Every other device this course recommends works over the radio. None of them touches the contact interface, and the contact interface is where modules 5 and 8 live: the certificate chain, the CDOL, the cryptogram. To watch that traffic you need something physically in the slot, between the chip and the terminal reading it.
SIMtrace2 is that thing. It is Osmocom open hardware built on a SAM3 microcontroller, the schematics are published, and sysmocom sells it assembled, so this is a board you buy rather than one you have to be lent. It was designed for SIM cards. A SIM and a payment card are both ISO/IEC 7816 devices in the same slot geometry, which is why it works here at all.
Two firmwares, two jobs#
The board does one job at a time, and which job is decided by the firmware you flash. Getting this wrong is the second most common way to lose an evening, because a board in the wrong mode enumerates perfectly over USB and simply never produces the data you are waiting for.
- Firmware
- trace
- What the board becomes
- A passive tap. The card and the terminal talk to each other exactly as they would anyway, and the board copies what passes.
- Use it for
- Reading a real transaction. This is the mode behind the contact capture in this site's corpus.
- Firmware
- cardem
- What the board becomes
- The card. The terminal is talking to the board, and the board answers, from a card in a PC/SC reader elsewhere or from whatever you decide.
- Use it for
- Emulation and relay. Osmocom's cardem speaks only T=0 to the terminal. The released T=1 research builds on this mode so the board can face an EMV terminal.
A first trace#
With the trace firmware flashed, the host side is two tools: simtrace2-list finds attached boards, and simtrace2-sniff runs the tap. Emulation has a tool of its own: Osmocom's simtrace2-cardem-pcsc, or simtrace2-remsim from the T=1 research, which is the one that can face an EMV terminal. Check that the board is seen first. It enumerates as USB vendor 0x1d50, product 0x60e3, and that pair is what you grep for when nothing appears.
Then start the sniffer and open Wireshark on the loopback interface. The traffic does not arrive as raw bytes on a terminal: simtrace2-sniff encapsulates it as GSMTAP and sends it to 127.0.0.1 by default, which means Wireshark dissects it for you. You will see the ATR come past first, then every APDU pair, as they happen.
Once the APDUs are flowing, everything the rest of this course teaches applies unchanged. Copy a response out of Wireshark, paste it into the decoder on this site, and you are reading the same tag-length-value structures the corpus captures are made of, except this time you produced them.