Since listening to a few Defcon talks on SIM cards and, more recently, the NSA Playset, I've become interested in GSM. This page gives a fairly good tutorial on getting Kraken set up, but apparently for a known-plaintext attack, I need to know the plaintext. The aforementioned tutorial isn't very helpful with this, only saying:

Note: this step [known-plaintext attack with Kraken] is not as easy as it sounds. Usually capture some calls of your own phone where you know the Kc (it can be read from the SIM or displayed by the Engineering Mode Screen of some phones) and look for known-plain-text candidates. An example are "SYSTEM INFORMATION 5/6/5ter" in the SACCH or "LAPDM U, func=UI" frames. Also keep in mind that there could be wrong bits in a burst due to distortion.

I'm more than happy to do this, as I believe in learning through experimentation (and like playing in traffic), but I'm having trouble finding Kc. I don't have the hardware to read my SIM card while it's connected to my phone (which I think I would need to do, or there wouldn't be any open sessions to have keys for). That leaves this "Engineering Mode Screen." I found several Android apps which say they open Engineering Mode, all of which open a screen entitled "Testing." This gives a great deal of information, but I don't see Kc (or anything that looks like it). Does anyone know how I can find my session key (preferably without buying anything)? Thanks!

  • 1
    You should take a look at : domonkos.tomcsanyi.net/?p=369
    – r00t
    Aug 2, 2015 at 22:15
  • @r00t That's exactly what I was looking for! You are clearly stronger in the art of Google-fu than I am. If you'd like to post as an answer, I'll gladly accept it.
    – KnightOfNi
    Aug 3, 2015 at 0:36

1 Answer 1


To find Kc from a SIM card you have 4 working ways :

(Credits to http://domonkos.tomcsanyi.net/?p=369)

  1. BlackBerry Engineering Screen:

pretty much on all of the BlackBerries you can enable the so called “Engineering Mode” which will simply show you the current Kc.

  1. OsmocomBB Mobile App

Download and install the app

  1. Upload layer1 to your phone
  2. Run mobile -i
  3. telnet 4247

After that simply say: show subscriber 1 At the top you should see the Kc printed.

  1. AT+CSIM Command

You need to send APDU commands to the SIM card via the modem (some phones allow you to do so):

Sample run:

AT+CSIM=14,"A0A40000026F20" +CSIM: 34,"000000096F2004001100BB010200009000"

OK AT+CSIM=10,"A0B0000009" +CSIM: 22,"E0940FC09AEFA000009000"

OK You find the last Kc used here: E0 94 0F C0 9A EF A0 00 and also the key sequence > number: 00

(From : http://openbsc.osmocom.org/trac/wiki/A5_GSM_AT_tricks)

  1. Using a SIM-card reader/Smart Card Reader

You need a PC/SC cardreader and a software like SIMspyII. After insterting the card, you will have Kc displayed.

I just copied the information from http://domonkos.tomcsanyi.net/?p=369 to be sure the information will not disapear if the site goes down.

Not the answer you're looking for? Browse other questions tagged .