00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 after aprox. 3CC50 requests

[joniGSM]

Hi,

I was trying to get KI from one old ('99) austrian max.mobil
SIM with Dejan's sim_scan (F5-F1), and after aproximately 3CC50
requests I got six**** red 00 on the screen.

Does that mean that this card is not clonable?
The SIM is still working after so many requests.....

[IvanKrasnyj]

This could be due to another version of COMP128 algorithm being used for GSM authenticatin (A3A8). SimScan as well as Cardinal and FKI use "collisions" based methods for Ki extraction. It seems that your card do not use the compromised COMP128v1 algorithm.

I've got a similar card, which shows all 8 red 00 pairs. It has quite an easy version of A3A8 algorithm implemented. I can check out if the A3A8 algorithm used in your card is the same as mine.
(Mine permits another easy means for Ki extraction)

I need some diagnostic outputs from your card.
If you are still interested, could you, please, test RUN GSM ALGORITHM function on your card?

First, you need a tool for manual APDU issuing for your reader (Phoenix, MAKI, etc.) You can use this one: http://www.sendme.cz/mfg/software/gsexv201.zip
(GSM SIM Explorer 2.01)

- You need to disable PIN1 (from your phone)
- Configure and run GSM Sim Explorer and chose Manual Command mode.

Then type APDU commands to your SIM-card:

1. Select DFgsm: A0A40000027F20
2. RUN GSM ALGORITHM function for RAND=0000... :
A08800001000000000000000000000000000000000
3. Read the response: A0C000000C ==> SRES,Kc (12 bytes, 1-st output)
4. RUN GSM ALGORITHM function for RAND=FFFF... :
A088000010FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
5. Read the response: A0C000000C ==> SRES,Kc (12 bytes, 2-d output)
6. RUN GSM ALGORITHM function for RAND=1111... :
A08800001011111111111111111111111111111111
7. Read the response: A0C000000C ==> SRES,Kc (12 bytes, 3-d output)

Post the 3 outputs to my e-mail address [email protected] (or to the Forum)

Thanks in advance
Ivan

[sadia]

Hi,
whats is another easy means for Ki extraction ?


Thanks

[joniGSM]

Is this gsexv tool working with dejan's reader?
I was trying various cmd line settings, but none of them work.

[IvanKrasnyj]

I've tested dejan's reader with SIM Explorer. The reader is powered from COM-port signal lines. It hasn't light up the LED. This means that SIM Explorer do not provide required voltage to COM-port lines (I don't know exactly which ones )
The author has tested SIM Explorer only with MAKI. You can look for another APDU tool or another reader.

As for my case, I've got developer's Atmel AT90SC3232 card and flashed the card OS from Windows Powered SmartCard (WPSC) Toolkit (preconfigured for GSM applications). I've also wrote down to the card IMSI and Ki extracted from my original SIM. I've tested RUN GSM ALGORITHM function and found that WPSC's RUN GSM ALGORITHM function reply (SRES, Kc) differs from my original SIM's reply for the same Ki and RAND.

I've decided that it was not COMP128v1 implemented in WPSC Toolkit. First I thought that it was a COMP128v2... ) but a few APDU tests showed that it was not ... just a fake

A simple APDU request A088000010 00000000000000000000000000000000 strips down first 12 bytes for Ki in (SRES, Kc) responce. The rest 4 bytes of Ki do not affect anything. Plaing with RAND's request I've found that the algorithm performs just per byte operations. I doubt if any GSM operator will venture to use this algorithm for authentication. As for SimScan, - of course, it failed to discower any figure for Ki because of the different algorithm being used.

Now I'm going to dock COMP128v1 to WPSC as a run-time application.

[achin_ji]

Hello sir
Sir I m sending APDU using WINEXPLORER to MY sim card
apdu:> A0 A4 00 00 02 7F 10
BUT IT IS NOT RESPOMDING WEEL
BUT IF I SEND
APDU:> A0 A4 00 00 02 R06 7F 10 R04
THEN IT IS RESPONDING WELL
SIR COULD U PLZ SPECIFY Y?
ACHIN JAIN

[email protected]

[Nuken]

To Ivan: if last 10 bits from SRES+Kc are not 0000..0 it means you have not comp128v1.

[CH@IN]

Originally Posted by Nuken

To Ivan: if last 10 bits from SRES+Kc are not 0000..0 it means you have not comp128v1.

Ivan sent this question 4 years ago. I think he knows the answer meanwhile