├── .gitignore
├── .idea
├── codeStyles
│ └── Project.xml
├── gradle.xml
├── misc.xml
├── runConfigurations.xml
└── vcs.xml
├── app
├── build.gradle
├── proguard-rules.pro
└── src
│ ├── androidTest
│ └── java
│ │ └── com
│ │ └── worthdoingbadly
│ │ └── simserver
│ │ └── ExampleInstrumentedTest.java
│ ├── main
│ ├── AndroidManifest.xml
│ ├── java
│ │ └── com
│ │ │ └── worthdoingbadly
│ │ │ └── simserver
│ │ │ ├── MainActivity.java
│ │ │ └── SimServerMain.java
│ └── res
│ │ ├── drawable-v24
│ │ └── ic_launcher_foreground.xml
│ │ ├── drawable
│ │ └── ic_launcher_background.xml
│ │ ├── layout
│ │ └── activity_main.xml
│ │ ├── mipmap-anydpi-v26
│ │ ├── ic_launcher.xml
│ │ └── ic_launcher_round.xml
│ │ ├── mipmap-hdpi
│ │ ├── ic_launcher.png
│ │ └── ic_launcher_round.png
│ │ ├── mipmap-mdpi
│ │ ├── ic_launcher.png
│ │ └── ic_launcher_round.png
│ │ ├── mipmap-xhdpi
│ │ ├── ic_launcher.png
│ │ └── ic_launcher_round.png
│ │ ├── mipmap-xxhdpi
│ │ ├── ic_launcher.png
│ │ └── ic_launcher_round.png
│ │ ├── mipmap-xxxhdpi
│ │ ├── ic_launcher.png
│ │ └── ic_launcher_round.png
│ │ └── values
│ │ └── strings.xml
│ └── test
│ └── java
│ └── com
│ └── worthdoingbadly
│ └── simserver
│ └── ExampleUnitTest.java
├── build.gradle
├── gradle.properties
├── gradle
└── wrapper
│ ├── gradle-wrapper.jar
│ └── gradle-wrapper.properties
├── gradlew
├── gradlew.bat
├── runsimserver.sh
└── settings.gradle
/.gitignore:
--------------------------------------------------------------------------------
1 | *.iml
2 | .gradle
3 | /local.properties
4 | /.idea/caches
5 | /.idea/libraries
6 | /.idea/modules.xml
7 | /.idea/workspace.xml
8 | /.idea/navEditor.xml
9 | /.idea/assetWizardSettings.xml
10 | .DS_Store
11 | /build
12 | /captures
13 | .externalNativeBuild
14 | .cxx
15 | app/build
16 |
--------------------------------------------------------------------------------
/.idea/codeStyles/Project.xml:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
9 |
10 | xmlns:android
11 |
12 | ^$
13 |
14 |
15 |
16 |
17 |
18 |
19 |
20 |
21 | xmlns:.*
22 |
23 | ^$
24 |
25 |
26 | BY_NAME
27 |
28 |
29 |
30 |
31 |
32 |
33 | .*:id
34 |
35 | http://schemas.android.com/apk/res/android
36 |
37 |
38 |
39 |
40 |
41 |
42 |
43 |
44 | .*:name
45 |
46 | http://schemas.android.com/apk/res/android
47 |
48 |
49 |
50 |
51 |
52 |
53 |
54 |
55 | name
56 |
57 | ^$
58 |
59 |
60 |
61 |
62 |
63 |
64 |
65 |
66 | style
67 |
68 | ^$
69 |
70 |
71 |
72 |
73 |
74 |
75 |
76 |
77 | .*
78 |
79 | ^$
80 |
81 |
82 | BY_NAME
83 |
84 |
85 |
86 |
87 |
88 |
89 | .*
90 |
91 | http://schemas.android.com/apk/res/android
92 |
93 |
94 | ANDROID_ATTRIBUTE_ORDER
95 |
96 |
97 |
98 |
99 |
100 |
101 | .*
102 |
103 | .*
104 |
105 |
106 | BY_NAME
107 |
108 |
109 |
110 |
111 |
112 |
113 |
--------------------------------------------------------------------------------
/.idea/gradle.xml:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
19 |
20 |
--------------------------------------------------------------------------------
/.idea/misc.xml:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
9 |
--------------------------------------------------------------------------------
/.idea/runConfigurations.xml:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
11 |
12 |
--------------------------------------------------------------------------------
/.idea/vcs.xml:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
--------------------------------------------------------------------------------
/app/build.gradle:
--------------------------------------------------------------------------------
1 | apply plugin: 'com.android.application'
2 | apply plugin: 'androidx.navigation.safeargs'
3 |
4 | android {
5 | compileSdkVersion 29
6 | buildToolsVersion "29.0.2"
7 | defaultConfig {
8 | applicationId "com.worthdoingbadly.simserver"
9 | minSdkVersion 26
10 | targetSdkVersion 29
11 | versionCode 1
12 | versionName "1.0"
13 | testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
14 | }
15 | buildTypes {
16 | release {
17 | minifyEnabled false
18 | proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro'
19 | }
20 | }
21 | }
22 |
23 | dependencies {
24 | implementation fileTree(dir: 'libs', include: ['*.jar'])
25 | testImplementation 'junit:junit:4.12'
26 | implementation 'org.nanohttpd:nanohttpd:2.3.1'
27 | androidTestImplementation 'androidx.test.ext:junit:1.1.2'
28 | androidTestImplementation 'androidx.test.espresso:espresso-core:3.3.0'
29 | }
30 |
--------------------------------------------------------------------------------
/app/proguard-rules.pro:
--------------------------------------------------------------------------------
1 | # Add project specific ProGuard rules here.
2 | # You can control the set of applied configuration files using the
3 | # proguardFiles setting in build.gradle.
4 | #
5 | # For more details, see
6 | # http://developer.android.com/guide/developing/tools/proguard.html
7 |
8 | # If your project uses WebView with JS, uncomment the following
9 | # and specify the fully qualified class name to the JavaScript interface
10 | # class:
11 | #-keepclassmembers class fqcn.of.javascript.interface.for.webview {
12 | # public *;
13 | #}
14 |
15 | # Uncomment this to preserve the line number information for
16 | # debugging stack traces.
17 | #-keepattributes SourceFile,LineNumberTable
18 |
19 | # If you keep the line number information, uncomment this to
20 | # hide the original source file name.
21 | #-renamesourcefileattribute SourceFile
22 |
--------------------------------------------------------------------------------
/app/src/androidTest/java/com/worthdoingbadly/simserver/ExampleInstrumentedTest.java:
--------------------------------------------------------------------------------
1 | package com.worthdoingbadly.simserver;
2 |
3 | import android.content.Context;
4 |
5 | import androidx.test.platform.app.InstrumentationRegistry;
6 | import androidx.test.ext.junit.runners.AndroidJUnit4;
7 |
8 | import org.junit.Test;
9 | import org.junit.runner.RunWith;
10 |
11 | import static org.junit.Assert.*;
12 |
13 | /**
14 | * Instrumented test, which will execute on an Android device.
15 | *
16 | * @see Testing documentation
17 | */
18 | @RunWith(AndroidJUnit4.class)
19 | public class ExampleInstrumentedTest {
20 | @Test
21 | public void useAppContext() {
22 | // Context of the app under test.
23 | Context appContext = InstrumentationRegistry.getInstrumentation().getTargetContext();
24 |
25 | assertEquals("com.worthdoingbadly.simserver", appContext.getPackageName());
26 | }
27 | }
28 |
--------------------------------------------------------------------------------
/app/src/main/AndroidManifest.xml:
--------------------------------------------------------------------------------
1 |
2 |
4 |
5 |
11 |
13 |
14 |
15 |
16 |
17 |
18 |
19 |
20 |
21 |
--------------------------------------------------------------------------------
/app/src/main/java/com/worthdoingbadly/simserver/MainActivity.java:
--------------------------------------------------------------------------------
1 | package com.worthdoingbadly.simserver;
2 |
3 | import android.app.Activity;
4 | import android.os.Bundle;
5 | import android.view.View;
6 |
7 | public class MainActivity extends Activity {
8 |
9 | @Override
10 | protected void onCreate(Bundle savedInstanceState) {
11 | super.onCreate(savedInstanceState);
12 | setContentView(R.layout.activity_main);
13 | }
14 |
15 | }
16 |
--------------------------------------------------------------------------------
/app/src/main/java/com/worthdoingbadly/simserver/SimServerMain.java:
--------------------------------------------------------------------------------
1 | package com.worthdoingbadly.simserver;
2 |
3 | import android.annotation.SuppressLint;
4 | import android.content.Context;
5 | import android.os.Build;
6 | import android.os.Looper;
7 | import android.telephony.TelephonyManager;
8 | import android.util.Base64;
9 |
10 | import java.lang.reflect.Field;
11 | import java.util.ArrayList;
12 | import java.util.List;
13 | import java.util.Map;
14 |
15 | import fi.iki.elonen.NanoHTTPD;
16 |
17 | public class SimServerMain {
18 | public static TelephonyManager telephonyManager;
19 | public static void main(String[] args) throws Exception {
20 | if (Build.VERSION.SDK_INT >= 30 /* Android 11 */) {
21 | // https://cs.android.com/android/platform/superproject/+/master:frameworks/base/cmds/telecom/src/com/android/commands/telecom/Telecom.java;l=48;drc=4b033d73165f96900b13d8a91536a7f7268a2b39
22 | Class activityThreadClass = Class.forName("android.app.ActivityThread");
23 | activityThreadClass.getMethod("initializeMainlineModules").invoke(null);
24 | Looper.prepareMainLooper();
25 | Object mainActivityThread = activityThreadClass.getMethod("systemMain").invoke(null);
26 | Context context = (Context) activityThreadClass.getMethod("getSystemContext").invoke(mainActivityThread);
27 | if (Build.VERSION.SDK_INT >= 31 /* Android 12 */) {
28 | // Android 12 needs context.getOpPackageName() to match our user's package
29 | // there's probably a proper way to do this (ActivityThread.getPackageInfo/LoadedApk.makeApplication) but oh well
30 | @SuppressLint("SoonBlockedPrivateApi")
31 | Field opPackageNameField = Class.forName("android.app.ContextImpl").getDeclaredField("mOpPackageName");
32 | opPackageNameField.setAccessible(true);
33 | opPackageNameField.set(context, "com.android.shell");
34 | context = context.createPackageContext("com.android.shell", 0);
35 | }
36 | telephonyManager = context.getSystemService(TelephonyManager.class);
37 | } else {
38 | // Android 8.1
39 | telephonyManager = (TelephonyManager)
40 | TelephonyManager.class.getMethod("getDefault")
41 | .invoke(null);
42 | }
43 | if (args.length == 0) {
44 | System.out.println("Usage:\n" +
45 | "imsi: prints imsi\n" +
46 | "auth : authenticates with EAP_AKA on ISIM\n" +
47 | "serve : serves web server");
48 | return;
49 | }
50 | if (args[0].equals("imsi")) {
51 | System.out.println(telephonyManager.getSubscriberId());
52 | } else if (args[0].equals("auth")) {
53 | String response = telephonyManager.getIccAuthentication(TelephonyManager.APPTYPE_ISIM, TelephonyManager.AUTHTYPE_EAP_AKA, args[1]);
54 | System.out.println(response);
55 | } else if (args[0].equals("serve")) {
56 | new SimHTTPD(Integer.parseInt(args[1])).start();
57 | Looper.loop();
58 | } else {
59 | System.out.println("Unknown command");
60 | }
61 | }
62 | public static String first(List l) {
63 | if (l == null || l.size() == 0) return null;
64 | return l.get(0);
65 | }
66 |
67 | // ripped from AOSP
68 | // returns a byte array where the first element is the length and the rest is bytes decoded from
69 | // hex data from the string
70 | private static byte[] parseHex(String hex) {
71 | /* This only works for good input; don't throw bad data at it */
72 | if (hex == null) {
73 | return new byte[0];
74 | }
75 |
76 | if (hex.length() % 2 != 0) {
77 | throw new NumberFormatException(hex + " is not a valid hex string");
78 | }
79 |
80 | byte[] result = new byte[(hex.length()) / 2 + 1];
81 | result[0] = (byte) ((hex.length()) / 2);
82 | for (int i = 0, j = 1; i < hex.length(); i += 2, j++) {
83 | byte b = (byte)(Integer.parseInt(hex.substring(i, i + 2), 16) & 0xff);
84 | result[j] = b;
85 | }
86 |
87 | return result;
88 | }
89 |
90 | private static byte[] concatHex(byte[] array1, byte[] array2) {
91 |
92 | int len = array1.length + array2.length;
93 |
94 | byte[] result = new byte[len];
95 |
96 | int index = 0;
97 | if (array1.length != 0) {
98 | for (byte b : array1) {
99 | result[index] = b;
100 | index++;
101 | }
102 | }
103 |
104 | if (array2.length != 0) {
105 | for (byte b : array2) {
106 | result[index] = b;
107 | index++;
108 | }
109 | }
110 |
111 | return result;
112 | }
113 |
114 | private static String makeHex(byte[] bytes) {
115 | StringBuilder sb = new StringBuilder();
116 | for (byte b : bytes) {
117 | sb.append(String.format("%02x", b));
118 | }
119 | return sb.toString();
120 | }
121 |
122 | private static String makeHex(byte[] bytes, int from, int len) {
123 | StringBuilder sb = new StringBuilder();
124 | for (int i = 0; i < len; i++) {
125 | sb.append(String.format("%02x", bytes[from + i]));
126 | }
127 | return sb.toString();
128 | }
129 |
130 | public static String runAuth(String randStr, String authnStr) {
131 | // https://android.googlesource.com/platform/frameworks/opt/net/wifi/+/refs/heads/nougat-release/service/java/com/android/server/wifi/WifiMonitor.java#314
132 | // https://cs.android.com/android/platform/superproject/+/master:packages/modules/Wifi/service/java/com/android/server/wifi/ClientModeImpl.java;l=5871;drc=master
133 | // https://cs.android.com/android/platform/superproject/+/master:packages/modules/Wifi/service/java/com/android/server/wifi/WifiCarrierInfoManager.java;l=1296;drc=master
134 | // shamelessly copied from AOSP
135 | byte[] rand = parseHex(randStr);
136 | byte[] authn = parseHex(authnStr);
137 | String base64Challenge = Base64.encodeToString(concatHex(rand, authn), Base64.NO_WRAP);
138 | System.out.println("Challenge: " + base64Challenge);
139 | // TODO(zhuowei): isim or usim?
140 | String tmResponse = telephonyManager.getIccAuthentication(TelephonyManager.APPTYPE_USIM,
141 | TelephonyManager.AUTHTYPE_EAP_AKA, base64Challenge);
142 | System.out.println("Challenge response: " + tmResponse);
143 |
144 | boolean goodReponse = false;
145 | String response = null;
146 | if (tmResponse != null && tmResponse.length() > 4) {
147 | byte[] result = Base64.decode(tmResponse, Base64.DEFAULT);
148 | System.out.println("Hex Response - " + makeHex(result));
149 | byte tag = result[0];
150 | if (tag == (byte) 0xdb) {
151 | System.out.println("successful 3G authentication ");
152 | int resLen = result[1];
153 | String res = makeHex(result, 2, resLen);
154 | int ckLen = result[resLen + 2];
155 | String ck = makeHex(result, resLen + 3, ckLen);
156 | int ikLen = result[resLen + ckLen + 3];
157 | String ik = makeHex(result, resLen + ckLen + 4, ikLen);
158 | response = "{\"ik\": \"" + ik + "\", \"ck\": \"" + ck + "\", \"res\": \"" + res + "\"}";
159 | System.out.println("ik: " + ik + " ck: " + ck + " res: " + res);
160 | } else if (tag == (byte) 0xdc) {
161 | System.out.println("synchronisation failure");
162 | int autsLen = result[1];
163 | String auts = makeHex(result, 2, autsLen);
164 | response = "{\"auts\": \"" + auts + "\"}";
165 | System.out.println("auts:" + auts);
166 | } else {
167 | System.out.println("bad response - unknown tag = " + tag);
168 | }
169 | } else {
170 | System.out.println("bad response - " + tmResponse);
171 | }
172 | return response;
173 | }
174 | private static class SimHTTPD extends NanoHTTPD {
175 | SimHTTPD(int port) {
176 | super(port);
177 | }
178 | @Override
179 | public Response serve(IHTTPSession session) {
180 | // https://github.com/fasferraz/USIM-https-server
181 | Map> params = session.getParameters();
182 | String type = first(params.get("type"));
183 | if (type == null) {
184 | return newFixedLengthResponse("no command");
185 | }
186 | if (type.equals("imsi")) {
187 | String imsi = telephonyManager.getSubscriberId();
188 | return newFixedLengthResponse("{\"imsi\": \"" + imsi + "\"}");
189 | } else if (type.equals("rand-autn")) {
190 | String rand = first(params.get("rand"));
191 | String autn = first(params.get("autn"));
192 | String response = runAuth(rand, autn);
193 | return newFixedLengthResponse(response);
194 | } else {
195 | return newFixedLengthResponse("invalid command");
196 | }
197 | }
198 | }
199 | }
200 |
--------------------------------------------------------------------------------
/app/src/main/res/drawable-v24/ic_launcher_foreground.xml:
--------------------------------------------------------------------------------
1 |
7 |
8 |
9 |
15 |