Every other device this course recommends works over the radio. None of them touches the contact interface, and the contact interface is where modules 5 and 8 live — the certificate chain, the CDOL, the cryptogram. To watch that traffic you need something physically in the slot, between the chip and the terminal reading it.
SIMtrace2 is that thing. It is Osmocom open hardware built on a SAM3 microcontroller, the schematics are published, and sysmocom sells it assembled, so this is a board you buy rather than one you have to be lent. It was designed for SIM cards, and a SIM and a payment card are both ISO/IEC 7816 devices in the same slot geometry — which is why it works here at all.
Two firmwares, two jobs
The board does one job at a time, and which job is decided by the firmware you flash. Getting this wrong is the second most common way to lose an evening, because a board in the wrong mode enumerates perfectly over USB and simply never produces the data you are waiting for.
| Firmware | What the board becomes | Use it for |
|---|---|---|
| trace | A passive tap. The card and the terminal talk to each other exactly as they would anyway, and the board copies what passes. | Reading a real transaction. This is the mode behind the contact capture in this site's corpus. |
| cardem | The card. The terminal is talking to the board, and the board answers — from a card in a PC/SC reader elsewhere, or from whatever you decide. | Emulation and relay. This is the mode the contact relay research on this site is built on. |
A first trace
With the trace firmware flashed, the host side is three tools: simtrace2-list finds attached boards, simtrace2-sniff runs the tap, and simtrace2-cardem-pcsc drives the emulation mode. Check the board is seen first — it enumerates as USB vendor 0x1d50, product 0x60e3, which is worth knowing because it is what you grep for when nothing appears.
Then start the sniffer and open Wireshark on the loopback interface. The traffic does not arrive as raw bytes on a terminal: simtrace2-sniff encapsulates it as GSMTAP and sends it to 127.0.0.1 by default, which means Wireshark dissects it for you. You will see the ATR come past first, then every APDU pair, as they happen.
Once the APDUs are flowing, everything the rest of this course teaches applies unchanged. Copy a response out of Wireshark, paste it into the decoder on this site, and you are reading the same tag-length-value structures the corpus captures are made of — except this time you produced them.