Last Update: 15.07.1999
SIM-PIC V2.3 oooooooooooooooooooooo
Ronny's SIM-PIC.
NEW!!! Sim-Pic V2.3 (includes A3A8 Algorithm!)
This version of Sim-Pic is a GSM Sim card emulator for the GSM Mobile Phone made for the GoldWafer (Pic16f84 + 24c16). V2.3 includes a lot of goodies: Pin Code (8 digits), ~20 Records and Binaries, A3A8 Algorithm procedure + tables, PhoneBook of 7 numbers, procedure to write or modify the content of the 24c16 eeprom with normal ISO card programming commands.
To make Sim-Pic work, all the Records, Binaries, Ki... must be read from your original Sim and copied to the 24c16 eeprom in the wafer. I will try to describe step by step how to do that. V2.3 is a test version so try it and send an email if successful. It contains a new procedure for receive/transmit byte so hopefully it works on all phones. It was just tested with my old Nokia 2110 and my new 6110. Who knows, maybe it's not Y2K bug safe too ;-)
WAFERS

If you don't feel like buying a wafer and your phone supports a full size Sim then you can make the following PCB or use the chip contacts of a phone card.
 This single Pic wafer (White Wafer) can be used with Sim-Pic version 1.0  or with the Motorola test card only.
To use Sim-Pic v2.3 you must have this piece of hardware! The Gold Wafer contains the Pic16f84 + an additional memory of 16Kbit from the external EEprom 24c16.
You can build one but if your phone is happy just with a mini size Sim then forget it! For a relatively low price, you can buy a Gold Wafer at Techtronics or at MaxKing and cut it to mini size with the help of your original Sim.

Basicaly the need of the 24c16 was because of the 5 giant Tables of the A3A8 Algorithm. The biggest Table (Table 0) is 4Kbit long! Tables 1,2,3,4 are 2Kbit, 1Kbit, 512bits, 256bits long.

The content of the Wafer V2.3:
Pic16f84: the concrete code (not to be modified!).
Internal EEprom (Pic16f84): ATR, list of valid INSTRUCTIONS (INS), list of valid file addr.
External EEprom (24c16): Pin, Ki, Records, Binaries, A3A8 Tables, PhoneBook.
 
PROGRAMING THE 24C16
To be able to program the Wafer successfully, first the file SimPic23.hex has to be burned in the Pic. Once the Pic is programmed the wafer can receive ISO card commands for programming the 24c16. The best software for doing that is WINEXPLORER V3.6 by Dexter. Download & Configuration

The 24c16 contains 8 pages, each 2Kbit long (256 bytes)
The ISO card command syntaxes: 
Reading Page 0 - 7 .
A0 BB 00 00 00     RFF R01 BB is an Instruction defined by me (not a GSM inst.) for reading the content of the 24c16 eeprom. This command syntax will read PAGE 0 of the eeprom which is FF+1 bytes (hex) = 256 bytes long.
P1 defines the page number.
A0 BB 01 00 00     RFF R01
A0 BB 02 00 00     RFF R01
A0 BB 03 00 00     RFF R01
A0 BB 04 00 00     RFF R01
A0 BB 05 00 00     RFF R01
A0 BB 06 00 00     RFF R01
A0 BB 07 00 00     RFF R01
That should read all the eeprom content
(8 pages, 0-7).
If P1 = 1 then read Page 1
If P1 = 7 then read Page 7... Got it?
Note: R is for Receive.

See Example!

Writing 1 - 10 bytes .
A0 AA 00 00 01     R01 81 R02 Instruction AA is writing 1 till 10 (hex) =16 bytes in the EEprom.
P1 defines the Page number.
P2 defines the Address in the Page.
LEN defines the number of bytes to be written.
In this example, one byte 81 will be written in PAGE 0, Address 0. (The first location in the EEprom)
A0 AA 01 30 02     R01 88 88 R02 Here two bytes 88 88 will be written in Page 1 at Address 30, 31
R01 is the BYTE RETURN (AA)
R02 are the STATUS BYTES (90 00) if successful.

See Example!

A3A8 Algorithm is what makes v2.3 beautiful :-) It works 100% correct but not 100% as fast as an original Sim. That is not much of a problem (not with my phones) because of repeated command syntax from the phone. For example, the phone is sending RAND to the Sim and immediately asks for the calculated Kc. Simpic is not ready and doesn't respond so the phone repeats the command. By then the Kc is calculated and simpic outputs it to the phone and the data dialog continues as normal.
Looks like this:
A0 88 00 00 10
88 CD 55 10 F3 79 C4 16 B1 F8 0C 2E 1E 1B 69 6F EB 9F 0C
A0 C0 00 00 0C
...
A0 C0 00 00 0C
C0 97 7D 7E 05 BF 96 7E 99 7C 09 2C 00 90 00
The Algorithm takes about 70% of the pic's memory and that's sad cause with all the compression that I did to the code I had to give up a lot of other features that I planed to include in this version. But according to emails that I got, the Algorithm is the most important feature and I agree.
To make the whole thing simpler I wrote a script for Winexplorer to be used after simpic23.hex was programmed in the Pic. The script contains all the data that should be in the 24c16. The data is based on Asim's configuration file sim.dat.
Open the script in WinExplorer, insert your IMSI and Ki and run the script. Your Wafer is then ready to be used.
Unfortunately the ATR in v2.3 is set to use inverse byte convention only.
That's about everything you should know about the new Sim-Pic version. Lower you can find what is where in the 24c16.
 


 

DOWNLOAD!!!
Sim-Pic v1.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . SIMPIC_10.ZIP
Sim-Pic v2.3 . . . . . . . . . . . . . . . . . . . . . . . . . . . SIMPIC_23.ZIP
Script for Sim-Pic V2.3 . . . . . . . . . . . . . . . . . . . . . . . . . . . SCRIPT_23.ZIP
Motorola Test Card . . . . . . . . . . . . . . . . . . . . . . . . . . . TESTCARD.ZIP


 

THE DATA IN THE 24C16  (the names are based on Asim)
Page 0 ADDR 00 - 07 Pin Code
ADDR 10 - 1F Ki
ADDR (20) 21 - 24 7F20:6F05 (LANGUAGE)
ADDR (25) 26 - 2E 7F20:6F07 (IMSI)
ADDR (2F) 30 - 38 7F20:6F20 (Kc)
ADDR (39) 3A - 3E 7F20:6F41 (PRICE PER UNIT)
ADDR (3F) 40 - 6F 7F20:6F30 (PLMN SELECTOR)
ADDR(70) 71 7F20:6F31 (SEARCH PERIOD)
ADDR (72) 73 - 75 7F20:6F37 (ACOUNT MAXIMUM)
ADDR (76) 77 - 7A 7F20:6F38 (SIM SERVICE TABLE)
ADDR (7B) 7C - 7E 7F20:6F39 (ACUMULATED CALL METER
ADDR (7F) 80 - 8F 7F20:6F74 (BROADCAST CONTROL CHANEL)
ADDR (90) 91 - 92 7F20:6F78 (ACCESS CONTROL CLASS)
ADDR (93) 94 - 9F 7F20:6F7B (PLMN PROHIBIDAS)
ADDR (A0) A1 - AB 7F20:6F7E (LOCATION INFORMATION)
ADDR (AC) AD - AF 7F20:6FAD (ADMINISTRATIVE DATA)
ADDR (B0) B1 7F20:6FAE (PHASE IDENTIFICATION)
ADDR (B2) B3 - BC 3F00:2FE2 (CARD SERIAL NUM)
ADDR (BD) BE - BF 7F20:6F10 (Not Implanted) Safer is better :-)
ADDR (C0) C1 - C2 7F10:6F43 (SMS STATUS)
ADDR (D0) D1 - E6 (MESSAGE 7F10)
ADDR (E7) E8 - FD (MESSAGE 7F20)
 
Page 1 ADDR(00) 01 - 0F (MESSAGE 2FE2)
ADDR (10) 11 - 1F (MESSAGE 6F07)
ADDR (20) 21 - 2F (MESSAGE 6F20)
ADDR (30) 31 - 3F (MESSAGE 6F30)
ADDR (40) 41 - 4F (MESSAGE 6F38)
ADDR (50) 51 - 5F (MESSAGE 6F3A)
ADDR (60) 61 - 6F (MESSAGE 6F3B)
ADDR (70) 71 - 7F (MESSAGE 6F3C)
ADDR (80) 81 - 8F (MESSAGE 6F40)
ADDR (90) 91 - 9F (MESSAGE 6F4A)
ADDR (A0) A1 - AF (MESSAGE 6F74)
ADDR (B0) B1 - BF (MESSAGE 6F78)
ADDR (C0) C1 - CF (MESSAGE 6F7B)
ADDR (D0) D1 - DF (MESSAGE 6F7E)
ADDR (E0) E1 - EF (MESSAGE 6FAD)
ADDR (F0) F1 - FF A general message for the remaining addresses.
 
Page 2 ADDR 00 - FF A3A8 TABLE 0 (First half)
Page 3 ADDR 00 - FF A3A8 TABLE 0 (Second half)
Page 4 ADDR 00 - FF A3A8 TABLE 1
Page 5 ADDR 00 - 7F A3A8 TABLE 2
Page 6 ADDR 00 - 3F A3A8 TABLE 3
Page 7 ADDR 00 - 1F A3A8 TABLE 4
ADDR 20 - 3F PHONEBOOK LOCATION 1 
ADDR 40 - 5F PHONEBOOK LOCATION 2 
ADDR 60 - 7F PHONEBOOK LOCATION 3 
ADDR 80 - 9F PHONEBOOK LOCATION 4 
ADDR A0 - BF PHONEBOOK LOCATION 5 
ADDR C0 - DF PHONEBOOK LOCATION 6 
ADDR E0 - EF PHONEBOOK LOCATION 7 

 
MPORTANT: The Address byte in brackets indicates the length of the Record which comes after, and is very important for SimPic to keep those bytes as they are in this Example! Those bytes I call HARD BYTES.
If those bytes are being modified, simpic will output errors. It works so that when you ask simpic to output x bytes of message or record, and x is smaller or equal to LEN of the message, then simpic will output the first x bytes of the specific message. If x is bigger then LEN of message, the ending 67_00 (Wrong LEN) will be returned.

SIM-PIC V1.0 (dos hex generator for the Pic16x84 and White Wafer)
Short description and info: simpic10.html
 
Sim-Pic was made by myself for myself and works fine with the Hardware/Software that I have. I don't guaranty that it will work on all the phone models, after all I don't profit from it and just wanted to share my toys with you. If happens that with the help of Sim-Pic you send to your phone some funny bytes, telling your phone 'Go in self-destruct mode', don't send me an E-mail with the subject: It's your fault.
But if successful, E-mails are welcome :-)

Thanks to everyone who helped. (Janus, Rick, Goran, Antonio...)
Legal stuff: the SIM-PIC won't help anybody to make free phone call, it's basically doing the same thing like the ASIM on Janus page, not with a PC but with a Pic card. 
Those with original Sims can maximum build clones of their own Sims, those without can
experiment with FF FFs so they can maximum get the menu of the phone working but not logged in the Center.

Final word: if you are not familiar to bits and cards, it's not recommended to use any of what I mentioned above. You might finish with burnt I/O card (programming Pics) or locked SIM ('I thought it was the Pic-card!!') or waste of time. I'm not responsible of any damage you might cause!!!
 

Any ideas or comments,    Email:  SIMPIC@GMX.DE
 
 

 



 










































   ~Created by Ronny Stern~   1999