INITIALIZING_ACCESS_PROTOCOL...
← Back to Tools Console
[ SYSTEM_NOTICE :: TOP_RESEARCH_NODE ]
System Node · Research Ready · PYSIM
pySim — SIM Card Programming & USIM File Analysis
Research Overview
TL;DR — pySim is an open-source Python tool for reading, writing, and programming SIM, USIM, and ISIM cards via PC/SC-compatible ISO/IEC 7816 readers. It implements the Elementary File (EF) structure defined in 3GPP TS 31.102 for USIM, supporting direct access to EF.ICCID, EF.IMSI, EF.MSISDN, EF.ACC, EF.HPPLMN, EF.OPLMNwACT, and carrier-specific extensions. Security researchers use pySim to audit USIM provisioning, inspect USAT application trees for OTA attack surface (SIMjacker-adjacent STK handlers), and program blank test SIMs with custom Ki/OPc values for 5G testbed deployments alongside Open5GS and srsRAN.
pySim operates over the PC/SC interface (ISO/IEC 7816-4) to communicate with SIM, USIM, and ISIM applications hosted on UICC cards. It implements the Elementary File (EF) structure defined in 3GPP TS 31.102 for USIM and TS 31.103 for ISIM, allowing direct read/write access to files such as EF.ICCID, EF.IMSI, EF.MSISDN, EF.SMSP, EF.ACC, EF.HPPLMN, and EF.ADN without requiring a live network connection. Researchers can enumerate card capabilities, extract authentication parameters, and inspect proprietary OEM extensions beyond the standardised EF tree.
When programming blank test SIMs or SysmoUSIM cards, pySim writes Ki, OPc, and ICCID values using APDU sequences conformant with TS 31.102 Annex C, enabling construction of controlled USIM profiles for testbed use alongside tools such as Open5GS and srsRAN. The tool also supports USAT (USIM Application Toolkit) file inspection via TS 31.111, exposing STK menu items and bearer-independent protocol capabilities that may constitute unaudited attack surface on commercial carrier SIMs.
Security auditors use pySim to compare EF.LOCI, EF.PSLOCI, and EF.EPSLOCI across cards — files that persist last-known LAI, RAI, and TAI values — to correlate historical network attachment data as part of IMSI and location privacy assessments. Combined with SIMtester for runtime SIM Toolkit fuzzing, pySim provides the static file-layer complement needed for a comprehensive UICC security evaluation per GSMA SAS-SM and GSMA FS.07 guidelines.
Key Research Applications
- >Read and decode USIM EF structure (EF.IMSI, EF.ACC, EF.HPPLMN, EF.OPLMNwACT) on carrier SIMs to audit provisioning and roaming partner lists per 3GPP TS 31.102
- >Program blank SysmoUSIM-SJS1 or sysmoISIM-SJA5 cards with custom Ki/OPc/ICCID for 5G testbed deployment with Open5GS core and srsRAN gNodeB
- >Inspect USAT file tree (EF.DIR, EF.ARR, EF.USIM_SRV) to enumerate STK capabilities and identify OTA attack surface on commercial carrier SIM cards
- >Extract and compare EF.LOCI, EF.PSLOCI, and EF.EPSLOCI location history fields during UICC forensic analysis or IMSI privacy research engagements
Technical Specifications
Operational Mode
Level 2 certification required. Targeting SIM Cards infrastructure layers.
Compatibility
Smartcard reader and PC/SC drivers required.
Secure Audit Threat Vectors
Unprotected UICC files expose authentication vectors and subscriber identity data foundational to telecom fraud and surveillance attacks. EF.Ki, when not hardware-protected by the card OS, can be extracted via pySim APDUs and combined with a known-plaintext attack; recovered Ki values enable SIM cloning attacks that bypass 3GPP TS 33.102 AKA without alerting the serving network. EF.ACC (Access Class bits) manipulation can selectively deny service to emergency access classes or grant priority access, directly impacting network resilience per 3GPP TS 22.011 access control requirements.
Carrier-provisioned USAT applications loaded into EF.DIR and managed via EF.ARR may contain proprietary STK handlers that accept bearer-independent protocol (BIP) commands over OTA channels (TS 31.115/116). Maliciously crafted OTA binary SMS payloads targeting vulnerable STK implementations — discoverable through pySim's EF enumeration — have historically enabled remote UICC compromise (SIMjacker, WIBattack). Post-exploitation, a compromised STK application can issue silent SEND SS, OPEN CHANNEL, or SEND DATA commands, bypassing NAS-layer controls and operator audit trails entirely.
Frequently Asked Questions
What is pySim — SIM Card Programming Tool?
pySim — SIM Card Programming Tool is an open-source telecom security utility in the SIM Cards category. pySim is an open-source Python tool for reading, writing, and programming SIM, USIM, and ISIM cards via PC/SC-compatible ISO/IEC 7816 readers. It implements the Elementary File (EF) structure defined in 3GPP TS 31.102 for USIM, supporting direct access to EF.ICCID, EF.IMSI, EF.MSISDN, EF.ACC, EF.HPPLMN, EF.OPLMNwACT, and carrier-specific extensions. Security researchers use pySim to audit USIM provisioning, inspect USAT application trees for OTA attack surface (SIMjacker-adjacent STK handlers), and program blank test SIMs with custom Ki/OPc values for 5G testbed deployments alongside Open5GS and srsRAN.
Which category does pySim — SIM Card Programming Tool belong to?
pySim — SIM Card Programming Tool is categorized under SIM Cards in the TelcoSec Tools console. This category covers tools used for auditing SIM card OTA security, APDU command surfaces, and Toolkit Application Reference vulnerabilities.
Does pySim require special hardware to interface with SIM cards?
pySim works with any PC/SC-compliant smart card reader (e.g., ACR38U, Identiv SCR3310) over the ISO/IEC 7816 T=0/T=1 protocol; a SIM-to-smart-card adapter is needed for SIM-sized cards. Certain operations — particularly writing Ki or programming blank cards — require the card's ADM (Administrative) PIN, which is only available for test SIMs (SysmoUSIM, sysmoISIM) or SIMs where the operator has supplied the ADM credential. Commercial carrier SIMs permit read-only access to unprotected EFs but will reject ADM-gated write commands.
Can pySim read 5G USIM files such as SUPI and subscription concealment keys?
Yes. pySim supports EF.Routing_Indicator and EF.SUCI_Calc_Info defined in 3GPP TS 31.102 Release 15 and later, including the Home Network Public Key used for SUPI concealment via ECIES Profile A or B. Auditors can verify that the correct public key is provisioned and that the protection scheme identifier matches operator policy — critical because a misconfigured or absent SUCI public key causes the UE to fall back to transmitting the unprotected SUPI, negating one of 5G NR's primary subscriber privacy improvements over LTE.
ADVANCED_TRAININGSIM Cards Security PathRecommended for: pySim — SIM Card Programming Tool
Master pySim — SIM Card Programming Tool Security at the Academy
Upgrade your skill set from running automated modules to manual exploit engineering. Learn deep protocol auditing, signaling vulnerabilities, and baseband hardware analysis inside our virtual environments.
•Hands-On Virtual Labs
•SDR & RF Sandbox Kits
•Industry-Recognized Certs
Research Credentials
Tool Feedback
Found a bug, have a feature request, or a technical question about pySim — SIM Card Programming Tool? Send it directly to the research team.