--- a/.hgignore	Sun Feb 21 22:34:03 2021 +0000
+++ b/.hgignore	Sun Feb 21 23:41:46 2021 +0000
@@ -3,3 +3,5 @@
 \.[oa]$
 
 ^smswrap/ota-smswrap-sjs1$
+
+^test/ota-smspp-envelope$

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/test/Makefile	Sun Feb 21 23:41:46 2021 +0000
@@ -0,0 +1,17 @@
+CC=	gcc
+CFLAGS=	-O2
+PROGS=	ota-smspp-envelope
+LIBS=	../libutil/libutil.a
+INSTBIN=/opt/freecalypso/bin
+
+all:	${PROGS}
+
+ota-smspp-envelope:	ota-smspp-envelope.o ${LIBS}
+	${CC} ${CFLAGS} -o $@ $@.o ${LIBS}
+
+install:
+	mkdir -p ${INSTBIN}
+	install -c ${PROGS} ${INSTBIN}
+
+clean:
+	rm -f ${PROGS} *.o

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/test/ota-smspp-envelope.c	Sun Feb 21 23:41:46 2021 +0000
@@ -0,0 +1,91 @@
+/*
+ * This test utility reads the output of ota-smswrap-* (should be run in a
+ * pipeline) and prepends additional headers to transform this OTA message
+ * into a byte string that can be fed to the SIM in an ENVELOPE command.
+ * The intent is to test OTA RFM functionality of SIM cards using only
+ * fc-simtool, without going through a GSM network.
+ */
+
+#include <sys/types.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <strings.h>
+
+#define	MAX_MSG_LEN	140
+#define	ENVELOPE_BUF	255
+#define	INIT_OFFSET	(ENVELOPE_BUF - MAX_MSG_LEN)
+
+u_char full_buffer[ENVELOPE_BUF], *curhead;
+unsigned msglen;
+
+u_char header1[14] = {0x40, 0x04, 0x81, 0x44, 0x44, 0x7F, 0xF6,
+		      0x12, 0x10, 0x71, 0x90, 0x04, 0x05, 0x2B};
+
+u_char header2[5] = {0x82, 0x02, 0x83, 0x81, 0x8B};
+
+read_input()
+{
+	int rc;
+
+	curhead = full_buffer + INIT_OFFSET;
+	rc = read_hex_from_stdin(curhead, MAX_MSG_LEN);
+	if (rc < 0)
+		exit(1);	/* error msg already printed */
+	msglen = rc;
+}
+
+prepend_byte(newb)
+{
+	curhead--;
+	*curhead = newb;
+	msglen++;
+}
+
+prepend_simple_len()
+{
+	prepend_byte(msglen);
+}
+
+prepend_ber_len()
+{
+	if (msglen < 0x80)
+		prepend_byte(msglen);
+	else {
+		prepend_byte(msglen);
+		prepend_byte(0x81);
+	}
+}
+
+prepend_header(hdr, hdrlen)
+	u_char *hdr;
+{
+	curhead -= hdrlen;
+	bcopy(hdr, curhead, hdrlen);
+	msglen += hdrlen;
+}
+
+emit_output()
+{
+	u_char *dp;
+	unsigned n;
+
+	dp = curhead;
+	for (n = 0; n < msglen; n++)
+		printf("%02X", *dp++);
+	putchar('\n');
+}
+
+main(argc, argv)
+	char **argv;
+{
+	read_input();
+	prepend_simple_len();
+	prepend_header(header1, 14);
+	prepend_ber_len();
+	prepend_header(header2, 5);
+	prepend_ber_len();
+	prepend_byte(0xD1);
+	emit_output();
+	exit(0);
+}