--- a/libcommon/Makefile	Sat Feb 13 03:32:37 2021 +0000
+++ b/libcommon/Makefile	Sat Feb 13 04:31:02 2021 +0000
@@ -2,8 +2,9 @@
 CFLAGS=	-O2 -I/usr/include/PCSC
 OBJS=	alpha_decode.o alpha_fromfile.o alpha_valid.o apdu.o atr.o \
 	cardconnect.o chkblank.o dumpdirfunc.o exit.o globalopts.o \
-	gsm7_decode.o gsm7_encode.o gsm7_encode_table.o hexdump.o hexread.o \
-	hexstr.o names.o number_decode.o number_encode.o pinentry.o revnibbles.o
+	gsm7_decode.o gsm7_encode.o gsm7_encode_table.o gsm7_unpack.o hexdump.o\
+	hexread.o hexstr.o names.o number_decode.o number_encode.o pinentry.o \
+	revnibbles.o
 LIB=	libcommon.a
 
 all:	${LIB}

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/libcommon/gsm7_unpack.c	Sat Feb 13 04:31:02 2021 +0000
@@ -0,0 +1,22 @@
+/*
+ * This library module implements unpacking of GSM 7-bit data
+ * from packed octets.
+ */
+
+#include <sys/types.h>
+
+static u_char shift[8] = {0, 7, 6, 5, 4, 3, 2, 1};
+
+gsm7_unpack(inbuf, outbuf, nseptets)
+	u_char *inbuf, *outbuf;
+	unsigned nseptets;
+{
+	u_char *inp = inbuf, *outp = outbuf;
+	unsigned n;
+
+	for (n = 0; n < nseptets; n++) {
+		*outp++ = (((inp[1] << 8) | inp[0]) >> shift[n&7]) & 0x7F;
+		if (n & 7)
+			inp++;
+	}
+}

--- a/simtool/Makefile	Sat Feb 13 03:32:37 2021 +0000
+++ b/simtool/Makefile	Sat Feb 13 04:31:02 2021 +0000
@@ -3,8 +3,8 @@
 PROG=	fc-simtool
 OBJS=	a38.o chv.o chvext.o curfile.o dispatch.o dumpdir.o grcard1.o grcard2.o\
 	hlread.o main.o pbcommon.o pbdump.o pberase.o pbupd_file.o pbupd_imm.o \
-	pbupd_immhex.o readcmd.o readops.o restorebin.o savebin.o script.o \
-	select.o smserase.o smsp_common.o smsp_dump.o smsp_erase.o \
+	pbupd_immhex.o pnndump.o readcmd.o readops.o restorebin.o savebin.o \
+	script.o select.o smserase.o smsp_common.o smsp_dump.o smsp_erase.o \
 	smsp_restore.o smsp_set.o sstdump.o sysmo.o telsum.o writecmd.o \
 	writeops.o
 LIBS=	../libcommon/libcommon.a

--- a/simtool/dispatch.c	Sat Feb 13 03:32:37 2021 +0000
+++ b/simtool/dispatch.c	Sat Feb 13 04:31:02 2021 +0000
@@ -31,6 +31,7 @@
 extern int cmd_pb_update();
 extern int cmd_pb_update_imm();
 extern int cmd_pb_update_imm_hex();
+extern int cmd_pnn_dump();
 extern int cmd_readbin();
 extern int cmd_readef();
 extern int cmd_readrec();
@@ -104,6 +105,7 @@
 	{"pb-update", 2, 2, cmd_pb_update},
 	{"pb-update-imm", 3, 4, cmd_pb_update_imm},
 	{"pb-update-imm-hex", 4, 4, cmd_pb_update_imm_hex},
+	{"pnn-dump", 0, 0, cmd_pnn_dump},
 	{"quit", 0, 0, good_exit},
 	{"readbin", 2, 2, cmd_readbin},
 	{"readef", 1, 1, cmd_readef},

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/simtool/pnndump.c	Sat Feb 13 04:31:02 2021 +0000
@@ -0,0 +1,104 @@
+/*
+ * This module implements the pnn-dump command, providing a
+ * user-accessible way to identify MVNO SIMs.
+ */
+
+#include <sys/types.h>
+#include <stdio.h>
+#include "simresp.h"
+#include "curfile.h"
+#include "file_id.h"
+
+static void
+dump_record(recno)
+	unsigned recno;
+{
+	u_char *dp, *endp;
+	char *name_kw;
+	unsigned ielen, code_byte, nsept;
+	u_char gsm7_buf[288];
+
+	printf("#%u:", recno);
+	dp = sim_resp_data;
+	endp = sim_resp_data + sim_resp_data_len;
+	while (dp < endp) {
+		if (*dp == 0xFF)
+			break;
+		switch (*dp++) {
+		case 0x43:
+			name_kw = "Ln";
+			break;
+		case 0x45:
+			name_kw = "Sn";
+			break;
+		default:
+			printf(" unknown-IEI\n");
+			return;
+		}
+		if (dp >= endp) {
+			printf(" truncated-IE\n");
+			return;
+		}
+		ielen = *dp++;
+		if (ielen < 1 || ielen > (endp - dp)) {
+			printf(" bad-length\n");
+			return;
+		}
+		code_byte = *dp++;
+		ielen--;
+		printf(" %s=0x%02X", name_kw, code_byte);
+		if (!ielen)
+			continue;
+		putchar(',');
+		if ((code_byte & 0x70) == 0) {
+			nsept = ielen * 8 / 7;
+			gsm7_unpack(dp, gsm7_buf, nsept);
+			dp += ielen;
+			print_gsm7_string_to_file(gsm7_buf, nsept, stdout);
+		} else {
+			for (; ielen; ielen--)
+				printf("%02X", *dp++);
+		}
+	}
+	for (; dp < endp; dp++) {
+		if (*dp != 0xFF) {
+			printf(" bad-padding\n");
+			return;
+		}
+	}
+	putchar('\n');
+}
+
+cmd_pnn_dump()
+{
+	int rc;
+	unsigned recno;
+
+	rc = select_op(DF_GSM);
+	if (rc < 0)
+		return(rc);
+	rc = select_op(EF_PNN);
+	if (rc < 0)
+		return(rc);
+	rc = parse_ef_select_response();
+	if (rc < 0)
+		return(rc);
+	if (curfile_structure != 0x01) {
+		fprintf(stderr, "error: EF_PNN is not linear fixed\n");
+		return(-1);
+	}
+	if (curfile_record_len < 3) {
+		fprintf(stderr,
+"error: EF_PNN record length is less than the spec minimum of 3 bytes\n");
+		return(-1);
+	}
+	for (recno = 1; recno <= curfile_record_count; recno++) {
+		rc = readrec_op(recno, 0x04, curfile_record_len);
+		if (rc < 0)
+			return(rc);
+		if (check_simresp_all_blank())
+			continue;
+		dump_record(recno);
+	}
+	return(0);
+}