--- a/simtool/Makefile	Tue Jan 26 07:02:52 2021 +0000
+++ b/simtool/Makefile	Thu Jan 28 01:46:40 2021 +0000
@@ -4,7 +4,7 @@
 OBJS=	alpha_decode.o alpha_valid.o apdu.o atr.o cardconnect.o chv.o \
 	dispatch.o globals.o hexdump.o hexread.o hlread.o main.o names.o \
 	pbcommon.o pbdump.o pberase.o pbupdate.o readcmd.o readops.o \
-	saverestore.o select.o telsum.o writecmd.o writeops.o
+	saverestore.o select.o sysmo.o telsum.o writecmd.o writeops.o
 INSTBIN=/opt/freecalypso/bin
 
 all:	${PROG}

--- a/simtool/dispatch.c	Tue Jan 26 07:02:52 2021 +0000
+++ b/simtool/dispatch.c	Thu Jan 28 01:46:40 2021 +0000
@@ -15,6 +15,7 @@
 extern int cmd_change_chv();
 extern int cmd_disable_chv();
 extern int cmd_enable_chv();
+extern int cmd_fix_sysmo_msisdn();
 extern int cmd_iccid();
 extern int cmd_imsi();
 extern int cmd_pb_dump();
@@ -58,6 +59,7 @@
 	{"enable-chv", 1, 1, cmd_enable_chv},
 	{"enable-pin", 1, 1, cmd_enable_chv},
 	{"exit", 0, 0, cmd_exit},
+	{"fix-sysmo-msisdn", 0, 0, cmd_fix_sysmo_msisdn},
 	{"iccid", 0, 0, cmd_iccid},
 	{"imsi", 0, 0, cmd_imsi},
 	{"pb-dump", 1, 2, cmd_pb_dump},

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/simtool/sysmo.c	Thu Jan 28 01:46:40 2021 +0000
@@ -0,0 +1,65 @@
+/*
+ * This module implements special commands for programmable and
+ * semi-programmable (made-up term for the version without ADM keys)
+ * SIM cards made by Sysmocom.
+ */
+
+#include <sys/types.h>
+#include <string.h>
+#include <strings.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <pcsclite.h>
+#include <winscard.h>
+#include "globals.h"
+#include "file_id.h"
+
+cmd_fix_sysmo_msisdn()
+{
+	int rc;
+	unsigned n;
+	u_char newrec[34];
+
+	rc = select_op(DF_TELECOM);
+	if (rc < 0)
+		return(rc);
+	rc = select_op(EF_MSISDN);
+	if (rc < 0)
+		return(rc);
+	rc = parse_ef_select_response();
+	if (rc < 0)
+		return(rc);
+	if (curfile_structure != 0x01) {
+		fprintf(stderr, "error: EF_MSISDN is not linear fixed\n");
+		return(-1);
+	}
+	if (curfile_record_len != 34) {
+		fprintf(stderr,
+		"error: expected EF_MSISDN record length of 34 bytes, got %u\n",
+			curfile_record_len);
+		return(-1);
+	}
+	rc = readrec_op(1, 0x04, 34);
+	if (rc < 0)
+		return(rc);
+	for (n = 0; n < 18; n++) {
+		if (sim_resp_data[n] != 0xFF) {
+			fprintf(stderr,
+		"error: non-FF data in the first 18 bytes of alpha tag area\n");
+			return(-1);
+		}
+	}
+	if (sim_resp_data[18] == 0xFF && sim_resp_data[19] == 0xFF) {
+		printf(
+		"last 2 bytes of alpha tag area are clear - already fixed?\n");
+		return(0);
+	}
+	if (sim_resp_data[18] != 0x07 || sim_resp_data[19] != 0x91) {
+		fprintf(stderr,
+	"error: bytes 18 & 19 don't match expected bogus programming\n");
+		return(-1);
+	}
+	memset(newrec, 0xFF, 34);
+	memcpy(newrec + 20, sim_resp_data + 18, 8);
+	return update_rec_op(1, 0x04, newrec, 34);
+}