SIMtrace Card Emulation

---

Card Emulation on simtrace2 under Arch/Manjaro

I ran into some troubles setting everything up under Manjaro/Arch and document the troubleshooting as follows. All of this is about card emulation via cardem.

Problem: Using the default firmware, the phone shows "invalid SIM card" and handing over the commercial SIM does not work.

System and Setup

$ lsb_release -a
LSB Version:    n/a
Distributor ID: ManjaroLinux
Description:    Manjaro Linux
Release:        21.0.4
Codename:       Ornara

1. Smart card reader in the computer, commercial SIM attached, tested via pcsc_scan
2. simtrace2 attached to the computer via USB, tested via dfu-util --list and ./simtrace2-list
3. Oneplus 6T, rooted, attached via nano SIM breakout
4. Remote control via adb (optional)

Building Things

I was not satisfied with the AUR version of libosmocore and needed to build the firmware manually, so the following documents how to first build libosmocore, then simtrace, and then the cardem firmware.

Libosmocore

Both AUR versions didn't really work for me, I've tested with 2 due to 1 being out of date:

2 aur/libosmocore-git 0.9.6.r165.ff20641-1 (+1 0.00) 
    Osmocom core library

1 aur/libosmocore 1.3.0-1 (+15 0.00) (Out-of-date: 2020-07-29) 
    core libs for osmocom

Building libosmocore

Installing the requirements was straightforward for libosmocore, so I'll skip it here. After the requirements, follow the wiki tutorial:

git clone git://git.osmocom.org/libosmocore.git
cd libosmocore
autoreconf -fi
./configure
make
sudo make install

Then the first problem occured: although libosmocore was installed successfully, simtrace would not find it when running ./configure:

configure: error: Package requirements (libosmocore >= 1.0.0) were not met:
Package 'libosmocore', required by 'virtual:world', not found

The reason for this is chaos in the pkgconf paths. For me, manually adding the path did not help because the .pc files were not in the right place:

export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig

The solution in my case was copying the .pc files from the libosmocore dir to the default pkgconf path:

sudo cp libosmocore/*.pc /usr/lib/pkgconfig

After that, the simtrace ./configure worked and I could build it.

Card Emulation

To test different firmwares, I checked out origin/hoernchen/simtrace_cardem (others might also work) and built the cardem firmware manually. The cross-compile process on Arch/Manjaro introduced another problem resulting in stdlib not being found:

libosmocore/source/backtrace.c:28:10: fatal error: stdlib.h: No such file or directory
    28 | #include <stdlib.h>
        |          ^~~~~~~~~~

This can be fixed via

sudo pacman -S arm-none-eabi-gcc arm-none-eabi-newlib

I had arm-none-eabi-gcc installed, but only adding arm-none-eabi-newlib solved the problem for me. After that building the firmware worked well, in my particular setting I used

make APP=cardem BOARD=simtrace MEM=dfu

After that I could flash the firmware and the card emulation worked.

Flashing and Runing cardem

Check if the simtrace is detected and get the device information:

dfu-util --list

Go to the simtrace repo:

cd Documents/Repos/simtrace2/host/src

Flash the device, --device info might need to be adjusted:

dfu-util --device 1d50:60e3 --cfg 1 --alt 1 --reset --download path-to-repo/simtrace2/firmware/bin/simtrace-cardem-dfu.bin

After flashing, it should look like this:

./simtrace2-list
USB matches: 1
        1d50:60e3 Addr=22, Path=6-1.2.3, Cfg=1, Intf=0, Alt=0: 255/2/0 (CardEmulator Modem 1)

Running Cardem

From the wiki with some extensions:

1. power off phone
2. insert card adapter cable into phone
3. insert card adapter cable SIMtrace v2 board
4. plug SIMtrace v2 board in host computer USB port
5. connect external card reader to host (any USB CCID reader should do the job)
6. ensure a card is present in the reader slot (not in the SIMtrace port)
7. check if the card is detected by the reader (use CTRL-C to exit)

For the next step it's important to use the correct device information and path:

1. sudo ./simtrace2-cardem-pcsc -V 1d50 -P 60e3 -C 1 -H "6-1.2.3"
2. power on phone

After fixing all the above, I could successfully emulate the commercial SIM :)