Uicc Unlock From System Updates Menu


How to change the APN settings on the Samsung Galaxy S5 (SPRINT) and make it work internationally:

UICC SIM cards, are simply there to give you access to LTE, nothing more, nothing less. They have a 'personalized code' that is linked to your device, and will ONLY work on that device. You CAN NOT take the SIM card, and put it into another device, even if its the same exact model, and expect it to work. In 'About Device' go to the next menu and choose 'System Updates' option and then 'Check for Updates'. Your phone will update automatically. You can update your device through Wi-Fi network only because your new SIM has no connectivity at all. Be Sure that You Are Unlocking GSM Phone. It is impossible to unlock Samsung Galaxy running on CDMA. In the update settings on your samsung, click on UICC Unlock and if you have Sprint (or Boost Mobile) it should fail. For some reason, after the UICC Unlock fails you can retry the OMADM profile update in your notifications and it'll work correctly. I was in the same situation as David King so I hope he tries this too. If no, then Download Data then click Get root. 1)insert Sim 2)install GTv3.1.5.apk 3)install GTUpdate2v3.1.8.apk and run, SuperSU will ask the question, then Grant, then Update and reboot your smartphone after the program closes itself. 4)Run idone press.UICC SIM Unlock. 5)reboot your device go to Settings menu, Mobile networks, Network mode, select GSM/UMTS.



1. Request Sprint iDCS to do a UICC unlock for the device.

System Update enables IT administrators to distribute updates for software, drivers, and BIOS in a managed environment from a local server. In system updates there isoption unlock uicc. Lowpriceskates Asked: 07:45. Domainscot 07:45. Settings - System updates shows: UICC Unlock 'Your device is locked to Sprint SIMs only'. Tried AT&T and T-Mobile GSM SIM cards, both are shown as invalid SIM cards. The whole menu 'Network Mode' is not present in Settings. Used 'GCF Setting' to make sure, that GSM with all bands is set. This is the case, CDMA and LTE bands are disabled. Uicc Unlock Code Android Robot From System Updates I met all the FCC requirements and Sprint level 1, 2 and 3 tier support have already said the phone is now unlocked via MEID AND IMEI.



2. Once confirmation is received from iDCS go to your phone's settings.


3. Settings -> General -> System Update -> UICC Unlock


4. Press UICC Unlock


5. If successful it should say the profile has been updated.

Update Uicc Unlock



6. Power off the device


7. Remove the Sprint SIM card and insert Foreign SIM card.


8.Power on the device and go to phone's settings.


9 Settings -> Connections -> More networks -> Mobile networks -> Network mode; now change the LTE/CDMA to GSM/UMTS (should automatically restart the device)


10. Once the device is back on; Settings -> Connections -> More networks -> Mobile networks -> Network operators; click on the + symbol on the top right corner now you can add a custom APN for your foreign network.

-->

Overview

This topic specifies an extension to the Mobile Broadband Interface Model (MBIM) interface to permit accessing UICC smart card application and file systems. This extension to MBIM exposes logical access to the UICC's ETSI TS 102 221 technical specification-compliant applications and filesystems, and is supported in Windows 10, version 1903 and later.

UICC access and security

The UICC provides a file system and supports a set of applications that can run concurrently. These include the USIM for UMTS, CSIM for CDMA, and ISIM for IMS. The SIM is a legacy portion of the UICC that can be modeled as one of these applications (for GSM).

The following diagram from Section 8.1 of the ETSI TS 102 221 technical specification shows an example card application structure.

The UICC file system can be regarded as a forest of directory trees. The legacy SIM tree is rooted at a Master File (MF) and contains up to two levels of subdirectories (Dedicated Files, or DFs) containing Elemental Files (EFs) that hold various types of information. The SIM defines DFs under the MF, one of which, DFTelecom, contains information common to multiple access types such as the common phone book. Additional applications are effectively implemented as separate trees, each rooted in its own Application Directory File (ADF). Each ADF is identified by an application identifier that can be up to 128 bits long. A file under the card root (EFDir under the MF in the diagram) contains the application names and corresponding identifiers. Within a tree (the MF or an ADF), DFs and EFs might be identified by a path of file IDs, where a file ID is a 16-bit integer.

NDIS interface extensions

The following OIDs have been defined to support UICC application and file system access.

MBIM service and CID values

Service nameUUIDUUID value
Microsoft Low-Level UICC AccessUUID_MS_UICC_LOW_LEVELC2F6588E-F037-4BC9-8665-F4D44BD09367
Microsoft Basic IP Connectivity ExtensionsUUID_BASIC_CONNECT_EXTENSIONS3D01DCC5-FEF5-4D05-9D3A-BEF7058E9AAF

The following table specifies the UUID and command code for each CID, as well as whether the CID supports Set, Query, or Event (notification) requests. See each CID’s individual Section within this topic for more info about its parameters, data structures, and notifications.

CIDUUIDCommand codeSetQueryNotify
MBIM_CID_MS_UICC_APP_LISTUUID_MS_UICC_LOW_LEVEL7NYN
MBIM_CID_MS_UICC_FILE_STATUSUUID_MS_UICC_LOW_LEVEL8NYN
MBIM_CID_MS_UICC_ACCESS_BINARYUUID_MS_UICC_LOW_LEVEL9YYN
MBIM_CID_MS_UICC_ACCESS_RECORDUUID_MS_UICC_LOW_LEVEL10YYN
MBIM_CID_MS_PIN_EXUUID_BASIC_CONNECT_EXTENSIONS14YYN

MBIM_CID_MS_UICC_APP_LIST

This CID retrieves a list of applications in a UICC and information about them. When the UICC in the modem is fully initialized and ready to register with the mobile operator, a UICC application must be selected for registration and a query with this CID should return the selected application in the ActiveAppIndex field in the MBIM_UICC_APP_LIST structure used in response.

Parameters

OperationSetQueryNotification
CommandNot applicableEmptyNot applicable
ResponseNot applicableMBIM_UICC_APP_LISTNot applicable

Query

The InformationBuffer of MBIM_COMMAND_MSG is empty.

Set

Not applicable.

Response

The InformationBuffer in MBIM_COMMAND_DONE contains the following MBIM_UICC_APP_LIST structure.

MBIM_UICC_APP_LIST (version 1)

OffsetSizeFieldTypeDescription
04VersionUINT32The version number of the structure that follows. This field must be set to 1 for version 1 of this structure.
44AppCountUINT32The number of UICC application MBIM_UICC_APP_INFO structures being returned in this response.
84ActiveAppIndexUINT32(0..NumApp - 1)The index of the application selected by the modem for registration with the mobile network. This field must be between 0 and the AppCount - 1. It indexes to the array of applications returned by this response. If no application is selected for registration, this field contains 0xFFFFFFFF.
124AppListOffsetOFFSETThe offset, in bytes, calculated from the beginning of this structure to the buffer containing the app list.
164AppListSizeSIZE (0..AppCount * 312)The size of the app list data, in bytes.
20AppListSizeDataBufferDATABUFFERAn array of AppCount * MBIM_UICC_APP_INFO structures.

MBIM_UICC_APP_INFO

OffsetSizeFieldTypeDescription
04AppTypeMBIM_UICC_APP_TYPEThe type of the UICC application.
44AppIdSizeSIZE (0..16)The size of the application ID, in bytes, as defined in Section 8.3 of the ETSI TS 102 221 technical specification. This field is set to zero for the MBIMUiccAppTypeMf, MBIMUiccAppTypeMfSIM, or MBIMUiccAppTypeMfRUIM app types.
816AppIdByte arrayThe application ID. Only the first AppIdSize bytes are meaningful. If the application ID is longer than MBIM_MAXLENGTH_APPID bytes, then AppIdSize specifies the actual length but only the first MBIM_MAXLENGTH_APPID bytes are in this field. This field is valid only when AppType is not MBIMUiccAppTypeMf, MBIMUiccAppTypeMfSIM, or MBIMUiccAppTypeMfRUIM.
244AppNameLengthSIZE (0..256)The length, in characters, of the application name.
28256AppNameASCII character arrayA UTF-8 string specifying the name of the application. The length of this field is specified by AppNameLength. If the length is greater than or equal to MBIM_MAXLENGTH_APPNAME bytes, this field contains the first MBIM_MAXLENGTH_APPNAME - 1 bytes of the name. The string is always null-terminated.
2844NumPinsSIZE (0..8)The number of application PIN references. In other words, the number of elements of PinRef that are valid. Applications on a virtual R-UIM have no PIN references.
2888PinRefByte arrayA byte array specifying the application PIN references for this application (keys for PIN1 and possibly UPIN), as defined in Section 9.4.2 of the ETSI TS 102 221 technical specification. In the case of a single-verification card, or an MBB driver and/or modem that does not support different application keys for different applications, this field must be 0x01.

MBIM_UICC_APP_TYPE

TypeValueDescription
MBIMUiccAppTypeUnknown0Unknown type.
MBIMUiccAppTypeMf1Legacy SIM directories rooted at the MF.
MBIMUiccAppTypeMfSIM2Legacy SIM directories rooted at the DF_GSM.
MBIMUiccAppTypeMfRUIM3Legacy SIM directories rooted at the DF_CDMA.
MBIMUiccAppTypeUSIM4USIM application.
MBIMUiccAppTypeCSIM5CSIM applicaton.
MBIMUiccAppTypeISIM6ISIM application.

Constants

The following constants are defined for MBIM_CID_MS_UICC_APP_INFO.

const int MBIM_MAXLENGTH_APPID = 16
const int MBIM_MAXLENGTH_APPNAME = 256
const int MBIM_MAXNUM_PINREF = 8

Unsolicited Events

Not applicable.

Status Codes

The following status codes are applicable:

Status codeDescription
MBIM_STATUS_SUCCESSBasic MBIM status as defined for all commands.
MBIM_STATUS_BUSYBasic MBIM status as defined for all commands.
MBIM_STATUS_FAILUREBasic MBIM status as defined for all commands.
MBIM_STATUS_NO_DEVICE_SUPPORTBasic MBIM status as defined for all commands.
MBIM_STATUS_SIM_NOT_INSERTEDUnable to perform the UICC operation because the UICC is missing.
MBIM_STATUS_BAD_SIMUnable to perform the UICC operation because the UICC is in an error state.
MBIM_STATUS_NOT_INITIALIZEDUnable to perform the UICC operation because the UICC is not yet fully initialized.

MBIM_CID_MS_UICC_FILE_STATUS

This CID retrieves information about a specified UICC file.

Parameters

OperationSetQueryNotification
CommandNot applicableMBIM_UICC_FILE_PATHNot applicable
ResponseNot applicableMBIM_UICC_FILE_STATUSNot applicable

Query

The InformationBuffer of MBIM_COMMAND_MSG contains the target EF as an MBIM_UICC_FILE_PATH structure.

MBIM_UICC_FILE_PATH (version 1)

OffsetSizeFieldTypeDescription
04VersionUINT32The version number of the structure that follows. This field must be 1 for version 1 of this structure.
44AppIdOffsetOFFSETThe offset, in bytes, calculated from the beginning of this structure to the buffer containing the application ID.
84AppIdSizeSIZE (0..16)The size of the application ID, in bytes, as defined in Section 8.3 of the ETSI TS 102 221 technical specification. For 2G cards, this field must be set to zero (0).
124FilePathOffsetOFFSETThe offset, in bytes, calculated from the beginning of this structure to the buffer containing the file path. The file path is an array of 16-bit file IDs. The first ID must be either 0x7FFF or 0x3F00. If the first ID is 0x7FFF, then the path is relative to the ADF of the application desginated by AppId. Otherwise, it is an absolute path starting from the MF.
164FilePathSizeSIZE (0..8)The size of the file path, in bytes.
20DataBufferDATABUFFERThe data buffer containing AppId and FilePath.

Set

Not applicable.

Response

The following MBIM_UICC_FILE_STATUS structure is used in the InformationBuffer.

MBIM_UICC_FILE_STATUS (version 1)

OffsetSizeFieldTypeDescription
04VersionUINT32The version number of the structure that follows. This field must be 1 for version 1 of this structure.
44StatusWord1UINT32(0..256)A return parameter specific to the UICC command.
84StatusWord2UINT32(0..256)A return parameter specific to the UICC command.
124FileAccessibilityMBIM_UICC_FILE_ACCESSIBILITYThe UICC file accessibility.
164FileTypeMBIM_UICC_FILE_TYPEThe UICC file type.
204FileStructureMBIM_UICC_FILE_STRUCTUREThe UICC file structure.
244ItemCountUINT32The number of items in the UICC file. For transparent and TLV files, this is set to 1.
284SizeUINT32The size of each item, in bytes. For transparent or TLV files, this is the size of the entire EF. For record-based files, this represents the total number of records.
3216FileLockStatusMBIM_PIN_TYPE_EX[4]An array of type MBIM_PIN_TYPE_EX that describes the access condition for each operation (READ, UPDATE, ACTIVATE, and DEACTIVATE in that order) on that file.

MBIM_UICC_FILE_ACCESSIBILITY

The MBIM_UICC_FILE_ACCESSIBILITY enumeration is used in the preceding MBIM_UICC_FILE_STATUS structure.

TypeValueDescription
MBIMUiccFileAccessibilityUnknown0File shareability unknown.
MBIMUiccFileAccessibilityNotShareable1Not shareable file.
MBIMUiccFileAccessibilityShareable2Shareable file.

MBIM_UICC_FILE_TYPE

The MBIM_UICC_FILE_TYPE enumeration is used in the preceding MBIM_UICC_FILE_STATUS structure.

TypeValueDescription
MBIMUiccFileTypeUnknown0File type unknown.
MBIMUiccFileTypeWorkingEf1Working EF.
MBIMUiccFileTypeInternalEf2Internal EF.
MBIMUiccFileTypeDfOrAdf3Dedicated file, a directory that is the parent of other nodes. This may be a DF or ADF.

MBIM_UICC_FILE_STRUCTURE

The MBIM_UICC_FILE_STRUCTURE enumeration is used in the preceding MBIM_UICC_FILE_STATUS structure.

TypeValueDescription
MBIMUiccFileStructureUnknown0An unknown file structure.
MBIMUiccFileStructureTransparent1A single record of variable length.
MBIMUiccFileStructureCyclic2A cyclic set of records, each of the same length.
MBIMUiccFileStructureLinear3A linear set of records, each of the same length.
MBIMUiccFileStructureBerTLV4A set of data values accessible by tag.

MBIM_PIN_TYPE_EX

The MBIM_PIN_TYPE_EX enumeration is used in the preceding MBIM_UICC_FILE_STATUS structure.

TypeValueDescription
MBIMPinTypeNone0No PIN is pending to be entered.
MBIMPinTypeCustom1The PIN type is a custom type and is none of the other PIN types listed in this enumeration.
MBIMPinTypePin12The PIN1 key.
MBIMPinTypePin23The PIN2 key.
MBIMPinTypeDeviceSimPin4The device to SIM key.
MBIMPinTypeDeviceFirstSimPin5The device to very first SIM key.
MBIMPinTypeNetworkPin6The network personalization key.
MBIMPinTypeNetworkSubsetPin7The network subset personalization key.
MBIMPinTypeServiceProviderPin8The service provider (SP) personalization key.
MBIMPinTypeCorporatePin9The corporate personalization key.
MBIMPinTypeSubsidyLock10The subsidy unlock key.
MBIMPinTypePuk111The Personal Identification Number 1 Unlock Key (PUK1).
MBIMPinTypePuk212The Personal Identification Number 2 Unlock Key (PUK2).
MBIMPinTypeDeviceFirstSimPuk13The device to very first SIM PIN unlock key.
MBIMPinTypeNetworkPuk14The network personalization unlock key.
MBIMPinTypeNetworkSubsetPuk15The network subset personalization unlock key.
MBIMPinTypeServiceProviderPuk16The service provider (SP) personalization unlock key.
MBIMPinTypeCorporatePuk17The corporate personalization unlock key.
MBIMPinTypeNev18The NEV key.
MBIMPinTypeAdm19The administrative key.
Download

Unsolicited Events

Not applicable.

Status Codes

The following status codes are applicable:

Status codeDescription
MBIM_STATUS_BUSYBasic MBIM status as defined for all commands.
MBIM_STATUS_FAILUREBasic MBIM status as defined for all commands.
MBIM_STATUS_SIM_NOT_INSERTEDUnable to perform the UICC operation because the UICC is missing.
MBIM_STATUS_BAD_SIMUnable to perform the UICC operation because the UICC is in an error state.
MBIM_STATUS_SHAREABILITY_CONDITION_ERRORThe file cannot be selected because it is not shareable and is currently being accessed by another application. The status word returned by the SIM is 6985.

MBIM_CID_MS_UICC_ACCESS_BINARY

This CID sends a specific command to access a UICC binary file, with structure type MBIMUiccFileStructureTransparent or MBIMUiccFileStructureBerTLV.

Parameters

OperationSetQueryNotification
CommandNot applicableMBIM_UICC_ACCESS_BINARYNot applicable
ResponseNot applicableMBIM_UICC_RESPONSENot applicable

Query

Reads a binary file. The InformationBuffer for MBIM_COMMAND_MSG contains an MBIM_UICC_ACCESS_BINARY structure. An MBIM_UICC_RESPONSE structure is returned in the InformationBuffer of MBIM_COMMAND_DONE.

Uicc Unlock Boost Code

MBIM_UICC_ACCESS_BINARY (version 1)

OffsetSizeFieldTypeDescription
04VersionUINT32The version number of the structure that follows. This field must be set to 1 for version 1 of this structure.
44AppIdOffsetOFFSETThe offset, in bytes, from the beginning of this structure to the buffer containing the application ID.
84AppIdSizeSIZE (0..16)The size of the application ID, in bytes, as defined in Section 8.3 of the ETSI TS 102 221 technical specification. For 2G cards, this field must be set to zero (0).
124FilePathOffsetOFFSETThe offset, in bytes, calculated from the beginning of this structure to the buffer containing the file path. The file path is an array of 16-bit file IDs. The first ID must be either 0x7FFF or 0x3F00. If the first ID is 0x7FFF, then the path is relative to the ADF of the application desginated by AppId. Otherwise, it is an absolute path starting from the MF.
164FilePathSizeSIZEThe size of the file path, in bytes.
204FileOffsetUINT32The offset to be used when reading from the file. This field can be bigger than 256, and it combines both offset high and offset low as defined in the ETSI TS 102 221 technical specification.
244NumberOfBytesUINT32The number of bytes to be read. For example, a client driver could use this function to read a transparent (binary) file that is larger than 256 bytes, although the maximum amount that can be read or written in a single UICC operation is 256 bytes per the ETSI TS 102 221 technical specification. It is the function's responsibility to split this into multiple APDUs and send back the result in a single response.
284LocalPinOffsetOFFSETThe offset, in bytes, calculated from the beginning of this structure to the buffer containing the password. This is the local PIN (PIN2) and is used in case the operation requires local PIN validation.
324LocalPinSizeSIZE (0..16)The size of the password, in bytes.
364BinaryDataOffsetOFFSETThe offset, in bytes, calculated from the beginning of this structure to the buffer containing the command-specific data. Binary data is only used for SET operations.
404BinaryDataSizeSIZE (0..32768)The size of the data, in bytes.
44DataBufferDATABUFFERThe data buffer containing AppId, FilePath, LocalPin, and BinaryData.

Set

Not applicable.

Response

Uicc

The following MBIM_UICC_RESPONSE structure is used in the InformationBuffer.

MBIM_UICC_RESPONSE (version 1)

OffsetSizeFieldTypeDescription
04VersionUINT32The version number of the structurethat follows. This field must be 1 for version 1 of this structure.
44StatusWord1UINT32(0..256)A return parameter specific to the UICC command.
84StatusWord2UINT32(0..256)A return parameter specific to the UICC command.
124ResponseDataOffsetOFFSETThe offset, in bytes, calculated from the beginning of this structure to the buffer containing the response data. The response data is only used for QUERY operations.
164ResponseDataSizeSIZE (0..32768)The size of the data, in bytes.
20DataBufferDATABUFFERThe data buffer containing ResponseData.

Unsolicited Events

Not applicable.

Status Codes

The following status codes are applicable:

Status codeDescription
MBIM_STATUS_BUSYBasic MBIM status as defined for all commands.
MBIM_STATUS_FAILUREBasic MBIM status as defined for all commands.
MBIM_STATUS_SIM_NOT_INSERTEDUnable to perform the UICC operation because the UICC is missing.
MBIM_STATUS_BAD_SIMUnable to perform the UICC operation because the UICC is in an error state.
MBIM_STATUS_SHAREABILITY_CONDITION_ERRORThe file cannot be selected because it is not shareable and is currently being accessed by another application. The status word returned by the SIM is 6985.
MBIM_STATUS_PIN_FAILUREThe operation failed due to a PIN error.

MBIM_CID_MS_UICC_ACCESS_RECORD

This CID sends a specific command to access a UICC linear fixed or cyclic file, with structure type of MBIMUiccFileStructureCyclic or MBIMUIccFileStructureLinear.

Parameters

OperationSetQueryNotification
CommandNot applicableMBIM_UICC_ACCESS_RECORDNot applicable
ResponseNot applicableMBIM_UICC_RESPONSENot applicable

Query

Reads contents of a record. The InformationBuffer for MBIM_COMMAND_MSG contains the following MBIM_UICC_ACCESS_RECORD structure. MBIM_UICC_RESPONSE is returned in the InformationBuffer of MBIM_COMMAND_DONE.

MBIM_UICC_ACCESS_RECORD (version 1)

OffsetSizeFieldTypeDescription
04VersionUINT32The version number of the structure that follows. This field must be set to 1 for version 1 of this structure.
44AppIdOffsetOFFSETThe offset, in bytes, from the beginning of this structure to the buffer containing the application ID.
84AppIdSizeSIZE (0..16)The size of the application ID, in bytes, as defined in Section 8.3 of the ETSI TS 102 221 technical specification. For 2G cards, this field must be set to zero (0).
124FilePathOffsetOFFSETThe offset, in bytes, calculated from the beginning of this structure to the buffer containing the file path. The file path is an array of 16-bit file IDs. The first ID must be either 0x7FFF or 0x3F00. If the first ID is 0x7FFF, then the path is relative to the ADF of the application desginated by AppId. Otherwise, it is an absolute path starting from the MF.
164FilePathSizeSIZEThe size of the file path, in bytes.
204RecordNumberUINT32(0..256)The record number. This represents the absolute record index at all times. Relative record access is not supported because the modem can perform multiple accesses on a file (NEXT, PREVIOUS).
244LocalPinOffsetOFFSETThe offset, in bytes, calculated from the beginning of this structure to the buffer containing the password. The lock password is a null-terminated UTF-8 string of decimal digits.
284LocalPinSizeSIZE (0..16)The size of the password, in bytes.
324RecordDataOffsetOFFSETThe offset, in bytes, calculated from the beginning of this structure to the buffer containing the command-specific data. Record data is only used for SET operations.
364RecordDataSizeSIZE (0..256)The size of the data, in bytes.
40DataBufferDATABUFFERThe data buffer containing AppId, FilePath, LocalPin, and RecordData.

Set

Not applicable.

Response

An MBIM_UICC_RESPONSE structure is used in the InformationBuffer.

Menu

Unsolicited Events

Not applicable.

Status Codes

The following status codes are applicable:

Status codeDescription
MBIM_STATUS_BUSYBasic MBIM status as defined for all commands.
MBIM_STATUS_FAILUREBasic MBIM status as defined for all commands.
MBIM_STATUS_SIM_NOT_INSERTEDUnable to perform the UICC operation because the UICC is missing.
MBIM_STATUS_BAD_SIMUnable to perform the UICC operation because the UICC is in an error state.
MBIM_STATUS_SHAREABILITY_CONDITION_ERRORThe file cannot be selected because it is not shareable and is currently being accessed by another application. The status word returned by the SIM is 6985.
MBIM_STATUS_PIN_FAILUREThe operation failed due to a PIN error.

MBIM_CID_MS_PIN_EX

This CID is used to perform all PIN security operations as defined in Section 9 of the ETSI TS 102 221 technical specification. The CID is similar to MBIM_CID_MS_PIN, but extends it to support multi-app UICC cards. Only single-verification-capable UICCs are supported. Multi-verification-capable UICCs that support more than one application PIN are not supported. One application PIN (PIN1) is assigned to all ADFs/DFs and files on the UICC. However, each application can specify a local PIN (PIN2) as a level 2 user verification requirement, resulting in the need for additional validation for every access command. This scenario is what MBIM_CID_MS_PIN_EX supports.

Just like MBIM_CID_MS_PIN, with MBIM_CID_MS_PIN_EX the device only reports one PIN at a time. If multiple PINs are enabled and reporting multiple PINs is also enabled, then functions must report PIN1 first. For example, if subsidy lock reporting is enabled and the SIM's PIN1 is enabled, then the subsidy lock PIN should be reported in a subsequent query request only after PIN1 has been successfully verified. An empty PIN is permitted together with MBIMPinOperationEnter. An empty PIN is specified by setting the PinSize to zero. In this case, a SET command is similar to a QUERY and returns the state of the PIN referenced. This is fully aligned to the behavior of the VERIFY command as specified in Section 11.1.9 of the ETSI TS 102 221 technical specification.

Parameters

OperationSetQueryNotification
CommandMBIM_SET_PIN_EXMBIM_PIN_APPNot applicable
ResponseMBIM_PIN_INFO_EXMBIM_PIN_INFO_EXNot applicable

Query

The following MBIM_PIN_APP structure is used in the InformationBuffer.

MBIM_PIN_APP (version 1)

OffsetSizeFieldTypeDescription
04VersionUINT32The version number of the structure that follows. This field must be set to 1 for version 1 of this structure.
44AppIdOffsetOFFSETThe offset, in bytes, from the beginning of this structure to the buffer containing the application ID.
84AppIdSizeSIZE (0..16)The size of the application ID, in bytes, as defined in Section 8.3 of the ETSI TS 102 221 technical specification. For 2G cards, this field must be set to zero (0).
12DataBufferDATABUFFERThe AppId as defined in the ETSI TS 102 221 technical specification.

Set

The following MBIM_SET_PIN_EX structure is used in the InformationBuffer.

MBIM_SET_PIN_EX

Menu
OffsetSizeFieldTypeDescription
04PinTypeMBIM_PIN_TYPE_EXThe PIN type. See the MBIM_PIN_TYPE_EX table in this topic.
44PinOperationMBIM_PIN_OPERATIONThe PIN operation. See MBIM 1.0.
84PinOffsetOFFSETThe offset, in bytes, calculated from the beginning of this structure to a string PIN that represents the PIN value with which to perform the action, or the PIN value required to enable or disable PIN settings. This field applies for all values of PinOperation.
124PinSizeSIZE (0..32)The size, in bytes, used for the PIN.
164NewPinOffsetOFFSETThe offset, in bytes, calculated from the beginning of this structure to the NewPin string that represents the new PIN value to set when PinOperation is MBIMPinOperationChange or MBIMPinOperationEnter, for PinTypeMBIMPinTypePuk1 or PinTypeMBIMPinTypePuk2.
204NewPinSizeSIZE (0..32)The size, in bytes, used for the NewPin.
244AppIdOffsetOFFSETThe offset, in bytes, calculated from the beginning of this structure to the buffer containing the application ID.
284AppIdSizeSIZE (0..16)The size of the application ID, in bytes, as defined in Section 8.3 of the ETSI TS 102 221 technical specification. For 2G cards, this field must be set to zero (0).
32DataBufferDATABUFFERThe data buffer containing the Pin, NewPin, and AppId.

Response

The following MBIM_PIN_INFO_EX structure is used in the InformationBuffer.

OffsetSizeFieldTypeDescription
04PinTypeMBIM_PIN_TYPE_EXThe PIN type. See the MBIM_PIN_TYPE_EX table in this topic.
44PinStateMBIM_PIN_STATEThe PIN state. See MBIM 1.0.
84RemainingAttemptsUINT32The number of remaining attempts for any PIN-related operations such as enter, enable, or disable. Devices that do not support this information must set this member to 0xFFFFFFFF.

Unsolicited Events

Uicc Unlock From System Updates Menu Free

Not applicable.

Status Codes

The following status codes are applicable:

Uicc Unlock Bypass

Status codeDescription
MBIM_STATUS_BUSYBasic MBIM status as defined for all commands.
MBIM_STATUS_FAILUREBasic MBIM status as defined for all commands.
MBIM_STATUS_SIM_NOT_INSERTEDUnable to perform the UICC operation because the UICC is missing.
MBIM_STATUS_BAD_SIMUnable to perform the UICC operation because the UICC is in an error state.
MBIM_STATUS_PIN_DISABLEDThe operation failed because the PIN is disabled.
MBIM_STATUS_PIN_REQUIREDThe operation failed because a PIN must be entered to proceed.
MBIM_STATUS_NO_DEVICE_SUPPORTThe operation failed because a SET on a corresponding PIN type is not supported by the device.

-->

Overview

This topic specifies an extension to the Mobile Broadband Interface Model (MBIM) interface to permit accessing UICC smart card application and file systems. This extension to MBIM exposes logical access to the UICC's ETSI TS 102 221 technical specification-compliant applications and filesystems, and is supported in Windows 10, version 1903 and later.

UICC access and security

The UICC provides a file system and supports a set of applications that can run concurrently. These include the USIM for UMTS, CSIM for CDMA, and ISIM for IMS. The SIM is a legacy portion of the UICC that can be modeled as one of these applications (for GSM).

The following diagram from Section 8.1 of the ETSI TS 102 221 technical specification shows an example card application structure.

The UICC file system can be regarded as a forest of directory trees. The legacy SIM tree is rooted at a Master File (MF) and contains up to two levels of subdirectories (Dedicated Files, or DFs) containing Elemental Files (EFs) that hold various types of information. The SIM defines DFs under the MF, one of which, DFTelecom, contains information common to multiple access types such as the common phone book. Additional applications are effectively implemented as separate trees, each rooted in its own Application Directory File (ADF). Each ADF is identified by an application identifier that can be up to 128 bits long. A file under the card root (EFDir under the MF in the diagram) contains the application names and corresponding identifiers. Within a tree (the MF or an ADF), DFs and EFs might be identified by a path of file IDs, where a file ID is a 16-bit integer.

NDIS interface extensions

The following OIDs have been defined to support UICC application and file system access.

MBIM service and CID values

Service nameUUIDUUID value
Microsoft Low-Level UICC AccessUUID_MS_UICC_LOW_LEVELC2F6588E-F037-4BC9-8665-F4D44BD09367
Microsoft Basic IP Connectivity ExtensionsUUID_BASIC_CONNECT_EXTENSIONS3D01DCC5-FEF5-4D05-9D3A-BEF7058E9AAF

The following table specifies the UUID and command code for each CID, as well as whether the CID supports Set, Query, or Event (notification) requests. See each CID’s individual Section within this topic for more info about its parameters, data structures, and notifications.

CIDUUIDCommand codeSetQueryNotify
MBIM_CID_MS_UICC_APP_LISTUUID_MS_UICC_LOW_LEVEL7NYN
MBIM_CID_MS_UICC_FILE_STATUSUUID_MS_UICC_LOW_LEVEL8NYN
MBIM_CID_MS_UICC_ACCESS_BINARYUUID_MS_UICC_LOW_LEVEL9YYN
MBIM_CID_MS_UICC_ACCESS_RECORDUUID_MS_UICC_LOW_LEVEL10YYN
MBIM_CID_MS_PIN_EXUUID_BASIC_CONNECT_EXTENSIONS14YYN

MBIM_CID_MS_UICC_APP_LIST

This CID retrieves a list of applications in a UICC and information about them. When the UICC in the modem is fully initialized and ready to register with the mobile operator, a UICC application must be selected for registration and a query with this CID should return the selected application in the ActiveAppIndex field in the MBIM_UICC_APP_LIST structure used in response.

Parameters

OperationSetQueryNotification
CommandNot applicableEmptyNot applicable
ResponseNot applicableMBIM_UICC_APP_LISTNot applicable

Query

The InformationBuffer of MBIM_COMMAND_MSG is empty.

Unlock

Set

Not applicable.

Response

The InformationBuffer in MBIM_COMMAND_DONE contains the following MBIM_UICC_APP_LIST structure.

MBIM_UICC_APP_LIST (version 1)

OffsetSizeFieldTypeDescription
04VersionUINT32The version number of the structure that follows. This field must be set to 1 for version 1 of this structure.
44AppCountUINT32The number of UICC application MBIM_UICC_APP_INFO structures being returned in this response.
84ActiveAppIndexUINT32(0..NumApp - 1)The index of the application selected by the modem for registration with the mobile network. This field must be between 0 and the AppCount - 1. It indexes to the array of applications returned by this response. If no application is selected for registration, this field contains 0xFFFFFFFF.
124AppListSizeUINT32The size of the app list data, in bytes.
8*AppCountAppListOL_PAIR_LISTFirst element of the pair is a 4-byte field with the Offset of an app info in the DataBuffer. Second element of the pair is a 4-byte field with the size of the app info.
AppListSizeDataBufferDATABUFFERAn array of AppCount * MBIM_UICC_APP_INFO structures.

MBIM_UICC_APP_INFO

Uicc Unlock From System Updates Menu Code

OffsetSizeFieldTypeDescription
04AppTypeMBIM_UICC_APP_TYPEThe type of the UICC application.
44AppIdOffsetOFFSETOffset for the application ID in the databuffer. Only the first AppIdSize bytes are meaningful. If the application ID is longer than MBIM_MAXLENGTH_APPID bytes, then AppIdSize specifies the actual length but only the first MBIM_MAXLENGTH_APPID bytes are in this field. This field is valid only when AppType is not MBIMUiccAppTypeMf, MBIMUiccAppTypeMfSIM, or MBIMUiccAppTypeMfRUIM.
84AppIdSizeSIZE (0..16)The size of the application ID, in bytes, as defined in Section 8.3 of the ETSI TS 102 221 technical specification. This field is set to zero for the MBIMUiccAppTypeMf, MBIMUiccAppTypeMfSIM, or MBIMUiccAppTypeMfRUIM app types.
12AppNameOffsetOFFSETOffset for the application name in the databuffer. A UTF-8 string specifying the name of the application. The length of this field is specified by AppNameLength. If the length is greater than or equal to MBIM_MAXLENGTH_APPNAME bytes, this field contains the first MBIM_MAXLENGTH_APPNAME - 1 bytes of the name. The string is always null-terminated.
164AppNameLengthSIZE (0..256)The length, in bytes, of the application name.
204NumPinKeyRefsSIZE (0..8)The number of application PIN key references. In other words, the number of elements of PinKeyRef that are valid. Applications on a virtual R-UIM have no PIN key references.
244KeyRefOffsetOFFSETOffset of the PinKeyRef in the DataBuffer. The PinKeyRef is a byte array specifying the application’s PIN key references for different levels of verification (keys for PIN1, PIN2, and possibly a universal PIN), as defined in Table 9.3 and Section 9.4.2 of the ETSI TS 102 221 technical specification. In the case of a single-verification card, or an MBB driver and/or modem that does not support different application keys for different applications, the first byte of the PinKeyRef field must be 0x01 (PIN1) and the second byte must be 0x81 (PIN2), as described in Section 9.5.1 of ETSI TS 102 221.
284KeyRefSizeSIZE (0..8)The size of PinKeyRef.
32DataBufferDATABUFFERThe data buffer containing AppId, AppName, and PinKeyRef.of a single-verification card, or an MBB driver and/or modem that does not support different application keys for different applications, this field must be 0x01.

MBIM_UICC_APP_TYPE

TypeValueDescription
MBIMUiccAppTypeUnknown0Unknown type.
MBIMUiccAppTypeMf1Legacy SIM directories rooted at the MF.
MBIMUiccAppTypeMfSIM2Legacy SIM directories rooted at the DF_GSM.
MBIMUiccAppTypeMfRUIM3Legacy SIM directories rooted at the DF_CDMA.
MBIMUiccAppTypeUSIM4USIM application.
MBIMUiccAppTypeCSIM5CSIM applicaton.
MBIMUiccAppTypeISIM6ISIM application.

Constants

The following constants are defined for MBIM_CID_MS_UICC_APP_INFO.

const int MBIM_MAXLENGTH_APPID = 32
const int MBIM_MAXLENGTH_APPNAME = 256
const int MBIM_MAXNUM_PINREF = 8

Unsolicited Events

Not applicable.

Status Codes

The following status codes are applicable:

Status codeDescription
MBIM_STATUS_SUCCESSBasic MBIM status as defined for all commands.
MBIM_STATUS_BUSYBasic MBIM status as defined for all commands.
MBIM_STATUS_FAILUREBasic MBIM status as defined for all commands.
MBIM_STATUS_NO_DEVICE_SUPPORTBasic MBIM status as defined for all commands.
MBIM_STATUS_SIM_NOT_INSERTEDUnable to perform the UICC operation because the UICC is missing.
MBIM_STATUS_BAD_SIMUnable to perform the UICC operation because the UICC is in an error state.
MBIM_STATUS_NOT_INITIALIZEDUnable to perform the UICC operation because the UICC is not yet fully initialized.

MBIM_CID_MS_UICC_FILE_STATUS

This CID retrieves information about a specified UICC file.

Parameters

OperationSetQueryNotification
CommandNot applicableMBIM_UICC_FILE_PATHNot applicable
ResponseNot applicableMBIM_UICC_FILE_STATUSNot applicable

Query

The InformationBuffer of MBIM_COMMAND_MSG contains the target EF as an MBIM_UICC_FILE_PATH structure.

MBIM_UICC_FILE_PATH (version 1)

OffsetSizeFieldTypeDescription
04VersionUINT32The version number of the structure that follows. This field must be 1 for version 1 of this structure.
44AppIdOffsetOFFSETThe offset, in bytes, calculated from the beginning of this structure to the buffer containing the application ID.
84AppIdSizeSIZE (0..16)The size of the application ID, in bytes, as defined in Section 8.3 of the ETSI TS 102 221 technical specification. For 2G cards, this field must be set to zero (0).
124FilePathOffsetOFFSETThe offset, in bytes, calculated from the beginning of this structure to the buffer containing the file path. The file path is an array of 16-bit file IDs. The first ID must be either 0x7FFF or 0x3F00. If the first ID is 0x7FFF, then the path is relative to the ADF of the application desginated by AppId. Otherwise, it is an absolute path starting from the MF.
164FilePathSizeSIZE (0..8)The size of the file path, in bytes.
20DataBufferDATABUFFERThe data buffer containing AppId and FilePath.

Set

Not applicable.

Response

The following MBIM_UICC_FILE_STATUS structure is used in the InformationBuffer.

MBIM_UICC_FILE_STATUS (version 1)

OffsetSizeFieldTypeDescription
04VersionUINT32The version number of the structure that follows. This field must be 1 for version 1 of this structure.
44StatusWord1UINT32(0..256)A return parameter specific to the UICC command.
84StatusWord2UINT32(0..256)A return parameter specific to the UICC command.
124FileAccessibilityMBIM_UICC_FILE_ACCESSIBILITYThe UICC file accessibility.
164FileTypeMBIM_UICC_FILE_TYPEThe UICC file type.
204FileStructureMBIM_UICC_FILE_STRUCTUREThe UICC file structure.
244ItemCountUINT32The number of items in the UICC file. For transparent and TLV files, this is set to 1.
284SizeUINT32The size of each item, in bytes. For transparent or TLV files, this is the size of the entire EF. For record-based files, this represents the total number of records.
3216FileLockStatusMBIM_PIN_TYPE_EX[4]An array of type MBIM_PIN_TYPE_EX that describes the access condition for each operation (READ, UPDATE, ACTIVATE, and DEACTIVATE in that order) on that file.

MBIM_UICC_FILE_ACCESSIBILITY

The MBIM_UICC_FILE_ACCESSIBILITY enumeration is used in the preceding MBIM_UICC_FILE_STATUS structure.

TypeValueDescription
MBIMUiccFileAccessibilityUnknown0File shareability unknown.
MBIMUiccFileAccessibilityNotShareable1Not shareable file.
MBIMUiccFileAccessibilityShareable2Shareable file.

MBIM_UICC_FILE_TYPE

The MBIM_UICC_FILE_TYPE enumeration is used in the preceding MBIM_UICC_FILE_STATUS structure.

TypeValueDescription
MBIMUiccFileTypeUnknown0File type unknown.
MBIMUiccFileTypeWorkingEf1Working EF.
MBIMUiccFileTypeInternalEf2Internal EF.
MBIMUiccFileTypeDfOrAdf3Dedicated file, a directory that is the parent of other nodes. This may be a DF or ADF.

MBIM_UICC_FILE_STRUCTURE

The MBIM_UICC_FILE_STRUCTURE enumeration is used in the preceding MBIM_UICC_FILE_STATUS structure.

TypeValueDescription
MBIMUiccFileStructureUnknown0An unknown file structure.
MBIMUiccFileStructureTransparent1A single record of variable length.
MBIMUiccFileStructureCyclic2A cyclic set of records, each of the same length.
MBIMUiccFileStructureLinear3A linear set of records, each of the same length.
MBIMUiccFileStructureBerTLV4A set of data values accessible by tag.

MBIM_PIN_TYPE_EX

The MBIM_PIN_TYPE_EX enumeration is used in the preceding MBIM_UICC_FILE_STATUS structure.

TypeValueDescription
MBIMPinTypeNone0No PIN is pending to be entered.
MBIMPinTypeCustom1The PIN type is a custom type and is none of the other PIN types listed in this enumeration.
MBIMPinTypePin12The PIN1 key.
MBIMPinTypePin23The PIN2 key.
MBIMPinTypeDeviceSimPin4The device to SIM key.
MBIMPinTypeDeviceFirstSimPin5The device to very first SIM key.
MBIMPinTypeNetworkPin6The network personalization key.
MBIMPinTypeNetworkSubsetPin7The network subset personalization key.
MBIMPinTypeServiceProviderPin8The service provider (SP) personalization key.
MBIMPinTypeCorporatePin9The corporate personalization key.
MBIMPinTypeSubsidyLock10The subsidy unlock key.
MBIMPinTypePuk111The Personal Identification Number 1 Unlock Key (PUK1).
MBIMPinTypePuk212The Personal Identification Number 2 Unlock Key (PUK2).
MBIMPinTypeDeviceFirstSimPuk13The device to very first SIM PIN unlock key.
MBIMPinTypeNetworkPuk14The network personalization unlock key.
MBIMPinTypeNetworkSubsetPuk15The network subset personalization unlock key.
MBIMPinTypeServiceProviderPuk16The service provider (SP) personalization unlock key.
MBIMPinTypeCorporatePuk17The corporate personalization unlock key.
MBIMPinTypeNev18The NEV key.
MBIMPinTypeAdm19The administrative key.

Unsolicited Events

Not applicable.

Status Codes

The following status codes are applicable:

Status codeDescription
MBIM_STATUS_BUSYBasic MBIM status as defined for all commands.
MBIM_STATUS_FAILUREBasic MBIM status as defined for all commands.
MBIM_STATUS_SIM_NOT_INSERTEDUnable to perform the UICC operation because the UICC is missing.
MBIM_STATUS_BAD_SIMUnable to perform the UICC operation because the UICC is in an error state.
MBIM_STATUS_SHAREABILITY_CONDITION_ERRORThe file cannot be selected because it is not shareable and is currently being accessed by another application. The status word returned by the SIM is 6985.

MBIM_CID_MS_UICC_ACCESS_BINARY

This CID sends a specific command to access a UICC binary file, with structure type MBIMUiccFileStructureTransparent or MBIMUiccFileStructureBerTLV.

Parameters

OperationSetQueryNotification
CommandNot applicableMBIM_UICC_ACCESS_BINARYNot applicable
ResponseNot applicableMBIM_UICC_RESPONSENot applicable

Query

Reads a binary file. The InformationBuffer for MBIM_COMMAND_MSG contains an MBIM_UICC_ACCESS_BINARY structure. An MBIM_UICC_RESPONSE structure is returned in the InformationBuffer of MBIM_COMMAND_DONE.

MBIM_UICC_ACCESS_BINARY (version 1)

OffsetSizeFieldTypeDescription
04VersionUINT32The version number of the structure that follows. This field must be set to 1 for version 1 of this structure.
44AppIdOffsetOFFSETThe offset, in bytes, from the beginning of this structure to the buffer containing the application ID.
84AppIdSizeSIZE (0..16)The size of the application ID, in bytes, as defined in Section 8.3 of the ETSI TS 102 221 technical specification. For 2G cards, this field must be set to zero (0).
124FilePathOffsetOFFSETThe offset, in bytes, calculated from the beginning of this structure to the buffer containing the file path. The file path is an array of 16-bit file IDs. The first ID must be either 0x7FFF or 0x3F00. If the first ID is 0x7FFF, then the path is relative to the ADF of the application desginated by AppId. Otherwise, it is an absolute path starting from the MF.
164FilePathSizeSIZEThe size of the file path, in bytes.
204FileOffsetUINT32The offset to be used when reading from the file. This field can be bigger than 256, and it combines both offset high and offset low as defined in the ETSI TS 102 221 technical specification.
244NumberOfBytesUINT32The number of bytes to be read. For example, a client driver could use this function to read a transparent (binary) file that is larger than 256 bytes, although the maximum amount that can be read or written in a single UICC operation is 256 bytes per the ETSI TS 102 221 technical specification. It is the function's responsibility to split this into multiple APDUs and send back the result in a single response.
284LocalPinOffsetOFFSETThe offset, in bytes, calculated from the beginning of this structure to the buffer containing the password. This is the local PIN (PIN2) and is used in case the operation requires local PIN validation.
324LocalPinSizeSIZE (0..16)The size of the password, in bytes.
364BinaryDataOffsetOFFSETThe offset, in bytes, calculated from the beginning of this structure to the buffer containing the command-specific data. Binary data is only used for SET operations.
404BinaryDataSizeSIZE (0..32768)The size of the data, in bytes.
44DataBufferDATABUFFERThe data buffer containing AppId, FilePath, LocalPin, and BinaryData.

Set

Not applicable.

Response

The following MBIM_UICC_RESPONSE structure is used in the InformationBuffer.

MBIM_UICC_RESPONSE (version 1)

OffsetSizeFieldTypeDescription
04VersionUINT32The version number of the structurethat follows. This field must be 1 for version 1 of this structure.
44StatusWord1UINT32(0..256)A return parameter specific to the UICC command.
84StatusWord2UINT32(0..256)A return parameter specific to the UICC command.
124ResponseDataOffsetOFFSETThe offset, in bytes, calculated from the beginning of this structure to the buffer containing the response data. The response data is only used for QUERY operations.
164ResponseDataSizeSIZE (0..32768)The size of the data, in bytes.
20DataBufferDATABUFFERThe data buffer containing ResponseData.

Unsolicited Events

Not applicable.

Status Codes

The following status codes are applicable:

Status codeDescription
MBIM_STATUS_BUSYBasic MBIM status as defined for all commands.
MBIM_STATUS_FAILUREBasic MBIM status as defined for all commands.
MBIM_STATUS_SIM_NOT_INSERTEDUnable to perform the UICC operation because the UICC is missing.
MBIM_STATUS_BAD_SIMUnable to perform the UICC operation because the UICC is in an error state.
MBIM_STATUS_SHAREABILITY_CONDITION_ERRORThe file cannot be selected because it is not shareable and is currently being accessed by another application. The status word returned by the SIM is 6985.
MBIM_STATUS_PIN_FAILUREThe operation failed due to a PIN error.

MBIM_CID_MS_UICC_ACCESS_RECORD

This CID sends a specific command to access a UICC linear fixed or cyclic file, with structure type of MBIMUiccFileStructureCyclic or MBIMUIccFileStructureLinear.

Parameters

OperationSetQueryNotification
CommandNot applicableMBIM_UICC_ACCESS_RECORDNot applicable
ResponseNot applicableMBIM_UICC_RESPONSENot applicable

Query

Reads contents of a record. The InformationBuffer for MBIM_COMMAND_MSG contains the following MBIM_UICC_ACCESS_RECORD structure. MBIM_UICC_RESPONSE is returned in the InformationBuffer of MBIM_COMMAND_DONE.

MBIM_UICC_ACCESS_RECORD (version 1)

OffsetSizeFieldTypeDescription
04VersionUINT32The version number of the structure that follows. This field must be set to 1 for version 1 of this structure.
44AppIdOffsetOFFSETThe offset, in bytes, from the beginning of this structure to the buffer containing the application ID.
84AppIdSizeSIZE (0..16)The size of the application ID, in bytes, as defined in Section 8.3 of the ETSI TS 102 221 technical specification. For 2G cards, this field must be set to zero (0).
124FilePathOffsetOFFSETThe offset, in bytes, calculated from the beginning of this structure to the buffer containing the file path. The file path is an array of 16-bit file IDs. The first ID must be either 0x7FFF or 0x3F00. If the first ID is 0x7FFF, then the path is relative to the ADF of the application desginated by AppId. Otherwise, it is an absolute path starting from the MF.
164FilePathSizeSIZEThe size of the file path, in bytes.
204RecordNumberUINT32(0..256)The record number. This represents the absolute record index at all times. Relative record access is not supported because the modem can perform multiple accesses on a file (NEXT, PREVIOUS).
244LocalPinOffsetOFFSETThe offset, in bytes, calculated from the beginning of this structure to the buffer containing the password. The lock password is a null-terminated UTF-8 string of decimal digits.
284LocalPinSizeSIZE (0..16)The size of the password, in bytes.
324RecordDataOffsetOFFSETThe offset, in bytes, calculated from the beginning of this structure to the buffer containing the command-specific data. Record data is only used for SET operations.
364RecordDataSizeSIZE (0..256)The size of the data, in bytes.
40DataBufferDATABUFFERThe data buffer containing AppId, FilePath, LocalPin, and RecordData.

Set

Not applicable.

Response

An MBIM_UICC_RESPONSE structure is used in the InformationBuffer.

Unsolicited Events

Not applicable.

Status Codes

The following status codes are applicable:

Status codeDescription
MBIM_STATUS_BUSYBasic MBIM status as defined for all commands.
MBIM_STATUS_FAILUREBasic MBIM status as defined for all commands.
MBIM_STATUS_SIM_NOT_INSERTEDUnable to perform the UICC operation because the UICC is missing.
MBIM_STATUS_BAD_SIMUnable to perform the UICC operation because the UICC is in an error state.
MBIM_STATUS_SHAREABILITY_CONDITION_ERRORThe file cannot be selected because it is not shareable and is currently being accessed by another application. The status word returned by the SIM is 6985.
MBIM_STATUS_PIN_FAILUREThe operation failed due to a PIN error.

MBIM_CID_MS_PIN_EX

This CID is used to perform all PIN security operations as defined in Section 9 of the ETSI TS 102 221 technical specification. The CID is similar to MBIM_CID_MS_PIN, but extends it to support multi-app UICC cards. Only single-verification-capable UICCs are supported. Multi-verification-capable UICCs that support more than one application PIN are not supported. One application PIN (PIN1) is assigned to all ADFs/DFs and files on the UICC. However, each application can specify a local PIN (PIN2) as a level 2 user verification requirement, resulting in the need for additional validation for every access command. This scenario is what MBIM_CID_MS_PIN_EX supports.

Just like MBIM_CID_MS_PIN, with MBIM_CID_MS_PIN_EX the device only reports one PIN at a time. If multiple PINs are enabled and reporting multiple PINs is also enabled, then functions must report PIN1 first. For example, if subsidy lock reporting is enabled and the SIM's PIN1 is enabled, then the subsidy lock PIN should be reported in a subsequent query request only after PIN1 has been successfully verified. An empty PIN is permitted together with MBIMPinOperationEnter. An empty PIN is specified by setting the PinSize to zero. In this case, a SET command is similar to a QUERY and returns the state of the PIN referenced. This is fully aligned to the behavior of the VERIFY command as specified in Section 11.1.9 of the ETSI TS 102 221 technical specification.

Parameters

OperationSetQueryNotification
CommandMBIM_SET_PIN_EXMBIM_PIN_APPNot applicable
ResponseMBIM_PIN_INFO_EXMBIM_PIN_INFO_EXNot applicable

Query

The following MBIM_PIN_APP structure is used in the InformationBuffer.

MBIM_PIN_APP (version 1)

Uicc Unlock From System Updates Menu Free

OffsetSizeFieldTypeDescription
04VersionUINT32The version number of the structure that follows. This field must be set to 1 for version 1 of this structure.
44AppIdOffsetOFFSETThe offset, in bytes, from the beginning of this structure to the buffer containing the application ID.
84AppIdSizeSIZE (0..16)The size of the application ID, in bytes, as defined in Section 8.3 of the ETSI TS 102 221 technical specification. For 2G cards, this field must be set to zero (0).
12DataBufferDATABUFFERThe AppId as defined in the ETSI TS 102 221 technical specification.

Set

The following MBIM_SET_PIN_EX structure is used in the InformationBuffer.

MBIM_SET_PIN_EX

OffsetSizeFieldTypeDescription
04PinTypeMBIM_PIN_TYPE_EXThe PIN type. See the MBIM_PIN_TYPE_EX table in this topic.
44PinOperationMBIM_PIN_OPERATIONThe PIN operation. See MBIM 1.0.
84PinOffsetOFFSETThe offset, in bytes, calculated from the beginning of this structure to a string PIN that represents the PIN value with which to perform the action, or the PIN value required to enable or disable PIN settings. This field applies for all values of PinOperation.
124PinSizeSIZE (0..32)The size, in bytes, used for the PIN.
164NewPinOffsetOFFSETThe offset, in bytes, calculated from the beginning of this structure to the NewPin string that represents the new PIN value to set when PinOperation is MBIMPinOperationChange or MBIMPinOperationEnter, for PinTypeMBIMPinTypePuk1 or PinTypeMBIMPinTypePuk2.
204NewPinSizeSIZE (0..32)The size, in bytes, used for the NewPin.
244AppIdOffsetOFFSETThe offset, in bytes, calculated from the beginning of this structure to the buffer containing the application ID.
284AppIdSizeSIZE (0..16)The size of the application ID, in bytes, as defined in Section 8.3 of the ETSI TS 102 221 technical specification. For 2G cards, this field must be set to zero (0).
32DataBufferDATABUFFERThe data buffer containing the Pin, NewPin, and AppId.

Response

Uicc Unlock From System Updates Menu Download

The following MBIM_PIN_INFO_EX structure is used in the InformationBuffer.

OffsetSizeFieldTypeDescription
04PinTypeMBIM_PIN_TYPE_EXThe PIN type. See the MBIM_PIN_TYPE_EX table in this topic.
44PinStateMBIM_PIN_STATEThe PIN state. See MBIM 1.0.
84RemainingAttemptsUINT32The number of remaining attempts for any PIN-related operations such as enter, enable, or disable. Devices that do not support this information must set this member to 0xFFFFFFFF.

Unsolicited Events

Uicc Unlock From System Updates Menu Pdf

Not applicable.

Status Codes

The following status codes are applicable:

Status codeDescription
MBIM_STATUS_BUSYBasic MBIM status as defined for all commands.
MBIM_STATUS_FAILUREBasic MBIM status as defined for all commands.
MBIM_STATUS_SIM_NOT_INSERTEDUnable to perform the UICC operation because the UICC is missing.
MBIM_STATUS_BAD_SIMUnable to perform the UICC operation because the UICC is in an error state.
MBIM_STATUS_PIN_DISABLEDThe operation failed because the PIN is disabled.
MBIM_STATUS_PIN_REQUIREDThe operation failed because a PIN must be entered to proceed.
MBIM_STATUS_NO_DEVICE_SUPPORTThe operation failed because a SET on a corresponding PIN type is not supported by the device.