Anyone who operates their own GSM network typically needs to program
and issue their own SIM cards — the alternative approach of letting
alien SIMs onto your network in guest roaming
mode with authentication
and ciphering disabled is generally unattractive.
And if you are a small community or lab operator, issuing your own SIMs
practically means being able to obtain (buy in small quantity) what are
called programmable SIMs: cards that allow you to program your own identities
(IMSI, possibly ICCID too) and keys (Ki and A3+A8 algorithm selection)
via some documented mechanism, typically using a special ADM PIN.
We are not the first vendor to offer programmable SIM cards — far
from it.
The most famous and most popular (at least in the Osmocom community from
which we offshoot) brand of programmable SIM cards are those sold by
Sysmocom in their webshop — and we (FreeCalypso and Themyscira Wireless)
used them too before we had our own.
However, these most common varieties of programmable SIM cards
(Sysmocom and other vendors we heard of over the years) are oriented
toward modern
users: those who operate newer G
networks
beyond pure GSM,
and those who are going to insert their SIMs into modern
phones.
From the perspective of someone who operates a pure GSM/2G network
for the sole purpose of providing service to vintage mobile phones,
these modern taste
programmable SIMs are rather unpleasant:
All modern
programmable SIMs, from both Sysmocom and other
vendors we heard of, are made in triple-cut physical form factor, i.e.,
the only fully solid form factor is 4FF (nano), with 3FF (micro) and
2FF (classic) provided in the form of additional plastic shells around that
4FF piece.
However, when you move that SIM around a lot between different sockets,
and even during initial breakout from the ID-1 carrier, those 2FF and 3FF
shells keep separating from the 4FF inner piece, making the whole structure
very weak.
4FF SIMs are also thinner than the standard thickness for 1FF, 2FF and 3FF,
potentially resulting in less reliable electrical contact in classic
2FF SIM sockets.
Current Sysmocom SIMs (and the same situation likely holds for other vendors) are not pure GSM 11.11 SIMs, instead they are UICC-native cards with USIM and ISIM applications, plus a GSM 11.11 SIM application only for backward compatbility. From the viewpoint of a pure GSM network operator, having to understand and program all those ADF.USIM and ADF.ISIM files creates a significant additional cognitive load that is totally undesired — or you can leave them unprogrammed and then end up in troubleshooting nightmare land if the phone you inserted the SIM into does understand those USIM and ISIM files, and is trying to do something with them that you don't even understand.
Fortunately, we as in Themyscira Wireless (FreeCalypso at the time) were able to find an older programmable SIM card model that is GSM 11.11 SIM only, without USIM or ISIM applications (and furthermore, no UICC at all!), these cards were still freely orderable at least as of 2021 (when we got our batch), and we were able to get them made for us in a 2FF-only cut, meaning that the 2FF piece is fully solid!
The card model we got is one that was previously used and sold by
Sysmocom (apparently some time around 2013), known in the Osmocom community as
GrcardSIM2,
made by Grcard in China.
We got a new batch of these cards made for us in 2021, in a 2FF-only cut
with our own color scheme and with FreeCalypso artwork on the plastic,
and our version is called FreeCalypso Community SIM, model FCSIM1.
We opted to not provide any programming data to Grcard factory at the
time of batch production, instead our model is that every downstream user
needs to program their own card(s) as needed for their unique environment
using our fc-simtool utility — see below.
We have a suite of
software tools for programming and manipulating SIM cards —
a suite that consists of main program fc-simtool and some
additional accessory programs.
fc-simtool is a utility for speaking GSM 11.11 protocol
to a SIM card in a standalone manner, without using any GSM ME (phone
or modem) or any other higher-level agent.
Physical access to the target SIM card is accomplished via a dedicated SIM
reader
device (either USB CCID or serial) or via a Calypso GSM MS
device supported by FreeCalypso host tools.
Our tool allows manual issue of low-level GSM 11.11 commands,
user-level operations such as manipulating SIM PINs and phonebooks,
and administrative programming (with the appropriate ADM PIN)
for supported SIM card models.
It is the official programming tool for our own FCSIM1 cards.
We were greatly inspired by Osmocom SIMtrace, but we also sought to lift its limitations:
Our SIMsniff solution retains the same
set of FPC cables
as Osmocom SIMtrace, but replaces the active SIMtrace2 board with our own
sniffer pod, which then connects to a
Lattice Icestick
FPGA board.
The Icestick plugs into an USB port on the developer's laptop and presents
itself as a USB-serial device; our simsniff-rx program
then reads all sniffed ME-to-SIM communication from the ttyUSB
device.
In contrast with Osmocom SIMtrace, this solution works equally well
whether ME-to-SIM communication happens in Class A (5.0 V),
Class B (3.0 V) or Class C (1.8 V) — or, for that matter,
at any voltage between 1.2 and 5.5 V.
We use a 74LVC4T3144 dual supply translating buffer on our sniffer pod
to produce the desired effect.
SIMsniff already works as described above, while SIMemu is currently only a planned idea. The plan for SIMemu is to modify the SIM bus connection pod slightly (retain the 74LVC4T3144 for receiving signals driven by the ME, but also add a 74LVC1G07 OD buffer for talking back to the ME on the SIM I/O line), and change our FPGA gateware from a passive sniffer to card emulation. The FPGA will implement the lowest level of ISO 7816-3 interface in the role of a card, and then we will need to develop host software for all upper layers, including the emulated SIM card file system.
See this Mercurial repository for both SIMsniff and SIMemu.