Merge branch 'master' of git.osmocom.org:simtrace

26 files changed, 2302 insertions, 260 deletions

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..26f74d4
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,2 @@
+*.o
+host/simtrace
diff --git a/docs/.gitignore b/docs/.gitignore
new file mode 100644
index 0000000..494f28a
--- /dev/null
+++ b/docs/.gitignore
@@ -0,0 +1,4 @@
+*.texi
+usermanual.txt
+usermanual.pdf
+*.sw?
diff --git a/docs/Makefile b/docs/Makefile
new file mode 100644
index 0000000..c208358
--- /dev/null
+++ b/docs/Makefile
@@ -0,0 +1,42 @@
+# XSL stylesheets downloaded from http://docbook.sourceforge.net/release/xsl/current/html/
+# Makefile from BitBake/OpenEmbedded manuals
+
+topdir = .
+manual = $(topdir)/usermanual.xml
+# types = pdf txt rtf ps xhtml html man tex texi dvi
+# types = pdf txt
+types = $(docbooktotypes)
+docbooktotypes = pdf txt
+# htmlcssfile =
+# htmlcss =
+cleanfiles = $(foreach i,$(types),$(topdir)/$(i))
+
+ifdef DEBUG
+define command
+	$(1)
+endef
+else
+define command
+	@echo $(2) $(3) $(4)
+	@$(1)
+endef
+endif
+
+all: $(types)
+
+lint: $(manual) FORCE
+	$(call command,xmllint --xinclude --postvalid --noout $(manual),XMLLINT $(manual))
+
+$(types): lint FORCE
+
+
+$(docbooktotypes): $(manual)
+	$(call command,docbook2$@ $(manual),DOCBOOK2 $@ $(manual))
+
+clean:
+	rm -rf $(cleanfiles)
+
+$(foreach i,$(types) $(foreach type,$(htmltypes),$(type)-nochunks),clean-$(i)):
+	rm -rf $(patsubst clean-%,%,$@)
+
+FORCE:
diff --git a/docs/README b/docs/README
new file mode 100644
index 0000000..0a70c26
--- /dev/null
+++ b/docs/README
@@ -0,0 +1,9 @@
+This should be our user manual, it is created using docbook and
+can be compiled by either. Patches for additional sections are
+more than welcome.
+
+$ make
+
+or
+
+$ dblatex usermanual.tex
diff --git a/docs/chapters/appendix.xml b/docs/chapters/appendix.xml
new file mode 100644
index 0000000..2f684a3
--- /dev/null
+++ b/docs/chapters/appendix.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+<appendix id="appendix_sql_v09">
+    <title>SQL Tabellen v0.9</title>
+        <programlisting>
+            <inlinemediaobject><imageobject><imagedata format="linespecific" fileref="file" /></imageobject></inlinemediaobject>
+        </programlisting>
+</appendix>
+-->
diff --git a/docs/chapters/building.xml b/docs/chapters/building.xml
new file mode 100644
index 0000000..bafbf15
--- /dev/null
+++ b/docs/chapters/building.xml
@@ -0,0 +1,90 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<chapter id="chapter_building">
+    <title>Getting and Building the Software</title>
+    <section id="building_intros">
+        <title>Building software</title>
+        <para>There are three parts that can be built. It is the firmware
+        for the SIMtrace hardware, the SIMtrace software and the modified
+        version of wireshark. All of these have different source trees and
+        dependencies.</para>
+    </section>
+
+    <section id="building_simtrace">
+        <title>Building SIMtrace</title>
+
+        <section id="libosmocore">
+            <title>Building the Osmocom libosmocore library</title>
+            <screen>
+$ <command>git</command> clone git://git.osmocom.org/libosmocore
+$ <command>cd</command> libosmocore
+$ <command>autoreconf</command> --install --force
+$ <command>./configure</command>
+$ <command>sudo</command> <command>make</command> install
+</screen>
+        </section>
+
+        <section id="libusb">
+            <title>Installing libusb</title>
+            <para>You will need to install the libusb header files
+            to be able to compile <command>simtrace</command></para>.
+        </section>
+
+        <section id="simtrace">
+            <title>Building <command>simtrace</command></title>
+            <screen>
+$ wget https://api.opensuse.org/public/source/home:zecke23/simtrace/simtrace_0.0.1.tar.gz
+$ tar xzf simtrace_0.0.1.tar.gz
+$ cd simtrace-0.0.1 
+$ PKG_CONFIG_PATH=/usr/local/lib/pkgconfig make
+cc  `pkg-config --cflags libosmocore` -o main.o -c main.c
+cc  `pkg-config --cflags libosmocore` -o usb_helper.o -c usb_helper.c
+cc  `pkg-config --cflags libosmocore` -o usb.o -c usb.c
+cc  `pkg-config --cflags libosmocore` -o apdu_split.o -c apdu_split.c
+cc -o simtrace main.o usb_helper.o usb.o apdu_split.o -lusb `pkg-config --libs libosmocore` -losmocore
+            </screen>
+        </section>
+    </section>
+
+    <section id="building_wireshark">
+        <title>Building Wireshark</title>
+        <para>SIMtrace provides a patch against <command>wireshark</command>
+        version 1.6. It is the easiest to checkout a copy using the 1.6 branch
+        of wireshark and applying the <filename>simcard.patch</filename> on top
+        of it. And then use the usual way of building wireshark</para>
+
+        <section id="getting_wireshark">
+            <title>Getting Wireshark</title>
+            <screen>
+$ svn co https://anonsvn.wireshark.org/wireshark/trunk-1.6 wireshark-1.6
+...
+A    wireshark-1.6/isprint.h
+ U   wireshark-1.6
+Checked out revision 38543.
+            </screen>
+        </section>
+
+        <section id="getting_simcard.patch">
+            <title>SIMCard patch</title>
+            <para>You will need to download and apply the patch.</para>
+            <screen>
+$ cd wireshark-1.6
+$ wget http://cgit.osmocom.org/cgit/simtrace/tree/wireshark/simcard-for-wireshark-1.6.patch
+$ cat ../simcard-for-wireshark-1.6.patch | patch -p 0
+patching file epan/dissectors/packet-gsm_sim.c
+patching file epan/dissectors/packet-gsmtap.c
+patching file epan/dissectors/Makefile.common
+            </screen>
+        </section>
+
+        <section id="building_and_installing">
+            <title>Building and Installing</title>
+            <screen>
+$ autoreconf --install
+$ ./configure
+$ make
+...
+$ sudo ./wireshark
+            </screen>
+        </section>
+    </section>
+</chapter>
diff --git a/docs/chapters/hardware_details.xml b/docs/chapters/hardware_details.xml
new file mode 100644
index 0000000..23f7355
--- /dev/null
+++ b/docs/chapters/hardware_details.xml
@@ -0,0 +1,116 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<chapter id="chapter_hw">
+    <title>Hardware Details</title>
+    <section id="hw_design">
+        <title>HW Design</title>
+        <para>The Free Software KiCAD EDA was used to design the
+        hardware and can be used to look at the schematics and the
+        PCB routing. The hardware design can be found in the git
+        repository of the SIMtrace sources. For the v1.0 hardware
+        you will have to look at the v1.0_production branch.
+        </para>
+    </section>
+
+    <section id="pcb_populated">
+        <title>Populated PCB</title>
+        <para>The version v1.0p is the first production that had an
+        automatic SMT run. Due some production issues the labeling of
+        components didn't make it to the PCB but can be found in this
+        manual. The difference between the v1.0 and v1.0p hardware is
+        in the footprint of some components to utilize the existing
+        stock of the factory. This was mostly done for the LED and the
+        shottky diodes.</para>
+
+        <figure><title>SIMtrace v1.0 PCB</title>
+        <mediaobject>
+          <imageobject>
+            <imagedata fileref="images/simtrace_hw.jpg" width="15cm"/>
+          </imageobject>
+          <textobject><phrase>SIMtrace v1.0 PCB</phrase></textobject>
+        </mediaobject>
+        </figure>
+    </section>
+
+    <section id="pcb_surface">
+        <title>PCB Surface</title>
+        <para>
+        <figure><title>SIMtrace v1.0 Surface</title>
+        <mediaobjectco>
+          <imageobjectco>
+            <areaspec id="surface"  units="calspair">
+                <area linkends="link_usb" coords="8800,0 8800,6100" id="usb"/>
+                <area linkends="link_serial" coords="8800,7000 8800,8000" id="serial"/>
+                <area linkends="link_debug" coords="8800,9000 8800,9500" id="debug"/>
+                <area linkends="link_jtag" coords="5000,8900 5000,9000" id="jtag"/>
+                <area linkends="link_bt1" coords="8900,0 9100,3500" id="bt1"/>
+                <area linkends="link_ffc" coords="500,3000 700,9000" id="ffc"/>
+                <area linkends="link_sim" coords="500,500 700,2000" id="sim"/>
+                <area linkends="link_reset" coords="200,9000 500,9000" id="reset"/>
+                <area linkends="link_bootloader" coords="1700,9000 1900,9000" id="bootloader"/>
+                <area linkends="link_test" coords="6500,8700 7000,8900" id="test"/>
+                <area linkends="link_erase" coords="7100,8700 7600,8900" id="erase"/>
+            </areaspec>
+            <imageobject>
+                <imagedata fileref="images/simtrace_surface.png" width="15cm" />
+            </imageobject>
+            <calloutlist>
+                <callout arearefs="usb" id="link_usb">
+                    <para>USB: USB mini-B connector. The main connector. The
+                    host software communicates (sniffing,...) through USB with
+                    the board. It can also be used to flash the micro-controller
+                    (using DFU).</para>
+                </callout>
+                <callout arearefs="serial" id="link_serial">
+                    <para>serial: 2.5 mm jack serial cable, as used by osmocomBB
+                    port used to debug the device (printf goes there).</para>
+                </callout>
+                <callout arearefs="debug" id="link_debug">
+                    <para>debug (P3): same as serial, but using the FTDI
+                    serial cable. It is recommended to cut the voltage wire of
+                    the 6pin FTDI connector before plugging the cable into the
+                    simtrace.
+                    </para>
+                </callout>
+                <callout arearefs="jtag" id="link_jtag">
+                    <para>jtag (P1): JTAG 20 pin connector to do hardware
+                    assisted debugging.</para>
+                </callout>
+                <callout arearefs="bt1" id="link_bt1">
+                    <para>BT1: battery connector (4.5-6V DC). normally the
+                    USB provides power, but the battery port can be used
+                    for autonomous use of SIMtrace. The sniffing can be saved
+                    in the flash (U1).</para>
+                </callout>
+                <callout arearefs="ffc" id="link_ffc">
+                    <para>FFC_SIM (P3): to connect the flat flexible cable with
+                    SIM end for the phone.</para>
+                </callout>
+                <callout arearefs="sim" id="link_sim">
+                    <para>SIM (P4): put your SIM in there (instead of in the
+                    phone)</para>
+                </callout>
+                <callout arearefs="reset" id="link_reset">
+                    <para>reset (SW1): to reset the board (not erasing the
+                    firmware). If your are too lazy to unplug and re-plug
+                    the USB.</para>
+                </callout>
+                <callout arearefs="bootloader" id="link_bootloader">
+                    <para>bootloader (SW2): used to start the bootloader so
+                    to flash the device using DFU. press when plugging in
+                    the USB.</para>
+                </callout>
+                <callout arearefs="test" id="link_test">
+                    <para>test (JP1): short circuit using a jumper to flash
+                    using SAM-BA.</para>
+                </callout>
+                <callout arearefs="erase" id="link_erase">
+                    <para>erase (JP2): short circuit using a jumper to erase
+                    completely erase the firmware.</para>
+                </callout>
+            </calloutlist>
+            </imageobjectco>
+        </mediaobjectco>
+        </figure>
+        </para>
+    </section>
+</chapter>
diff --git a/docs/chapters/installation.xml b/docs/chapters/installation.xml
new file mode 100644
index 0000000..b886b45
--- /dev/null
+++ b/docs/chapters/installation.xml
@@ -0,0 +1,118 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<chapter id="chapter_installation">
+    <title>Installation</title>
+    <para><application>SIMtrace</application> will need a patched version of
+    <application>wireshark</application> and the <command>simtrace</command>
+    host utility to fully operate. The installation might be possible from
+    binary packages or will require building from source. The following
+    sections provide some hints how to achieve this on the various Linux
+    distributions. All these operations must be executed as root.</para>
+
+    <section id="install_ubuntu_natty">
+        <title>Installation Ubuntu Natty</title>
+        <para>Ubuntu Natty users can use the holger+lp/osmocom PPA to install
+<application>SIMtrace</application> and upgrade wireshark. The PPA needs to
+        be added to the system, the package database needs to be refreshed
+        and the applications can be installed afterwards.</para>
+
+        <screen>
+$ <command>sudo</command> <command>add-apt-repository</command> ppa:holger+lp/osmocom
+[sudo] password for username:
+Executing: gpg --ignore-time-conflict --no-options --no-default-keyring --secret-keyring /etc/apt/secring.gpg --trustdb-name /etc/apt/trustdb.gpg --keyring /etc/apt/trusted.gpg --primary-keyring /etc/apt/trusted.gpg --keyserver hkp://keyserver.ubuntu.com:80/ --recv 84C86214C00BAF820F43585CCABF944FA2AD19FA
+gpg: requesting key A2AD19FA from hkp server keyserver.ubuntu.com
+gpg: Total number processed: 1
+gpg:              unchanged: 1
+        </screen>
+
+        <para>The next step is to update the package database and install or upgrade
+        the <application>wireshark</application> application.</para>
+
+        <screen>
+$ <command>sudo</command> <command>apt-get</command> update
+...
+$ <command>sudo</command> <command>apt-get</command> install wireshark simtrace
+...
+        </screen>
+    </section>
+
+    <section id="install_opensuse">
+        <title>Installation OpenSUSE</title>
+        <para>The installation on OpenSUSE uses zypper. The repository must be added
+        via the <command>zypper</command> application and then the binary packages
+        can be installed.</para>
+
+        <section>
+            <title>openSUSE 11.3</title>
+            <screen>
+$ <command>zypper</command> addrepo http://download.opensuse.org/repositories/home:/zecke23/openSUSE_11.3/home:zecke23.repo
+$ <command>zypper</command> refresh
+$ <command>zypper</command> install wireshark simtrace
+            </screen>
+        </section>
+
+        <section>
+            <title>openSUSE 11.4</title>
+            <screen>
+$ <command>zypper</command> addrepo http://download.opensuse.org/repositories/home:/zecke23/openSUSE_11.4/home:zecke23.repo
+$ <command>zypper</command> refresh
+$ <command>zypper</command> install wireshark simtrace
+            </screen>
+        </section>
+    </section>
+
+    <section id="install_fedora">
+        <title>Installation Fedora</title>
+        <section>
+            <title>Fedora 14</title>
+            <screen>
+$ cd /etc/yum/repos.d/
+$ wget http://download.opensuse.org/repositories/home:zecke23/Fedora_14/home:zecke23.repo
+$ yum install wireshark simtrace
+            </screen>
+        </section>
+
+        <section>
+            <title>Fedora 15</title>
+            <screen>
+$ cd /etc/yum/repos.d/
+$ wget http://download.opensuse.org/repositories/home:zecke23/Fedora_15/home:zecke23.repo
+$ yum install wireshark simtrace
+            </screen>
+        </section>
+    </section>
+
+    <section id="install_centos">
+        <title>Installation CentOS</title>
+        <section>
+            <title>CentOS 5</title>
+            <screen>
+$ cd /etc/yum/repos.d/
+$ wget http://download.opensuse.org/repositories/home:zecke23/CentOS_CentOS-5/home:zecke23.repo
+$ yum install wireshark simtrace
+            </screen>
+        </section>
+
+        <section>
+            <title>Fedora 15</title>
+            <screen>
+$ cd /etc/yum/repos.d/
+$ wget http://download.opensuse.org/repositories/home:zecke23/CentOS_CentOS-6/home:zecke23.repo
+$ yum install wireshark simtrace
+            </screen>
+        </section>
+    </section>
+
+    <section id="install_mandriva">
+        <title>Mandriva 2010.1</title>
+        <screen>
+$ urpmi.addmedia home:zecke23 http://download.opensuse.org/repositories/home:zecke23/Mandriva_2010.1/
+$ urpmi.update -a
+$ urpmi wireshark simtrace
+        </screen>
+    </section>
+
+    <section id="installation_from_source">
+        <title>Installation from Source</title>
+        <para>Please see the <xref linkend="chapter_building"/></para>
+    </section>
+</chapter>
diff --git a/docs/chapters/introduction.xml b/docs/chapters/introduction.xml
new file mode 100644
index 0000000..4994c57
--- /dev/null
+++ b/docs/chapters/introduction.xml
@@ -0,0 +1,43 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<chapter id="chapter_introduction">
+    <title>Introduction</title>
+    <section id="intro_overview">
+        <title>History</title>
+        <para>SIMtrace was created out of necessity. Harald Welte wanted
+        to see the communication between a GSM Mobile Station (or
+        what we call a cellphone) and the SIM. He was not able to
+        find an existing solution, or the existing ones had mayor
+        drawbacks that made using them very time consuming and slow.
+        The Atmel AT91SAM7 came to the rescue. This microcontroller
+        has hardware support for the  ISO7816 T0/T1 Smart Card
+        specification. We can connect the external clock to the UART
+        and are able to read bytes coming and going to the SIM.
+        The next step in the project was taken by Kevin Redon
+        that started to modify an existing AT91SAM7 design, started
+        to use the Free Software KiCAD CAD Software. In 2011 the project
+        went from having Schematics to having routed circuits, prototypes
+        and the final product. The first production run was in August.</para>
+    </section>
+    <section id="intro_picture">
+        <title>Overview</title>
+        <para>The setup of SIMtrace consists out of a Hardware and a
+        Software part. The SIM card needs to be put into the SIMtrace
+        Hardware, the flex cable needs to be connected to the SIMtrace
+        Hardware and the SIM end needs to be placed in the SIM socket
+        of the phone. The SIMtrace hardware can be seen as a USB device
+        from the host, the SIMtrace software will try to find this device
+        and claim it. The SIMtrace software will receive packets from the
+        SIMtrace hardware and can forward them using the GSMTAP protocol
+        to the IANA assigned GSMTAP port (4729). A modified version of Wireshark
+        can be used to analyze the data.</para>
+
+         <figure><title>Schematic Overview</title>
+         <mediaobject>
+           <imageobject>
+             <imagedata fileref="images/setup_overview.png" width="6cm"/>
+           </imageobject>
+           <textobject><phrase>SIMtrace being connected</phrase></textobject>
+         </mediaobject>
+         </figure>
+    </section>
+</chapter>
diff --git a/docs/chapters/using_sniff.xml b/docs/chapters/using_sniff.xml
new file mode 100644
index 0000000..cbe3bcb
--- /dev/null
+++ b/docs/chapters/using_sniff.xml
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<chapter id="chapter_sniff">
+    <title>Sniffing your SIM</title>
+
+    <section id="hw_setup">
+        <title>Connecting your device</title>
+        <para>You will need to put your SIM into the SIMtrace hardware, connect
+        one of the four flex cables to the SIMtrace hardware, put the other side
+        into the SIM socket of your phone. Use USB to connect the SIMtrace hardware
+        to the PC. On your PC you should be able to see the USB device now.</para>
+
+        <figure><title>Connecting the SIMtrace Hardware</title>
+        <mediaobject>
+          <imageobject>
+            <imagedata fileref="images/simtrace_hw_setup.png" width="15cm"/>
+          </imageobject>
+          <textobject><phrase>SIMtrace being connected</phrase></textobject>
+        </mediaobject>
+        </figure>
+    </section>
+
+    <section id="launching_simtrace">
+        <title>Launching SIMtrace</title>
+        <screen>
+$ <command>./simtrace</command>
+simtrace - GSM SIM and smartcard tracing
+(C) 2010 by Harald Welte &lt;laforge@gnumonks.org&gt;
+        </screen>
+        <para>Launching the <command>simtrace</command> will try to find
+        the SIMtrace hardware and then try to claim the USB device. The
+        application will send the received data encapsulated in the GSMTAP
+        format on localhost and the IANA assigned GSMTAP port.</para>
+    </section>
+
+    <section id="launching_wireshark">
+        <title>Launching Wireshark</title>
+        <para>The <command>wireshark</command> application will start a GUI
+        and given the right permissions you should be able listen to the
+        localhost interface and filter for the GSMTAP port on 4729. You should
+        be able to see the decoded messages like in the figure below.</para>
+
+         <figure><title>GSMTAP in Wireshark</title>
+         <mediaobject>
+           <imageobject>
+             <imagedata fileref="images/wireshark-sim.png" width="16cm"/>
+           </imageobject>
+           <textobject><phrase>SIMtrace sending data</phrase></textobject>
+         </mediaobject>
+         </figure>
+    </section>
+
+    <section id="known_firmware_issues">
+        <title>Known Firmware Issues</title>
+        <para>The current firmware has two known bugs that limit the usage
+        of the device. The first one is with enumeration on USB 3.0 controllers
+        and the second one with baudrate selection of some SIM cards.</para>
+
+        <para>The firmware does not properly enumerate on systems with USB 3.0
+        controllers. The issue has not been analyzed and the workaround is to
+        use a USB &lt; 3.0 port or put a USB &lt; 3.0 hub between.</para>
+
+        <para>The firmware has issues with selecting the right baudrate of
+        some SIMcards. The microcontroller will call the parity error interrupt
+        handler and the watchdog will reset the device. There is no workaround
+        for this issue yet.</para>
+    </section>
+
+    <section id="other_modes">
+        <title>Other modes</title>
+        <para>The hardware is capable to be used as an ordinary card reader,
+        provide Man-In-The-Middle (MITM) attacks, or operate as a SIM. The
+        firmware currently does not have support for these modes.</para>
+    </section>
+</chapter>
diff --git a/docs/images/setup_overview.png b/docs/images/setup_overview.png
new file mode 100644
index 0000000..2e511eb
--- /dev/null
+++ b/docs/images/setup_overview.png
diff --git a/docs/images/simtrace_hw.jpg b/docs/images/simtrace_hw.jpg
new file mode 100644
index 0000000..c7bd943
--- /dev/null
+++ b/docs/images/simtrace_hw.jpg
diff --git a/docs/images/simtrace_hw_setup.png b/docs/images/simtrace_hw_setup.png
new file mode 100644
index 0000000..b73ae3a
--- /dev/null
+++ b/docs/images/simtrace_hw_setup.png
diff --git a/docs/images/simtrace_surface.png b/docs/images/simtrace_surface.png
new file mode 100644
index 0000000..d1dcc16
--- /dev/null
+++ b/docs/images/simtrace_surface.png
diff --git a/docs/images/wireshark-sim.png b/docs/images/wireshark-sim.png
new file mode 100644
index 0000000..e05f5b6
--- /dev/null
+++ b/docs/images/wireshark-sim.png
diff --git a/docs/usermanual.xml b/docs/usermanual.xml
new file mode 100644
index 0000000..626b1dd
--- /dev/null
+++ b/docs/usermanual.xml
@@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  ex:ts=4:sw=4:sts=4:et
+  -*- tab-width: 4; c-basic-offset: 4; indent-tabs-mode: nil -*-
+-->
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
+<!ENTITY chapter-introduction SYSTEM "chapters/introduction.xml">
+<!ENTITY chapter-installation SYSTEM "chapters/installation.xml">
+<!ENTITY chapter-hw-details SYSTEM "chapters/hardware_details.xml">
+<!ENTITY chapter-using-sniff SYSTEM "chapters/using_sniff.xml">
+<!ENTITY chapter-building SYSTEM "chapters/building.xml">
+<!ENTITY chapter-appendix SYSTEM "chapters/appendix.xml">
+]>
+
+<book>
+  <bookinfo>
+    <revhistory>
+        <revision>
+            <revnumber>0.0.1</revnumber>
+            <date>12 July 2011</date>
+            <authorinitials>z</authorinitials>
+            <revremark>Initial</revremark>
+        </revision>
+        <revision>
+            <revnumber>0.0.2</revnumber>
+            <date>14 August 2011</date>
+            <authorinitials>z</authorinitials>
+            <revremark>Copy HW Info from the Wiki</revremark>
+        </revision>
+        <revision>
+            <revnumber>0.0.3</revnumber>
+            <date>15 August 2011</date>
+            <authorinitials>z</authorinitials>
+            <revremark>Document building wireshark</revremark>
+        </revision>
+    </revhistory>
+
+    <title>SIMtrace Usermanual</title>
+
+    <copyright>
+      <year>2011</year>
+    </copyright>
+
+    <legalnotice>
+      <para>This work is licensed under a Creative Commons Attribution 3.0
+      Unported License. To view a copy of this license, visit <ulink
+      url="http://creativecommons.org/licenses/by-sa/3.0/">http://creativecommons.org/licenses/by-sa/3.0/</ulink>
+      or send a letter to Creative Commons, 559 Nathan Abbott Way, Stanford,
+      California 94305, USA.</para>
+    </legalnotice>
+  </bookinfo>
+
+  <!-- Main chapters-->
+  &chapter-introduction;
+  &chapter-installation;
+  &chapter-hw-details;
+  &chapter-using-sniff;
+  &chapter-building;
+
+  &chapter-appendix;
+</book>
diff --git a/host/Makefile b/host/Makefile
index 819aa26..8e31075 100644
--- a/host/Makefile
+++ b/host/Makefile
@@ -1,13 +1,17 @@
-LDFLAGS=-lusb -losmocore
+LDFLAGS=`pkg-config --libs libusb-1.0 libosmocore` -losmocore
 
 all: simtrace
 
-simtrace: main.o usb_helper.o usb.o apdu_split.o
-	$(CC) $(LDFLAGS) -o $@ $^
+simtrace: main.o apdu_split.o
+	$(CC) -o $@ $^ $(LDFLAGS)
 
 %.o: %.c
-	$(CC) $(CFLAGS) -o $@ -c $^
+	$(CC) $(CFLAGS) `pkg-config --cflags libusb-1.0 libosmocore` -o $@ -c $^
 
+install: simtrace
+	install -d $(DESTDIR)/usr/bin/
+	install -m 0755 simtrace $(DESTDIR)/usr/bin/
+.PHONY: install
 
 clean:
 	@rm -f simtrace *.o
diff --git a/host/apdu_split.c b/host/apdu_split.c
index 53c196a..f2cfb7a 100644
--- a/host/apdu_split.c
+++ b/host/apdu_split.c
@@ -136,7 +136,7 @@ static void apdu_split_inbyte(struct apdu_split *as, uint8_t ch)
 		break;
 	case APDU_S_SW2:
 		apdu_buf_append(as, ch);
-		//printf("APDU: %s\n", hexdump(as->apdu_buf, as->apdu_len));
+		//printf("APDU: %s\n", osmo_hexdump(as->apdu_buf, as->apdu_len));
 		as->apdu_out_cb(as->apdu_buf, as->apdu_len, as->user_data);
 		set_state(as, APDU_S_CLA);
 		break;
diff --git a/host/main.c b/host/main.c
index 0007f09..4fbac8d 100644
--- a/host/main.c
+++ b/host/main.c
@@ -19,6 +19,7 @@
 #include <errno.h>
 #include <unistd.h>
 #include <stdio.h>
+#include <stdlib.h>
 #include <string.h>
 #include <stdint.h>
 #include <time.h>
@@ -31,17 +32,17 @@
 #include <netinet/in.h>
 #include <arpa/inet.h>
 
-#include <usb.h>
+#include <libusb.h>
 
-#include "usb_helper.h"
 #include "simtrace.h"
 #include "simtrace_usb.h"
 #include "apdu_split.h"
 
 #include <osmocom/core/gsmtap.h>
 #include <osmocom/core/gsmtap_util.h>
+#include <osmocom/core/utils.h>
 
-static struct usb_dev_handle *udev;
+static struct libusb_device_handle *devh;
 static struct apdu_split *as;
 static struct gsmtap_inst *g_gti;
 
@@ -76,13 +77,13 @@ static int gsmtap_send_sim(const uint8_t *apdu, unsigned int len)
 
 static void apdu_out_cb(uint8_t *buf, unsigned int len, void *user_data)
 {
-	printf("APDU: %s\n", hexdump(buf, len));
+	printf("APDU: %s\n", osmo_hexdump(buf, len));
 	gsmtap_send_sim(buf, len);
 }
 
 static int process_usb_msg(uint8_t *buf, int len)
 {
-	struct simtrace_hdr *sh = buf;
+	struct simtrace_hdr *sh = (struct simtrace_hdr *)buf;
 	uint8_t *payload = buf += sizeof(*sh);
 	int payload_len = len - sizeof(*sh);
 
@@ -138,9 +139,10 @@ int main(int argc, char **argv)
 {
 	char buf[16*265];
 	char *gsmtap_host = "127.0.0.1";
-	int rc, c;
+	int rc, c, ret = 1;
 	int skip_atr = 0;
-	unsigned int msg_count, byte_count;
+	int xfer_len;
+	unsigned int msg_count, byte_count = 0;
 
 	print_welcome();
 
@@ -164,35 +166,56 @@ int main(int argc, char **argv)
 		}
 	}
 
+	rc = libusb_init(NULL);
+	if (rc < 0) {
+		fprintf(stderr, "libusb initialization failed\n");
+		goto close_exit;
+	}
+
 	g_gti = gsmtap_source_init(gsmtap_host, GSMTAP_UDP_PORT, 0);
 	if (!g_gti) {
 		perror("unable to open GSMTAP");
-		exit(1);
+		goto close_exit;
 	}
 	gsmtap_source_add_sink(g_gti);
 
-	udev = usb_find_open(SIMTRACE_USB_VENDOR, SIMTRACE_USB_PRODUCT);
-	if (!udev) {
-		perror("opening USB device");
-		exit(1);
+	devh = libusb_open_device_with_vid_pid(NULL, SIMTRACE_USB_VENDOR, SIMTRACE_USB_PRODUCT);
+	if (!devh) {
+		fprintf(stderr, "can't open USB device\n");
+		goto close_exit;
+	}
+
+	rc = libusb_claim_interface(devh, 0);
+	if (rc < 0) {
+		fprintf(stderr, "can't claim interface; rc=%d\n", rc);
+		goto close_exit;
 	}
 
 	as = apdu_split_init(&apdu_out_cb, NULL);
 	if (!as)
-		exit(1);
+		goto release_exit;
 
 	printf("Entering main loop\n");
 	while (1) {
-		rc = usb_bulk_read(udev, SIMTRACE_IN_EP, buf, sizeof(buf), 100000);
-		if (rc < 0 && rc != -EAGAIN) {
-			fprintf(stderr, "Error submitting BULK IN urb: %s\n", usb_strerror());
-			exit(1);
+		rc = libusb_bulk_transfer(devh, SIMTRACE_IN_EP, buf, sizeof(buf), &xfer_len, 100000);
+		if (rc < 0 && rc != LIBUSB_ERROR_TIMEOUT) {
+			fprintf(stderr, "BULK IN transfer error; rc=%d\n", rc);
+			goto release_exit;
 		}
-		if (rc > 0) {
-			//printf("URB: %s\n", hexdump(buf, rc));
-			process_usb_msg(buf, rc);
+		if (xfer_len > 0) {
+			//printf("URB: %s\n", osmo_hexdump(buf, rc));
+			process_usb_msg(buf, xfer_len);
 			msg_count++;
-			byte_count += rc;
+			byte_count += xfer_len;
 		}
 	}
+	ret = 0;
+
+release_exit:
+	libusb_release_interface(devh, 0);
+close_exit:
+	if (devh)
+		libusb_close(devh);
+	libusb_exit(NULL);
+	return ret;
 }
diff --git a/host/simtrace.1 b/host/simtrace.1
new file mode 100644
index 0000000..bdb3bf5
--- /dev/null
+++ b/host/simtrace.1
@@ -0,0 +1,55 @@
+.\"                                      Hey, EMACS: -*- nroff -*-
+.\" First parameter, NAME, should be all caps
+.\" Second parameter, SECTION, should be 1-8, maybe w/ subsection
+.\" other parameters are allowed: see man(7), man(1)
+.TH SIMTRACE 1 "July 17, 2011"
+.\" Please adjust this date whenever revising the manpage.
+.\"
+.\" Some roff macros, for reference:
+.\" .nh        disable hyphenation
+.\" .hy        enable hyphenation
+.\" .ad l      left justify
+.\" .ad b      justify to both left and right margins
+.\" .nf        disable filling
+.\" .fi        enable filling
+.\" .br        insert line break
+.\" .sp <n>    insert n+1 empty lines
+.\" for manpage-specific macros, see man(7)
+.SH NAME
+SIMtrace \- GSM SIM and smartcard tracing
+.SH SYNOPSIS
+.B simtrace
+.RI [ options ]
+.br
+.SH DESCRIPTION
+This manual page documents briefly the
+.B simtrace 
+command.
+.PP
+.\" TeX users may be more comfortable with the \fB<whatever>\fP and
+.\" \fI<whatever>\fP escape sequences to invode bold face and italics, 
+.\" respectively.
+\fBsimtrace\fP is a utility that communicates with the sysmocom SIMtrace
+hardware and forwards messages coming from the USB device to IP using
+the GSMtap protcol. The wireshark utility contains a protocol analyzer.
+.SH OPTIONS
+This program follows the usual GNU command line syntax, with long
+options starting with two dashes (`-').
+.TP
+.B \-h, \-\-help
+Show summary of options.
+.TP
+.B \-iIP, \-\-gsmtap-ip=IP
+The destination IP address for the SIM PDUs encapsulated in the GSMtap
+protocol.
+.TP
+.B \-a, \-\-skip\-atr
+Skip the ATR of the SIMcard.
+.TP
+
+.SH AUTHORS
+SIMtrace was written by 
+Harald Welte
+.PP
+This manual page was written by Holger Freyther
+for the Debian project (but may be used by others).
diff --git a/host/simtrace_usb.h b/host/simtrace_usb.h
index 68378ac..c020093 120000..100644
--- a/host/simtrace_usb.h
+++ b/host/simtrace_usb.h
@@ -1 +1,24 @@
-../../../openpcd/firmware/include/simtrace_usb.h
\ No newline at end of file
+#ifndef SIMTRACE_USB_H
+#define SIMTRACE_USB_H
+
+//#include <stdint.h>
+
+/* this is kept compatible with OpenPCD protocol */
+struct simtrace_hdr {
+	u_int8_t cmd;
+	u_int8_t flags;
+	u_int8_t res[2];
+	u_int8_t data[0];
+} __attribute__ ((packed));
+
+enum simtrace_usb_msgt {
+	SIMTRACE_MSGT_NULL,
+	SIMTRACE_MSGT_DATA,
+	SIMTRACE_MSGT_RESET,		/* reset was asserted, no more data */
+};
+
+/* flags for MSGT_DATA */
+#define SIMTRACE_FLAG_ATR		0x01	/* ATR immediately after reset */
+#define SIMTRACE_FLAG_WTIME_EXP		0x04	/* work waiting time expired */
+
+#endif /* SIMTRACE_USB_H */
diff --git a/host/usb.c b/host/usb.c
deleted file mode 100644
index 1d3aaf4..0000000
--- a/host/usb.c
+++ /dev/null
@@ -1,87 +0,0 @@
-#include <stdlib.h>
-#include <stdio.h>
-#include <unistd.h>
-#include <errno.h>
-#include <usb.h>
-#include <sys/ioctl.h>
-#include "usb.h"
-#include <linux/usbdevice_fs.h>
-
-#define MAX_READ_WRITE	4096
-
-#define USB_ERROR_STR(ret, x, args...)	return ret
-
-static int usb_get_fd(usb_dev_handle *uh)
-{
-	return *((int *)uh);
-}
-
-int __usb_bulk_write(usb_dev_handle *dev, int ep, char *bytes, int length,
-		     int timeout)
-{
-	struct usbdevfs_bulktransfer bulk;
-	int ret, sent = 0;
-
-	/* Ensure the endpoint address is correct */
-	ep &= ~USB_ENDPOINT_IN;
-
-	do {
-		bulk.ep = ep;
-		bulk.len = length - sent;
-		if (bulk.len > MAX_READ_WRITE)
-			bulk.len = MAX_READ_WRITE;
-		bulk.timeout = timeout;
-		bulk.data = (unsigned char *)bytes + sent;
-
-		ret = ioctl(usb_get_fd(dev), USBDEVFS_BULK, &bulk);
-		if (ret < 0)
-			USB_ERROR_STR(ret,
-				      "error writing to bulk endpoint %d: %s",
-				      ep, strerror(errno));
-
-		sent += ret;
-	} while (ret > 0 && sent < length);
-
-	return sent;
-}
-
-int __usb_bulk_read(usb_dev_handle *dev, int ep, char *bytes, int size,
-		    int timeout)
-{
-	struct usbdevfs_bulktransfer bulk;
-	int ret, retrieved = 0, requested;
-
-	/* Ensure the endpoint address is correct */
-	ep |= USB_ENDPOINT_IN;
-
-	do {
-		bulk.ep = ep;
-		requested = size - retrieved;
-		if (requested > MAX_READ_WRITE)
-			requested = MAX_READ_WRITE;
-		bulk.len = requested;
-		bulk.timeout = timeout;
-		bulk.data = (unsigned char *)bytes + retrieved;
-
-		ret = ioctl(usb_get_fd(dev), USBDEVFS_BULK, &bulk);
-		if (ret < 0)
-			USB_ERROR_STR(ret,
-				      "error reading from bulk endpoint 0x%x: %s",
-				      ep, strerror(errno));
-
-		retrieved += ret;
-	} while (ret > 0 && retrieved < size && ret == requested);
-
-	return retrieved;
-}
-
-int __usb_reattach_kernel_driver_np(usb_dev_handle *dev, int interface)
-{
-	struct usbdevfs_ioctl command;
-
-	command.ifno = interface;
-	command.ioctl_code = USBDEVFS_CONNECT;
-	command.data = NULL;
-
-	return ioctl(usb_get_fd(dev), USBDEVFS_IOCTL, &command);
-}
diff --git a/host/usb_helper.c b/host/usb_helper.c
deleted file mode 100644
index 0830fe4..0000000
--- a/host/usb_helper.c
+++ /dev/null
@@ -1,96 +0,0 @@
-/* usb_helper - Low-Level USB routines for SimTrace
- *
- * (C) 2006-2010 by Harald Welte <hwelte@hmw-consulting.de>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License version 2 
- *  as published by the Free Software Foundation
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- */
-
-#include <errno.h>
-#include <unistd.h>
-#include <stdio.h>
-#include <string.h>
-#include <stdint.h>
-#include <time.h>
-#include <sys/time.h>
-
-#include <sys/types.h>
-
-#include <usb.h>
-
-const char *
-hexdump(const void *data, unsigned int len)
-{
-	static char string[65535];
-	unsigned char *d = (unsigned char *) data;
-	unsigned int i, left, ofs;
-
-	string[0] = '\0';
-	ofs = snprintf(string, sizeof(string)-1, "(%u): ", len);
-	
-	left = sizeof(string) - ofs;
-	for (i = 0; len--; i += 3) {
-		if (i >= sizeof(string) -4)
-			break;
-		snprintf(string+ofs+i, 4, " %02x", *d++);
-	}
-	string[sizeof(string)-1] = '\0';
-	return string;
-}
-
-static struct usb_device *find_usb_device (uint16_t vendor_id, uint16_t product_id)
-{
-	struct usb_bus *bus;
-
-	for (bus = usb_busses; bus; bus = bus->next) {
-		struct usb_device *dev;
-		for (dev = bus->devices; dev; dev = dev->next) {
-			if (dev->descriptor.idVendor == vendor_id &&
-			    dev->descriptor.idProduct == product_id)
-				return dev;
-		}
-	}
-	return NULL;
-}
-
-struct usb_dev_handle *usb_find_open(uint16_t vendor_id, uint16_t product_id)
-{
-	struct usb_device *dev;
-	struct usb_dev_handle *hdl;
-
-	usb_init();
-	usb_find_busses();
-	usb_find_devices();
-
-	dev = find_usb_device(vendor_id, product_id);
-	if (!dev) {
-		fprintf(stderr, "Cannot find matching USB Device. "
-			"Are you sure it is connected?\n");
-		exit(1);
-	}
-
-	hdl = usb_open(dev);
-	if (!hdl) {
-		fprintf(stderr, "Unable to open usb device: %s\n",
-			usb_strerror());
-		exit(1);
-	}
-
-	if (usb_claim_interface(hdl, 0) < 0) {
-		fprintf(stderr, "Unable to claim usb interface "
-			"1 of device: %s\n", usb_strerror());
-		exit(1);
-	}
-
-	return hdl;
-}
diff --git a/host/usb_helper.h b/host/usb_helper.h
deleted file mode 100644
index 60c802a..0000000
--- a/host/usb_helper.h
+++ /dev/null
@@ -1,28 +0,0 @@
-#ifndef _USB_HELPER_H
-#define _USB_HELPER_H
-
-/* usb_helper - Low-Level USB routines for SimTrace
- *
- * (C) 2006-2010 by Harald Welte <hwelte@hmw-consulting.de>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License version 2 
- *  as published by the Free Software Foundation
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- */
-
-#include <stdint.h>
-
-const char *hexdump(const void *data, unsigned int len);
-
-struct usb_dev_handle *usb_find_open(uint16_t vendor_id, uint16_t product_id);
-
-#endif
diff --git a/wireshark/simcard-for-wireshark-1.6.patch b/wireshark/simcard-for-wireshark-1.6.patch
new file mode 100644
index 0000000..171db33
--- /dev/null
+++ b/wireshark/simcard-for-wireshark-1.6.patch
@@ -0,0 +1,1586 @@
+Index: epan/dissectors/packet-gsm_sim.c
+===================================================================
+--- epan/dissectors/packet-gsm_sim.c	(revision 0)
++++ epan/dissectors/packet-gsm_sim.c	(revision 0)
+@@ -0,0 +1,1528 @@
++/* packet-gsm_sim.c
++ * Routines for packet dissection of GSM SIM APDUs (GSM TS 11.11)
++ *
++ *	GSM TS 11.11 / 3GPP TS 51.011
++ * 	3GPP TS 31.102
++ * Copyright 2010 by Harald Welte <laforge@gnumonks.org>
++ *
++ * $Id$
++ *
++ * Wireshark - Network traffic analyzer
++ * By Gerald Combs <gerald@wireshark.org>
++ * Copyright 1998 Gerald Combs
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * as published by the Free Software Foundation; either version 2
++ * of the License, or (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, write to the Free Software
++ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
++ */
++
++#ifdef HAVE_CONFIG_H
++# include "config.h"
++#endif
++
++#include <glib.h>
++
++#include <epan/packet.h>
++#include <epan/emem.h>
++#include <epan/lapd_sapi.h>
++#include <epan/prefs.h>
++
++//#include "packet-gsm_sim.h"
++
++#include <stdio.h>
++
++static int proto_gsm_sim = -1;
++
++/* ISO 7816-4 APDU */
++static int hf_apdu_cla = -1;
++static int hf_apdu_ins = -1;
++static int hf_apdu_p1 = -1;
++static int hf_apdu_p2 = -1;
++static int hf_apdu_p3 = -1;
++static int hf_apdu_data = -1;
++static int hf_apdu_sw = -1;
++static int hf_apdu_sw1 = -1;
++static int hf_apdu_sw2 = -1;
++
++static int hf_file_id = -1;
++static int hf_aid = -1;
++static int hf_bin_offset = -1;
++static int hf_record_nr = -1;
++static int hf_auth_rand = -1;
++static int hf_chan_op = -1;
++static int hf_chan_nr = -1;
++
++/* Chapter 5.2 TS 11.14 */
++static int hf_tprof_b1 = -1;
++static int hf_tprof_b2 = -1;
++static int hf_tprof_b3 = -1;
++static int hf_tprof_b4 = -1;
++static int hf_tprof_b5 = -1;
++static int hf_tprof_b6 = -1;
++static int hf_tprof_b7 = -1;
++static int hf_tprof_b8 = -1;
++static int hf_tprof_b9 = -1;
++static int hf_tprof_b10 = -1;
++static int hf_tprof_b11 = -1;
++static int hf_tprof_b12 = -1;
++static int hf_tprof_b13 = -1;
++static int hf_tprof_b14 = -1;
++static int hf_tprof_b15 = -1;
++static int hf_tprof_b16 = -1;
++static int hf_tprof_b17 = -1;
++/* First byte */
++static int hf_tp_prof_dld = -1;
++static int hf_tp_sms_data_dld = -1;
++static int hf_tp_cb_data_dld = -1;
++static int hf_tp_menu_sel = -1;
++static int hf_tp_9e_err = -1;
++static int hf_tp_timer_exp = -1;
++static int hf_tp_ussd_cc = -1;
++static int hf_tp_auto_redial = -1;
++/* Second byte (Other) */
++static int hf_tp_cmd_res = -1;
++static int hf_tp_cc_sim = -1;
++static int hf_tp_cc_sim_cellid = -1;
++static int hf_tp_mo_sms_sim = -1;
++static int hf_tp_alpha_id = -1;
++static int hf_tp_ucs2_entry = -1;
++static int hf_tp_ucs2_display = -1;
++static int hf_tp_display_ext = -1;
++/* 3rd byte (Proactive SIM) */
++static int hf_tp_pa_display_text = -1;
++static int hf_tp_pa_get_inkey = -1;
++static int hf_tp_pa_get_input = -1;
++static int hf_tp_pa_more_time = -1;
++static int hf_tp_pa_play_tone = -1;
++static int hf_tp_pa_poll_intv = -1;
++static int hf_tp_pa_polling_off = -1;
++static int hf_tp_pa_refresh = -1;
++/* 4th byte (Proactive SIM) */
++static int hf_tp_pa_select_item = -1;
++static int hf_tp_pa_send_sms = -1;
++static int hf_tp_pa_send_ss = -1;
++static int hf_tp_pa_send_ussd = -1;
++static int hf_tp_pa_set_up_call = -1;
++static int hf_tp_pa_set_up_menu = -1;
++static int hf_tp_pa_prov_loci = -1;
++static int hf_tp_pa_prov_loci_nmr = -1;
++/* 5th byte (Event drive information) */
++static int hf_tp_pa_evt_list = -1;
++static int hf_tp_ev_mt_call = -1;
++static int hf_tp_ev_call_connected = -1;
++static int hf_tp_ev_call_disconnected = -1;
++static int hf_tp_ev_location_status = -1;
++static int hf_tp_ev_user_activity = -1;
++static int hf_tp_ev_idle_screen = -1;
++static int hf_tp_ev_cardreader_status = -1;
++/* 6th byte (Event drive information extension) */
++static int hf_tp_ev_lang_sel = -1;
++static int hf_tp_ev_brows_term = -1;
++static int hf_tp_ev_data_avail = -1;
++static int hf_tp_ev_chan_status = -1;
++/* 7th byte (Multiple card proactive commands) */
++static int hf_tp_pa_power_on = -1;
++static int hf_tp_pa_power_off = -1;
++static int hf_tp_pa_perform_card_apdu = -1;
++static int hf_tp_pa_get_reader_status = -1;
++static int hf_tp_pa_get_reader_status_id = -1;
++/* 8th byte (Proactive SIM) */
++static int hf_tp_pa_timer_start_stop = -1;
++static int hf_tp_pa_timer_get_current = -1;
++static int hf_tp_pa_prov_loci_date_tz = -1;
++static int hf_tp_pa_get_inkey_binary = -1;
++static int hf_tp_pa_set_up_idle_mode_text = -1;
++static int hf_tp_pa_run_at_command = -1;
++static int hf_tp_pa_2nd_alpha_setup_call = -1;
++static int hf_tp_pa_2nd_capability_param = -1;
++
++/* 12th byte (Proactive SIM) */
++static int hf_tp_pa_open_chan = -1;
++static int hf_tp_pa_close_chan = -1;
++static int hf_tp_pa_recv_data = -1;
++static int hf_tp_pa_send_data = -1;
++static int hf_tp_pa_get_chan_status = -1;
++
++/* 13th byte (Proactive SIM) */
++static int hf_tp_bip_csd = -1;
++static int hf_tp_bip_gprs = -1;
++
++/* 17th byte (Proactive SIM) */
++static int hf_tp_bip_tcp = -1;
++static int hf_tp_bip_udp = -1;
++
++static int hf_cat_ber_tag = -1;
++
++static int ett_sim = -1;
++static int ett_tprof_b1 = -1;
++static int ett_tprof_b2 = -1;
++static int ett_tprof_b3 = -1;
++static int ett_tprof_b4 = -1;
++static int ett_tprof_b5 = -1;
++static int ett_tprof_b6 = -1;
++static int ett_tprof_b7 = -1;
++static int ett_tprof_b8 = -1;
++static int ett_tprof_b9 = -1;
++static int ett_tprof_b10 = -1;
++static int ett_tprof_b11 = -1;
++static int ett_tprof_b12 = -1;
++static int ett_tprof_b13 = -1;
++static int ett_tprof_b14 = -1;
++static int ett_tprof_b15 = -1;
++static int ett_tprof_b16 = -1;
++static int ett_tprof_b17 = -1;
++
++static dissector_handle_t sub_handle_cap;
++
++
++static const int *tprof_b1_fields[] = {
++	&hf_tp_prof_dld,
++	&hf_tp_sms_data_dld,
++	&hf_tp_cb_data_dld,
++	&hf_tp_menu_sel,
++	&hf_tp_9e_err,
++	&hf_tp_timer_exp,
++	&hf_tp_ussd_cc,
++	&hf_tp_auto_redial,
++	NULL
++};
++
++static const int *tprof_b2_fields[] = {
++	&hf_tp_cmd_res,
++	&hf_tp_cc_sim,
++	&hf_tp_cc_sim_cellid,
++	&hf_tp_mo_sms_sim,
++	&hf_tp_alpha_id,
++	&hf_tp_ucs2_entry,
++	&hf_tp_ucs2_display,
++	&hf_tp_display_ext,
++	NULL
++};
++
++static const int *tprof_b3_fields[] = {
++	&hf_tp_pa_display_text,
++	&hf_tp_pa_get_inkey,
++	&hf_tp_pa_get_input,
++	&hf_tp_pa_more_time,
++	&hf_tp_pa_play_tone,
++	&hf_tp_pa_poll_intv,
++	&hf_tp_pa_polling_off,
++	&hf_tp_pa_refresh,
++	NULL
++};
++
++static const int *tprof_b4_fields[] = {
++	&hf_tp_pa_select_item,
++	&hf_tp_pa_send_sms,
++	&hf_tp_pa_send_ss,
++	&hf_tp_pa_send_ussd,
++	&hf_tp_pa_set_up_call,
++	&hf_tp_pa_set_up_menu,
++	&hf_tp_pa_prov_loci,
++	&hf_tp_pa_prov_loci_nmr,
++	NULL
++};
++
++static const int *tprof_b5_fields[] = {
++	&hf_tp_pa_evt_list,
++	&hf_tp_ev_mt_call,
++	&hf_tp_ev_call_connected,
++	&hf_tp_ev_call_disconnected,
++	&hf_tp_ev_location_status,
++	&hf_tp_ev_user_activity,
++	&hf_tp_ev_idle_screen,
++	&hf_tp_ev_cardreader_status,
++	NULL
++};
++
++static const int *tprof_b6_fields[] = {
++	&hf_tp_ev_lang_sel,
++	&hf_tp_ev_brows_term,
++	&hf_tp_ev_data_avail,
++	&hf_tp_ev_chan_status,
++	NULL
++};
++
++static const int *tprof_b7_fields[] = {
++	&hf_tp_pa_power_on,
++	&hf_tp_pa_power_off,
++	&hf_tp_pa_perform_card_apdu,
++	&hf_tp_pa_get_reader_status,
++	&hf_tp_pa_get_reader_status_id,
++	NULL
++};
++
++static const int *tprof_b8_fields[] = {
++	&hf_tp_pa_timer_start_stop,
++	&hf_tp_pa_timer_get_current,
++	&hf_tp_pa_prov_loci_date_tz,
++	&hf_tp_pa_get_inkey_binary,
++	&hf_tp_pa_set_up_idle_mode_text,
++	&hf_tp_pa_run_at_command,
++	&hf_tp_pa_2nd_alpha_setup_call,
++	&hf_tp_pa_2nd_capability_param,
++	NULL
++};
++
++static const int *tprof_b9_fields[] = {
++	NULL
++};
++
++static const int *tprof_b10_fields[] = {
++	NULL
++};
++
++static const int *tprof_b11_fields[] = {
++	NULL
++};
++
++static const int *tprof_b12_fields[] = {
++	&hf_tp_pa_open_chan,
++	&hf_tp_pa_close_chan,
++	&hf_tp_pa_recv_data,
++	&hf_tp_pa_send_data,
++	&hf_tp_pa_get_chan_status,
++	NULL
++};
++
++static const int *tprof_b13_fields[] = {
++	&hf_tp_bip_csd,
++	&hf_tp_bip_gprs,
++	NULL
++};
++
++static const int *tprof_b14_fields[] = {
++	NULL
++};
++static const int *tprof_b15_fields[] = {
++	NULL
++};
++static const int *tprof_b16_fields[] = {
++	NULL
++};
++static const int *tprof_b17_fields[] = {
++	&hf_tp_bip_tcp,
++	&hf_tp_bip_udp,
++	NULL
++};
++
++/* According to Section 7.2 of ETSI TS 101 220 / Chapter 7.2 */
++/* BER-TLV tag CAT templates */
++static const value_string ber_tlv_cat_tag_vals[] = {
++	{ 0xcf, "Reserved for proprietary use (terminal->UICC)" },
++	{ 0xd0, "Proactive Command" },
++	{ 0xd1, "GSM/3GPP/3GPP2 - SMS-PP Download" },
++	{ 0xd2, "GSM/3GPP/3GPP2 - Cell Broadcast Download" },
++	{ 0xd3, "Menu selection" },
++	{ 0xd4, "Call Control" },
++	{ 0xd5, "GSM/3G - MO Short Message control" },
++	{ 0xd6, "Event Download" },
++	{ 0xd7, "Timer Expiration" },
++	{ 0xd8, "Reserved for intra-UICC communication" },
++	{ 0xd9, "3G - USSD Download" },
++	{ 0xda, "MMS Transfer status" },
++	{ 0xdb, "MMS notification download" },
++	{ 0xdc, "Terminal application" },
++	{ 0xdd, "3G - Geographical Location Reporting" },
++	{ 0, NULL }
++};
++
++static const value_string chan_op_vals[] = {
++	{ 0x00, "Open Channel" },
++	{ 0x80, "Close Channel" },
++	{ 0, NULL }
++};
++
++static const value_string apdu_cla_vals[] = {
++	{ 0xa0,	"GSM" },
++	{ 0, NULL }
++};
++
++/* Table 9 of GSM TS 11.11 */
++static const value_string apdu_ins_vals[] = {
++	{ 0xA4, "SELECT" },
++	{ 0xF2, "STATUS" },
++	{ 0xB0, "READ BINARY" },
++	{ 0xD6, "UPDATE BINARY" },
++	{ 0xB2, "READ RECORD" },
++	{ 0xDC, "UPDATE RECORD" },
++	{ 0xA2, "SEEK" },
++	{ 0x32, "INCREASE" },
++	{ 0x20, "VERIFY CHV" },
++	{ 0x24, "CHANGE CHV" },
++	{ 0x26, "DISABLE CHV" },
++	{ 0x28, "ENABLE CHV" },
++	{ 0x2C, "UNBLOCK CHV" },
++	{ 0x04, "INVALIDATE" },
++	{ 0x44, "REHABILITATE" },
++	{ 0x88, "RUN GSM ALGORITHM / AUTHENTICATE" },
++	{ 0xFA, "SLEEP" },
++	{ 0xC0, "GET RESPONSE" },
++	{ 0x10, "TERMINAL PROFILE" },
++	{ 0xC2, "ENVELOPE" },
++	{ 0x12, "FETCH" },
++	{ 0x14, "TERMINAL RESPONSE" },
++	/* Only in TS 102 221 v9.2.0 */
++	{ 0xCB, "RETRIEVE DATA" },
++	{ 0xDB, "SET DATA" },
++	{ 0x89, "RUN GSM ALGORITHM / AUTHENTICATE" },
++	{ 0x84, "GET CHALLENGE" },
++	{ 0xAA, "TERMINAL CAPABILITY" },
++	{ 0x70, "MANAGE CHANNEL" },
++	{ 0x73, "MANAGE SECURE CHANNEL" },
++	{ 0x75, "TRANSACT DATA" },
++	{ 0, NULL }
++};
++
++/* Section 10.7 */
++
++/* Files at the MF level */
++static const value_string mf_dfs[] = {
++	{ 0x3f00, "MF" },
++	{ 0x7f20, "DF.GSM" },
++	{ 0x7f10, "DF.TELECOM" },
++	{ 0x7f22, "DF.IS-41" },
++	{ 0x7f23, "DF.FP-CTS" },
++	{ 0x7fff, "ADF" },
++#if 0
++	{ 0, NULL }
++};
++static const value_string mf_efs[] = {
++#endif
++	{ 0x2f00, "EF.DIR" },
++	{ 0x2f05, "EF.ELP" },
++	{ 0x2f06, "EF.PL" },
++	{ 0x2fe2, "EF.ICCID" },
++#if 0
++	{ 0, NULL }
++};
++
++/* Elementary files at the DF.TELECOM level */
++static const value_string df_telecom_efs[] = {
++#endif
++	{ 0x6f06, "EF.ARR" },
++	{ 0x6f3a, "EF.ADN" },
++	{ 0x6f3b, "EF.FDN" },
++	{ 0x6f3c, "EF.SMS" },
++	{ 0x6f3d, "EF.CCP" },
++	{ 0x6f40, "EF.MSISDN" },
++	{ 0x6f42, "EF.SMSP" },
++	{ 0x6f43, "EF.SMSS" },
++	{ 0x6f44, "EF.LND" },
++	{ 0x6f47, "EF.SMSR" },
++	{ 0x6f49, "EF.SDN" },
++	{ 0x6f4a, "EF.EXT1" },
++	{ 0x6f4b, "EF.EXT2" },
++	{ 0x6f4c, "EF.EXT3" },
++	{ 0x6f4d, "EF.BDN" },
++	{ 0x6f4e, "EF.EXT4" },
++	{ 0x6f4f, "EF.ECCP" },
++	{ 0x6f54, "EF.SUME" },
++#if 0
++	{ 0, NULL }
++};
++
++/* Elementary Files at the DF.GSM level */
++static const value_string df_gsm_efs[] = {
++#endif
++	{ 0x6f05, "EF.LP" },
++	{ 0x6f07, "EF.IMSI" },
++	{ 0x6f20, "EF.Kc" },
++	{ 0x6f30, "EF.PLMNsel" },
++	{ 0x6f31, "EF.HPPLMN" },
++	{ 0x6f37, "EF.ACMax" },
++	{ 0x6f38, "EF.SST" },
++	{ 0x6f39, "EF.ACM" },
++	{ 0x6f3e, "EF.GID1" },
++	{ 0x6f3f, "EF.GID2" },
++	{ 0x6f41, "EF.PUCT" },
++	{ 0x6f45, "EF.CBMI" },
++	{ 0x6f46, "EF.SPN" },
++	{ 0x6f74, "EF.BCCH" },
++	{ 0x6f78, "EF.ACC" },
++	{ 0x6f7b, "EF.FPLMN" },
++	{ 0x6f7e, "EF.LOCI" },
++	{ 0x6fad, "EF.AD" },
++	{ 0x6fae, "EF.PHASE" },
++	{ 0x6fb1, "EF.VGCS" },
++	{ 0x6fb2, "EF.VGCSS" },
++	{ 0x6fb3, "EF.VBS" },
++	{ 0x6fb4, "EF.VBSS" },
++	{ 0x6fb5, "EF.eMLPP" },
++	{ 0x6fb6, "EF.AAeM" },
++	{ 0x6fb7, "EF.ECC" },
++	{ 0x6f50, "EF.CBMIR" },
++	{ 0x6f51, "EF.NIA" },
++	{ 0x6f52, "EF.KcGPRS" },
++	{ 0x6f53, "EF.LOCIGPRS" },
++	{ 0x6f54, "EF.SUME" },
++	{ 0x6f60, "EF.PLMNwAcT" },
++	{ 0x6f61, "EF.OPLMNwAcT" },
++	{ 0x6f62, "EF.HPLMNAcT" },
++	{ 0x6f63, "EF.CPBCCH" },
++	{ 0x6f64, "EF.INVSCAN" },
++#if 0
++	{ 0, NULL }
++};
++
++static const value_string df_gsm_dfs[] = {
++#endif
++	{ 0x5f30, "DF.IRIDIUM" },
++	{ 0x5f31, "DF.GLOBST" },
++	{ 0x5f32, "DF.ICO" },
++	{ 0x5f33, "DF.ACeS" },
++	{ 0x5f40, "DF.EIA/TIA-533" },
++	{ 0x5f60, "DF.CTS" },
++	{ 0x5f70, "DF.SoLSA" },
++	{ 0x5f3c, "DF.MExE" },
++#if 0
++	{ 0, NULL }
++};
++
++static const value_string adf_usim_dfs[] = {
++#endif
++	{ 0x5f3a, "DF.PHONEBOOK" },
++	{ 0x5f3b, "DF.GSM-ACCESS" },
++	{ 0x5f3c, "DF.MExE" },
++	{ 0x5f70, "DF.SoLSA" },
++	{ 0x5f40, "DF.WLAN" },
++#if 0
++	{ 0, NULL }
++};
++
++static const value_string adf_usim_efs[] = {
++#endif
++	{ 0x6f05, "EF.LI" },
++	{ 0x6f06, "EF.ARR" },
++	{ 0x6f07, "EF.IMSI" },
++	{ 0x6f08, "EF.Keys" },
++	{ 0x6f09, "EF.KeysPS" },
++	{ 0x6f2c, "EF.DCK" },
++	{ 0x6f31, "EF.HPPLMN" },
++	{ 0x6f32, "EF.CNL" },
++	{ 0x6f37, "EF.ACMax" },
++	{ 0x6f38, "EF.USI" },
++	{ 0x6f39, "EF.ACM" },
++	{ 0x6f3b, "EF.FDN" },
++	{ 0x6f3c, "EF.SMS" },
++	{ 0x6f3e, "EF.GID1" },
++	{ 0x6f3f, "EF.GID2" },
++	{ 0x6f40, "EF.MSISDN" },
++	{ 0x6f41, "EF.PUCI" },
++	{ 0x6f42, "EF.SMSP" },
++	{ 0x6f43, "EF.SMSS" },
++	{ 0x6f45, "EF.CBMI" },
++	{ 0x6f46, "EF.SPN" },
++	{ 0x6f47, "EF.SMSR" },
++	{ 0x6f48, "EF.CBMID" },
++	{ 0x6f49, "EF.SIN" },
++	{ 0x6f4b, "EF.EXT2" },
++	{ 0x6f4c, "EF.EXT3" },
++	{ 0x6f4d, "EF.BDN" },
++	{ 0x6f4e, "EF.EXT5" },
++	{ 0x6f50, "EF.CBMIR" },
++	{ 0x6f55, "EF.EXT4" },
++	{ 0x6f56, "EF.EST" },
++	{ 0x6f57, "EF.ACL" },
++	{ 0x6f58, "EF.CMI" },
++	{ 0x6f5b, "EF.START-HFN" },
++	{ 0x6f5c, "EF.THRESHOLD" },
++	{ 0x6f60, "EF.PLMNwAcT" },
++	{ 0x6f61, "EF.OPLMNwAcT" },
++	{ 0x6f62, "EF.HPLMNAcT" },
++	{ 0x6fd9, "EF.EHPLMN" },
++	{ 0x6f73, "EF.PSLOCI" },
++	{ 0x6f78, "EF.ACC" },
++	{ 0x6f7b, "EF.FPLMN" },
++	{ 0x6f7e, "EF.LOCI" },
++	{ 0x6f80, "EF.ICI" },
++	{ 0x6f81, "EF.OCI" },
++	{ 0x6f82, "EF.ICT" },
++	{ 0x6f83, "EF.OCT" },
++	{ 0x6fad, "EF.AD" },
++	{ 0x6fb5, "EF.eMLPP" },
++	{ 0x6fb6, "EF.AAeM" },
++	{ 0x6fb7, "EF.ECC" },
++	{ 0x6fc3, "EF.Hiddenkey" },
++	{ 0x6fc4, "EF.NETPAR" },
++	{ 0x6fc5, "EF.PNN" },
++	{ 0x6fc6, "EF.OPL" },
++	{ 0x6fc7, "EF.MBDN" },
++	{ 0x6fc8, "EF.EXT6" },
++	{ 0x6fc9, "EF.MBI" },
++	{ 0x6fca, "EF.MWIS" },
++	{ 0x6fcb, "EF.CFIS" },
++	{ 0x6fcc, "EF.EXT7" },
++	{ 0x6fcd, "EF.SPDI" },
++	{ 0x6fce, "EF.MMSN" },
++	{ 0x6fcf, "EF.EXT8" },
++	{ 0x6fd0, "EF.MMSICP" },
++	{ 0x6fd1, "EF.MMSUP" },
++	{ 0x6fd2, "EF.MMSUCP" },
++	{ 0x6fd3, "EF.NIA" },
++	{ 0x6f4f, "EF.CCP2" },
++	{ 0x6fb1, "EF.VGCS" },
++	{ 0x6fb2, "EF.VGCSS" },
++	{ 0x6fb3, "EF.VBS" },
++	{ 0x6fb4, "EF.VBSS" },
++	{ 0x6fd4, "EF.VGCSCA" },
++	{ 0x6fd5, "EF.VBSCA" },
++	{ 0x6fd6, "EF.GBAP" },
++	{ 0x6fd7, "EF.MSK" },
++	{ 0x6fd8, "EF.MUK" },
++	{ 0x6fda, "EF.GBANL" },
++#if 0
++	{ 0, NULL }
++};
++
++static const value_string df_phonebook_efs[] = {
++#endif
++	{ 0x4f30, "EF.PBR" },
++	{ 0x4f4a, "EF.EXT1" },
++	{ 0x4f4b, "EF.AAS" },
++	{ 0x4f4c, "EF.GAS" },
++	{ 0x4f22, "EF.FSC" },
++	{ 0x4f23, "EF.CC" },
++	{ 0x4f24, "EF.PUID" },
++	{ 0x4f3a, "EF.ADN" },
++	{ 0x4f09, "EF.PBC" },
++	{ 0x4f11, "EF.ANRA" },
++	{ 0x4f13, "EF.ANRB" },
++	{ 0x4f50, "EF.EMAIL" },
++	{ 0x4f19, "EF.SNE" },
++	{ 0x4f21, "EF.UID" },
++	{ 0x4f26, "EF.GRP" },
++	{ 0x4f15, "EF.ANRC" },
++	{ 0x4f3b, "EF.ADN1" },
++	{ 0x4f0a, "EF.PBC1" },
++	{ 0x4f12, "EF.ANRA1" },
++	{ 0x4f14, "EF.ANRB1" },
++	{ 0x4f51, "EF.EMAIL1" },
++	{ 0x4f1a, "EF.SNE1" },
++	{ 0x4f20, "EF.UID1" },
++	{ 0x4f25, "EF.GRP1" },
++	{ 0x4f16, "EF.ANRC1" },
++	{ 0, NULL }
++};
++
++/* Section 9.4 of TS 11.11 */
++static const value_string sw_vals[] = {
++	/* we only list the non-wildcard commands here */
++	{ 0x9000, "Normal ending of the command" },
++	{ 0x9300, "SIM Application Toolkit is busy" },
++	{ 0x9240, "Memory problem" },
++	{ 0x9400, "No EF selected" },
++	{ 0x9402, "Out of range (invalid address)" },
++	{ 0x0404, "File ID not found" },
++	{ 0x9408, "File is inconsistent with the command" },
++	{ 0x9802, "No CHV initialized" },
++	{ 0x9804, "Access condition not fulfilled / authentication failed" },
++	{ 0x9808, "In contradiction with CHV status" },
++	{ 0x9810, "In contradiction with invalidation status" },
++	{ 0x9840, "Unsuccessful CHV verification, no attempt left / CHV blocked" },
++	{ 0x9850, "Increase cannot be performed, max value reached" },
++	{ 0x6b00, "Incorrect paramaeter P1 or P2" },
++	/* Section 10.2.1.3 of TS 102 221 */
++	{ 0x6200, "Warning: No information given, state of volatile memory unchanged" },
++	{ 0x6281, "Warning: Part of returned data may be corrupted" },
++	{ 0x6282, "Warning: End of file/record reached before reading Le bytes" },
++	{ 0x6283, "Warning: Selected file invalidated" },
++	{ 0x6285, "Warning: Selected file in termination state" },
++	{ 0x62f1, "Warning: More data available" },
++	{ 0x62f2, "Warning: More data available and proactive command pending" },
++	{ 0x62f3, "Warning: Response data available" },
++	{ 0x63f1, "Warning: More data expected" },
++	{ 0x63f2, "Warning: More data expected and proactive command pending" },
++	/* Section 10.2.1.4 of TS 102 221 */
++	{ 0x6400, "Execution error: No information given, memory unchanged" },
++	{ 0x6500, "Execution error: No information given, memory changed" },
++	{ 0x6581, "Execution error: Memory problem" },
++	/* Section 10.2.1.5 of TS 102 221 */
++	{ 0x6700, "Wrong length" },
++	{ 0x6d00, "Instruction code not supported or invalid" },
++	{ 0x6e00, "Class not supported" },
++	{ 0x6f00, "Technical problem, no precise diagnosis" },
++	/* Section 10.2.1.5.1 of TS 102 221 */
++	{ 0x6800, "Function in CLA not supported" },
++	{ 0x6881, "Function in CLA not supported: Logical channel not supported" },
++	{ 0x6882, "Function in CLA not supported: Secure messaging not supported" },
++	/* Section 10.2.1.5.2 of TS 102 221 */
++	{ 0x6900, "Command not allowed" },
++	{ 0x6981, "Command not allowed: Command incompatible with file structure" },
++	{ 0x6982, "Command not allowed: Security status not satisfied" },
++	{ 0x6983, "Command not allowed: Authentication/PIN method blocked" },
++	{ 0x6984, "Command not allowed: Referenced data invalid" },
++	{ 0x6985, "Command not allowed: Conditions of use not satisfied" },
++	{ 0x6986, "Command not allowed: No EF selected" },
++	{ 0x6989, "Command not allowed: Secure channel - security not satisfied" },
++	/* Section 10.2.1.5.3 of TS 102 221 */
++	{ 0x6a80, "Wrong parameters: Incorrect parameters in the data field" },
++	{ 0x6a81, "Wrong parameters: Function not supported" },
++	{ 0x6a82, "Wrong parameters: File not found" },
++	{ 0x6a83, "Wrong parameters: Record not found" },
++	{ 0x6a84, "Wrong parameters: Not enough memory space" },
++	{ 0x6a86, "Wrong parameters: Incorrect P1 to P2" },
++	{ 0x6a87, "Wrong parameters: Lc inconsistent with P1 to P2" },
++	{ 0x6a88, "Wrong parameters: Referenced data not found" },
++	/* Section 10.2.1.6 of TS 102 221 */
++	{ 0x9862, "Authentication error, application specific" },
++	{ 0x9863, "Security session or association expired" },
++	{ 0, NULL }
++};
++
++static const gchar *get_sw_string(guint16 sw)
++{
++	guint8 sw1 = sw >> 8;
++
++	switch (sw1) {
++	case 0x91:
++		return "Normal ending of command with info from proactive SIM";
++	case 0x9e:
++		return "Length of the response data given / SIM data download error";
++	case 0x9f:
++		return "Length of the response data";
++	case 0x92:
++		if ((sw & 0xf0) == 0x00)
++			return "Command successful but after internal retry routine";
++	case 0x67:
++		return "Incorrect parameter P3";
++	case 0x6d:
++		return "Unknown instruction code";
++	case 0x6e:
++		return "Wrong instruction class";
++	case 0x6f:
++		return "Technical problem with no diacnostic";
++	}
++	return val_to_str(sw, sw_vals, "%04x");
++}
++
++static void
++dissect_bertlv(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
++{
++	int pos = 0;
++
++	while (pos < tvb_length(tvb)) {
++		guint8 tag, len;
++		tvbuff_t *subtvb;
++
++		proto_tree_add_item(tree, hf_cat_ber_tag, tvb, pos, 1, FALSE);
++
++		/* FIXME: properly follow BER coding rules */
++		tag = tvb_get_guint8(tvb, pos++);
++		len = tvb_get_guint8(tvb, pos++);
++
++		subtvb = tvb_new_subset(tvb, pos, len, len);
++		switch (tag) {
++		case 0xD0:	/* proactive command */
++			call_dissector(sub_handle_cap, subtvb, pinfo, tree);
++			break;
++		}
++
++		pos += len;
++	}
++}
++
++
++#define P1_OFFS 	0
++#define P2_OFFS 	1
++#define P3_OFFS 	2
++#define DATA_OFFS	3
++
++static int
++dissect_gsm_apdu(guint8 ins, guint8 p1, guint8 p2, guint8 p3,
++		 tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree)
++{
++	guint8 g8;
++	guint16 g16;
++	tvbuff_t *subtvb;
++	int i;
++
++	col_append_fstr(pinfo->cinfo, COL_INFO, "%s ",
++			val_to_str(ins, apdu_ins_vals, "%02x"));
++
++	switch (ins) {
++	case 0xA4: /* SELECT */
++		if (p3 < 2)
++			break;
++		switch (p1) {
++		case 0x03:	/* parent DF */
++			col_append_fstr(pinfo->cinfo, COL_INFO, "Parent DF ");
++			break;
++		case 0x04:	/* select by AID */
++			col_append_fstr(pinfo->cinfo, COL_INFO, "Application %s ",
++					tvb_bytes_to_str(tvb, offset+DATA_OFFS, p3));
++			proto_tree_add_item(tree, hf_aid, tvb, offset+DATA_OFFS, p3, FALSE);
++			break;
++
++		case 0x09:	/* select by relative path */
++			col_append_fstr(pinfo->cinfo, COL_INFO, ".");
++			/* fallthrough */
++		case 0x08:	/* select by absolute path */
++			for (i = 0; i < p3; i += 2) {
++				g16 = tvb_get_ntohs(tvb, offset+DATA_OFFS+i);
++				col_append_fstr(pinfo->cinfo, COL_INFO, "/%s",
++						val_to_str(g16, mf_dfs, "%04x"));
++				proto_tree_add_item(tree, hf_file_id, tvb, offset+DATA_OFFS+i, 2, FALSE);
++			}
++			col_append_fstr(pinfo->cinfo, COL_INFO, " ");
++			break;
++		default:
++			g16 = tvb_get_ntohs(tvb, offset+DATA_OFFS);
++			col_append_fstr(pinfo->cinfo, COL_INFO, "File %s ",
++					val_to_str(g16, mf_dfs, "%04x"));
++			proto_tree_add_item(tree, hf_file_id, tvb, offset+DATA_OFFS, p3, FALSE);
++			offset++;
++			break;
++		}
++		break;
++	case 0xB0: /* READ BINARY */
++	case 0xD6: /* UPDATE BINARY */
++		col_append_fstr(pinfo->cinfo, COL_INFO, "Offset=%u ", p1 << 8 | p2);
++		proto_tree_add_item(tree, hf_bin_offset, tvb, offset+P1_OFFS, 2, FALSE);
++		proto_tree_add_item(tree, hf_apdu_data, tvb, offset+DATA_OFFS, p3, FALSE);
++		break;
++	case 0xB2: /* READ RECORD */
++	case 0xDC: /* READ RECORD */
++		col_append_fstr(pinfo->cinfo, COL_INFO, "RecordNr=%u ", p1);
++		proto_tree_add_item(tree, hf_record_nr, tvb, offset+P1_OFFS, 1, FALSE);
++		proto_tree_add_item(tree, hf_apdu_data, tvb, offset+DATA_OFFS, p3, FALSE);
++		break;
++	case 0x20: /* VERIFY CHV */
++	case 0x24: /* CHANGE CHV */
++	case 0x2C: /* UNBLOCK CHV */
++		col_append_fstr(pinfo->cinfo, COL_INFO, "CHV=%u ", p2);
++		offset += DATA_OFFS;
++		break;
++	case 0x88: /* RUN GSM ALGO */
++		proto_tree_add_item(tree, hf_auth_rand, tvb, offset+DATA_OFFS, 16, FALSE);
++		offset += DATA_OFFS+16;
++		/* FIXME: SRES, Kc */
++		break;
++	case 0x10: /* TERMINAL PROFILE */
++		offset += DATA_OFFS;
++		proto_tree_add_bitmask(tree, tvb, offset++, hf_tprof_b1, ett_tprof_b1, tprof_b1_fields, FALSE);
++		proto_tree_add_bitmask(tree, tvb, offset++, hf_tprof_b2, ett_tprof_b2, tprof_b2_fields, FALSE);
++		proto_tree_add_bitmask(tree, tvb, offset++, hf_tprof_b3, ett_tprof_b3, tprof_b3_fields, FALSE);
++		proto_tree_add_bitmask(tree, tvb, offset++, hf_tprof_b4, ett_tprof_b4, tprof_b4_fields, FALSE);
++		proto_tree_add_bitmask(tree, tvb, offset++, hf_tprof_b5, ett_tprof_b5, tprof_b5_fields, FALSE);
++		proto_tree_add_bitmask(tree, tvb, offset++, hf_tprof_b6, ett_tprof_b6, tprof_b6_fields, FALSE);
++		proto_tree_add_bitmask(tree, tvb, offset++, hf_tprof_b7, ett_tprof_b7, tprof_b7_fields, FALSE);
++		proto_tree_add_bitmask(tree, tvb, offset++, hf_tprof_b8, ett_tprof_b8, tprof_b8_fields, FALSE);
++		proto_tree_add_bitmask(tree, tvb, offset++, hf_tprof_b9, ett_tprof_b9, tprof_b9_fields, FALSE);
++		proto_tree_add_bitmask(tree, tvb, offset++, hf_tprof_b10, ett_tprof_b10, tprof_b10_fields, FALSE);
++		proto_tree_add_bitmask(tree, tvb, offset++, hf_tprof_b11, ett_tprof_b11, tprof_b11_fields, FALSE);
++		proto_tree_add_bitmask(tree, tvb, offset++, hf_tprof_b12, ett_tprof_b12, tprof_b12_fields, FALSE);
++		proto_tree_add_bitmask(tree, tvb, offset++, hf_tprof_b13, ett_tprof_b13, tprof_b13_fields, FALSE);
++		proto_tree_add_bitmask(tree, tvb, offset++, hf_tprof_b14, ett_tprof_b14, tprof_b14_fields, FALSE);
++		proto_tree_add_bitmask(tree, tvb, offset++, hf_tprof_b15, ett_tprof_b15, tprof_b15_fields, FALSE);
++		proto_tree_add_bitmask(tree, tvb, offset++, hf_tprof_b16, ett_tprof_b16, tprof_b16_fields, FALSE);
++		proto_tree_add_bitmask(tree, tvb, offset++, hf_tprof_b17, ett_tprof_b17, tprof_b17_fields, FALSE);
++		/* FIXME */
++		break;
++	case 0x12: /* FETCH */
++		subtvb = tvb_new_subset(tvb, offset+DATA_OFFS, p3, p3);
++		dissect_bertlv(subtvb, pinfo, tree);
++		break;
++	case 0x14: /* TERMINAL RESPONSE */
++		subtvb = tvb_new_subset(tvb, offset+DATA_OFFS, p3, p3);
++		call_dissector(sub_handle_cap, subtvb, pinfo, tree);
++		break;
++	case 0x70: /* MANAGE CHANNEL */
++		proto_tree_add_item(tree, hf_chan_op, tvb, offset-3, 1, FALSE);
++		col_append_fstr(pinfo->cinfo, COL_INFO, "Operation=%s ",
++				val_to_str(p1, chan_op_vals, "%02x"));
++		switch (p1) {
++		case 0x00: /* OPEN */
++			/* Logical channels are assigned by the card, so in 'open' they are
++			 * in the DATA, whereas in close their number is in P2 */
++			proto_tree_add_item(tree, hf_chan_nr, tvb, offset+DATA_OFFS, 1, FALSE);
++			g8 = tvb_get_guint8(tvb, offset+DATA_OFFS);
++			col_append_fstr(pinfo->cinfo, COL_INFO, "Channel=%d ", g8);
++			break;
++		case 0x80: /* CLOSE */
++			proto_tree_add_item(tree, hf_chan_nr, tvb, offset-2, 1, FALSE);
++			col_append_fstr(pinfo->cinfo, COL_INFO, "Channel=%d ", p2);
++			break;
++		}
++		break;
++	default:
++		return -1;
++	}
++
++	return 0;
++}
++
++static void
++dissect_apdu_tvb(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree)
++{
++	guint8 cla, ins, p1, p2, p3;
++	guint16 sw;
++	proto_item *ti;
++	proto_tree *sim_tree = NULL;
++	int rc = -1;
++	guint tvb_len = tvb_length(tvb);
++
++	cla = tvb_get_guint8(tvb, offset);
++	ins = tvb_get_guint8(tvb, offset+1);
++	p1 = tvb_get_guint8(tvb, offset+2);
++	p2 = tvb_get_guint8(tvb, offset+3);
++	p3 = tvb_get_guint8(tvb, offset+4);
++
++	if (tree) {
++		ti = proto_tree_add_item(tree, proto_gsm_sim, tvb, 0, -1, FALSE);
++		sim_tree = proto_item_add_subtree(ti, ett_sim);
++
++		proto_tree_add_item(sim_tree, hf_apdu_cla, tvb, offset, 1, TRUE);
++		proto_tree_add_item(sim_tree, hf_apdu_ins, tvb, offset+1, 1, TRUE);
++	}
++	offset += 2;
++
++	col_append_fstr(pinfo->cinfo, COL_INFO, "%s ",
++			val_to_str(cla, apdu_cla_vals, "%02x"));
++
++	//if (cla == 0xA0)
++		rc = dissect_gsm_apdu(ins, p1, p2, p3, tvb, offset, pinfo, sim_tree);
++
++	if (rc == -1 && sim_tree) {
++		/* default dissector */
++		proto_tree_add_item(sim_tree, hf_apdu_p1, tvb, offset+0, 1, TRUE);
++		proto_tree_add_item(sim_tree, hf_apdu_p2, tvb, offset+1, 1, TRUE);
++		proto_tree_add_item(sim_tree, hf_apdu_p3, tvb, offset+2, 1, TRUE);
++		proto_tree_add_item(sim_tree, hf_apdu_data, tvb, offset+3, p3, TRUE);
++	}
++	offset += 3;
++
++	/* FIXME: DATA */
++
++	/* obtain status word */
++	sw = tvb_get_ntohs(tvb, tvb_len-2);
++	//proto_tree_add_item(sim_tree, hf_apdu_sw, tvb, tvb_len-2, 2, FALSE);
++	proto_tree_add_uint_format(sim_tree, hf_apdu_sw, tvb, tvb_len-2, 2, sw,
++				   "Status Word: %s", get_sw_string(sw));
++
++	switch (sw >> 8) {
++	case 0x61:
++	case 0x90:
++	case 0x91:
++	case 0x92:
++		break;
++	default:
++		col_append_fstr(pinfo->cinfo, COL_INFO, ": %s ", get_sw_string(sw));
++		break;
++	}
++
++#if 0
++	sw1 = tvb_get_guint8(tvb, tvb_len-2);
++	proto_tree_add_item(sim_tree, hf_apdu_sw1, tvb, tvb_len-2, 1, TRUE);
++	sw2 = tvb_get_guint8(tvb, tvb_len-1);
++	proto_tree_add_item(sim_tree, hf_apdu_sw2, tvb, tvb_len-1, 1, TRUE);
++#endif
++}
++
++static void
++dissect_gsm_sim(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
++{
++	proto_item *ti;
++	proto_tree *sim_tree;
++
++	dissect_apdu_tvb(tvb, 0, pinfo, tree);
++}
++
++void
++proto_reg_handoff_gsm_sim(void);
++
++void
++proto_register_gsm_sim(void)
++{
++	static hf_register_info hf[] = {
++		{ &hf_apdu_cla,
++			{ "Class", "iso7816.apdu.cla",
++			  FT_UINT8, BASE_HEX, VALS(apdu_cla_vals), 0,
++			  "ISO 7816-4 APDU CLA (Class) Byte", HFILL }
++		},
++		{ &hf_apdu_ins,
++			{ "Instruction", "iso7816.apdu.ins",
++			  FT_UINT8, BASE_HEX, VALS(apdu_ins_vals), 0,
++			  "ISO 7816-4 APDU INS (Instruction) Byte", HFILL }
++		},
++		{ &hf_apdu_p1,
++			{ "Parameter 1", "iso7816.apdu.p1",
++			  FT_UINT8, BASE_HEX, NULL, 0,
++			  "ISO 7816-4 APDU P1 (Parameter 1) Byte", HFILL }
++		},
++		{ &hf_apdu_p2,
++			{ "Parameter 2", "iso7816.apdu.p2",
++			  FT_UINT8, BASE_HEX, NULL, 0,
++			  "ISO 7816-4 APDU P2 (Parameter 2) Byte", HFILL }
++		},
++		{ &hf_apdu_p3,
++			{ "Length (Parameter 3)", "iso7816.apdu.p3",
++			  FT_UINT8, BASE_HEX, NULL, 0,
++			  "ISO 7816-4 APDU P3 (Parameter 3) Byte", HFILL }
++		},
++		{ &hf_apdu_data,
++			{ "APDU Payload", "iso7816.apdu.data",
++			  FT_BYTES, BASE_NONE, NULL, 0,
++			  "ISO 7816-4 APDU Data Payload", HFILL }
++		},
++		{ &hf_apdu_sw,
++			{ "Status Word (SW1:SW2)", "iso7816.apdu.sw",
++			  FT_UINT16, BASE_HEX, VALS(sw_vals), 0,
++			  "ISO 7816-4 APDU Status Word", HFILL }
++		},
++		{ &hf_file_id,
++			{ "File ID", "iso7816.file_id",
++			  FT_UINT16, BASE_HEX, VALS(mf_dfs), 0,
++			  "ISO 7816-4 File ID", HFILL }
++		},
++		{ &hf_aid,
++			{ "Application ID", "iso7816.aid",
++			  FT_BYTES, BASE_NONE, NULL, 0,
++			  "ISO 7816-4 Application ID", HFILL }
++		},
++		{ &hf_bin_offset,
++			{ "Offset", "iso7816.bin_offset",
++			  FT_UINT16, BASE_DEC, NULL, 0,
++			  "Offset into binary file", HFILL }
++		},
++		{ &hf_record_nr,
++			{ "Record number", "iso7816.record_nr",
++			  FT_UINT8, BASE_DEC, NULL, 0,
++			  "Offset into binary file", HFILL }
++		},
++		{ &hf_auth_rand,
++			{ "Random Challenge", "iso7816.auth_rand",
++			  FT_BYTES, BASE_NONE, NULL, 0,
++			  "GSM Authentication Random Challenge", HFILL }
++		},
++		{ &hf_chan_nr,
++			{ "Channel Number", "iso7816.chan_nr",
++			  FT_UINT8, BASE_DEC, NULL, 0,
++			  "ISO 7816-4 Logical Channel Number", HFILL }
++		},
++		{ &hf_chan_op,
++			{ "Channel Operation", "iso7816.chan_op",
++			  FT_UINT8, BASE_HEX, VALS(chan_op_vals), 0,
++			  "ISO 7816-4 Logical Channel Operation", HFILL }
++		},
++
++
++		/* Terminal Profile Byte 1 */
++		{ &hf_tprof_b1,
++			{ "Terminal Profile Byte 1 (Download)", "iso7816.tp.b1",
++			  FT_UINT8, BASE_HEX, NULL, 0,
++			  NULL, HFILL },
++		},
++		{ &hf_tp_prof_dld,
++			{ "Profile Download", "iso7816.tp.prof_dld",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x01,
++			  "TP Profile Downolad", HFILL }
++		},
++		{ &hf_tp_sms_data_dld,
++			{ "SMS-PP Data Download", "iso7816.tp.sms_data_dld",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x02,
++			  "TP SMS-PP Data Downolad", HFILL }
++		},
++		{ &hf_tp_cb_data_dld,
++			{ "CB Data Download", "iso7816.tp.cb_data_dld",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x04,
++			  "TP Cell Broadcast Data Downolad", HFILL }
++		},
++		{ &hf_tp_menu_sel,
++			{ "Menu Selection", "iso7816.tp.menu_sel",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x08,
++			  "TP Menu Selection", HFILL }
++		},
++		{ &hf_tp_9e_err,
++			{ "Menu Selection", "iso7816.tp.9e_err",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x10,
++			  "TP 9EXX response code for SIM data download error", HFILL }
++		},
++		{ &hf_tp_timer_exp,
++			{ "Timer expiration", "iso7816.tp.timer_exp",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x20,
++			  "TP Timer expiration", HFILL }
++		},
++		{ &hf_tp_ussd_cc,
++			{ "USSD string data in Call Control", "iso7816.tp.ussd_cc",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x40,
++			  "TP USSD string data object in Call Control", HFILL }
++		},
++		{ &hf_tp_auto_redial,
++			{ "Envelope CC during automatic redial", "iso7816.tp.auto_redial",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x80,
++			  "TP Envelope CC always sent to SIM during automatic redial", HFILL }
++		},
++
++		/* Terminal Profile Byte 2 */
++		{ &hf_tprof_b2,
++			{ "Terminal Profile Byte 2 (Other)", "iso7816.tp.b2",
++			  FT_UINT8, BASE_HEX, NULL, 0,
++			  NULL, HFILL },
++		},
++		{ &hf_tp_cmd_res,
++			{ "Command result", "iso7816.tp.cmd_res",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x01,
++			  "TP Command result", HFILL }
++		},
++		{ &hf_tp_cc_sim,
++			{ "Call Control by SIM", "iso7816.tp.cc_sim",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x02,
++			  "TP Call Control by SIM", HFILL }
++		},
++		{ &hf_tp_cc_sim_cellid,
++			{ "Cell ID in Call Control by SIM", "iso7816.tp.cc_sim_cellid",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x04,
++			  "TP Cell ID included in Call Control by SIM", HFILL }
++		},
++		{ &hf_tp_mo_sms_sim,
++			{ "MO SMS control by SIM", "iso7816.tp.mo_sms_sim",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x08,
++			  "TP MO short message control by SIM", HFILL }
++		},
++		{ &hf_tp_alpha_id,
++			{ "Alpha identifier according 9.1.3", "iso7816.tp.alpha_id",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x10,
++			  "TP Handling of alpha identifier according to 9.1.3", HFILL }
++		},
++		{ &hf_tp_ucs2_entry,
++			{ "UCS2 Entry", "iso7816.tp.ucs2_entry",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x20,
++			  "TP UCS2 Entry", HFILL }
++		},
++		{ &hf_tp_ucs2_display,
++			{ "UCS2 Display", "iso7816.tp.ucs2_display",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x40,
++			  "TP UCS2 Display", HFILL }
++		},
++		{ &hf_tp_display_ext,
++			{ "Display of Extension Text", "iso7816.tp.display_ext",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x80,
++			  "TP Display of the Extension Text", HFILL }
++		},
++		/* Terminal Profile Byte 3 */
++		{ &hf_tprof_b3,
++			{ "Terminal Profile Byte 3 (Proactive SIM)", "iso7816.tp.b3",
++			  FT_UINT8, BASE_HEX, NULL, 0,
++			  NULL, HFILL },
++		},
++		{ &hf_tp_pa_display_text,
++			{ "Proactive SIM: DISPLAY TEXT", "iso7816.tp.pa.display_text",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x01,
++			  NULL, HFILL }
++		},
++		{ &hf_tp_pa_get_inkey,
++			{ "Proactive SIM: GET INKEY", "iso7816.tp.pa.get_inkey",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x02,
++			  NULL, HFILL }
++		},
++		{ &hf_tp_pa_get_input,
++			{ "Proactive SIM: GET INPUT", "iso7816.tp.pa.get_input",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x04,
++			  NULL, HFILL }
++		},
++		{ &hf_tp_pa_more_time,
++			{ "Proactive SIM: MORE TIME", "iso7816.tp.pa.more_time",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x08,
++			  NULL, HFILL }
++		},
++		{ &hf_tp_pa_play_tone,
++			{ "Proactive SIM: PLAY TONE", "iso7816.tp.pa.play_tone",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x10,
++			  NULL, HFILL }
++		},
++		{ &hf_tp_pa_poll_intv,
++			{ "Proactive SIM: POLL INTERVAL", "iso7816.tp.pa.poll_intv",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x20,
++			  NULL, HFILL }
++		},
++		{ &hf_tp_pa_polling_off,
++			{ "Proactive SIM: POLLING OFF", "iso7816.tp.pa.polling_off",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x40,
++			  NULL, HFILL }
++		},
++		{ &hf_tp_pa_refresh,
++			{ "Proactive SIM: REFRESH", "iso7816.tp.pa.refresh",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x80,
++			  NULL, HFILL }
++		},
++		/* Terminal Profile Byte 4 */
++		{ &hf_tprof_b4,
++			{ "Terminal Profile Byte 4 (Proactive SIM)", "iso7816.tp.b4",
++			  FT_UINT8, BASE_HEX, NULL, 0,
++			  NULL, HFILL },
++		},
++		{ &hf_tp_pa_select_item,
++			{ "Proactive SIM: SELECT ITEM", "iso7816.tp.pa.select_item",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x01,
++			  NULL, HFILL }
++		},
++		{ &hf_tp_pa_send_sms,
++			{ "Proactive SIM: SEND SHORT MESSAGE", "iso7816.tp.pa.send_sms",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x02,
++			  NULL, HFILL }
++		},
++		{ &hf_tp_pa_send_ss,
++			{ "Proactive SIM: SEND SS", "iso7816.tp.pa.send_ss",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x04,
++			  NULL, HFILL }
++		},
++		{ &hf_tp_pa_send_ussd,
++			{ "Proactive SIM: SEND USSD", "iso7816.tp.pa.send_ussd",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x08,
++			  NULL, HFILL }
++		},
++		{ &hf_tp_pa_set_up_call,
++			{ "Proactive SIM: SET UP CALL", "iso7816.tp.pa.set_up_call",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x10,
++			  NULL, HFILL }
++		},
++		{ &hf_tp_pa_set_up_menu,
++			{ "Proactive SIM: SET UP MENU", "iso7816.tp.pa.set_up_menu",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x20,
++			  NULL, HFILL }
++		},
++		{ &hf_tp_pa_prov_loci,
++			{ "Proactive SIM: PROVIDE LOCAL INFORMATION", "iso7816.tp.pa.prov_loci",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x40,
++			  NULL, HFILL }
++		},
++		{ &hf_tp_pa_prov_loci_nmr,
++			{ "Proactive SIM: PROVIDE LOCAL INFORMATION (NMR)", "iso7816.tp.pa.prov_loci_nmr",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x80,
++			  NULL, HFILL }
++		},
++		/* Terminal Profile Byte 5 */
++		{ &hf_tprof_b5,
++			{ "Terminal Profile Byte 5 (Event driven information)", "iso7816.tp.b5",
++			  FT_UINT8, BASE_HEX, NULL, 0,
++			  NULL, HFILL },
++		},
++		{ &hf_tp_pa_evt_list,
++			{ "Proactive SIM: SET UP EVENT LIST", "iso7816.tp.pa.set_up_evt_list",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x01,
++			  NULL, HFILL }
++		},
++		{ &hf_tp_ev_mt_call,
++			{ "Event: MT call", "iso7816.tp.evt.mt_call",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x02,
++			  NULL, HFILL }
++		},
++		{ &hf_tp_ev_call_connected,
++			{ "Event: Call connected", "iso7816.tp.evt.call_conn",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x04,
++			  NULL, HFILL }
++		},
++		{ &hf_tp_ev_call_disconnected,
++			{ "Event: Call disconnected", "iso7816.tp.evt.call_disc",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x08,
++			  NULL, HFILL }
++		},
++		{ &hf_tp_ev_location_status,
++			{ "Event: Location status", "iso7816.tp.evt.loc_status",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x10,
++			  NULL, HFILL }
++		},
++		{ &hf_tp_ev_user_activity,
++			{ "Event: User activity", "iso7816.tp.evt.user_activity",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x20,
++			  NULL, HFILL }
++		},
++		{ &hf_tp_ev_idle_screen,
++			{ "Event: Idle screen available", "iso7816.tp.evt.idle_screen",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x40,
++			  NULL, HFILL }
++		},
++		{ &hf_tp_ev_cardreader_status,
++			{ "Event: Cardreader status", "iso7816.tp.evt.card_status",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x80,
++			  NULL, HFILL }
++		},
++		/* Terminal Profile Byte 6 */
++		{ &hf_tprof_b6,
++			{ "Terminal Profile Byte 6 (Event driven information extension)", "iso7816.tp.b6",
++			  FT_UINT8, BASE_HEX, NULL, 0,
++			  NULL, HFILL },
++		},
++		{ &hf_tp_ev_lang_sel,
++			{ "Event: Language Selection", "iso7816.tp.evt.lang_sel",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x01,
++			  NULL, HFILL }
++		},
++		{ &hf_tp_ev_brows_term,
++			{ "Event: Browser Termination", "iso7816.tp.evt.brows_term",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x02,
++			  NULL, HFILL }
++		},
++		{ &hf_tp_ev_data_avail,
++			{ "Event: Data Available", "iso7816.tp.evt.data_avail",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x04,
++			  NULL, HFILL }
++		},
++		{ &hf_tp_ev_chan_status,
++			{ "Event: Channel Status", "iso7816.tp.evt.chan_status",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x08,
++			  NULL, HFILL }
++		},
++		/* Terminal Profile Byte 7 */
++		{ &hf_tprof_b7,
++			{ "Terminal Profile Byte 7 (Multiple card proactive commands)", "iso7816.tp.b7",
++			  FT_UINT8, BASE_HEX, NULL, 0,
++			  NULL, HFILL },
++		},
++		{ &hf_tp_pa_power_on,
++			{ "Proactive SIM: POWER ON CARD", "iso7816.tp.pa.power_on_card",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x01,
++			  NULL, HFILL }
++		},
++		{ &hf_tp_pa_power_off,
++			{ "Proactive SIM: POWER OFF CARD", "iso7816.tp.pa.power_off_card",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x02,
++			  NULL, HFILL }
++		},
++		{ &hf_tp_pa_perform_card_apdu,
++			{ "Proactive SIM: PERFORM CARD APDU", "iso7816.tp.pa.perf_card_apdu",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x04,
++			  NULL, HFILL }
++		},
++		{ &hf_tp_pa_get_reader_status,
++			{ "Proactive SIM: GET READER STATUS (status)", "iso7816.tp.pa.get_rdr_status",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x08,
++			  NULL, HFILL }
++		},
++		{ &hf_tp_pa_get_reader_status_id,
++			{ "Proactive SIM: GET READER STATUS (identifier)", "iso7816.tp.pa.get_rdr_status_id",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x10,
++			  NULL, HFILL }
++		},
++		/* Terminal Profile Byte 8 */
++		{ &hf_tprof_b8,
++			{ "Terminal Profile Byte 8 (Proactive SIM)", "iso7816.tp.b8",
++			  FT_UINT8, BASE_HEX, NULL, 0,
++			  NULL, HFILL },
++		},
++		{ &hf_tp_pa_timer_start_stop,
++			{ "Proactive SIM: TIMER MANAGEMENT (start, stop)", "iso7816.tp.pa.timer_start_stop",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x01,
++			  NULL, HFILL }
++		},
++		{ &hf_tp_pa_timer_get_current,
++			{ "Proactive SIM: TIMER MANAGEMENT (get current value)", "iso7816.tp.pa.timer_get_current",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x02,
++			  NULL, HFILL }
++		},
++		{ &hf_tp_pa_prov_loci_date_tz,
++			{ "Proactive SIM: PROVIDE LOCAL INFORMATION (date, time, tz)", "iso7816.tp.pa.prov_loci_date",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x04,
++			  NULL, HFILL }
++		},
++		{ &hf_tp_pa_get_inkey_binary,
++			{ "Proactive SIM: Binary choice in GET INKEY", "iso7816.tp.pa.get_inkey_bin",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x08,
++			  NULL, HFILL }
++		},
++		{ &hf_tp_pa_set_up_idle_mode_text,
++			{ "Proactive SIM: SET UP IDLE MODE TEXT", "iso7816.tp.pa.set_up_idle_text",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x10,
++			  NULL, HFILL }
++		},
++		{ &hf_tp_pa_run_at_command,
++			{ "Proactive SIM: RUN AT COMMAND", "iso7816.tp.pa.run_at_command",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x20,
++			  NULL, HFILL }
++		},
++		{ &hf_tp_pa_2nd_alpha_setup_call,
++			{ "Proactive SIM: 2nd alpha identifier in SET UP CALL", "iso7816.tp.pa.2nd_alpha_id",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x40,
++			  NULL, HFILL }
++		},
++		{ &hf_tp_pa_2nd_capability_param,
++			{ "Proactive SIM: 2nd capability config param", "iso7816.tp.pa.2nd_capa_conf",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x80,
++			  NULL, HFILL }
++		},
++
++		/* Terminal Profile Byte 9 */
++		{ &hf_tprof_b9,
++			{ "Terminal Profile Byte 9", "iso7816.tp.b9",
++			  FT_UINT8, BASE_HEX, NULL, 0,
++			  NULL, HFILL },
++		},
++
++		/* Terminal Profile Byte 10 */
++		{ &hf_tprof_b10,
++			{ "Terminal Profile Byte 10", "iso7816.tp.b10",
++			  FT_UINT8, BASE_HEX, NULL, 0,
++			  NULL, HFILL },
++		},
++
++		/* Terminal Profile Byte 11 */
++		{ &hf_tprof_b11,
++			{ "Terminal Profile Byte 11", "iso7816.tp.b11",
++			  FT_UINT8, BASE_HEX, NULL, 0,
++			  NULL, HFILL },
++		},
++
++		/* Terminal Profile Byte 12 */
++		{ &hf_tprof_b12,
++			{ "Terminal Profile Byte 12", "iso7816.tp.b12",
++			  FT_UINT8, BASE_HEX, NULL, 0,
++			  NULL, HFILL },
++		},
++		{ &hf_tp_pa_open_chan,
++			{ "Proactive SIM: OPEN CHANNEL", "iso7816.tp.pa.open_chan",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x01,
++			  NULL, HFILL }
++		},
++		{ &hf_tp_pa_close_chan,
++			{ "Proactive SIM: CLOSE CHANNEL", "iso7816.tp.pa.close_chan",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x02,
++			  NULL, HFILL }
++		},
++		{ &hf_tp_pa_recv_data,
++			{ "Proactive SIM: RECEIVE DATA", "iso7816.tp.pa.recv_data",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x04,
++			  NULL, HFILL }
++		},
++		{ &hf_tp_pa_send_data,
++			{ "Proactive SIM: SEND DATA", "iso7816.tp.pa.send_data",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x08,
++			  NULL, HFILL }
++		},
++		{ &hf_tp_pa_get_chan_status,
++			{ "Proactive SIM: GET CHANNEL STATUS", "iso7816.tp.pa.get_chan_status",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x10,
++			  NULL, HFILL }
++		},
++
++		/* Terminal Profile Byte 13 */
++		{ &hf_tprof_b13,
++			{ "Terminal Profile Byte 13 (Bearer Independent protocol)", "iso7816.tp.b13",
++			  FT_UINT8, BASE_HEX, NULL, 0,
++			  NULL, HFILL },
++		},
++		{ &hf_tp_bip_csd,
++			{ "CSD bearer", "iso7816.tp.bip.csd",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x01,
++			  NULL, HFILL }
++		},
++		{ &hf_tp_bip_gprs,
++			{ "GPRS bearer", "iso7816.tp.bip.gprs",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x02,
++			  NULL, HFILL }
++		},
++
++		/* Terminal Profile Byte 14 */
++		{ &hf_tprof_b14,
++			{ "Terminal Profile Byte 14 (Screen height)", "iso7816.tp.b14",
++			  FT_UINT8, BASE_HEX, NULL, 0,
++			  NULL, HFILL },
++		},
++
++		/* Terminal Profile Byte 15 */
++		{ &hf_tprof_b15,
++			{ "Terminal Profile Byte 15 (Screen width)", "iso7816.tp.b15",
++			  FT_UINT8, BASE_HEX, NULL, 0,
++			  NULL, HFILL },
++		},
++
++		/* Terminal Profile Byte 16 */
++		{ &hf_tprof_b16,
++			{ "Terminal Profile Byte 16 (Screen effects)", "iso7816.tp.b16",
++			  FT_UINT8, BASE_HEX, NULL, 0,
++			  NULL, HFILL },
++		},
++
++		/* Terminal Profile Byte 17 */
++		{ &hf_tprof_b17,
++			{ "Terminal Profile Byte 17 (Bearer independent protocol)", "iso7816.tp.b17",
++			  FT_UINT8, BASE_HEX, NULL, 0,
++			  NULL, HFILL },
++		},
++		{ &hf_tp_bip_tcp,
++			{ "TCP transport", "iso7816.tp.bip.tcp",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x01,
++			  NULL, HFILL }
++		},
++		{ &hf_tp_bip_udp,
++			{ "UDP transport", "iso7816.tp.bip.udp",
++			  FT_BOOLEAN, 8, TFS(&tfs_supported_not_supported), 0x02,
++			  NULL, HFILL }
++		},
++
++		{ &hf_cat_ber_tag,
++			{ "BER-TLV Tag", "cat.ber_tlv_tag",
++			  FT_UINT8, BASE_HEX, VALS(ber_tlv_cat_tag_vals), 0,
++			  "Card Application Toolkit BER-TLV tag", HFILL },
++		},
++
++	};
++	static gint *ett[] = {
++		&ett_sim,
++		&ett_tprof_b1,
++		&ett_tprof_b2,
++		&ett_tprof_b3,
++		&ett_tprof_b4,
++		&ett_tprof_b5,
++		&ett_tprof_b6,
++		&ett_tprof_b7,
++		&ett_tprof_b8,
++		&ett_tprof_b9,
++		&ett_tprof_b10,
++		&ett_tprof_b11,
++		&ett_tprof_b12,
++		&ett_tprof_b13,
++		&ett_tprof_b14,
++		&ett_tprof_b15,
++		&ett_tprof_b16,
++		&ett_tprof_b17,
++	};
++
++	module_t *sim_module;
++
++	proto_gsm_sim = proto_register_protocol("GSM SIM 11.11", "GSM SIM",
++						 "gsm_sim");
++
++	proto_register_field_array(proto_gsm_sim, hf, array_length(hf));
++
++	proto_register_subtree_array(ett, array_length(ett));
++
++	register_dissector("gsm_sim", dissect_gsm_sim, proto_gsm_sim);
++
++#if 0
++	sim_module = prefs_register_protocol(proto_gsm_sim, proto_reg_handoff_gsm_sim);
++	prefs_register_bool_preference(sim_module, "use_ipaccess_oml",
++		    "Use nanoBTS definitions",
++		    "Use ipaccess nanoBTS specific definitions for OML",
++		    &global_oml_use_nano_bts);
++#endif
++	sub_handle_cap = find_dissector("etsi_cat");
++}
++
++/* This function is called once at startup and every time the user hits
++ * 'apply' in the preferences dialogue */
++void
++proto_reg_handoff_gsm_sim(void)
++{
++	static gboolean initialized = FALSE;
++
++	if (!initialized) {
++		dissector_handle_t gsm_sim_handle;
++
++		gsm_sim_handle = create_dissector_handle(dissect_gsm_sim, proto_gsm_sim);
++		//dissector_add("iso7816.apdu.sim", 0, gsm_sim_handle);
++
++	} else {
++		/* preferences have been changed */
++	}
++}
+
+Property changes on: epan/dissectors/packet-gsm_sim.c
+___________________________________________________________________
+Added: svn:eol-style
+   + native
+
+Index: epan/dissectors/packet-gsmtap.c
+===================================================================
+--- epan/dissectors/packet-gsmtap.c	(revision 38543)
++++ epan/dissectors/packet-gsmtap.c	(working copy)
+@@ -145,6 +145,7 @@
+ 	GSMTAP_SUB_UM,
+ 	GSMTAP_SUB_UM_LAPDM,
+ 	GSMTAP_SUB_ABIS,
++	GSMTAP_SUB_SIM,
+ 
+ 	GSMTAP_SUB_MAX
+ };
+@@ -299,6 +300,13 @@
+ 
+ 	col_set_str(pinfo->cinfo, COL_PROTOCOL, "GSMTAP");
+ 
++	/* Some GSMTAP types are completely unrelated to the Um air interface */
++	switch (type) {
++	case GSMTAP_TYPE_SIM:
++		call_dissector(sub_handles[GSMTAP_SUB_SIM], payload_tvb, pinfo, tree);
++		return;
++	}
++
+ 	if (arfcn & GSMTAP_ARFCN_F_UPLINK) {
+ 		col_append_str(pinfo->cinfo, COL_RES_NET_SRC, "MS");
+ 		col_append_str(pinfo->cinfo, COL_RES_NET_DST, "BTS");
+@@ -475,6 +483,7 @@
+ 	sub_handles[GSMTAP_SUB_UM] = find_dissector("gsm_a_ccch");
+ 	sub_handles[GSMTAP_SUB_UM_LAPDM] = find_dissector("lapdm");
+ 	sub_handles[GSMTAP_SUB_ABIS] = find_dissector("gsm_a_dtap");
++	sub_handles[GSMTAP_SUB_SIM] = find_dissector("gsm_sim");
+ 	gsmtap_handle = create_dissector_handle(dissect_gsmtap, proto_gsmtap);
+ 	dissector_add_uint("udp.port", GSMTAP_UDP_PORT, gsmtap_handle);
+ }
+Index: epan/dissectors/Makefile.common
+===================================================================
+--- epan/dissectors/Makefile.common	(revision 38543)
++++ epan/dissectors/Makefile.common	(working copy)
+@@ -67,6 +67,8 @@
+ 	packet-dcerpc-dnsserver.c 	\
+ 	packet-dcerpc-eventlog.c \
+ 	packet-dcerpc-lsa.c \
++	packet-gsm_sim.c	\
++	packet-card_app_toolkit.c	\
+ 	packet-dcerpc-winreg.c
+ 
+ #
diff --git a/wireshark/simcard.patch b/wireshark/simcard.patch
index b7d59fd..c6a9837 100644
--- a/wireshark/simcard.patch
+++ b/wireshark/simcard.patch
@@ -1546,31 +1546,23 @@ Index: wireshark/epan/dissectors/packet-gsm_sim.c
 +}
 Index: wireshark/epan/dissectors/packet-gsmtap.c
 ===================================================================
---- wireshark.orig/epan/dissectors/packet-gsmtap.c	2010-11-18 16:11:48.000000000 +0100
-+++ wireshark/epan/dissectors/packet-gsmtap.c	2010-11-18 17:04:37.000000000 +0100
-@@ -46,6 +46,7 @@
- #define GSMTAP_TYPE_UM			0x01
- #define GSMTAP_TYPE_ABIS		0x02
- #define GSMTAP_TYPE_UM_BURST	0x03	/* raw burst bits */
-+#define GSMTAP_TYPE_SIMCARD		0x04
- 
- #define GSMTAP_BURST_UNKNOWN		0x00
- #define GSMTAP_BURST_FCCH			0x01
-@@ -125,6 +126,7 @@
- 	GSMTAP_SUB_UM,
- 	GSMTAP_SUB_UM_LAPDM,
- 	GSMTAP_SUB_ABIS,
+--- wireshark/epan/dissectors/packet-gsmtap.c	(revision 38494)
++++ wireshark/epan/dissectors/packet-gsmtap.c	(working copy)
+@@ -171,6 +171,7 @@
+ 	GSMTAP_SUB_PDU,
+ 	GSMTAP_SUB_HACK,
+ 	GSMTAP_SUB_PHY_ATTRIBUTES,
 +	GSMTAP_SUB_SIM,
  
  	GSMTAP_SUB_MAX
  };
-@@ -236,6 +238,13 @@
+@@ -334,6 +335,13 @@
  
  	col_set_str(pinfo->cinfo, COL_PROTOCOL, "GSMTAP");
  
 +	/* Some GSMTAP types are completely unrelated to the Um air interface */
 +	switch (type) {
-+	case GSMTAP_TYPE_SIMCARD:
++	case GSMTAP_TYPE_SIM:
 +		call_dissector(sub_handles[GSMTAP_SUB_SIM], payload_tvb, pinfo, tree);
 +		return;
 +	}
@@ -1578,14 +1570,14 @@ Index: wireshark/epan/dissectors/packet-gsmtap.c
  	if (arfcn & GSMTAP_ARFCN_F_UPLINK) {
  		col_append_str(pinfo->cinfo, COL_RES_NET_SRC, "MS");
  		col_append_str(pinfo->cinfo, COL_RES_NET_DST, "BTS");
-@@ -393,6 +402,7 @@
- 	sub_handles[GSMTAP_SUB_UM] = find_dissector("gsm_a_ccch");
- 	sub_handles[GSMTAP_SUB_UM_LAPDM] = find_dissector("lapdm");
+@@ -557,6 +565,7 @@
+ 	sub_handles[GSMTAP_SUB_LLC] = find_dissector("llcgprs");
+ 	sub_handles[GSMTAP_SUB_SNDCP] = find_dissector("sndcp");
  	sub_handles[GSMTAP_SUB_ABIS] = find_dissector("gsm_a_dtap");
 +	sub_handles[GSMTAP_SUB_SIM] = find_dissector("gsm_sim");
- 	gsmtap_handle = create_dissector_handle(dissect_gsmtap, proto_gsmtap);
- 	dissector_add("udp.port", GSMTAP_UDP_PORT, gsmtap_handle);
- }
+ 	sub_handles[GSMTAP_SUB_CDMA_CODE] = find_dissector("wimax_cdma_code_burst_handler"); 
+ 	sub_handles[GSMTAP_SUB_FCH] = find_dissector("wimax_fch_burst_handler"); 
+ 	sub_handles[GSMTAP_SUB_FFB] = find_dissector("wimax_ffb_burst_handler"); 
 Index: wireshark/epan/dissectors/packet-card_app_toolkit.c
 ===================================================================
 --- /dev/null	1970-01-01 00:00:00.000000000 +0000
@@ -2317,3 +2309,4 @@ Index: wireshark/epan/dissectors/packet-card_app_toolkit.c
 +		/* preferences have been changed */
 +	}
 +}
+