[SECURITY] [APP][WIP] IMSI Catcher/Spy Detector

EF      - Elementary Files 
AD      - Administrative (Data) Field
BCD     - Binary-Coded Decimal (compressed) 
CHV     - Card Holder Verification (usually your SIM code)
TLV     - Tag, Length, Value
BER-TLV - Object that conform to the Basic Encoding Rules (BER)
RFU     - Reserved for Future Use

-----------------------------------------------------------
Name:           EFAD (Administrative Data)
Identifier:     '6FAD' (28589)  
File size:      3+X bytes
-----------------------------------------------------------
Byte    Description
-----------------------------------------------------------
1       UE operation mode
2-3     Additional information (incl. cipher indication)
4       Length of MNC of IMSI
5-X     RFU
-----------------------------------------------------------
UE Operation Mode:              (byte 1)
-----------------------------------------------------------
This is the mode of operation for the MS.

Coding: (Initial value)
'00'    - normal operation
'80'    - type approval operations
'01'    - normal operation + specific facilities
'81'    - type approval operations + specific facilities
'02'    - maintenance (off line)
'04'    - cell test operation
NOTE: All other values are RFU (reserved for future) use 
-----------------------------------------------------------
Additional Information:         (byte 2-3)
-----------------------------------------------------------
Coding:
- Specific facilities code              (if b1=1 in byte 1);
- ME manufacturer specific information  (if b2=1 in byte 1).

Ciphering indication is enabled by enabling both the specific 
facilities bit (b1) in byte-1 AND the cipher indicator bit (b1) 
in byte-3. Thus the administrative data field has to be:

Byte-1: 0x01    0000 0001
Byte-2: 0x00    0000 0000
Byte-3: 0x01    0000 0001
Byte-4: 0x02/3  0000 001x  
-----------------------------------------------------------
Length of MNC in the IMSI:      (byte 4)
-----------------------------------------------------------
The length indicator refers to the number of digits, 
used for extracting the MNC from the IMSI.

This value codes the number of digits of the MNC in
the IMSI. Only the values (b1-b2) '0010' and '0011' are
currently specified, all other values are reserved
for future use.
-----------------------------------------------------------
Relevant Documents:
TS 22.101
TS 31.102
TS 33.102
-----------------------------------------------------------

AT+CRSM=<command>[,<fileid> [,<P1>,<P2>,<P3> [,<data> [,<pathid>]]]]

<command>       This is the operation to be performed:

        176 READ BINARY
        178 READ RECORD
        192 GET RESPONSE
        214 UPDATE BINARY
        220 UPDATE RECORD
        242 STATUS

<fileid>        This is an integer which is the identifier of a elementary
                datafile (EF) on SIM. Mandatory for every command except 
                STATUS and may be e.g.:

        Hex     Dec     File
        ---------------------
        6F37    28471   ACMmax
        6F07    28423   IMSI
        6F39    28473   ACM 
        6F41    28481   PUKT
        6F42    28482   SMS

Structure:
[CLA INS  P1  P2  P3 Data]

The bytes have the following meaning:

CLA             Is the class of instruction (ISO/IEC 7816-3 [25]), 'A0' is used in the GSM application;
INS             Is the instruction code (ISO/IEC 7816-3 [25]) as defined in this subclause for each command;
P1, P2, P3      Are parameters for the instruction. They are specified in table 9. 'FF' is a valid value for
                P1, P2 and P3. P3 gives the length of the data element. P3='00' introduces a 256 byte data transfer
                from the SIM in an outgoing data transfer command (response direction). In an ingoing data transfer
                command (command direction), P3='00' introduces no transfer of data.
SW1 and SW2     Are the Status Words indicating the successful or unsuccessful outcome of the command.

-------------------------------------------------------------------------------
Dec.    <sw1> <sw2>     Description
-------------------------------------------------------------------------------
144     0x90 0x00 normal entry of the command, indicating OK 

103     0x67 0xXX incorrect parameter P3
        0x6B 0xXX incorrect parameter P1 or P2
        0x6D 0xXX unknown instruction code given in the command
        0x6E 0xXX wrong instruction class given in the command
        0x6F 0xXX technical problem with no diagnostic given

        0x9F 0xXX length XX of the response data
        0x92 0x0X update successful but after using an internal retry routine X times
        0x92 0x40 memory problem
        
        0x94 0x00 no EF selected
        0x94 0x02 out of range (invalid address)
        0x94 0x04 file ID not found; pattern not found
        0x94 0x08 file is inconsistent with the command

        0x98 0x02 no CHV initialized
        0x98 0x04 Access condition not fullfiled / unsucc. CHV verify / authent.failed
        0x98 0x08 in contradiction with CHV status
        0x98 0x10 in contradiction with invalidation status
        0x98 0x40 Unsuccessful CHV-verification. Or UNBLOCK CHF / CHV blocked /UNBL.blocked
        0x98 0x50 Increase cannot be performed. Max. value reached
-------------------------------------------------------------------------------

AT+CRSM=176,28589,0,0,3
+CRSM: 144,0,"000000"

==> Bytes: 1-3 = 00,00,00
    byte1: "MS operation mode" 
    byte2: "Specific facilities" B1
    byte3: "Specific facilities" B2 (+ cipher indication)
==> Ciphering indication is disabled

Note: a response like this "+CRSM: 103,3" indicates that there is 
      a problem with P3 and that the value for P3 should be 3.

AT+CRSM=214,28589,0,0,3,"010001"

AT+CRSM=214,28589,0,0,3,"100010"