GRID REF :: X:0000 Y:0000 // 53.7960N 1.7594W
--:--:-- // RF: SWEEPING
deconstructing your digital collar

SIM CARD
PARTS &
FUNCTIONS

That tiny gold chip in your pocket is a tamper-resistant computer that decides who you are to the network. Corporations want you to ignore it. Hackers learn to read it, control it, and kill-switch it.

This is your field manual for understanding the leash — so you can live without it when you choose to.

6 CONTACTS+2 USB OPT
ISO 7816SMART-CARD PROTOCOL
NO TRACKIF YOU OWN IT
0 PACKETSLEAVE THIS PAGE
[REF_IMG_01] / SIM_CARD_PARTS_AND_FUNCTIONS.JPG● ENCRYPTED
SIM Card Parts and Functions diagram - original intel
> analyzing contacts: VCC... GND... I/O... [OK]
file_01 // anatomy

THE CHIP IS NOT THE PLASTIC

The image you gave us is the only thing the telco wants you to see: harmless gold pads. Truth is, under those 6 pads sits a full microcontroller with its own OS, crypto keys, and file system. The plastic carrier is just a handle. The computer is underneath.

Click any pad. Get its dossier. Break it down and you break free.

ISO 7816-2 CONTACT BLOCK — CLICK A PAD● TOUCH INTERFACE
SIM://DIE C1 VCC C2 RST C3 CLK C4 USB D+ C5 GND C6 VPP C7 I/O C8 USB D-
DOSSIER — VCC // C11.8V / 3V / 5V

Power pin. Feeds regulated operating voltage to the internal microcontroller.

    ⚠ EXPLOIT VECTOR
    ✓ DEFENSE TACTIC
    VCC // C1

    Voltage Supply — The Juice

    Power pin. Feeds 1.8V / 3V / 5V to the chip. Cut this, the SIM dies instantly. Free living protocol: kill-switch = airplane mode + physical ejection.

    CORE EXPLOIT: No power = No IMSI catcher can handshake
    RESET // C2

    Reset — The Reboot

    Forces cold reset of the SIM OS. Phone pulls RST low to restart authentication. Understand this if you build your own readers.

    NOTE: Every boot = new RAND challenge from tower
    CLOCK // C3

    Clock — The Heartbeat

    Timing signal, usually 1-5 MHz. Synchronizes data between phone baseband and SIM. Jitter here = failed auth. High-frequency analysis can leak operations (side-channel 101).

    FREEDOM INTEL: Faraday + no clock = invisible
    GROUND // C5

    Ground — The Reference

    Electrical zero. Without clean ground, the rest lies. In opsec terms: your digital ground truth is your threat model.

    METAPHOR: Know your baseline before you go dark
    VPP // C6

    Programming Voltage — The Ghost

    Legacy pin. Used decades ago to flash higher voltage for EEPROM write. Today NC (Not Connected) on most operators. Kept for backwards compatibility. Like surveillance laws — obsolete but still there.

    HACKER NOTE: Modern 5V-tolerant SIMs ignore this
    I/O // C7

    Input / Output — The Mouth

    Single-wire bidirectional half-duplex. This is where all the secrets travel: IMSI, AUTH responses, SMS, contacts. T=0 protocol. Intercept here = you own the identity. That's why it's encrypted inside.

    RED TEAM: This pin is the only thing towers actually talk to
    USB // C4/C8

    Optional USB Pad — The Backdoor

    High-speed USB 2.0 pins for Inter-Chip USB SIMs. Allows 12Mbps vs 100k of I/O. New eUICC use this for rapid profile swaps. Your key to burner eSIM life: fast, remote, untraceable reprovision.

    FREE LIVING: eSIM = no physical SIM to find
    SIM_TRACE.LOG
    // full APDU capture from own card via $8 reader — frame-by-frame, file IDs decoded
    TX >> A0 A4 00 00 02 3F 00 # SELECT MF (0x3F00)
    << 61 12 : 18 response bytes pending
    TX >> A0 C0 00 00 12 # GET RESPONSE
    << 00 00 00 00 3F 00 01 ... 90 00 [OK]
    TX >> A0 A4 00 00 02 7F 20 # SELECT DF_GSM (0x7F20)
    << 61 16 : DF_GSM directory selected
    TX >> A0 A4 00 00 02 6F 07 # SELECT EF_IMSI (0x6F07)
    << 61 0F : IMSI file selected
    TX >> A0 B0 00 00 09 # READ BINARY — 9 bytes of IMSI
    << 08 49 60 •• •• •• •• •• [OK] # MCC+MNC plaintext, MSIN masked — your own card only
    TX >> A0 88 00 00 10 [RAND] # RUN GSM ALGORITHM
    << SRES: 82A1C904 | Kc: 9F1012AB4801 [90 00] # Ki never leaves the die
    TX >> AT+CLCK="SC",1,"1234" # ENABLE CHV1 PIN LOCK
    << OK — cold boot now demands the 4-digit code

    // free-living countermeasures:
    [1] PIN lock SIM (CHV1), 3 attempts max
    [2] Disable 2G - blocks most IMSI catchers
    [3] Use prepaid data-only + VoIP
    [4] Physically remove when not needed
    ⚠ THREAT:
    IMSI Catchers (Stingrays) force your SIM to attach via C1/C7 handshake. Catches IMSI even with data off.
    ✓ DEFENSE:
    Faraday sleeve (£5), 4G/5G-only mode, eSIM profiles that rotate weekly.
    file_02 // free_living_protocols

    OWN YOUR SIGNAL, OWN YOUR LIFE

    A hacker doesn't use tech to steal free phone bills. That's petty and gets you caught. A hacker uses understanding to become un-leashable. Three field protocols — click a step to check it off, click again for the why. Progress persists on this device.

    PROTOCOL 01 — BURNER IDENTITY

    Disposable Self

    Decouple the subscriber from the database. The SIM is you — so don't be you.

    • Cash-bought prepaid SIM (or privacy VCC eSIM) — never a card tied to your name.Zero credit-card or bank record linking physical person to ICCID. Where legal, buy over the counter with cash.
    • Activate on public WiFi or shielded hotspot — never your home IP.Prevents your home ISP from geolocating you during the registration handshake.
    • Rotate every 14–90 days. Destroy the chip — snap across the C1 VCC pad.Limits how long historical cell-tower location datasets stay useful against you.
    • Never link burner numbers to banking, 2FA, or personal accounts.One cross-platform correlation immediately burns the whole identity.
    PROTOCOL 02 — OFF-GRID COMMS

    Air-Gapped Mind

    Baseband isolation. Keep the radio firmware from silently reporting you.

    • De-Googled daily driver (GrapheneOS / CalyxOS) with NO SIM at all — WiFi VoIP only.Eliminates passive cell-site timing-advance logging from your everyday movements.
    • Second phone, Faraday-bagged, strictly for unavoidable cellular voice/SMS.RF physically blocked when not in active use. A bagged phone logs nothing.
    • Enable SIM PIN (CHV1), max 3 attempts.A seized or lost phone can't mount the SIM identity without the code. PUK = carrier-only reset.
    • No SMS 2FA. FIDO2 hardware keys or TOTP apps for everything sensitive.Kills SIM-swap fraud and baseband SMS interception in one move.
    PROTOCOL 03 — SIGNAL DISCIPLINE

    Die Living Free

    The network logs when and where C7 answered. Minimize the footprint.

    • Force 4G/5G-only mode — disable the legacy 2G GSM radio entirely.Stingray IMSI catchers rely on forced 2G fallback, which has no mutual tower authentication.
    • Airplane mode as your default state. You call the tower — not the reverse.Stops passive multi-tower sector-handoff location pinging while you idle.
    • Power fully off before protests, borders, or sensitive meetings.Denies ambient presence triangulation from tower logs after the fact.
    • VoIP over a VPN tunnel instead of circuit-switched cellular voice.Moves voice behind end-to-end IP-layer encryption the baseband can't see into.
    INTEL DROP — WHAT SIM DOESN'T STORE

    Corp Myth vs Reality

    Telcos love you thinking everything is "on the SIM". It's not:

    • NOT on SIM: Your photos, full call history, browsing. That's phone / cloud / carrier HLR.
    • ON SIM: Ki (secret), IMSI, ICCID, some contacts, PLMN prefs, carrier keys.
    • Future: eSIM / iSIM — same logic, soldered. No plastic to pull. Learn to rewrite profiles before it solders you in.
    root@freebox:~LIVE
    $ cat /manifesto/free_living.txt

    The goal is not to get free service.
    The goal is to make service optional.

    If you need the network to live,
    you are not alive. You are subscribed.

    $ rm -rf /fear █
    file_03 // infiltration_lab

    DIGITAL INFILTRATION LAB

    Real infiltration is 90% reading logs and 10% typing very calmly. This lab is pure SANDBOX — JavaScript theatre, zero packets leave this page. Practice the mindset on the only network you always have permission to hack: your own.

    MOD_01 // AUTH HANDSHAKE VISUALIZER● ARMED
    DEVICEyour SIM inside
    ROGUE BTSimsi catcher
    REAL TOWERMCC 234 · UK
    HLR / AuCKi vault
    [idle] choose an engagement above. watch which nodes light up — and which one shouldn't.
    MOD_02 // LOOPBACK PORT SCANNER● READY

    TARGET: 127.0.0.1 — the one host you can always scan legally. Everything below is simulated in-browser.

    [idle] scanner cold. memory viewer hot.
    MOD_03 // RF ENVIRONMENT SWEEP● SWEEPING
    [*] passive scan — listening only. towers beacon; you just hear them first.
    guest@simroot : /labSANDBOX SHELL
    guest@simroot:~$
    MOD_05 // ISO 7816 APDU BUILDER● CRAFT FRAMES

    Forge a smart-card command frame byte by byte. Execute runs a simulation — no reader attached, no chip touched. This is the exact grammar your phone speaks to the C7 pad.

    A0 A4 00 00 02 3F 00
    SESSION TRACE · C7 I/O LINESW words decoded
    [idle] build a frame, hit execute. try SELECT 3F00 → GET RESPONSE → SELECT 6F07 → READ BINARY.

    RULES OF ENGAGEMENT: scanning or intercepting networks you don't own — or lack written permission to test — is a crime. In the UK that's the Computer Misuse Act 1990 and the Investigatory Powers Act 2016. Everything above is client-side simulation for learning. Hack your own gear. Get certs, not charges.

    file_04 // field_kit

    THE FIELD KIT

    Three instruments from the merged arsenal: measure your exposure, price your rotation, and keep notes that decrypt only for you. All math and crypto runs locally in this tab.

    KIT_01 // EXPOSURE CALCULATOR● LIVE SCORE

    Tick what's true about your current setup. Score starts hardened at 100 — each tick is a leak.

    100/ 100 OPSEC SCORE
    LOW EXPOSURE — HARDENED
    nothing to fix. stay paranoid, stay free.
    KIT_02 // ROTATION BUDGET● £££

    Privacy has a price — and it's cheaper than the data they sell about you.

    SIMS BURNED / YEAR13
    ANNUAL PRIVACY BUDGET£130
    MONTHLY EQUIVALENT£10.83

    Rule of thumb: £10/mo buys you a fresh IMSI every month. The data broker pays £0 for your current one.

    KIT_03 // FIELD NOTES · AES-GCM● LOCAL ONLY

    Client-side encrypted notes: PBKDF2×100k → AES-256-GCM. Ciphertext lives in this browser's storage. The passphrase never does.

    state: no ciphertext stored on this device.
    final_payload

    THE MANIFESTO: FREE LIVING IS A SKILL

    This diagram from @tipsfcworld is normally boring ISP training material. Reframe it and it's a map of your leash. Every pad is a point where you negotiate with a trillion-dollar surveillance grid. Know it cold.

    BUILD YOUR OWN READER — ETHICAL ONLY

    Arduino + SIM slot: VCC->5V via LDO, GND->GND, RST->D2, CLK->D3, I/O->D4 (with 1k). Dump ATR with AT+CSIM. Never share Ki attempts, never clone. Use to WIP your own SIM for understanding ISO 7816-3 T=0.

    *VPP is almost always legacy. C4/C8 USB are optional and rare outside eUICC. Labels vary by manufacturer. This guide is educational. No instructions for bypassing carrier billing, cloning, or illegal interception. Knowledge is freedom, abuse is prison.

    SIM diagram closeup repeated for final grid
    ORIGINAL INTEL // INCOMING FILE: image.png
    RE-ANALYZED FOR FREE HUMANS
    [CLASSIFICATION DOWNGRADED: PUBLIC]