SIM CARD APDU解析工具

Posted

技术标签:

【中文标题】SIM CARD APDU解析工具【英文标题】：SIM CARD APDU parsing tool 【发布时间】：2017-10-31 11:38:54 【问题描述】：

我正在嗅探 SIM 卡和 LTE 模块之间的 IO 线路。我记录了很多数据，但由于只有一行用于命令和响应，所以我得到了大量没有边界的十六进制数据。是否有任何工具可以获取该十六进制转储并将其解析为命令和响应，并告诉它是哪种类型的命令以及它在做什么？

【问题讨论】：

您希望从一个不错的转储中获得什么见解？无论如何，我无法想象它可以帮助您跳过学习全球平台规范和 ISO 7816-3，T=0 协议部分。我猜大部分数据很无聊，其余的要么加密要么以某种方式随机化。 这就是问题所在。这只是一个垃圾场。所以我想知道是否有一种工具可以将其解析为有意义的命令和响应对。否则我将不得不通过转储并手动解析它，这将需要很长时间 【参考方案1】：

我为我 15 多年前编写的一个程序挖掘了我的存档，并在github 上分享了它。

它分析网络上捕获的 T=0 通信，并具有某种基本的 APDU 识别（仅限 SIM，无 USIM）。

可能对你有用。

祝你好运！

PS：有一个simtrace project，它可能提供类似的功能。

示例输入：

FF FF 3F 2F 00 80 69 AF 02 04 02 31 00 00 00 0E 
83 3E 9F 16 A0 A4 00 00 02 A4 3F 00 9F 16 A0 A4 
00 00 02 A4 2F E2 9F 0F A0 B0 00 00 0A B0 FF FF 
FF FF FF FF FF FF FF FF 90 00 A0 A4 00 00 02 A4 
7F 20 9F 16 A0 A4 00 00 02 A4 6F AE 9F 0F A0 B0 
00 00 01 B0 02 90 00 A0 A4 00 00 02 A4 6F 05 9F 
0F A0 C0 00 00 0F C0 85 0D 00 07 6F 05 04 00 01 
FF FF 03 02 00 00 90 00 A0 B0 00 00 05 B0 01 00 
03 02 04 90 00 A0 A4 00 00 02 A4 7F 20 9F 16 A0 
C0 00 00 16 C0 85 14 00 04 7F 20 02 00 00 FB FF 
03 09 99 00 12 04 00 83 8A 80 8A 90 00 A0 A4 00 
00 02 A4 6F 07 9F 0F A0 C0 00 00 0F C0 85 0D 00 
09 6F 07 04 00 1B FF 1B 03 02 00 00 90 00 A0 A4 
00 00 02 A4 3F 00 9F 16 A0 A4 00 00 02 A4 2F E2 
9F 0F A0 A4 00 00 02 A4 7F 20 9F 16 A0 A4 00 00 
02 A4 6F 31 9F 0F A0 B0 00 00 01 B0 FF 90 00 A0 
A4 00 00 02 A4 6F 16 94 04 A0 A4 00 00 02 A4 6F 
AD 9F 0F A0 C0 00 00 0F C0 85 0D 00 03 6F AD 04 
00 0B FF FF 03 02 00 00 90 00 A0 B0 00 00 03 B0 
00 FF FF 90 00 A0 A4 00 00 02 A4 6F 38 9F 0F A0 
C0 00 00 0F C0 85 0D 00 04 6F 38 04 00 1B FF FF 
03 02 00 00 90 00 A0 B0 00 00 04 B0 FF 3F FF 0F 
90 00 A0 A4 00 00 02 A4 6F 07 9F 0F

示例输出：

---============-----------------------------------------------------------------
Garbage: FF FF

---============-----------------------------------------------------------------
ATR: 3F 2F 00 80 69 AF 02 04 02 31 00 00 00 0E 83 3E 9F 16

(*) ATR analyze
        Initial character TS=3F
                Inverse convention
        Format character T0=2F
                TB1 global interface character(s) defined
                15 historical characters present
        Global interface character TB1=00
        Historical characters: 80 69 AF 02 04 02 31 00 00 00 0E 83 3E 9F 16

---============-----------------------------------------------------------------
ME: A0 A4 00 00 02 - (SELECT command)
SIM: A4 - (Ins echo)

(Processing command SELECT)

ME: 3F 00 - (File 3F00)

SIM: 9F 16 - (SIM has response data with length 16)

---============-----------------------------------------------------------------
ME: A0 A4 00 00 02 - (SELECT command)
SIM: A4 - (Ins echo)

(Processing command SELECT)

ME: 2F E2 - (File 2FE2)

SIM: 9F 0F - (SIM has response data with length 0F)

---============-----------------------------------------------------------------
ME: A0 B0 00 00 0A - (READ BINARY command)
SIM: B0 - (Ins echo)

(Processing command READ BINARY)

SIM: FF FF FF FF FF FF FF FF FF FF - (Data of file 2FE2 at offset 0000)

SIM: 90 00 - (Normal ending of the command)

---============-----------------------------------------------------------------
ME: A0 A4 00 00 02 - (SELECT command)
SIM: A4 - (Ins echo)

(Processing command SELECT)

ME: 7F 20 - (File 7F20)

SIM: 9F 16 - (SIM has response data with length 16)

---============-----------------------------------------------------------------
ME: A0 A4 00 00 02 - (SELECT command)
SIM: A4 - (Ins echo)

(Processing command SELECT)

ME: 6F AE - (File 6FAE)

SIM: 9F 0F - (SIM has response data with length 0F)

---============-----------------------------------------------------------------
ME: A0 B0 00 00 01 - (READ BINARY command)
SIM: B0 - (Ins echo)

(Processing command READ BINARY)

SIM: 02 - (Data of file 6FAE at offset 0000)

SIM: 90 00 - (Normal ending of the command)

---============-----------------------------------------------------------------
ME: A0 A4 00 00 02 - (SELECT command)
SIM: A4 - (Ins echo)

(Processing command SELECT)

ME: 6F 05 - (File 6F05)

SIM: 9F 0F - (SIM has response data with length 0F)

---============-----------------------------------------------------------------
ME: A0 C0 00 00 0F - (GET RESPONSE command)
SIM: C0 - (Ins echo)

(Processing command GET RESPONSE)

SIM: 85 0D 00 07 6F 05 04 00 01 FF FF 03 02 00 00 - (SELECT response data)

SIM: 90 00 - (Normal ending of the command)

---============-----------------------------------------------------------------
ME: A0 B0 00 00 05 - (READ BINARY command)
SIM: B0 - (Ins echo)

(Processing command READ BINARY)

SIM: 01 00 03 02 04 - (Data of file 6F05 at offset 0000)

SIM: 90 00 - (Normal ending of the command)

---============-----------------------------------------------------------------
ME: A0 A4 00 00 02 - (SELECT command)
SIM: A4 - (Ins echo)

(Processing command SELECT)

ME: 7F 20 - (File 7F20)

SIM: 9F 16 - (SIM has response data with length 16)

---============-----------------------------------------------------------------
ME: A0 C0 00 00 16 - (GET RESPONSE command)
SIM: C0 - (Ins echo)

(Processing command GET RESPONSE)

SIM: 85 14 00 04 7F 20 02 00 00 FB FF 03 09 99 00 12 04 00 83 8A 80 8A - (SELECT response data)

SIM: 90 00 - (Normal ending of the command)

---============-----------------------------------------------------------------
ME: A0 A4 00 00 02 - (SELECT command)
SIM: A4 - (Ins echo)

(Processing command SELECT)

ME: 6F 07 - (File 6F07)

SIM: 9F 0F - (SIM has response data with length 0F)

---============-----------------------------------------------------------------
ME: A0 C0 00 00 0F - (GET RESPONSE command)
SIM: C0 - (Ins echo)

(Processing command GET RESPONSE)

SIM: 85 0D 00 09 6F 07 04 00 1B FF 1B 03 02 00 00 - (SELECT response data)

SIM: 90 00 - (Normal ending of the command)

---============-----------------------------------------------------------------
ME: A0 A4 00 00 02 - (SELECT command)
SIM: A4 - (Ins echo)

(Processing command SELECT)

ME: 3F 00 - (File 3F00)

SIM: 9F 16 - (SIM has response data with length 16)

---============-----------------------------------------------------------------
ME: A0 A4 00 00 02 - (SELECT command)
SIM: A4 - (Ins echo)

(Processing command SELECT)

ME: 2F E2 - (File 2FE2)

SIM: 9F 0F - (SIM has response data with length 0F)

---============-----------------------------------------------------------------
ME: A0 A4 00 00 02 - (SELECT command)
SIM: A4 - (Ins echo)

(Processing command SELECT)

ME: 7F 20 - (File 7F20)

SIM: 9F 16 - (SIM has response data with length 16)

---============-----------------------------------------------------------------
ME: A0 A4 00 00 02 - (SELECT command)
SIM: A4 - (Ins echo)

(Processing command SELECT)

ME: 6F 31 - (File 6F31)

SIM: 9F 0F - (SIM has response data with length 0F)

---============-----------------------------------------------------------------
ME: A0 B0 00 00 01 - (READ BINARY command)
SIM: B0 - (Ins echo)

(Processing command READ BINARY)

SIM: FF - (Data of file 6F31 at offset 0000)

SIM: 90 00 - (Normal ending of the command)

---============-----------------------------------------------------------------
ME: A0 A4 00 00 02 - (SELECT command)
SIM: A4 - (Ins echo)

(Processing command SELECT)

ME: 6F 16 - (File 6F16)

SIM: 94 04 - (File ID not found / Pattern not found)

---============-----------------------------------------------------------------
ME: A0 A4 00 00 02 - (SELECT command)
SIM: A4 - (Ins echo)

(Processing command SELECT)

ME: 6F AD - (File 6FAD)

SIM: 9F 0F - (SIM has response data with length 0F)

---============-----------------------------------------------------------------
ME: A0 C0 00 00 0F - (GET RESPONSE command)
SIM: C0 - (Ins echo)

(Processing command GET RESPONSE)

SIM: 85 0D 00 03 6F AD 04 00 0B FF FF 03 02 00 00 - (SELECT response data)

SIM: 90 00 - (Normal ending of the command)

---============-----------------------------------------------------------------
ME: A0 B0 00 00 03 - (READ BINARY command)
SIM: B0 - (Ins echo)

(Processing command READ BINARY)

SIM: 00 FF FF - (Data of file 6FAD at offset 0000)

SIM: 90 00 - (Normal ending of the command)

---============-----------------------------------------------------------------
ME: A0 A4 00 00 02 - (SELECT command)
SIM: A4 - (Ins echo)

(Processing command SELECT)

ME: 6F 38 - (File 6F38)

SIM: 9F 0F - (SIM has response data with length 0F)

---============-----------------------------------------------------------------
ME: A0 C0 00 00 0F - (GET RESPONSE command)
SIM: C0 - (Ins echo)

(Processing command GET RESPONSE)

SIM: 85 0D 00 04 6F 38 04 00 1B FF FF 03 02 00 00 - (SELECT response data)

SIM: 90 00 - (Normal ending of the command)

---============-----------------------------------------------------------------
ME: A0 B0 00 00 04 - (READ BINARY command)
SIM: B0 - (Ins echo)

(Processing command READ BINARY)

SIM: FF 3F FF 0F - (Data of file 6F38 at offset 0000)

SIM: 90 00 - (Normal ending of the command)

---============-----------------------------------------------------------------
ME: A0 A4 00 00 02 - (SELECT command)
SIM: A4 - (Ins echo)

(Processing command SELECT)

ME: 6F 07 - (File 6F07)

SIM: 9F 0F - (SIM has response data with length 0F)

【讨论】：

【参考方案2】：

我们实施了在线工具来解析卡 ATR 和 APDU 命令/响应以获取已知指令。

示例：

ISO 7816 APDU 解析器https://iso8583.info/lib/ISO/7816/APDU EMV APDU 解析器https://iso8583.info/lib/EMV/APDU PC/SC APDU 解析器https://iso8583.info/lib/PC_SC/APDU

跟踪数据条目可以是 Level 1 格式，该格式是协议级别，带有针对 T=0、T=1 数据包等的 INS 回显。或者在 APDU 命令和响应的伪跟踪日志中。

具有相关规范数据细分的解析器。抱歉，尚未定义 SIM 工具包。

在来自 SIM 卡的 APDU 跟踪下方（没有回显的 INS 字节）。

尝试使用ISO 7816 APDU parser tool 解析它以查看一些可用的详细信息：

# FF FF
? 3F 2F 00 80 69 AF 02 04 02 31 00 00 00 0E 83 3E 9F 16

# Ins Echo removed from card responses

> A0 A4 00 00 02 3F 00
< 9F 16

> A0 A4 00 00 02 2F E2
< 9F 0F

> A0 B0 00 00 0A FF FF FF FF FF FF FF FF FF FF
< 90 00

> A0 A4 00 00 02 7F 20
< 9F 16

> A0 A4 00 00 02 6F AE
< 9F 0F

> A0 B0 00 00 01
< 02 90 00

> A0 A4 00 00 02 6F 05
< 9F 0F

> A0 C0 00 00 0F 
< 85 0D 00 07 6F 05 04 00 01 FF FF 03 02 00 00
< 90 00

> A0 B0 00 00 05
< 01 00 03 02 04 90 00

> A0 A4 00 00 02 7F 20
< 9F 16

> A0 C0 00 00 16
> 85 14 00 04 7F 20 02 00 00 FB FF 03 09 99 00 12 04 00 83 8A 80 8A 90 00

> A0 A4 00 00 02 6F 07
< 9F 0F

> A0 C0 00 00 0F
< 85 0D 00 09 6F 07 04 00 1B FF 1B 03 02 00 00 90 00

> A0 A4 00 00 02 3F 00
< 9F 16

> A0 A4 00 00 02 2F E2
< 9F 0F

> A0 A4 00 00 02 7F 20
< 9F 16

> A0 A4 00 00 02 6F 31
< 9F 0F

> A0 B0 00 00 01
< FF 90 00

> A0 A4 00 00 02 6F 16
< 94 04

> A0 A4 00 00 02 6F AD
< 9F 0F

> A0 C0 00 00 0F
< 85 0D 00 03 6F AD 04 00 0B FF FF 03 02 00 00 90 00

> A0 B0 00 00 03
< 00 FF FF 90 00

> A0 A4 00 00 02 6F 38
< 9F 0F

> A0 C0 00 00 0F
< 85 0D 00 04 6F 38 04 00 1B FF FF 03 02 00 00 90 00

> A0 B0 00 00 04
< FF 3F FF 0F 90 00

> A0 A4 00 00 02 6F 07
< 9F 0F

【讨论】：

以上是关于SIM CARD APDU解析工具的主要内容，如果未能解决你的问题，请参考以下文章

SIM逻辑模型与APDU

APDU 命令更改 IMSI SIM 卡

Osmocom SIMtrace简介

启用 NFC 的 SIM APDU 响应 6A 82

Java Card 对 INS = 0x70 的 APDU 有奇怪的响应

APDU 命令读取 SLE4432/42 卡