Applet Lab: tasks with tested values
This page is the hands-on companion to the Applet Lab guide. Each
task gives the values to enter and the answer the live lab returned when the task
was run on 4 October 2026, as a principal holding appletlab: maintain.
Before you start
| Address | appletlab.rsplab.click |
| Role needed | appletlab: maintain to build, install and run anything |
| Signed out | every API call answers 401 with a JSON body — the page shows the landing card |
Every Build & install makes a new simulated card. Earlier cards are kept on the server under your account; the page itself has no list of them (see Housekeeping).
1. Build and install a sample
- Choose Samples, then MenuKiosk.
- Leave over the air unticked. Choose Build & install.
Expected result. The card console logs, in order:
| Step | What the console shows |
|---|---|
| Build | compiled, no diagnostics; a CAP file of 3108 octets |
| New card | card 4e77c033 (the first 8 characters of the session id) |
load A00000015141434C (3108 octets) | 9000 |
install A00000015141434C0102 from module A00000015141434C01 | 9000 |
select A00000015141434C0102 | 9000 |
terminal profile (9 octets) | 9000 |
Pressing ☰ shows three entries: Top up, Pick a plan, About.
| If you see | It means |
|---|---|
did not compile, with line numbers | The Java did not compile — read the diagnostic |
cannot find symbol … LocalInfo | A multi-file sample was built without its other files. Open it from Samples, which loads all of them |
no applet | No class declares install(byte[], short, byte) |
2. Answer the card from the phone
The answer must be queued before the applet asks.
| Do this | Enter | Card answer |
|---|---|---|
| CAT tab, Phone answers → Text, Queue this answer | 2500 | queue 1 phone reply; the line underneath reads 1 answer waiting, used in order |
| Press Top up on the phone | — | GET INPUT “How much?”, result Command performed successfully |
| Card console APDU | 00 80 00 00 00 | data 00000432353030, 9000 |
The read-back is: last result 00, item 00, then the text with its coding
scheme — 04 (8-bit) and 32353030, which is 2500.
Select an item. Queue Item 2, then press Pick a plan. The phone
shows SELECT ITEM “Choose:” with Small, Medium, Large, and the
terminal response carries item 02.
Display text. Press About. The screen shows “A card drives the phone.”
A refusal. Choose Queue a refusal, then press Top up. The command ends
with User did not accept the proactive command (result 22), and
00 80 00 00 00 now returns 220200.
3. Trace one command
- Tick trace in the card console.
- Send
00 80 00 00 00.
Expected result. 9000, and a trace of 33 instructions in method
process, starting at MenuKiosk.java line 187 (aload_1, invokevirtual, …).
Drag the step slider to move through it. A run that stops early offers More.
Setting a breakpoint by clicking a source line is not yet verified — it needs the editor in a browser.
4. Push an S@T page
- In the S@T tab, under S@T page, replace the default text with
Hello from S@T. - Choose Send S@T page.
Expected result. A 38-octet page (S@T page (38 octets)), status 9000, and
the phone screen shows Hello from S@T.
5. Fire a toolkit event
Build EventProbe, then in the CAT tab choose event 04 — USER_ACTIVITY and
Send ENVELOPE.
| Step | Result |
|---|---|
| Envelope built | D60799010482028281 |
| The applet reacts | DISPLAY TEXT “Event 016 tag D6” |
00 40 00 00 00 (the tally) | 0010D6000000010000…, 9000 |
The event list offers 21 codes, 00–10, 13, 14, 16 and 1C. The
sample itself registers for 22 events: 20 of those codes, plus menu selection
and timer expiration. It does not register for code 14.
6. Move the phone
Build LocationScout (three files; Samples loads them all).
| Network panel | Then | Phone screen |
|---|---|---|
4G, MCC 001, MNC 01, TAC 1, ECI 1, normal → Move & send EVENT DOWNLOAD | — | Moved: 001-01 ?? LAC 1 cell 0000001F |
| (unchanged) | Press Where am I? | Asked: 001-01 4G TAC 1 cell 0000001F |
| (unchanged) | Press Everything | loc:9 imei:8 nmr:x time:7 lang:2 rat:1 srch:1 batt:1 |
| Service none → Move & send EVENT DOWNLOAD | — | Moved: no service |
| (unchanged) | Press Where am I? | handset refused |
In Everything, x means the handset refused that question — here the
network measurement results (02) answer beyond terminal capability, because
no measurements are set. With no service, PROVIDE LOCAL INFORMATION answers
terminal unable to process (20).
7. Read the card’s files
Build CardReader.
| APDU | Answer | Meaning |
|---|---|---|
00 70 00 00 00 | 984400000000000000F1 9000 | EF_ICCID, nibble-swapped as stored |
00 71 00 00 00 | 6985 | EF_SMS needs PIN1, so the read is refused |
Build UsimReader: 00 70 00 00 00 returns EF_AD as 00000000 9000;
00 71 00 00 00 (EF_IMSI) answers 6985.
Files tab. Open it to see the tree (MF, DF_TELECOM, ADF_USIM), each file’s
read and update condition, and PIN1/PIN2 with 3 attempts left. The contents
of EF_Keys and EF_KeysPS always read <withheld>.
Present PIN1. Choose Present PIN1: VERIFY 01 answers 9000 and the
panel shows PIN1 verified. Verify these digits with wrong digits answers
63Cx, where x is the attempts left. After Present PIN1, send
00 71 00 00 00 again: EF_IMSI now answers with its content and 9000. The PIN
stays verified while the applet moves within the USIM; selecting another
application would drop it.
8. Install over the air
- Build SmsCourier with over the air ticked.
Expected result. The INSTALL travels as a secured Short Message to TAR
000000, with SPI 1201 and counter 1:
| Field | Value |
|---|---|
| Envelope | 9000 |
| Proof of Receipt | PoR OK, 1 command executed, last status word 9000 |
| Registered TARs | B00010 → A00000015141434C0102 |
| Security tab counters | 000000: 1 |
The phone menu then has Send long SM. Pressing it sends two SEND SHORT MESSAGE commands — “This message is split across two concate” and “nated SMS parts with a proper UDH.” — both performed successfully.
A packet whose security is below the card’s minimum is refused in the Proof of Receipt, not in the envelope status. Always read the PoR line.
9. Toolkit commands that talk to the network
| Sample | Press | Proactive commands | APDU read-back |
|---|---|---|---|
| UssdDialer | Check balance | SEND USSD *#100#, alpha Check balance, performed | 00 60 00 00 00 → 0000 |
| BipEcho | Open a channel | OPEN CHANNEL, SEND DATA, RECEIVE DATA, CLOSE CHANNEL — all performed | 00 90 00 00 00 → 0402000042495001 |
| BipParser | far end scripted, replies 0103414243 and 01FF414243, Set the far end; press Fetch a record twice | each press opens, sends, receives and closes | 00 B0 00 00 00 → 0401FF00 |
| LegacyAlive | Am I alive | PROVIDE LOCAL INFORMATION, then DISPLAY TEXT On air: 00F110 | 00 A0 00 00 00 → 0000 |
LegacyAlive is a sim.toolkit applet; its TAR B00011 appears in the registered
TARs straight after install.
10. Contactless
Build FieldWatcher, open the NFC tab.
| Press | Result |
|---|---|
| Field on | HCI event a reader’s field is present; screen Reader 001 |
| Field off | nothing — only the arriving edge is an event |
| Field on | screen Reader 002 |
00 B0 00 00 00 | 0002D600 |
Ask: state? answers 9000 with the terminal asks what the contactless state
is.
11. Set the handset
In the Terminal tab, set IMEI 490154203237518 and clock 2026-01-01 12:00, no
measurements, then Apply — no envelope sent. The log reads terminal IMEI 490154203237518, 2026-01-01T12:00Z,
NMR none, no language.
12. Build a message by hand
| Tool | Input | Output |
|---|---|---|
| Channel → Build the message | TAR B00010, data 48656C6C6F | SPI 0001, command packet 00130D00010000B0001000000000010048656C6C6F, an envelope, and a submit_sm |
| Decode (SMPP) | the submit_sm from the Bruno collection | submit_sm, destination 447700900456, ESM class 40, data coding F6, reaches the card, plus the envelope to deliver |
| Envelope | event 07 | D60799010782028281 |
13. Run a campaign
- Open Campaign, choose New and name it
ICCID then EF_SMS. - Add a step: an APDU
00 70 00 00 00; under What should this answer? set Status word9000. - Add a step: an APDU
00 71 00 00 00, status word6982. - Save, then Run against the current card (CardReader installed).
Expected result. saved “ICCID then EF_SMS” — 2 steps, then the summary
1 passed · 1 failed, with the reason expected status word 6982, the card
answered 6985. Change the second expectation to 6985 and both pass.
Open… lists saved campaigns. The page has no delete button; the API’s
DELETE /campaigns/{id} answers deleted with the id.
14. Housekeeping
- Your cards are kept as sessions under your account. The page has no list;
through the API,
GET /sessionslists them andDELETE /sessions/{id}answers204and removes the card with its whole history. - Export and Import save and load your sources as one file in the browser. Not yet verified — browser-only.
Not yet verified
| Capability | Why |
|---|---|
| The Assistant | Needs your own model provider key |
| Breakpoints on a source line | Needs the editor in a browser |
| Export / Import | Browser-only file handling |
| CAT_TP peer | Not run in this pass |