APDU Simulator
Emulate an EMV card, drive a real one, or push a card profile to an STM32 board any terminal can read — with every APDU formatted and raw, a trace of the whole session, and scripted test plans from SELECT PSE to GENERATE AC.
On this page
apdu-simulator · APDU Simulator - Card-1 · MasterCard Debit (Test)
Overview
The APDU Simulator is the card side of an EMV transaction. It holds a card profile — ATR, applications, records, issuer keys — and answers the terminal’s commands from it: SELECT, GET PROCESSING OPTIONS, READ RECORD, VERIFY, GENERATE AC. That card can run in-process, be pushed to an STM32 board that presents a physical contact card to any terminal, or step aside while Studio drives a real card through a PC/SC reader.
Every exchange is shown formatted and raw as it happens, kept in the session trace, and checkable against a scripted test plan.
OnlineEmulate·cu.usbmodem2103 @ 115200MasterCard Debit (Test) · MASTERCARD Exchanges: 7
StatusOnlinePhaseCryptogramLast AIDA0000000041010Exchanges7
▸ GENERATE AC · ARQC
CLA INS P1 P2 80 AE 80 00
↳ P1 80 · ARQC requested
Lc 2B
9F02 Amount, Authorised 00 00 00 00 12 50
9F03 Amount, Other 00 00 00 00 00 00
9F1A Terminal Country Code 08 40
95 TVR 00 00 00 80 00
5F2A Transaction Currency 08 40
9A Transaction Date 26 09 21
9C Transaction Type 00
9F37 Unpredictable Number 1A 2B 3C 4D
9F35 Terminal Type 22
9F45 Data Authentication Code 00 00
9F4C ICC Dynamic Number 00 00 00 00 00 00 00 00
9F34 CVM Results 41 03 02
Le 00
77 Response Message Template
9F27 Cryptogram Information 80 ↳ ARQC
9F36 ATC 00 2E
9F26 Application Cryptogram 0D 44 BF 74 12 5C 4E E3
9F10 Issuer Application Data 01 10 A0 00 03 22 00 00 00 00 …
SW 90 00 Success
80AE80002B000000001250000000000000084000000080000840260921001A2B3C4D220000000000000000000041030200
77299F2701809F3602002E9F26080D44BF74125C4EE39F10120110A00003220000000000000000000000FF9000
apdu-simulator · Card Session — Connect, then a contact purchase from SELECT PSE to GENERATE AC — each command parsed to labelled TLV beside its raw hex, the ARQC coming back in the last response
Three Operating ModesLoopback in-process, a real card through a PC/SC reader, or the STM32 card emulator over USB-CDC — pick the role and the transport adapts.
Card ProfilesScheme, ATR, applications with AID, label, PAN, expiry, records and issuer keys. Clone the test profile and personalize it, or start blank.
Terminal ProfilesTerminal type, capabilities, country and currency, floor limit and action codes — the terminal Studio plays when it drives a card.
Formatted and Raw APDUsEvery command and response parsed to labelled TLV beside its raw hex, from
SELECT PSE to GENERATE AC.Risk and Fault InjectionCryptogram policy, PIN try counter, ATC and offline limits, plus wrong status words, tears and delays on demand.
Test PlansScripted APDU sequences with expected status words and data checks, run step by step or end to end, with an L3-style report.
Configuration tabs
APDU Simulator Configuration has five tabs. Each card links to the section that documents it.
01 · Configure
Quick Start
- Create a card profile — Open
APDU Simulatorand add a profile in the left rail, or keepMasterCard Debit (Test). - Pick the mode — On Mode & Transport choose Loopback, Reader (PC/SC) or Card emulator (USB-CDC to STM32). Loopback needs no hardware.
- Pick the transport — For the card emulator, select the port the firmware enumerated on (
cu.usbmodemXXXXon macOS) and leave the baud at115200. - Check the profile — Card Profile shows the ATR, AID, PAN and issuer keys the simulator will present; Clone & personalize to change them.
- Launch — Launch APDU Simulator opens the session window. Connect, then present the pinboard to the terminal — or run a test plan in loopback.
- Read the exchange — Every APDU lands in the four panes, formatted and raw; Trace Log keeps the whole session.
Tip
Develop test plans and personalisation in Loopback first — the EMV runtime is the same one the hardware modes drive, so a plan that passes there is ready for the pinboard.
01 · Configure
Mode & Transport Tab
Pick the role this simulator plays. The transport section below adapts to it.
Mode & TransportCard ProfileTerminal ProfileRisk & BehaviorTest Plans
Pick the role this simulator plays. The transport section below adapts.
Pick the serial port the firmware enumerated on.
Port
cu.usbmodem2103
Baud rate
115200
ATR override (hex, blank = use card profile)
3B9F95801FC78031E073FE211B63004C45544F4E
On macOS the device shows up as /dev/cu.usbmodemXXXX after the firmware boots. The default baud is 115200 but the firmware framing is binary — baud only affects throughput, not protocol.
apdu-simulator · Mode & Transport — the three operating modes, Card emulator selected, and the STM32 transport — port, baud rate and ATR override
Operating modes
| Mode | What happens |
|---|---|
| Loopback (software-only) | EMV runtime in-process against the active card profile. No hardware. Ideal for developing test plans and personalization. |
| Reader (PC/SC) | Studio acts as the terminal and drives a physical card through a PC/SC reader such as the ACS ACR39U-I1. The card profile is informational only — the real card is the source of truth. |
| Card emulator (USB-CDC to STM32) | Studio pushes APDU responses to the Nucleo-L432KC firmware over USB-CDC. The firmware emulates a contact card on the XCRFID pinboard, readable by an external POS terminal. |
The hardware modes need hardware you supply
Loopback needs nothing — it is where to start. The other two modes each need a piece of kit that does not ship with ISO8583Studio:
- Reader (PC/SC) — any PC/SC contact reader, for example an ACS ACR39U-I1.
- Card emulator — an ST Nucleo-L432KC, an XCRFID 4-in-1 SIM/smart-card pinboard, a USB micro-B cable, and a 3V3↔5V level shifter such as a TXS0108E if your terminal drives Class A 5 V cards.
firmware/stm32-card/ in the repository: the C source, its PlatformIO project, the full bill of materials and the C1–C8 wiring table from the Nucleo to the ISO 7816 contacts. If you would rather have the board design than a parts list, open an issue and ask for it.Transport — STM32 / USB-CDC
PortThe serial port the firmware enumerated on. Rescan lists them again after you plug the board in.
Baud rate
115200 by default. The framing is binary, so the baud only affects throughput, not the protocol.ATR overrideHex; blank uses the card profile’s ATR. Set it when a terminal insists on a particular Answer To Reset.
macOS
The device shows up as
/dev/cu.usbmodemXXXX after the firmware boots. If it is missing, check the Firmware tab of the session window — the board may still be in DFU mode.01 · Configure
Card Profile Tab
The simulator emulates the active profile when running. The tab shows the key fields; the full editor opens from Edit profile.
Mode & TransportCard ProfileTerminal ProfileRisk & BehaviorTest Plans
The simulator emulates this profile when running.
Profile
MasterCard Debit (Test) (MASTERCARD)
Key fields — full editor available above.
SchemeMASTERCARD
ATR3B6500002063CB6800
Application 1
AIDA0000000041010
LabelDEBIT MASTERCARD
PAN5555555555554444
Expiry291231
CVN1
Records1 record(s)
Issuer key idmc-imk-1
Issuer keys: 1
mc-imk-1TDES_AC — UDK 33333333…
apdu-simulator · Card Profile — the active profile, MasterCard Debit (Test), and its summary — scheme, ATR, the first application and the issuer key it signs with
ATRThe Answer To Reset sent on power-up —
3B6500002063CB6800 for the Mastercard test profile. Mode & Transport can override it per port.ApplicationsOne or more ADFs, each with AID, label, priority, PAN, expiry, PAN sequence number and CVN — the Cryptogram Version Number selecting the derivation tree. The PSE directory is built from them.
RecordsThe SFI records returned to
READ RECORD — CDOL1 and CDOL2, the CVM list, issuer action codes, application usage control and the rest of the application data.Issuer keysThe issuer master keys (
TDES_AC, TDES_SMI, TDES_SMC) the card derives its UDKs from, referenced by id such as mc-imk-1.Actions
- Edit profile — opens the full editor for the active profile — every tag, record and key.
- Clone & personalize — copies the profile and steps through PAN, expiry, name and keys so a test card becomes yours.
- New blank — starts an empty profile.
- Refresh — re-reads the profile list from disk after an import.
Note
In Reader (PC/SC) mode the profile is informational only. The physical card answers, not this.
01 · Configure
The Other Configuration Tabs
Terminal ProfileThe terminal side of the exchange — what the simulated reader claims about itself when loopback drives a transaction. See Terminal Profile Tab.
Risk & BehaviorHow the card decides, and where it misbehaves on purpose. See Risk & Behavior Tab.
Test PlansWhich plans are available to the runtime’s Test Plans tab. See Test Plans Tab.
01 · Configure
Terminal Profile Tab
When Studio plays the terminal — in loopback and reader modes — this profile is what the card sees: the PDOL and CDOL data it is answered with, the CVMs the terminal supports, and the action codes that decide offline, online or decline.
Mode & TransportCard ProfileTerminal ProfileRisk & BehaviorTest Plans
Who the card thinks it is talking to.
Terminal type (9F35)
22 — attended · online capable · merchant
Terminal ID (9F1C)
TERM0001
Merchant ID (9F16)
ISO8583STUDIO00
Merchant category (9F15)
5411 — Grocery
Country (9F1A)
0840 — United States
Currency (5F2A · 5F36)
0840 USD · exponent 2
Capability bytes, with what they claim.
Terminal capabilities (9F33)
E0 F8 C8
Additional capabilities (9F40)
F0 00 F0 A0 01
Manual key entryMagnetic stripeICC contactPlaintext PIN (ICC)Enciphered PIN onlineSignatureEnciphered PIN offlineNo CVM requiredSDADDACDA
What decides offline, online or decline.
Floor limit (9F1B)
00 00 03 E8 — 10.00
TAC – Denial
00 00 00 00 00
TAC – Online
FC 50 BC F8 00
TAC – Default
FC 50 BC A0 00
Random selection threshold
0.00
Target %
20
Max target %
99
Applications the terminal will select. Partial match allowed.
MastercardA0000000041010
MaestroA0000000043060
VisaA0000000031010
Visa ElectronA0000000032010
AmexA00000002501
JCBA0000000651010
apdu-simulator · Terminal Profile — identity, capability bytes with their decoded meaning, floor limit and action codes, and the AIDs the terminal accepts
| Tag | Field | What it sets |
|---|---|---|
9F35 | Terminal type | 22 — attended, online capable, operated by the merchant. |
9F33 | Terminal capabilities | Card data input, CVM and security capability bytes — which CVMs and which offline data authentication the terminal claims. |
9F40 | Additional capabilities | Transaction types, input and output capabilities. |
9F1A · 5F2A | Country and currency | 0840 USD with exponent 2 in the test profile. |
9F1B | Floor limit | Amounts under it can be approved offline with a TC; over it the TVR bit sends the transaction online. |
| TAC | Terminal action codes | Denial, Online and Default masks matched against the TVR during terminal action analysis. |
01 · Configure
Risk & Behavior Tab
How the emulated card decides. Everything here changes what GENERATE AC returns, how the card treats PIN, counters and issuer scripts — and what goes wrong when you ask it to.
Mode & TransportCard ProfileTerminal ProfileRisk & BehaviorTest Plans
What GENERATE AC returns.
Follow terminal requestARQC, TC or AAC as the terminal asks — the default for a compliant card.
Always ARQC — force onlineEvery GENERATE AC returns an ARQC, whatever P1 says.
Always AAC — declineEvery GENERATE AC declines. For decline-path testing.
TC when under floor limitApprove offline below the terminal floor limit, otherwise ARQC.
Offline PIN and the counters the card reports.
Reference PIN
••••
PIN try counter
3
ATC start (9F36)
00 2E
LCOL · UCOL (9F14 · 9F23)
03 · 05
Second GENERATE AC and scripts.
Off by default. Applies to the next session.
Response delay
120 ms
Wrong SW on command
None
apdu-simulator · Risk & Behavior — cryptogram policy, PIN and counters, issuer authentication and the fault injection switches
Cryptogram policyFollow the terminal’s request, force an ARQC to go online every time, force an AAC to decline, or approve with a TC when the amount is under the floor limit.
PIN and countersOffline PIN with a reference value and try counter, the starting ATC, and the lower and upper consecutive offline limits (
9F14, 9F23).Issuer authenticationVerify the ARPC in
EXTERNAL AUTHENTICATE, accept or refuse issuer scripts (71 / 72), and optionally require a valid ARPC before returning a TC.Fault injectionA response delay, a wrong status word on a chosen command, a tear at
GENERATE AC, or one corrupted cryptogram byte — to see how the terminal copes.01 · Configure
Test Plans Tab
A test plan is a scripted sequence of APDUs with the status word and data each step must return. Plans are stored with the profile and run from the session window, step by step or end to end.
Mode & TransportCard ProfileTerminal ProfileRisk & BehaviorTest Plans
Test PlansStored with Card-1 · 5 plans
#StepCommandExpect SWExpect data
1SELECT PSE00 A4 04 00 0E …90 006F present
2READ RECORD · PSE00 B2 01 0C 0090 004F = A0000000041010
3SELECT AID00 A4 04 00 07 …90 009F38 present
4GET PROCESSING OPTIONS80 A8 00 00 05 …90 0082 = 18 00
5READ RECORD · SFI 100 B2 01 0C 0090 005A = 5555…4444
6VERIFY00 20 00 80 08 …90 00—
7GENERATE AC80 AE 80 00 2B …90 009F27 = 80 · 9F26 8 bytes
apdu-simulator · Test Plans — the built-in plans and the steps of the online ARQC purchase passing one by one
- Step — a command by name or raw hex, with the fields the simulator fills at run time — amount, date, unpredictable number.
- Expect SW — the status word the step must return; anything else fails the plan at that step.
- Expect data — a tag that must be present, or a tag with an exact value —
82 = 18 00,9F27 = 80. - Report — each run ends in a pass / fail line per step with timing, and feeds the L3 Report tab.
Tip
Start from the built-in plans — online ARQC purchase, offline TC under the floor limit, PIN try counter exhaustion, unknown AID — and clone one to add your own assertions.
02 · Run
The Session Window
Launch APDU Simulator opens the session window for the profile. Seven tabs, all live:
| Tab | What it does |
|---|---|
| Card Session | The live exchange. In loopback and reader modes it is active — a quick-action toolbar, a raw APDU composer, and the last exchange split into formatted and raw command and response. In card-emulator mode it is passive: the external terminal drives and Studio answers, so there is no composer. |
| Trace Log | Every exchange as a log entry, with the same filter, auto-scroll and stats chrome as the other simulators. A non-9000 status word is coloured as an error. |
| Test Plans | Pick a built-in plan, run it through the connected transport, see pass/fail per case, export the report in the scheme’s preferred format. |
| Wire Sniff | Imports a sigrok .sr or CSV capture from a 24 MHz logic analyzer and lines it up against the exchange log, so you can confirm the firmware emitted on I/O, CLK, RST and VCC what the runtime says it sent. |
| L3 Report | Generates a certified-format report from the most recent test-plan run. |
| Firmware | Builds and flashes the stm32-card firmware, with the build log in the shared log panel. |
| Settings | A live view of how the running simulator is wired. Changing anything means going back to the configuration screen. |
TimePhaseCommandC-APDUSWms
+1.204SelectionSELECT PSE00 A4 04 00 0E 31 50 41 59 2E …90 009
+1.221SelectionREAD RECORD · PSE directory00 B2 01 0C 0090 007
+1.236SelectionSELECT AID00 A4 04 00 07 A0 00 00 00 04 …90 0011
+1.255InitiateGET PROCESSING OPTIONS80 A8 00 00 05 83 03 08 40 22 …90 0014
+1.277Read dataREAD RECORD · SFI 1 rec 100 B2 01 0C 0090 0012
+1.298CVMVERIFY · plaintext PIN00 20 00 80 08 24 •• •• FF FF …90 006
+1.402CryptogramGENERATE AC · ARQC80 AE 80 00 2B 00 00 00 00 12 …90 0038
Entries: 7/7Timestamps: relative to ConnectAuto-scroll: ON
apdu-simulator · Trace Log — the seven exchanges of a contact purchase arriving in order, with the L2 phases ticking off above them
←from firmware · terminal side→to firmware · card side
+0.000←HELLOHELLO fw 0.4.2 · NUCLEO-L432KC · pinboard XCRFID · T=0
+0.012→ATRATR 3B 9F 95 80 1F C7 80 31 E0 73 FE 21 1B 63 00 4C 45 54 4F 4E
+0.014←ACKACK ATR armed · waiting for terminal reset
+1.198←RESETRESET VCC 5.0 V · CLK 4 MHz · RST ↑ · ATR replayed
+1.204←C-APDUC-APDU 00 A4 04 00 0E 31 50 41 59 2E 53 59 53 2E 44 44 46 30 31 00 (20 B)
+1.213→R-APDUR-APDU 6F 1E 84 0E 31 50 41 59 2E 53 59 53 2E 44 44 … 90 00 (34 B · 9 ms)
+1.221←C-APDUC-APDU 00 B2 01 0C 00 (5 B)
+1.228→R-APDUR-APDU 70 20 61 1E 4F 07 A0 00 00 00 04 10 10 50 10 … 90 00 (36 B · 7 ms)
+1.236←C-APDUC-APDU 00 A4 04 00 07 A0 00 00 00 04 10 10 00 (13 B)
+1.247→R-APDUR-APDU 6F 29 84 07 A0 00 00 00 04 10 10 A5 1E 50 10 … 90 00 (45 B · 11 ms)
+1.255←C-APDUC-APDU 80 A8 00 00 05 83 03 08 40 22 00 (11 B)
+1.269→R-APDUR-APDU 77 0A 82 02 18 00 94 04 08 01 01 00 90 00 (14 B · 14 ms)
+1.277←C-APDUC-APDU 00 B2 01 0C 00 (5 B)
+1.289→R-APDUR-APDU 70 6D 5A 08 55 55 55 55 55 55 44 44 5F 24 03 … 90 00 (113 B · 12 ms)
+1.298←C-APDUC-APDU 00 20 00 80 08 24 •• •• FF FF FF FF FF (13 B)
+1.304→R-APDUR-APDU 90 00 (2 B · 6 ms)
+1.402←C-APDUC-APDU 80 AE 80 00 2B 00 00 00 00 12 50 00 00 00 00 00 00 08 40 00 00 … (49 B)
+1.440→R-APDUR-APDU 77 29 9F 27 01 80 9F 36 02 00 2E 9F 26 08 0D … 90 00 (45 B · 38 ms)
Frames: 18/18CRC errors: 0Retries: 0
apdu-simulator · Wire Sniff — the USB-CDC link frame by frame — hello, ATR, reset, then every C-APDU in and R-APDU out with sizes and timing
apdu-simulator · L3 Report — the ten checks of the last transaction, eight passed, offline data authentication skipped and online processing noted
BoardNUCLEO-L432KC
MCUSTM32L432KC · 80 MHz · 256 KB
DebuggerST-LINK/V2-1 · 066BFF38…
Portcu.usbmodem2103
PinboardXCRFID contact card
Contact map
C1VCCPA0 · sense
C2RSTPB0 · EXTI
C3CLKPA8 · TIM1_CH1
C5GNDGND
C7I/OPA9 · USART1 half-duplex
Installed
0.4.3
built 2026-09-19 · T=1 block chaining
Latest
0.4.3
up to date
Done · board reset · fw 0.4.3 reported100%
› st-flash · cu.usbmodem2103
Erasing sectors 0–23…
Writing 47,312 bytes…
Verifying…
✓ Done · board reset · fw 0.4.3 reported
apdu-simulator · Firmware — the NUCLEO-L432KC board, its pinboard map, and a firmware update flashed and verified from Studio
Card Session status strip
| Field | What it shows |
|---|---|
| Status | Idle, or connected and exchanging. |
| Phase | Which part of the EMV flow the session has reached. |
| Last AID | The application most recently selected. |
| Exchanges | How many command/response pairs this session has carried. |
Two things are still landing
Hold next APDU in a passive session is a UI placeholder until the firmware-side interception ships, and Wire Sniff imports captures but is not yet a full overlay. L3 Report covers Visa VCPS and Mastercard M/Chip; other schemes can run plans but skip the certified export until their templates are in.
Note
For the terminal side of the same transaction, pair this with the POS Simulator; for key derivation and cryptogram checks, use the EMV & Card Tools.
Common Status Words
| SW1 SW2 | Meaning |
|---|---|
9000 | Success. |
61xx | Response available; xx bytes remain. Issue GET RESPONSE. |
6Cxx | Wrong Le; correct Le is xx. |
6300 | Authentication failed (PIN verification with no retry counter). |
63Cx | PIN verification failed; x tries remaining. |
6700 | Wrong length. |
6982 | Security status not satisfied. |
6985 | Conditions of use not satisfied. |
6A82 | File or application not found. |
6A86 | Incorrect P1 / P2. |
6D00 | Instruction code not supported. |
6E00 | Class not supported. |
Tips & Troubleshooting
- No serial port listed — The firmware has to boot before the device appears. Wait for
/dev/cu.usbmodemXXXX, then press Rescan. - No PC/SC readers detected — Check the PC/SC service is running and no other smartcard application is holding the reader exclusively.
- ATR mismatch — Some terminals validate the ATR against a list. Set an ATR override on Mode & Transport to match the card you are impersonating.
- Terminal times out — A passive session answers as fast as the firmware relays it; if the terminal still gives up, check the wire capture rather than the runtime.
- Plan passes in loopback but fails on hardware — Loopback and the hardware modes share the EMV runtime, so the difference is on the wire. Wire Sniff is the tab for that.
Try it on your own cards
Free and open source. Download the studio and run this simulator on your desk in minutes.
✦ Pro
Testing with a team, or certifying with a scheme? Pro raises the CPS ceiling, unlocks the full algorithm set and deep simulator tweaks, plus hosted endpoints and priority support.
Register for Pro