[GH-ISSUE #34] lpac error euicc_init when using thingsmobile.com card #14

Closed
opened 2026-03-04 23:13:29 +03:00 by kerem · 5 comments
Owner

Originally created by @tayfundogdas on GitHub (Mar 11, 2025).
Original GitHub issue: https://github.com/creamlike1024/EasyLPAC/issues/34

I am getting lpac error euicc_init when using thingsmobile.com card . As I understand I need to go to Settings -> lpac ISD-R AID and type to set thingsmobile's custom AID, then retry . I don't know this information. How can I get this AID? Is there a way to send APDU commands to card and get AID?

Thanks for your help.

Originally created by @tayfundogdas on GitHub (Mar 11, 2025). Original GitHub issue: https://github.com/creamlike1024/EasyLPAC/issues/34 I am getting lpac error euicc_init when using thingsmobile.com card . As I understand I need to go to Settings -> lpac ISD-R AID and type to set thingsmobile's custom AID, then retry . I don't know this information. How can I get this AID? Is there a way to send APDU commands to card and get AID? Thanks for your help.
kerem closed this issue 2026-03-04 23:13:29 +03:00
Author
Owner

@creamlike1024 commented on GitHub (Mar 11, 2025):

Decompiling their app can get AID(if possible).

The AID format is defined in the SGP.02 specification, and the GSMA standard ISD-R AID is A0 00 05 59 10 FF FF FF 89 00 01 00. If lucky enough, the manufacturer may only change the last two bytes, so traverse the AID within a limited range is possible.

You can send SELECT APDU command to check if AID is valid. For euicc, it should return 61xx. Note that you should be looking for ISD-R AID, not all AID are ISD-R AID.

SELECT is a Case 3 APDU, its struct is CLA INS P1 P2 Lc Data.

  • CLA (Class Byte): Higher 4 bits are 0x0, lower 4 bits are channel, usually using logical channel 1 so CLA is 0x01
  • INS (Instruction Byte): SELECT is 0xA4
  • P1 and P2 (Parameter Bytes): P1 is 0x04 means select by AID, P2 is 0x00
  • LC (Length of Command Data): Length of AID
  • Data: AID

This is a Python script for sending SELECT APDU, using GSMA standard AID returns 0x6121 on my card. Perhaps it can be rewritten to traverse AID.

from smartcard.System import readers
from smartcard.Exceptions import NoCardException
from smartcard.util import toHexString, toBytes
import sys

aid_str = "A0000005591010FFFFFFFF8900000100"
aid = toBytes(aid_str)

select_apdu = [0x01, 0xA4, 0x04, 0x00, len(aid)] + aid

reader_list = readers()
if not reader_list:
    print("Card Reader Not found")
    sys.exit()

reader = reader_list[0]
print("Use Card Reader: ", reader)

try:
    connection = reader.createConnection()
    connection.connect()

    # print(f"Send APDU Command: {toHexString(select_apdu)}")
    data, sw1, sw2 = connection.transmit(select_apdu)
    status = (sw1 << 8) | sw2

    if (status & 0xFF00) == 0x6100:
        print(f"AID {aid_str} exists, response: {hex(status)}")
    else:
        print(f"AID {aid_str} invalid, response: {hex(status)}")

except NoCardException:
    print("No Card in Card Reader.")
except Exception as e:
    print("Error:", e)

<!-- gh-comment-id:2714650338 --> @creamlike1024 commented on GitHub (Mar 11, 2025): Decompiling their app can get AID(if possible). The AID format is defined in the [SGP.02 specification](https://www.gsma.com/solutions-and-impact/technologies/esim/wp-content/uploads/2020/07/SGP.02-v4.2.pdf#page=27), and the GSMA standard ISD-R AID is `A0 00 05 59 10 FF FF FF 89 00 01 00`. If lucky enough, the manufacturer may only change the last two bytes, so traverse the AID within a limited range is possible. You can send SELECT APDU command to check if AID is valid. For euicc, it should return `61xx`. Note that you should be looking for ISD-R AID, not all AID are ISD-R AID. SELECT is a Case 3 APDU, its struct is `CLA INS P1 P2 Lc Data`. - CLA (Class Byte): Higher 4 bits are `0x0`, lower 4 bits are channel, usually using logical channel 1 so CLA is `0x01` - INS (Instruction Byte): SELECT is `0xA4` - P1 and P2 (Parameter Bytes): P1 is `0x04` means select by AID, P2 is `0x00` - LC (Length of Command Data): Length of AID - Data: AID This is a Python script for sending SELECT APDU, using GSMA standard AID returns 0x6121 on my card. Perhaps it can be rewritten to traverse AID. ```python from smartcard.System import readers from smartcard.Exceptions import NoCardException from smartcard.util import toHexString, toBytes import sys aid_str = "A0000005591010FFFFFFFF8900000100" aid = toBytes(aid_str) select_apdu = [0x01, 0xA4, 0x04, 0x00, len(aid)] + aid reader_list = readers() if not reader_list: print("Card Reader Not found") sys.exit() reader = reader_list[0] print("Use Card Reader: ", reader) try: connection = reader.createConnection() connection.connect() # print(f"Send APDU Command: {toHexString(select_apdu)}") data, sw1, sw2 = connection.transmit(select_apdu) status = (sw1 << 8) | sw2 if (status & 0xFF00) == 0x6100: print(f"AID {aid_str} exists, response: {hex(status)}") else: print(f"AID {aid_str} invalid, response: {hex(status)}") except NoCardException: print("No Card in Card Reader.") except Exception as e: print("Error:", e) ```
Author
Owner

@tayfundogdas commented on GitHub (Mar 11, 2025):

Thanks @creamlike1024 for your great response. I see your point. I will give a try when I have some time.

By the way, since this app using lpac project for low level operations, would it be possible, lpac provide this AIDs fetching with some info classes?

In future maybe you could add this AID finding logic to settings tab so that people able to use their sims from all vendor.

<!-- gh-comment-id:2715422534 --> @tayfundogdas commented on GitHub (Mar 11, 2025): Thanks @creamlike1024 for your great response. I see your point. I will give a try when I have some time. By the way, since this app using lpac project for low level operations, would it be possible, lpac provide this AIDs fetching with some info classes? In future maybe you could add this AID finding logic to settings tab so that people able to use their sims from all vendor.
Author
Owner

@creamlike1024 commented on GitHub (Mar 12, 2025):

Please make sure your card is compatible with SGP.22, IoT does not use this specification.

<!-- gh-comment-id:2716161020 --> @creamlike1024 commented on GitHub (Mar 12, 2025): Please make sure your card is compatible with SGP.22, IoT does not use this specification.
Author
Owner

@tayfundogdas commented on GitHub (Mar 12, 2025):

Hi @creamlike1024 ,

Thank you for your comments, yes the card is an eUICC card, "All form factors (2FF, 3FF, 4FF, MFF2) are available with eUICC (eSIM) functions to ensure maximum flexibility and autonomy from network operators." It stated on their website, it also recognized in regular cell phones. Would it be possible, lpac provide this AIDs fetching with some info classes?

Best regards.

<!-- gh-comment-id:2717079647 --> @tayfundogdas commented on GitHub (Mar 12, 2025): Hi @creamlike1024 , Thank you for your comments, yes the card is an eUICC card, "_All form factors (2FF, 3FF, 4FF, MFF2) are available with eUICC (eSIM) functions to ensure maximum flexibility and autonomy from network operators._" It stated on their website, it also recognized in regular cell phones. **Would it be possible, lpac provide this AIDs fetching with some info classes?** Best regards.
Author
Owner

@creamlike1024 commented on GitHub (Mar 12, 2025):

This cannot be done, only SGP.22 card is supported by lpac.

<!-- gh-comment-id:2717722777 --> @creamlike1024 commented on GitHub (Mar 12, 2025): This cannot be done, only SGP.22 card is supported by lpac.
Sign in to join this conversation.
No labels
bug
pull-request
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/EasyLPAC#14
No description provided.