356 lines
10 KiB
Java
Executable File
356 lines
10 KiB
Java
Executable File
/* Copyright 2020 sysmocom s.f.m.c. GmbH
|
|
* SPDX-License-Identifier: Apache-2.0 */
|
|
package org.osmocom.IMSIPseudo;
|
|
|
|
import sim.access.*;
|
|
import sim.toolkit.*;
|
|
import javacard.framework.*;
|
|
|
|
public class IMSIPseudo extends Applet implements ToolkitInterface, ToolkitConstants {
|
|
// DON'T DECLARE USELESS INSTANCE VARIABLES! They get saved to the EEPROM,
|
|
// which has a limited number of write cycles.
|
|
|
|
private byte STKServicesMenuId;
|
|
private SIMView gsmFile;
|
|
static byte[] LUCounter = new byte[] { '0', 'x', ' ', 'L', 'U' };
|
|
|
|
/* Main menu */
|
|
private static final byte[] title = new byte[] { 'I', 'M', 'S', 'I', ' ', 'P', 's', 'e', 'u', 'd', 'o', 'n', 'y', 'm',
|
|
'i', 'z', 'a', 't', 'i', 'o', 'n'};
|
|
private static final byte[] showLU = new byte[] {'S', 'h', 'o', 'w', ' ', 'L', 'U', ' ', 'c', 'o', 'u', 'n', 't', 'e', 'r'};
|
|
private static final byte[] showIMSI = new byte[] {'S', 'h', 'o', 'w', ' ', 'I', 'M', 'S', 'I'};
|
|
private static final byte[] changeIMSI = new byte[] {'C', 'h', 'a', 'n', 'g', 'e', ' ', 'I', 'M', 'S', 'I', ' '};
|
|
private final Object[] itemListMain = {title, showLU, showIMSI, changeIMSI};
|
|
|
|
/* Change IMSI menu */
|
|
private static final byte[] enterIMSI = new byte[] {'E', 'n', 't', 'e', 'r', ' ', 'I', 'M', 'S', 'I' };
|
|
private static final byte[] setDigit1 = new byte[] {'S', 'e', 't', ' ', '1', ' ', 'a', 's', ' ', 'l', 'a', 's', 't', ' ',
|
|
'd', 'i', 'g', 'i', 't'};
|
|
private static final byte[] setDigit2 = new byte[] {'S', 'e', 't', ' ', '2', ' ', 'a', 's', ' ', 'l', 'a', 's', 't', ' ',
|
|
'd', 'i', 'g', 'i', 't'};
|
|
private final Object[] itemListChangeIMSI = {changeIMSI, enterIMSI, setDigit1, setDigit2};
|
|
|
|
private static final byte MI_IMSI = 1;
|
|
|
|
private IMSIPseudo() {
|
|
gsmFile = SIMSystem.getTheSIMView();
|
|
|
|
/* Register menu and trigger on location updates */
|
|
ToolkitRegistry reg = ToolkitRegistry.getEntry();
|
|
STKServicesMenuId = reg.initMenuEntry(title, (short)0, (short)title.length, PRO_CMD_SELECT_ITEM, false,
|
|
(byte)0, (short)0);
|
|
reg.setEvent(EVENT_EVENT_DOWNLOAD_LOCATION_STATUS);
|
|
}
|
|
|
|
public static void install(byte[] bArray, short bOffset, byte bLength) {
|
|
IMSIPseudo applet = new IMSIPseudo();
|
|
applet.register();
|
|
}
|
|
|
|
public void process(APDU arg0) throws ISOException {
|
|
if (selectingApplet())
|
|
return;
|
|
}
|
|
|
|
public void processToolkit(byte event) throws ToolkitException {
|
|
EnvelopeHandler envHdlr = EnvelopeHandler.getTheHandler();
|
|
|
|
if (event == EVENT_MENU_SELECTION) {
|
|
byte selectedItemId = envHdlr.getItemIdentifier();
|
|
|
|
if (selectedItemId == STKServicesMenuId) {
|
|
showMenu(itemListMain, (byte)4);
|
|
handleMenuResponseMain();
|
|
}
|
|
}
|
|
|
|
if (event == EVENT_EVENT_DOWNLOAD_LOCATION_STATUS) {
|
|
LUCounter[0]++;
|
|
showMsg(LUCounter);
|
|
}
|
|
}
|
|
|
|
private void showMenu(Object[] itemList, byte itemCount) {
|
|
ProactiveHandler proHdlr = ProactiveHandler.getTheHandler();
|
|
proHdlr.init((byte) PRO_CMD_SELECT_ITEM,(byte)0,DEV_ID_ME);
|
|
|
|
for (byte i=(byte)0;i<itemCount;i++) {
|
|
if (i == 0) {
|
|
/* Title */
|
|
proHdlr.appendTLV((byte)(TAG_ALPHA_IDENTIFIER | TAG_SET_CR), (byte[])itemList[i],
|
|
(short)0, (short)((byte[])itemList[i]).length);
|
|
|
|
} else {
|
|
/* Menu entry */
|
|
proHdlr.appendTLV((byte)(TAG_ITEM | TAG_SET_CR), (byte)i, (byte[])itemList[i], (short)0,
|
|
(short)((byte[])itemList[i]).length);
|
|
}
|
|
}
|
|
proHdlr.send();
|
|
}
|
|
|
|
private void showMsg(byte[] msg) {
|
|
ProactiveHandler proHdlr = ProactiveHandler.getTheHandler();
|
|
proHdlr.initDisplayText((byte)0, DCS_8_BIT_DATA, msg, (short)0, (short)(msg.length));
|
|
proHdlr.send();
|
|
}
|
|
|
|
private byte[] getResponse()
|
|
{
|
|
ProactiveResponseHandler rspHdlr = ProactiveResponseHandler.getTheHandler();
|
|
byte[] resp = new byte[rspHdlr.getTextStringLength()];
|
|
rspHdlr.copyTextString(resp, (short)0);
|
|
return resp;
|
|
}
|
|
|
|
private byte[] showMsgAndWaitKey(byte[] msg) {
|
|
ProactiveHandler proHdlr = ProactiveHandler.getTheHandler();
|
|
proHdlr.initGetInkey((byte)0, DCS_8_BIT_DATA, msg, (short)0, (short)(msg.length));
|
|
proHdlr.send();
|
|
|
|
return getResponse();
|
|
}
|
|
|
|
private byte[] prompt(byte[] msg, short minLen, short maxLen) {
|
|
/* if maxLen < 1, the applet crashes */
|
|
if (maxLen < 1)
|
|
maxLen = 1;
|
|
|
|
ProactiveHandler proHdlr = ProactiveHandler.getTheHandler();
|
|
proHdlr.initGetInput((byte)0, DCS_8_BIT_DATA, msg, (short)0, (short)(msg.length), minLen, maxLen);
|
|
proHdlr.send();
|
|
|
|
return getResponse();
|
|
}
|
|
|
|
private void showError(short code) {
|
|
byte[] msg = new byte[] {'E', '?', '?'};
|
|
msg[1] = (byte)('0' + code / 10);
|
|
msg[2] = (byte)('0' + code % 10);
|
|
showMsg(msg);
|
|
}
|
|
|
|
/* Convert BCD-encoded digit into printable character
|
|
* \param[in] bcd A single BCD-encoded digit
|
|
* \returns single printable character
|
|
*/
|
|
private byte bcd2char(byte bcd)
|
|
{
|
|
if (bcd < 0xa)
|
|
return (byte)('0' + bcd);
|
|
else
|
|
return (byte)('A' + (bcd - 0xa));
|
|
}
|
|
|
|
private byte char2bcd(byte c)
|
|
{
|
|
if (c >= '0' && c <= '9')
|
|
return (byte)(c - '0');
|
|
else if (c >= 'A' && c <= 'F')
|
|
return (byte)(0xa + (c - 'A'));
|
|
else if (c >= 'a' && c <= 'f')
|
|
return (byte)(0xa + (c - 'a'));
|
|
else
|
|
return 0;
|
|
}
|
|
|
|
/* Convert BCD to string.
|
|
* The given nibble offsets are interpreted in BCD order, i.e. nibble 0 is bcd[0] & 0xf, nibble 1 is bcd[0] >> 4, nibble
|
|
* 3 is bcd[1] & 0xf, etc..
|
|
* \param[out] dst Output byte array.
|
|
* \param[in] dst_ofs Where to start writing in dst.
|
|
* \param[in] dst_len How many bytes are available at dst_ofs.
|
|
* \param[in] bcd Binary coded data buffer.
|
|
* \param[in] start_nibble Offset to start from, in nibbles.
|
|
* \param[in] end_nibble Offset to stop before, in nibbles.
|
|
* \param[in] allow_hex If false, return false if there are digits other than 0-9.
|
|
* \returns true on success, false otherwise
|
|
*/
|
|
private boolean bcd2str(byte dst[], byte dst_ofs, byte dst_len,
|
|
byte bcd[], byte start_nibble, byte end_nibble, boolean allow_hex)
|
|
{
|
|
byte nibble_i;
|
|
byte dst_i = dst_ofs;
|
|
byte dst_end = (byte)(dst_ofs + dst_len);
|
|
boolean rc = true;
|
|
|
|
for (nibble_i = start_nibble; nibble_i < end_nibble && dst_i < dst_end; nibble_i++, dst_i++) {
|
|
byte nibble = bcd[(byte)nibble_i >> 1];
|
|
if ((nibble_i & 1) != 0)
|
|
nibble >>= 4;
|
|
nibble &= 0xf;
|
|
|
|
if (!allow_hex && nibble > 9)
|
|
rc = false;
|
|
|
|
dst[dst_i] = bcd2char(nibble);
|
|
}
|
|
|
|
return rc;
|
|
}
|
|
|
|
private byte mi2str(byte dst[], byte dst_ofs, byte dst_len,
|
|
byte mi[], boolean allow_hex)
|
|
{
|
|
/* The IMSI byte array by example:
|
|
* 08 99 10 07 00 00 10 74 90
|
|
*
|
|
* This is encoded according to 3GPP TS 24.008 10.5.1.4 Mobile
|
|
* Identity, short the Mobile Identity IEI:
|
|
*
|
|
* 08 length for the following MI, in bytes.
|
|
* 9 = 0b1001
|
|
* 1 = odd nr of digits
|
|
* 001 = MI type = IMSI
|
|
* 9 first IMSI digit (BCD)
|
|
* 0 second digit
|
|
* 1 third
|
|
* ...
|
|
* 0 14th digit
|
|
* 9 15th and last digit
|
|
*
|
|
* If the IMSI had an even number of digits:
|
|
*
|
|
* 08 98 10 07 00 00 10 74 f0
|
|
*
|
|
* 08 length for the following MI, in bytes.
|
|
* 8 = 0b0001
|
|
* 0 = even nr of digits
|
|
* 001 = MI type = IMSI
|
|
* 9 first IMSI digit
|
|
* 0 second digit
|
|
* 1 third
|
|
* ...
|
|
* 0 14th and last digit
|
|
* f filler
|
|
*/
|
|
byte bytelen = mi[0];
|
|
byte mi_type = (byte)(mi[1] & 0xf);
|
|
boolean odd_nr_of_digits = ((mi_type & 0x08) != 0);
|
|
byte start_nibble = 2 + 1; // 2 to skip the bytelen, 1 to skip the mi_type
|
|
byte end_nibble = (byte)(2 + bytelen * 2 - (odd_nr_of_digits ? 0 : 1));
|
|
bcd2str(dst, dst_ofs, dst_len, mi, start_nibble, end_nibble, allow_hex);
|
|
return (byte)(end_nibble - start_nibble);
|
|
}
|
|
|
|
private byte[] str2mi(byte str[], byte mi_type)
|
|
{
|
|
/* 1 byte of MI length.
|
|
* 1 nibble of mi_type.
|
|
* str.length nibbles of MI BCD.
|
|
* The first MI digit is in the high-nibble of the mi_type, so an odd amount of digits becomes
|
|
* (1 + str.length)/2 bytes; an even amount of digits has same amount of bytes with the last
|
|
* nibble unused (0xf0). */
|
|
byte len = (byte)(1 + (byte)(1 + str.length)/2);
|
|
byte mi[] = new byte[1 + len];
|
|
mi[0] = len;
|
|
|
|
boolean odd_digits = ((str.length & 1) != 0);
|
|
mi_type = (byte)(mi_type & 0x07);
|
|
if (odd_digits)
|
|
mi_type |= 0x08;
|
|
mi[1] = (byte)((char2bcd(str[0]) << 4) + mi_type);
|
|
byte str_i = 1;
|
|
for (byte bcd_i = 1; bcd_i < len; bcd_i++) {
|
|
byte data = char2bcd(str[str_i]);
|
|
str_i++;
|
|
if (str_i < str.length) {
|
|
data |= char2bcd(str[str_i]) << 4;
|
|
str_i++;
|
|
} else
|
|
data |= 0xf0;
|
|
mi[1 + bcd_i] = data;
|
|
}
|
|
return mi;
|
|
}
|
|
|
|
private byte nibble2hex(byte nibble)
|
|
{
|
|
nibble = (byte)(nibble & 0xf);
|
|
if (nibble < 0xa)
|
|
return (byte)('0' + nibble);
|
|
else
|
|
return (byte)('a' + nibble - 0xa);
|
|
}
|
|
|
|
private byte[] hexdump(byte data[])
|
|
{
|
|
byte res[] = new byte[(byte)(data.length*2)];
|
|
for (byte i = 0; i < data.length; i++) {
|
|
res[(byte)(i*2)] = nibble2hex((byte)(data[i] >> 4));
|
|
res[(byte)(i*2 + 1)] = nibble2hex(data[i]);
|
|
}
|
|
return res;
|
|
}
|
|
|
|
private void showIMSI() {
|
|
/* 3GPP TS 31.102 4.2.2: IMSI */
|
|
byte[] msg = {'C', 'u', 'r', 'r', 'e', 'n', 't', ' ', 'I', 'M', 'S', 'I', ':', ' ',
|
|
' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' '};
|
|
|
|
try {
|
|
byte IMSI[] = readIMSI();
|
|
mi2str(msg, (byte)14, (byte)16, IMSI, false);
|
|
showMsgAndWaitKey(msg);
|
|
} catch (SIMViewException e) {
|
|
showError(e.getReason());
|
|
}
|
|
}
|
|
|
|
private void handleMenuResponseMain() {
|
|
ProactiveResponseHandler rspHdlr = ProactiveResponseHandler.getTheHandler();
|
|
|
|
switch (rspHdlr.getItemIdentifier()) {
|
|
case 1: /* Show LU counter */
|
|
showMsg(LUCounter);
|
|
break;
|
|
case 2: /* Show IMSI */
|
|
showIMSI();
|
|
break;
|
|
case 3: /* Change IMSI */
|
|
showMenu(itemListChangeIMSI, (byte)4);
|
|
handleMenuResponseChangeIMSI();
|
|
break;
|
|
}
|
|
}
|
|
|
|
private void handleMenuResponseChangeIMSI() {
|
|
ProactiveResponseHandler rspHdlr = ProactiveResponseHandler.getTheHandler();
|
|
switch (rspHdlr.getItemIdentifier()) {
|
|
case 1: /* enter IMSI */
|
|
promptIMSI();
|
|
break;
|
|
case 2: /* set last digit to 1 */
|
|
promptIMSI();
|
|
break;
|
|
case 3: /* set last digit to 2 */
|
|
promptIMSI();
|
|
break;
|
|
}
|
|
}
|
|
|
|
private void promptIMSI()
|
|
{
|
|
byte[] msg = {'N', 'e', 'w', ' ', 'I', 'M', 'S', 'I', '?'};
|
|
byte imsi[] = prompt(msg, (short)0, (short)15);
|
|
byte mi[] = str2mi(imsi, MI_IMSI);
|
|
showMsgAndWaitKey(hexdump(mi));
|
|
}
|
|
|
|
private byte[] readIMSI()
|
|
{
|
|
gsmFile.select((short) SIMView.FID_DF_GSM);
|
|
gsmFile.select((short) SIMView.FID_EF_IMSI);
|
|
byte[] IMSI = new byte[9];
|
|
gsmFile.readBinary((short)0, IMSI, (short)0, (short)9);
|
|
return IMSI;
|
|
}
|
|
|
|
private void writeIMSI(byte mi[])
|
|
{
|
|
gsmFile.select((short) SIMView.FID_DF_GSM);
|
|
gsmFile.select((short) SIMView.FID_EF_IMSI);
|
|
gsmFile.updateBinary((short)0, mi, (short)0, (short)mi.length);
|
|
}
|
|
}
|