How to program Amarisoft test sim card

 

AMARI test sim card is a programmable USIM card configured with predefined values :

• IMSI: 001010123456789
• AUthentication algorithm: XOR
• Ki: 00112233445566778899aabbccddeeff
• Admin key : 11111111
• Pin: 1234
• PUK: 12345678

Model of programmable sim card:

Note: The Anristsu test sim card delivered in the past are not programmable

To program it, you will need first a card sim reader like the HID OMNIKEY 3121 R31210320-01

On the software side, you can use the pySim-shell for changing parameters such as IMSI, K, OPC values.

See the home page here https://git.osmocom.org/pysim.

The legacy tools pySim-prog.py and pySim-read.py have been superseded by the much more capable pySim-shell.

 

Example of pySim SIM command

 

Start

Start pySim-shell with:

./pySim-shell.py -p0

help: see the available commands

dir: see the directories listing

 

Useful commands to read and update an EF

For transparent EF

read_binary, update_binary, read_binary_decoded, edit_binary_decoded, update_binary_decoded

For linear fixed EF

read_record, update_record, read_record_decoded, edit_record_decoded, update_record_decoded

 

Read SIM card

To export the SIM content, use export command in the master file:

select MF export

 

Change the Home PLMN

Change the IMSI

• use the following commands to edit the content of EF IMSI in JSON format:

verify_adm 11111111 select MF/ADF.USIM/EF.IMSI edit_binary_decoded

• modify "imsi" and save. The new IMSI will be written in the card.
• to verify the modification use the following command:

read_binary_decoded

Change Home PLMN

• edit the Home PLMN mcc and mnc values use the following commands:

select MF/ADF.USIM/EF.EHPLMN edit_binary_decoded

• modify "mcc" and "mnc" and save
• to verify the modification use the following command:

read_binary_decoded

Set the number of digits in mnc

• edit EF AD using the following commands:

select MF/ADF.USIM/EF.AD read_binary

• set the 4th displayed octet to the mnc number of digits 2 or 3 using the command update_binary. For example if the content of EF_AD is 80000002, the command to set the mcc number of digits to 3 is:

update_binary 80000003

• to verify the modification use the following command:

read_binary

 

Change Ki key

• use the following commands to edit the current key configuration:

verify_adm 11111111 select MF/ADF.USIM/EF.USIM_AUTH_KEY edit_binary_decoded

• update "key" and save
• to verify the modification use the following command:

read_binary_decoded

 

Set the SIM algo to XOR or Milenage

The JSON format for XOR and Milenage in EF USIM_AUTH_KEY is:

{ "cfg": { "only_4bytes_res_in_3g": false, "sres_deriv_func_in_2g": 1, "use_opc_instead_of_op": false, "algorithm": "xor" }, "key": "00112233445566778899aabbccddeeff", "op_opc": "000102030405060708090a0b0c0d0e0f" }

Where the allowed values are:

• "only_4bytes_res_in_3g": true, false
• "sres_deriv_func_in_2g": 0, 1
• "use_opc_instead_of_op": true, false
• "algorithm": "xor", "milenage"
• "key": 16 bytes in hexa string format
• "op_opc": 16 bytes OP or OPc in hexa string format

 

Check the SIM algo configured in the card using:

verify_adm 11111111 select MF/ADF.USIM/EF.USIM_AUTH_KEY edit_binary_decoded { "cfg": { "only_4bytes_res_in_3g": false, "sres_deriv_func_in_2g": 1, "use_opc_instead_of_op": false, "algorithm": "xor" }, "key": "00112233445566778899aabbccddeeff", "op_opc": "000102030405060708090a0b0c0d0e0f" }

 

To change for XOR to Milenage, set "algorithm" to "milenage" and configure "use_opc_instead_of_op" and "op_opc", for example:

{ "cfg": { "only_4bytes_res_in_3g": false, "sres_deriv_func_in_2g": 1, "use_opc_instead_of_op": true, "algorithm": "milenage" }, "key": "00112233445566778899aabbccddeeff", "op_opc": "010102030405060708090a0b0c0d0e0f" }

Save and check the new content using:

read_binary_decoded

 

Set the SIM algo to TUAK

The JSON format for TUAK in EF USIM_AUTH_KEY is:

{ "cfg": { "key_length": 128, "sres_deriv_func_in_2g": 1, "use_opc_instead_of_op": true, "algorithm": "tuak" }, "tuak_cfg": { "ck_and_ik_size": 128, "mac_size": 128, "res_size": 128 }, "num_of_keccak_iterations": 4, "op_opc": "101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f", "k": "000102030405060708090a0b0c0d0e0f" }

Where the allowed values are:

• "key_length": 128, 256
• "sres_deriv_func_in_2g": 0, 1
• "use_opc_instead_of_op": true, false
• "algorithm": "tuak"
• "ck_and_ik_size": 128, 256
• "mac_size": 64, 128, 256
• "res_size": 32, 64, 128, 256
• "num_of_keccak_iterations": unsigned 8 bits integer
• "op_opc": 32 bytes in hexa string format
• "k": 16 bytes in hexa string format

 

To set the SIM algo to TUAK:

• configure the content of the JSON structure above
• use the following commands to edit the current configuration:
verify_adm 11111111 select MF/ADF.USIM/EF.USIM_AUTH_KEY edit_binary_decoded
• copy the new JSON content in the editor and save

 

Note: in all of the above, the command "verify_adm 11111111" is required only once

Here you can find the sysmoUSIM/sysmoISIM User Manual

https://www.sysmocom.de/manuals/sysmousim-manual.pdf