EMV Testing Tools (Legal and Secure)

[Cloned Boy]

If you're researching EMV cards for educational or professional purposes, here are proven, virus-free tools used by developers, pentesters, and payment processors.

1. pyApduTool​

What it is used for: Analysis of APDU commands (data exchange with the chip).
Features:

• Works with JavaCard, EMV, NFC.
• Allows sending RAW-APDU (e.g. 00A4040000 for application selection).
• Suitable for studying the structure of the map (reading PSE, AID, AFL).

Installation:

git clone https://github.com/martinpaljak/pyApduTool
pip install -r requirements.txt

Example command:

python pyapdutool.py -d "OMNIKEY 3021" -s "00A4040007A0000000041010"

(Reading Mastercard EMV application data)

2. JCIDE​

What it is for: Developing and testing JavaCard applets.
Features:

• JavaCard emulator (without real chip).
• Support for CAP files (compiled applets).
• Debugging cryptographic operations (AES, RSA, 3DES).

Link: https://www.javacardos.com/javacardforum/viewforum.php?f=3

Usage example:

1. Download a CAP file (eg EMV emulator).
2. Start debugging via JCIDE Debugger .
3. Check the responses to the SELECT, GET PROCESSING OPTIONS commands.

3. GlobalPlatform Pro (gp.exe)​

What it does: Manage Secure Element (SE) and SIM cards.
Features:

• Works with EMV, JavaCard, NFC chips.
• Supports:
  • Installing/removing applets.
  • Export keys (if allowed by card policy).
  • ATR and file system analysis.

Installation:

git clone https://github.com/martinpaljak/GlobalPlatformPro
cd GlobalPlatformPro
./gradlew install

Example command:

gp --list

(Shows all apps on the map)

4. Create a Framework​

What it does: EMV malware analysis (in a sandbox).
Features:

• BIOS/UEFI emulation for low-level attack analysis.
• Support for APDU injection.

Example:

from qiling import Qiling

ql = Qiling(["malware.exe"], rootfs="/tmp/rootfs")
ql.run()

5. Legic Advant (for MIFARE/NFC)​

What it is for: Contactless card testing (similar to EMV for RFID).
Functions:

• Reading/writing dumps.
• Cryptography analysis (Legic Prime, AES).

Where can I get test cards?​

For legal experiments use:

• EMVCo Test Cards (available through affiliate programs).
• Fime/UL Validator (for POS terminal certification).
• JavaCard Developer Kits (emulators).

Important!​

• These tools are not for cloning, but for studying EMV security.
• Genuine EMV cards cannot be cloned without access to the ICC Private Key.
• Penetration testing of payment systems requires an agreement with the bank (PCI DSS).

Want a case study (for example, how to emulate an EMV transaction using JCIDE)? Or are you interested in methods of protection against skimming?