Friday, August 28, 2009


The following guide enables us to make clones of sims used in India. Unlike the complicated guides you find on the Internet I have compiled them all together and made one simple guide which can be followed even by beginners. Covering only the relevant things needed to know rather than going technically deep.

Before I start off with this guide I would like to make one thing clear. SIM CLONING is completely illegal. There have been many cases in india where people have been caught for cloning other's SIM CARDS, and making calls worth thousands through it. Recently many GSM operators in INDIA have set up surveillance techniques to trap people who use cloned SIM'S. So I once again request to everyone that please use this guide for personal purpose only, do not use this guide for cheating.

First off a little introduction about SIM CARDS:
Our sim cards contains two secret codes or keys called (IMSI value and Ki value) which enables the operator in identifying the SIM card number and authenticate the customer, these codes are related to our mobile numbers which the operators store in their vast database. It is based on these secret keys that enables the billing to be made to that customer. Now what we do in SIM cloning is extract these two secret codes from the SIM and programme it into a new blank smart card often known as wafer. Since the operator authentication of SIM CARDS is based on these values, it enables us to fool the operators in thinking that its the original SIM. This authentication system is a big flaw concerning GSM technology.

Now which sim cards can be cloned:

Sim cards are manufactured on the basis of 3 algorithms: COMP128v1,COMP128v2 and COMP128v3.
NB: Currently only COMP128v1 version SIM CARDs can be cloned; since this is the only algorithm which has been cracked by users.
Bear in mind that 70% of all the SIM cards we use are COMP128v1. They are as follows:
Airtel-90% can be cloned; Hutch-75% can be cloned; BPL mobile-90% can be cloned; IDEA -numbers before Aug 2005 can be cloned newer cards very rare; BSNL- 0% say no - reason not comp128v1 version;
OK thats it about the background.; Now lets get to the Main Part-->
a) SIM card Reader (phoenix or smartmouse reader)
b) Plain or Blank silver wafer card or smart card
c) Software to Extract Ki and imsi (Woron scan 1.09 is the best)
d) Wafer Card Programmer (is a hardware chipset needed to programme smart card Millenium 2000VX MAX)
e) Software to make the PIC and EEPROM files (Sim Emu 1.06 configurator by pic-ador)
f) Software to write the PIC and EEPROM files to blank card (card master 2.1)

a)Extracting the Ki and IMSI:
First connect the SIM card reader to the PC's com port insert your original sim card. Run "woron scan 1.06". click on the menu "card reader" and click settings and select the com port which the card reader is connected to. Dont change any thing else in settings. Click OK.
If you have a phoenix card reader checkmark pheonix in the card reader menu.
Now click on "IMSI select" on the task menu. The program will now communicate with the sim card and retrieve the imsi value. Once you got the imsi value, write that on a piece of paper.
now in the same way retrieve the "icc value" and write that down too.
now click on "Ki search" now the program hacks the sim and retrieves the the ki value which consists of 32 numbers. Note that it may take up to 8 hrs to completely get the ki value....... no matter how much faster the comp is. This is because the SIM CARD is only capableof receiving and sending data @9600 bits/sec...
So go to sleep for now.
After u wake up make sure u write down the Ki value safely in a piece of paper like u did for the imsi value. Exit woron scan.
yaaahhoooo now you can stand up and proudly say that u hacked YOUR FIRST SIM CARD.
b) Making the PIC and EEPROM files with SIM EMU configurator:
First uncheck the A3A8 checkbox under security.
N.B: Please dont enable this even from the sim services menu. If enabled, it countsback to zero and when it reaches zero, it will corrupt your simcard.
In the configurator you can set the number of ADN, FDN and SMS. You can use the formulae: ?16448 = (ADN - 51 ) x 32 +SMS x 176 + FDN x 32 must be less than 6480. for silver wafer cards.
Then generate the Hex files forPIC and EEPROM by clicking the GenerateHex file. With this configurator, in addition to the 16 number slots, you can make the simcard a Motorola Test card too. In 16 in 1 configurator the positions are from 0-9 and from A-F. Each position can be customised by induvidual PIN an PUK codes. finished making the files now next step copy these files to the blank card using the programmer.
c) Write the files to the SILVER WAFER card:
Now we have the files to be written to the Silver Wafer card. For this we need the Wafer card programmer and the software for programming. Here i am using the Millenium 2000VX Max programmer and the Cardmaster 2.1 software. Connect the programmer and run the software. Select the type of card you are using. Select the port by clicking setup > port. If the port set by you is correct the red colour with message on status bar changes to yellow and shows no SIM CARD. Insert the SIM CARD and load the files for PIC and EEPROM in the file to PIC and file to EEPROM fields respectively. Dont change any other settings. Now you are at the last stage.
Press F3 or click edit > Auto Program. You can watch the status bar about what is happening. Programming the pic, Programming the eeprom, programming the pic, Verifying, and atlast you will get the message that the card is programmed succesfully. Here you may ask the question why the PIC is programmed again after programming the EEPROM? The PIC is first programmed with the eeprom loader to program the EEPROM. then the EEPROM is programmed through the pic. After that the contents in the pic is erased and the actual file is programmed in the PIC.
d) Cutting the smart card into a Sim card and settings on the phone:
The card which we have made is a 16 in 1 sim card; means we can store 16 different SIM card numbers in one. This is the last step guys. Cut the smart card in the shape of your SIM card. Insert the SIM card in the phone.
Switch on the handset. The phone asks for the PIN. Type any 4 digit number this is for the first slot 0. now the phone asks for the PUK code again type any 8 digit number again for the firstslot. Now the phone switches on with no network coverage. A network error message will appear. This is usual because the main values (ki and imsi) have not entered. So the network operator cannot authenticate the sim.
now the Finally you would have noticed by now that a new menu called the "sim emu 6.01" has appeared. Select it you can see the menus Configure, Select Phone and Information. Select Configure and go to config postion. It asks for the position. You can select anyposition from 0-9 and A-F. After selecting the position it asks for a PIN and PUK. Always provide different PIN and PUK for each positions. It helps us to switch to a number directly when the handset is switched on. After PIN and PUK it asks for KI,IMSI and ICCID. You can now recall the extracted values from STEP1 and enter it to appropriate fileds.
After doing all this you should now posses your newly cloned SIM card. you earned it congratulations. If not then. you must beat yourself 10 times. and repeat the entire process.

Contributed by: Mainak

1 comment:

    Posted Aug 2009

    Hello Unish,

    We are a company providing Vehicle Tracking solutions to our clients and are considering a solution you have mentioned above to avoid using 16 different modems connected to 16 PCs for 16 of our clients.

    We are trying to find/source the items you've listed in this article above and I was wondering if you could point us to any reliable suppliers that can provide us the goods. We are looking to procure this legally. I feel it is always better to purchase from a seller who comes well recommended rather than one that just has a good brochure/site/price.

    I'd really appreciate your help.

    Kindest regards