time has expired, signal explicit boundary */
+ if (sh->flags & SIMTRACE_FLAG_WTIME_EXP)
+ apdu_split_boundary(as);
+ #endif
+ break;
+ case SIMTRACE_MSGT_RESET:
+ default:
+ //module_out("unknown simtrace msg type 0x%02x\n", sh->cmd);
+ break;
+ }
+ sh_offset += sh->tot_len;
+ sh = (struct simtrace_hdr*) usb_buffer + sh_offset;
+ if (sh_offset < len) {
+ if (sh_offset + sh->tot_len > len) {
+ memcpy(usb_buffer, sh, len - sh_offset);
+ usb_remainder = len - sh_offset;
+ sh = NULL;
+ } else {
+ payload = (char*)sh + sizeof(struct simtrace_hdr);
+ payload_len = sh->tot_len - sizeof(struct simtrace_hdr);
+ }
+ } else {
+ sh = NULL;
+ usb_remainder = 0;
+ }
+ }
+ return 0;
}
static void print_welcome(void)
diff --git a/host/simtrace_usb.h b/host/simtrace_usb.h
index b8b62d3..332f917 100644
--- a/host/simtrace_usb.h
+++ b/host/simtrace_usb.h
@@ -8,6 +8,9 @@ struct simtrace_hdr {
u_int8_t cmd;
u_int8_t flags;
u_int8_t res[2];
+ u_int16_t seq_num;
+ u_int16_t offset;
+ u_int16_t tot_len;
u_int8_t data[0];
} __attribute__ ((packed));
