源码对照：4.2.10.2.4
ES10b 下载准备异常用例 / TC_eUICC_ES10b.PrepareDownloadErrorCases
左侧为人工切片入口（-man，来自 原料/切片 的最小可执行脚本），右侧为 Cas 盲生成入口（-cas，仅依据规范生成）。文件按原始编码（多为 GBK）解码为 UTF-8 显示，行号自 1 起；字节级原文与 sha256 见两侧脚本包。完整 unified diff 见本页底部折叠区，以及 报告原文 §4。
-man 入口
Import/TestCase_SGP_23.js
325 行 / 13453 字符 / gb18030
-cas 入口
TC_eUICC_ES10b_PrepareDownloadErrorCases/Import/TC_eUICC_ES10b_PrepareDownloadErrorCases.js
762 行 / 76894 字符 / gb18030
默认折行显示长行；取消勾选可横向滚动查看原始行宽
-man 人工切片Import/TestCase_SGP_23.js325 行 / 13453 字符 / gb18030入口函数 @L3
1// slice of Import\TestCase_SGP_23.js - cases: TC_eUICC_ES10b_PrepareDownloadErrorCases_01_Error_No_Hashed_Confirmation_Code_but_with_Confirmation_Code_Required_Flag_set_to_TRUE + TC_eUICC_ES10b_PrepareDownloadErrorCases_02_Error_With_incorrect_CERT_DPpb_ECDSA + TC_eUICC_ES10b_PrepareDownloadErrorCases_03_Error_CERT_DPpb_ECDSA_and_CERT_DPauth_ECDSA_not_belonging_to_the_same_entity + TC_eUICC_ES10b_PrepareDownloadErrorCases_04_Error_With_invalid_SM_DP_signature + TC_eUICC_ES10b_PrepareDownloadErrorCases_05_Error_With_invalid_Transaction_ID + TC_eUICC_ES10b_PrepareDownloadErrorCases_06_Error_SM_DP_has_not_been_previously_authenticated + TC_eUICC_ES10b_PrepareDownloadErrorCases_07_Error_Unsupported_curve + TC_eUICC_ES10b_PrepareDownloadErrorCases_08_Error_Invalid_Certificate_Role_OID (extracted verbatim)
2
3function TC_eUICC_ES10b_PrepareDownloadErrorCases_01_Error_No_Hashed_Confirmation_Code_but_with_Confirmation_Code_Required_Flag_set_to_TRUE()
4{
5 tracenamestr = "执行PrepareDownload，不带hashCc，但ccRequiredFlag为TRUE";
6 curDis.TraceStart(sno++,tracenamestr);
7
8 curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
9 Ini_powerOn_eUICC_LPAe_not_activate();
10
11 curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
12 TS_MANAGE_CHANNEL_OPEN();
13
14 curLogicChannel = 1;
15
16 curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
17 TS_SELECT("Select ISD",ISD_R_AID,"9000");
18
19 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
20 var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL1_DATA);
21 Profile_load_procedure.ICCID = ICCID_OP_PROF1;
22 Profile_load_procedure.ES10b_GetEUICCInfo1();
23
24
25 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
26 Profile_load_procedure.ES10b_GetEUICCChallenge();
27
28
29 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
30 Profile_load_procedure.ES10b_AuthenticateServer();
31
32 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest,确认码标记为true，但不包含Confirmation Code；");
33 Profile_load_procedure.ccRequiredFlag = "FF";
34 Profile_load_procedure.PrepareDownloadisErrorTest = true;
35 Profile_load_procedure.preparedownloadErrorCode = DownloadErrorCode.undefinedError;
36 Profile_load_procedure.ES10b_PrepareDownload();
37
38 RecoverCard();
39}
40
41function TC_eUICC_ES10b_PrepareDownloadErrorCases_02_Error_With_incorrect_CERT_DPpb_ECDSA()
42{
43 tracenamestr = "执行PrepareDownload，使用不正确的CERT.DPpb.ECDSA（即无效签名）";
44 curDis.TraceStart(sno++,tracenamestr);
45
46 curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
47 Ini_powerOn_eUICC_LPAe_not_activate();
48
49 curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
50 TS_MANAGE_CHANNEL_OPEN();
51
52 curLogicChannel = 1;
53
54 curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
55 TS_SELECT("Select ISD",ISD_R_AID,"9000");
56
57 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
58 var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL1_DATA);
59 Profile_load_procedure.ICCID = ICCID_OP_PROF1;
60 Profile_load_procedure.ES10b_GetEUICCInfo1();
61
62
63 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
64 Profile_load_procedure.ES10b_GetEUICCChallenge();
65
66
67 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
68 Profile_load_procedure.ES10b_AuthenticateServer();
69
70 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest，使用错误的CERT.DPpb.ECDSA（比如签名错）；");
71 Profile_load_procedure.DPbpInforObj.Cert = CERT_S_SM_DPpb_INV_SIGN_NIST;
72 Profile_load_procedure.PrepareDownloadisErrorTest = true;
73 Profile_load_procedure.preparedownloadErrorCode = DownloadErrorCode.invalidCertificate;
74 Profile_load_procedure.ES10b_PrepareDownload();
75
76 RecoverCard();
77}
78
79function TC_eUICC_ES10b_PrepareDownloadErrorCases_03_Error_CERT_DPpb_ECDSA_and_CERT_DPauth_ECDSA_not_belonging_to_the_same_entity()
80{
81 tracenamestr = "执行PrepareDownload，CERT.DPpb.ECDSA和CERT.DPauth.ECDSA不属于同一实体";
82 curDis.TraceStart(sno++,tracenamestr);
83
84 curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
85 Ini_powerOn_eUICC_LPAe_not_activate();
86
87 curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
88 TS_MANAGE_CHANNEL_OPEN();
89
90 curLogicChannel = 1;
91
92 curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
93 TS_SELECT("Select ISD",ISD_R_AID,"9000");
94
95 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
96
97 var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL1_DATA);
98 Profile_load_procedure.ICCID = ICCID_OP_PROF1;
99 Profile_load_procedure.ES10b_GetEUICCInfo1();
100
101 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
102 Profile_load_procedure.ES10b_GetEUICCChallenge();
103
104 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
105 Profile_load_procedure.ES10b_AuthenticateServer();
106
107 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest，使用错误的CERT.DPpb.ECDSA（错误的OID）；");
108 Profile_load_procedure.DPbpInforObj.Cert = CERT_S_SM_DP2pb_ECDSA_NIST;
109 Profile_load_procedure.PrepareDownloadisErrorTest = true;
110 Profile_load_procedure.preparedownloadErrorCode = DownloadErrorCode.invalidCertificate;
111 Profile_load_procedure.ES10b_PrepareDownload();
112
113 RecoverCard();
114
115}
116
117function TC_eUICC_ES10b_PrepareDownloadErrorCases_04_Error_With_invalid_SM_DP_signature()
118{
119 tracenamestr = "执行PrepareDownload，SM-DP+签名无效";
120 curDis.TraceStart(sno++,tracenamestr);
121
122 curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
123 Ini_powerOn_eUICC_LPAe_not_activate();
124
125 curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
126 TS_MANAGE_CHANNEL_OPEN();
127
128 curLogicChannel = 1;
129
130 curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
131 TS_SELECT("Select ISD",ISD_R_AID,"9000");
132
133 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
134
135 var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL1_DATA);
136 Profile_load_procedure.ICCID = ICCID_OP_PROF1;
137 Profile_load_procedure.ES10b_GetEUICCInfo1();
138
139 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
140 Profile_load_procedure.ES10b_GetEUICCChallenge();
141
142 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
143 Profile_load_procedure.ES10b_AuthenticateServer();
144
145 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest，使用无效的SM-DP+签名；");
146 Profile_load_procedure.DPbpInforObj.D_key = curStrHandle.RandHexStr(32);
147 Profile_load_procedure.PrepareDownloadisErrorTest = true;
148 Profile_load_procedure.preparedownloadErrorCode = DownloadErrorCode.invalidSignature;
149 Profile_load_procedure.ES10b_PrepareDownload();
150
151 RecoverCard();
152
153}
154
155function TC_eUICC_ES10b_PrepareDownloadErrorCases_05_Error_With_invalid_Transaction_ID()
156{
157 tracenamestr = "执行PrepareDownload，Transaction ID无效";
158 curDis.TraceStart(sno++,tracenamestr);
159
160 curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
161 Ini_powerOn_eUICC_LPAe_not_activate();
162
163 curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
164 TS_MANAGE_CHANNEL_OPEN();
165
166 curLogicChannel = 1;
167
168 curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
169 TS_SELECT("Select ISD",ISD_R_AID,"9000");
170
171 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
172
173 var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL1_DATA);
174 Profile_load_procedure.ICCID = ICCID_OP_PROF1;
175 Profile_load_procedure.ES10b_GetEUICCInfo1();
176
177 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
178 Profile_load_procedure.ES10b_GetEUICCChallenge();
179
180 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
181 Profile_load_procedure.ES10b_AuthenticateServer();
182
183 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest，使用无效的Transaction ID；");
184 Profile_load_procedure.transactionId = curStrHandle.RandHexStr(16);
185 Profile_load_procedure.PrepareDownloadisErrorTest = true;
186 Profile_load_procedure.preparedownloadErrorCode = DownloadErrorCode.invalidTransactionId;
187 Profile_load_procedure.ES10b_PrepareDownload();
188
189 RecoverCard();
190}
191
192function TC_eUICC_ES10b_PrepareDownloadErrorCases_06_Error_SM_DP_has_not_been_previously_authenticated()
193{
194 tracenamestr = "执行PrepareDownload，SM-DP+未经过认证";
195 curDis.TraceStart(sno++,tracenamestr);
196
197 curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
198 Ini_powerOn_eUICC_LPAe_not_activate();
199
200 curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
201 TS_MANAGE_CHANNEL_OPEN();
202
203 curLogicChannel = 1;
204
205 curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
206 TS_SELECT("Select ISD",ISD_R_AID,"9000");
207
208 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
209
210 var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL1_DATA);
211 Profile_load_procedure.ICCID = ICCID_OP_PROF1;
212 Profile_load_procedure.ES10b_GetEUICCInfo1();
213
214 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
215 Profile_load_procedure.ES10b_GetEUICCChallenge();
216
217 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
218 Profile_load_procedure.ES10b_AuthenticateServer();
219
220 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest；");
221 Profile_load_procedure.ES10b_PrepareDownload();
222
223 curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
224 TS_SELECT("Select ISD",ISD_R_AID,"9000");
225
226 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
227
228 Profile_load_procedure.ICCID = ICCID_OP_PROF1;
229 Profile_load_procedure.ES10b_GetEUICCInfo1();
230
231 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
232 Profile_load_procedure.ES10b_GetEUICCChallenge();
233
234 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest,前面没有安全认证；");
235 Profile_load_procedure.transactionId = curStrHandle.RandHexStr(16);
236 Profile_load_procedure.PrepareDownloadisErrorTest = true;
237 Profile_load_procedure.preparedownloadErrorCode = DownloadErrorCode.noSessionContext;
238 Profile_load_procedure.ES10b_PrepareDownload();
239
240 RecoverCard();
241
242}
243
244function TC_eUICC_ES10b_PrepareDownloadErrorCases_07_Error_Unsupported_curve()
245{
246 if(!Card_Have_ECC_Cert)
247 return;
248
249 tracenamestr = "执行PrepareDownload，使用不支持的曲线";
250 curDis.TraceStart(sno++,tracenamestr);
251
252 curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
253 Ini_powerOn_eUICC_LPAe_not_activate();
254
255 curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
256 TS_MANAGE_CHANNEL_OPEN();
257
258 curLogicChannel = 1;
259
260 curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
261 TS_SELECT("Select ISD",ISD_R_AID,"9000");
262
263 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
264
265 var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL1_DATA);
266 Profile_load_procedure.ICCID = ICCID_OP_PROF1;
267
268 pkId_CI_ForVerification = pkId_CI_ECDSA_NIST;
269 pkId_CI_ForSigning = pkId_CI_ECDSA_NIST;
270
271 Profile_load_procedure.ES10b_GetEUICCInfo1();
272
273 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
274 Profile_load_procedure.ES10b_GetEUICCChallenge();
275
276 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
277 Profile_load_procedure.ES10b_AuthenticateServer();
278
279 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest，证书使用不支持的曲线算法；");
280 Profile_load_procedure.DPbpInforObj.Cert = CERT_S_SM_DPpb_INV_CURVE_NIST192;
281 Profile_load_procedure.PrepareDownloadisErrorTest = true;
282 Profile_load_procedure.preparedownloadErrorCode = DownloadErrorCode.unsupportedCurve;
283 Profile_load_procedure.ES10b_PrepareDownload();
284
285 RecoverCard();
286
287}
288
289function TC_eUICC_ES10b_PrepareDownloadErrorCases_08_Error_Invalid_Certificate_Role_OID()
290{
291 tracenamestr = "执行PrepareDownload，使用无效的证书Role OID";
292 curDis.TraceStart(sno++,tracenamestr);
293
294 curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
295 Ini_powerOn_eUICC_LPAe_not_activate();
296
297 curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
298 TS_MANAGE_CHANNEL_OPEN();
299
300 curLogicChannel = 1;
301
302 curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
303 TS_SELECT("Select ISD",ISD_R_AID,"9000");
304
305 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
306
307 var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL1_DATA);
308 Profile_load_procedure.ICCID = ICCID_OP_PROF1;
309 Profile_load_procedure.ES10b_GetEUICCInfo1();
310
311 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
312 Profile_load_procedure.ES10b_GetEUICCChallenge();
313
314 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
315 Profile_load_procedure.ES10b_AuthenticateServer();
316
317 curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest，证书使用无效的Certificate Role OID；");
318 Profile_load_procedure.DPbpInforObj.Cert = CERT_S_SM_DPauth_ECDSA_NIST;
319 Profile_load_procedure.PrepareDownloadisErrorTest = true;
320 Profile_load_procedure.preparedownloadErrorCode = DownloadErrorCode.invalidCertificate;
321 Profile_load_procedure.ES10b_PrepareDownload();
322
323 RecoverCard();
324}
325
-cas 盲生成TC_eUICC_ES10b_PrepareDownloadErrorCases/Import/TC_eUICC_ES10b_PrepareDownloadErrorCases.js762 行 / 76894 字符 / gb18030入口函数 @L16
1// Author: 卡思Cas智能体
2// Date: 20261005-152741
3// Function: （purpose 原文未由 SGP.23 该 TC 提供，corpus vacuum 登记）TC_eUICC_ES10b.PrepareDownloadErrorCases，Test Sequence #01-#08 Error (all 8 sequences)，适用性 M。
4// Test points: ICH-SEQ06-IC1-K1-C1 ATR_present；ICH-SEQ06-IC1-K2-C2 FCP_Template
5// ICH-SEQ06-IC1-K2-C4 SW；ICH-SEQ06-IC1-K3-C4 SW；ICH-SEQ06-IC1-K4-C4 final SW
6// ICH-SEQ06-IC2-K1-C4 SW；ICH-SEQ06-IC2-K1-C3 CHANNEL_NUMBER extracted；ICH-SEQ06-IC2-K2-C4 SW
7// S1-C2 R_PREP_DOWNLOAD response structure；S2-C1 SW；S2-C2 R_PREP_DOWNLOAD response structure
8// S3-C1 SW；S3-C2 R_PREP_DOWNLOAD response structure；S4-C1 SW
9// S4-C2 R_PREP_DOWNLOAD response structure；S5-C1 SW；S5-C2 R_PREP_DOWNLOAD response structure
10// S6-C1 SW；S6-C2 R_EUICC_INFO1 outer tag；S6-C2 R_EUICC_INFO1 required members present；S7-C1 SW
11// S7-C2 R_PREP_DOWNLOAD response structure；S8-C1 SW；S8-C2 R_PREP_DOWNLOAD response structure
12// S9-C1 SW；S9-C2 R_PREP_DOWNLOAD response structure
13// 本函数由 CaseIR 4.2.10.2.4 编译生成（fullwave-blindgen-live-70-W1-laneA2，SGP.23 v1.16 × SGP.22 v2.7）：字节权威=CaseIR，非誊录黄金脚本。
14// Value-free template: every data byte is injected from CaseIR fields; no scaffold globals (see docs/speconly/compile-symbol-migration.md).
15// 适用性 M：编译期门，运行时由 harness 环境前置承担。
16function TC_eUICC_ES10b_PrepareDownloadErrorCases_01_08_Error_all_8_sequences() {
17 var bind = curBind;
18 // TC-GEN-1 eUICC: The PROFILE_OPERATIONAL1 is not loaded on the eUICC.: declared unexpanded (non-PROC row or K corpus vacuum; see CaseIR open_items).
19 // TC-GEN-2 eUICC: S_Device 与 eUICC 通信已初始化，S_LPAd 已选 ISD-R；eUICC 与 S_SM-DP+ 已成功执行 Common Mutual Authentication；#GET_EUICC_INFO1、#GET_EUICC_CHALLENGE、#AUTHENTICATE_SMDP 已发送；签名与验证选用同一 GSMA CI。: declared unexpanded (non-PROC row or K corpus vacuum; see CaseIR open_items).
20 // SEQ01-IC1 <S_HASHED_CC> = MTD_GENERATE_HASHED_CC(#CONFIRMATION_CODE1, <S_TRANSACTION_ID>)（测试工具侧计算，H_annexC1_methods 表1228）: declared unexpanded (non-PROC row or K corpus vacuum; see CaseIR open_items).
21 // SEQ06-IC-T1 eUICC: No Common Mutual Authentication procedure has been executed between the eUICC and the S_SM-DP+（覆盖本 TC 最后一条 general initial condition）: declared unexpanded (non-PROC row or K corpus vacuum; see CaseIR open_items).
22
23 // IC head inline (initial_conditions → PROC_EUICC_INITIALIZATION_SEQUENCE, K row 1)：RESET（K 语料机械展开）
24 var s10 = bind.resetAndAtr();
25 bind.checkData("ICH-SEQ06-IC1-K1-C1 ATR_present", "1", s10.atr_hex !== "" ? "1" : "0");
26
27 // IC head inline (initial_conditions → PROC_EUICC_INITIALIZATION_SEQUENCE, K row 2)：SELECT_MF（K 语料机械展开）
28 // FCP outer tag not materialized from clause: tag-face asserted only when corpus fixes the tag byte (e.g. TS 102 221 FCP '62').
29 var s11 = bind.sendApdu("00", "A4", "00", "04", "3F00", "00", "9000");
30 bind.checkData("ICH-SEQ06-IC1-K2-C2 FCP_Template", "1", s11.resp.length > 0 ? "1" : "0");
31 bind.checkData("ICH-SEQ06-IC1-K2-C4 SW", "9000", s11.sw);
32
33 // IC head inline (initial_conditions → PROC_EUICC_INITIALIZATION_SEQUENCE, K row 3)：TERMINAL_CAPABILITY_LPAd（K 语料机械展开）
34 var s12 = bind.sendApdu("80", "AA", "00", "00", "A9058100830107", null, "9000");
35 bind.checkData("ICH-SEQ06-IC1-K3-C4 SW", "9000", s12.sw);
36
37 // IC head inline (initial_conditions → PROC_EUICC_INITIALIZATION_SEQUENCE, K row 4)：TERMINAL_PROFILE（K 语料机械展开）
38 var steady13 = bind.runToSteadyState(function () {
39 return bind.sendTerminalProfile("FFFFFFFF7F9D00DFBF00001FE2000000C7EB0000000168005000000000000200", "9000");
40 });
41 bind.checkData("ICH-SEQ06-IC1-K4-C4 final SW", "9000", steady13.final.sw);
42
43 // IC head inline (initial_conditions → PROC_OPEN_LOGICAL_CHANNEL_AND_SELECT_ISDR, K row 1)：MANAGE_CHANNEL_OPEN（K 语料机械展开）
44 // CHANNEL_NUMBER extraction and dynamic CLA rebinding are CasBind internal state (chaining rule; no generated-code re-implementation).
45 var s14 = bind.manageChannelOpen("9000");
46 bind.checkData("ICH-SEQ06-IC2-K1-C4 SW", "9000", s14.sw);
47 bind.checkData("ICH-SEQ06-IC2-K1-C3 CHANNEL_NUMBER extracted", "1", s14.chan !== null ? "1" : "0");
48
49 // IC head inline (initial_conditions → PROC_OPEN_LOGICAL_CHANNEL_AND_SELECT_ISDR, K row 2)：MTD_SELECT（K 语料机械展开）
50 // CLA = bound channel (cla_rule) and <L> length binding are CasBind internal state (chaining rule; no generated-code re-implementation).
51 var s15 = bind.sendApdu(null, "A4", "04", "00", "A0000005591010FFFFFFFF8900000100", null, "9000");
52 // MTD_SELECT expected face is SW-only (K Annex C.2 open-channel procedure step 2: no FCI content assertion in corpus); no fabricated template parse.
53 bind.checkData("ICH-SEQ06-IC2-K2-C4 SW", "9000", s15.sw);
54
55 // 步骤 1：SEQ01-1] MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ31_130, RQ31_135, RQ31_136, RQ57_031, RQ57_036, RQ57_037, RQ57_038）
56 // PREP_DOWNLOAD 运行时绑定（PREP_DOWNLOAD_INVALID_CC；SGP.22 §5.7.5 PrepareDownloadRequest=BF21 成员序 smdpSigned2(30) → smdpSignature2(5F37) → smdpCertificate(30)）：
57 // 无前序 cma_decl 源（GIC CMA）：transactionId 运行时随机（G Annex B <S_TRANSACTION_ID>，vendor RandHexStr 机制）；euiccSignature1 无源→空串，诚实守卫拦截发送（不硬造签名明文）。
58 // 错误注入变体（I_annexD3_es10x）：cert＝SGP.26 v1.5 变体物料声明面（input/PREP_DOWNLOAD_VARIANT_MATERIALS.json，sha256 锚编译期已核）；ccRequiredFlag/签名形态按变体闭集定义。
59 var pd1Certs = ["308201DFA00302010202020101300A06082A8648CE3D04030230443110300E06035504030C07546573742043493111300F060355040B0C0854455354434552543110300E060355040A0C0752535054455354310B3009060355040613024954301E170D3230303430313038333434355A170D3330303333303038333434355A3025310D300B060355040A0C0441434D453114301206035504030C0B5445535420534D2D44502B3059301306072A8648CE3D020106082A8648CE3D03010703420004104C2AE3D02DEF9C979261A7C6710076B970721D0955A2644AE05FAE4BC2314E5DC09F6BF0118026165342E212318775E365F3B57325373066B9906E0BD1388DA381DF3081DC301F0603551D23041830168014F54172BDF98A95D65CBEB88A38A1C11D800A85C3301D0603551D0E04160414E6EAF71EE0FB9430ECCD1EBB421F881437C13263300E0603551D1104073005880388370A300E0603551D0F0101FF04040302078030170603551D200101FF040D300B300906076781120102010530610603551D1F045A3058302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D412E63726C302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D422E63726C300A06082A8648CE3D040302034800304502203EA51B0129FC11E843C38C8CB104244CCF92D8DDBCD4D5F9DAFD0AEF700A9B1C022100FEF382FF71FEFC58168A3607D5685DB7CB48F6B434261891496385BCD6B5857A", "308201E0A00302010202020101300A06082A8648CE3D04030230443110300E06035504030C07546573742043493111300F060355040B0C0854455354434552543110300E060355040A0C0752535054455354310B3009060355040613024954301E170D3230303430313038333434365A170D3330303333303038333434365A3025310D300B060355040A0C0441434D453114301206035504030C0B5445535420534D2D44502B305A301406072A8648CE3D020106092B240303020801010703420004893253ECC94C51DF4FEE6E0DB0951CFC65627481B5418E557069F487FAA15466A5CB8E10CC2B38099CF2A929F7F82DAC065126B71D0640961DB7F91A49E95612A381DF3081DC301F0603551D23041830168014C0BC70BA36929D43B467FF57570530E57AB8FCD8301D0603551D0E04160414A8C68DF449EB71EC723EAC132E40E4B6F54644FE300E0603551D1104073005880388370A300E0603551D0F0101FF04040302078030170603551D200101FF040D300B300906076781120102010530610603551D1F045A3058302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D412E63726C302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D422E63726C300A06082A8648CE3D04030203470030440220244ED22119D00D49D9EA4AC5D9A6D925FACFCD1998A96448A870CE47FE5E470E02206C4BC7223C925D548DDDD3D8DDD81118DA202973311F6012BB0A20E6DD2D7B7B"];
60 var pd1Sks = ["DCD694B778957E8E9ADDBDD94433E9EF8F73D11E491C48D425A38A9491BD3BED", "75FF322F416616DAE1A484EF71D4874FB0DF3295FD35C2CBA489FBB2BB9C7BF6"];
61 var pd1Tid = "";
62 for (var pd1Ri = 0; pd1Ri < 16; pd1Ri++) {
63 pd1Tid += bind.engine.Hex(Math.round(255 * Math.random()), 2);
64 }
65 var pd1Sel = 0;
66 var pd1Sig1 = "";
67 var pd1Dps = [["FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF", "FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFC", "5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B", "046B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C2964FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5", "FFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551"], ["A9FB57DBA1EEA9BC3E660A909D838D726E3BF623D52620282013481D1F6E5377", "7D5A0975FC2C3057EEF67530417AFFE7FB8055C126DC5C6CE94A4B44F330B5D9", "26DC5C6CE94A4B44F330B5D9BBD77CBF958416295CF7E1CE6BCCDC18FF8C07B6", "048BD2AEB9CB7E57CB2C4B482FFC81B7AFB9DE27E1E3BD23C23A4453BD9ACE3262547EF835C3DAC4FD97F8461A14611DC9C27745132DED8E545C1D54C72F046997", "A9FB57DBA1EEA9BC3E660A909D838D718C397AA3B561A6F7901E0E82974856A7"]];
68 if (pd1Sel < 0 || pd1Sig1 === "") {
69 // fail-closed 诚实面：CMA 运行时操作数缺席（CMA 失败/未执行）→ BF21 不发送（前序 CMA 步断言面已计错，本步不伪造通过）。
70 bind.checkData("S1-C2 R_PREP_DOWNLOAD response structure", "1", "pd1_not_executed:cma_operands_absent");
71 } else {
72 bind.engine.InitEccDomainParams(pd1Dps[pd1Sel][0], pd1Dps[pd1Sel][1], pd1Dps[pd1Sel][2], pd1Dps[pd1Sel][3], pd1Dps[pd1Sel][4], 1);
73 var pd1S2 = BindEs10xSingleRequest.buildTlv("30",
74 BindEs10xSingleRequest.buildTlv("80", pd1Tid)
75 + BindEs10xSingleRequest.buildTlv("01", "FF"));
76 var pd1Sgn = "";
77 while (pd1Sgn.length != 2 * pd1Sks[pd1Sel].length) {
78 bind.engine.SleepTime(2000);
79 pd1Sgn = bind.engine.EccSignData(pd1Sks[pd1Sel], pd1S2 + BindEs10xSingleRequest.buildTlv("5F37", pd1Sig1), 33);
80 }
81 var pd1Req = BindEs10xSingleRequest.buildTlv("BF21",
82 pd1S2
83 + BindEs10xSingleRequest.buildTlv("5F37", pd1Sgn)
84 + BindEs10xSingleRequest.buildTlv("30", pd1Certs[pd1Sel]));
85 var pd1Run = BindEs10xSingleRequest.runTransport(bind.sendApdu,
86 {cla: "", ins: "E2", p1: "91", p2: "00", data: pd1Req,
87 le: "00", blockSize: 255, blockSw: "9000", final_sw: "9000"});
88 var pd1Sw = (pd1Run.final && pd1Run.final.sw) ? pd1Run.final.sw : "transport_error";
89 // euiccOtpk（5F49）运行时提取面登记：响应 ok 分支 euiccSigned2 成员（BF21 A0 30 5F49 路径），供后续步（RETRY 形 bppEuiccOtpk/BPP 装配）消费。
90 var pd1Otpk = "";
91 if (pd1Run.final && pd1Run.final.resp) {
92 var pd1L1 = BindEs10xSingleRequest.parseBerTlv(pd1Run.final.resp);
93 for (var pd1I1 = 0; pd1I1 < pd1L1.length && pd1Otpk === ""; pd1I1++) {
94 if (pd1L1[pd1I1].tag !== "BF21") continue;
95 var pd1L2 = BindEs10xSingleRequest.parseBerTlv(pd1L1[pd1I1].value);
96 for (var pd1I2 = 0; pd1I2 < pd1L2.length && pd1Otpk === ""; pd1I2++) {
97 if (pd1L2[pd1I2].tag !== "A0") continue;
98 var pd1L3 = BindEs10xSingleRequest.parseBerTlv(pd1L2[pd1I2].value);
99 for (var pd1I3 = 0; pd1I3 < pd1L3.length && pd1Otpk === ""; pd1I3++) {
100 if (pd1L3[pd1I3].tag !== "30") continue;
101 var pd1L4 = BindEs10xSingleRequest.parseBerTlv(pd1L3[pd1I3].value);
102 for (var pd1I4 = 0; pd1I4 < pd1L4.length; pd1I4++) {
103 if (pd1L4[pd1I4].tag === "5F49") pd1Otpk = pd1L4[pd1I4].value;
104 }
105 }
106 }
107 }
108 }
109 }
110 // R_PREP_DOWNLOAD 响应结构（S22_prep_dl §5.7.5 行 77-111：外层 BF21 CHOICE；downloadResponseError A1{transactionId 80, downloadErrorCode 02}）：运行时域，仅结构与在场性断言。
111 var pd1RSR = (pd1Run.final && pd1Run.final.resp) ? BindEs10xSingleRequest.parseBerTlv(pd1Run.final.resp) : [];
112 var pd1RSOuter = pd1RSR.length === 1 ? pd1RSR[0].tag : "absent";
113 var pd1RSBr = pd1RSR.length === 1 ? BindEs10xSingleRequest.parseBerTlv(pd1RSR[0].value) : [];
114 var pd1RSA0 = false, pd1RSA1 = false, pd1RSCk = [];
115 for (var pd1RSi = 0; pd1RSi < pd1RSBr.length; pd1RSi++) {
116 if (pd1RSBr[pd1RSi].tag === "A0") { pd1RSA0 = true; pd1RSCk = BindEs10xSingleRequest.parseBerTlv(pd1RSBr[pd1RSi].value); }
117 if (pd1RSBr[pd1RSi].tag === "A1") { pd1RSA1 = true; pd1RSCk = BindEs10xSingleRequest.parseBerTlv(pd1RSBr[pd1RSi].value); }
118 }
119 var pd1RS30 = false, pd1RS5F37 = false, pd1RS80 = false, pd1RS02 = false;
120 for (var pd1RSj = 0; pd1RSj < pd1RSCk.length; pd1RSj++) {
121 if (pd1RSCk[pd1RSj].tag === "30") pd1RS30 = true;
122 if (pd1RSCk[pd1RSj].tag === "5F37") pd1RS5F37 = true;
123 if (pd1RSCk[pd1RSj].tag === "80") pd1RS80 = true;
124 if (pd1RSCk[pd1RSj].tag === "02") pd1RS02 = true;
125 }
126 var pd1RS5F49 = false;
127 if (pd1RS30) {
128 for (var pd1RSk = 0; pd1RSk < pd1RSCk.length; pd1RSk++) {
129 if (pd1RSCk[pd1RSk].tag !== "30") continue;
130 var pd1RSU = BindEs10xSingleRequest.parseBerTlv(pd1RSCk[pd1RSk].value);
131 for (var pd1RSm = 0; pd1RSm < pd1RSU.length; pd1RSm++) {
132 if (pd1RSU[pd1RSm].tag === "5F49") pd1RS5F49 = true;
133 if (pd1RSU[pd1RSm].tag === "80") pd1RS80 = true;
134 }
135 }
136 }
137 bind.checkData("S1-C2 R_PREP_DOWNLOAD response structure" + " (downloadResponseError or no data)", "1", (pd1RSOuter === "absent" || (pd1RSA1 && pd1RS80 && pd1RS02)) ? "1" : "0");
138 // S1-C1: binding:prep_download_variant_error_status_disjunctive(error-swp|downloadResponseError;I_annexD3) (check_attestation)
139 // S1-C3: binding:prep_download_variant_error_no_response(ANY_SW_IN_ERROR;G-annexB) (check_attestation)
140
141 // 步骤 2：SEQ02-1] MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ31_130, RQ31_131, RQ31_136, RQ57_027, RQ57_030, RQ57_031, RQ57_036, RQ57_037, RQ57_038, RQ45_006, RQ45_026_1, RQ45_026, RQ45_028）
142 // PREP_DOWNLOAD 运行时绑定（PREP_DOWNLOAD_INV_CERT；SGP.22 §5.7.5 PrepareDownloadRequest=BF21 成员序 smdpSigned2(30) → smdpSignature2(5F37) → smdpCertificate(30)）：
143 // 无前序 cma_decl 源（GIC CMA）：transactionId 运行时随机（G Annex B <S_TRANSACTION_ID>，vendor RandHexStr 机制）；euiccSignature1 无源→空串，诚实守卫拦截发送（不硬造签名明文）。
144 // 错误注入变体（I_annexD3_es10x）：cert＝SGP.26 v1.5 变体物料声明面（input/PREP_DOWNLOAD_VARIANT_MATERIALS.json，sha256 锚编译期已核）；ccRequiredFlag/签名形态按变体闭集定义。
145 var pd2Certs = ["308201DFA00302010202020101300A06082A8648CE3D04030230443110300E06035504030C07546573742043493111300F060355040B0C0854455354434552543110300E060355040A0C0752535054455354310B3009060355040613024954301E170D3230303430313038333434355A170D3330303333303038333434355A3025310D300B060355040A0C0441434D453114301206035504030C0B5445535420534D2D44502B3059301306072A8648CE3D020106082A8648CE3D03010703420004104C2AE3D02DEF9C979261A7C6710076B970721D0955A2644AE05FAE4BC2314E5DC09F6BF0118026165342E212318775E365F3B57325373066B9906E0BD1388DA381DF3081DC301F0603551D23041830168014F54172BDF98A95D65CBEB88A38A1C11D800A85C3301D0603551D0E04160414E6EAF71EE0FB9430ECCD1EBB421F881437C13263300E0603551D1104073005880388370A300E0603551D0F0101FF04040302078030170603551D200101FF040D300B300906076781120102010530610603551D1F045A3058302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D412E63726C302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D422E63726C300A06082A8648CE3D040302034800304502203EA51B0129FC11E843C38C8CB104244CCF92D8DDBCD4D5F9DAFD0AEF71200A256211089EF382FF71FEFC58168A3607D5685DB7CB48F6B434261891496385BCD6B5857A", "308201E0A00302010202020101300A06082A8648CE3D04030230443110300E06035504030C07546573742043493111300F060355040B0C0854455354434552543110300E060355040A0C0752535054455354310B3009060355040613024954301E170D3230303430313038333434365A170D3330303333303038333434365A3025310D300B060355040A0C0441434D453114301206035504030C0B5445535420534D2D44502B305A301406072A8648CE3D020106092B240303020801010703420004893253ECC94C51DF4FEE6E0DB0951CFC65627481B5418E557069F487FAA15466A5CB8E10CC2B38099CF2A929F7F82DAC065126B71D0640961DB7F91A49E95612A381DF3081DC301F0603551D23041830168014C0BC70BA36929D43B467FF57570530E57AB8FCD8301D0603551D0E04160414A8C68DF449EB71EC723EAC132E40E4B6F54644FE300E0603551D1104073005880388370A300E0603551D0F0101FF04040302078030170603551D200101FF040D300B300906076781120102010530610603551D1F045A3058302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D412E63726C302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D422E63726C300A06082A8648CE3D04030203470030440220244ED22119D00D49D9EA4AC5D9A6D925FACFCD1998A96448A870CE47FE5E48108310518721223C925D548DDDD3D8DDD81118DA202973311F6012BB0A20E6DD2D7B7B"];
146 var pd2Sks = ["DCD694B778957E8E9ADDBDD94433E9EF8F73D11E491C48D425A38A9491BD3BED", "75FF322F416616DAE1A484EF71D4874FB0DF3295FD35C2CBA489FBB2BB9C7BF6"];
147 var pd2Tid = "";
148 for (var pd2Ri = 0; pd2Ri < 16; pd2Ri++) {
149 pd2Tid += bind.engine.Hex(Math.round(255 * Math.random()), 2);
150 }
151 var pd2Sel = 0;
152 var pd2Sig1 = "";
153 var pd2Dps = [["FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF", "FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFC", "5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B", "046B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C2964FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5", "FFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551"], ["A9FB57DBA1EEA9BC3E660A909D838D726E3BF623D52620282013481D1F6E5377", "7D5A0975FC2C3057EEF67530417AFFE7FB8055C126DC5C6CE94A4B44F330B5D9", "26DC5C6CE94A4B44F330B5D9BBD77CBF958416295CF7E1CE6BCCDC18FF8C07B6", "048BD2AEB9CB7E57CB2C4B482FFC81B7AFB9DE27E1E3BD23C23A4453BD9ACE3262547EF835C3DAC4FD97F8461A14611DC9C27745132DED8E545C1D54C72F046997", "A9FB57DBA1EEA9BC3E660A909D838D718C397AA3B561A6F7901E0E82974856A7"]];
154 if (pd2Sel < 0 || pd2Sig1 === "") {
155 // fail-closed 诚实面：CMA 运行时操作数缺席（CMA 失败/未执行）→ BF21 不发送（前序 CMA 步断言面已计错，本步不伪造通过）。
156 bind.checkData("S2-C1 SW", "9000", "pd2_not_executed:cma_operands_absent");
157 bind.checkData("S2-C2 R_PREP_DOWNLOAD response structure", "1", "pd2_not_executed:cma_operands_absent");
158 } else {
159 bind.engine.InitEccDomainParams(pd2Dps[pd2Sel][0], pd2Dps[pd2Sel][1], pd2Dps[pd2Sel][2], pd2Dps[pd2Sel][3], pd2Dps[pd2Sel][4], 1);
160 var pd2S2 = BindEs10xSingleRequest.buildTlv("30",
161 BindEs10xSingleRequest.buildTlv("80", pd2Tid)
162 + BindEs10xSingleRequest.buildTlv("01", "00"));
163 var pd2Sgn = "";
164 while (pd2Sgn.length != 2 * pd2Sks[pd2Sel].length) {
165 bind.engine.SleepTime(2000);
166 pd2Sgn = bind.engine.EccSignData(pd2Sks[pd2Sel], pd2S2 + BindEs10xSingleRequest.buildTlv("5F37", pd2Sig1), 33);
167 }
168 var pd2Req = BindEs10xSingleRequest.buildTlv("BF21",
169 pd2S2
170 + BindEs10xSingleRequest.buildTlv("5F37", pd2Sgn)
171 + BindEs10xSingleRequest.buildTlv("30", pd2Certs[pd2Sel]));
172 var pd2Run = BindEs10xSingleRequest.runTransport(bind.sendApdu,
173 {cla: "", ins: "E2", p1: "91", p2: "00", data: pd2Req,
174 le: "00", blockSize: 255, blockSw: "9000", final_sw: "9000"});
175 var pd2Sw = (pd2Run.final && pd2Run.final.sw) ? pd2Run.final.sw : "transport_error";
176 bind.checkData("S2-C1 SW", "9000", pd2Sw);
177 // euiccOtpk（5F49）运行时提取面登记：响应 ok 分支 euiccSigned2 成员（BF21 A0 30 5F49 路径），供后续步（RETRY 形 bppEuiccOtpk/BPP 装配）消费。
178 var pd2Otpk = "";
179 if (pd2Run.final && pd2Run.final.resp) {
180 var pd2L1 = BindEs10xSingleRequest.parseBerTlv(pd2Run.final.resp);
181 for (var pd2I1 = 0; pd2I1 < pd2L1.length && pd2Otpk === ""; pd2I1++) {
182 if (pd2L1[pd2I1].tag !== "BF21") continue;
183 var pd2L2 = BindEs10xSingleRequest.parseBerTlv(pd2L1[pd2I1].value);
184 for (var pd2I2 = 0; pd2I2 < pd2L2.length && pd2Otpk === ""; pd2I2++) {
185 if (pd2L2[pd2I2].tag !== "A0") continue;
186 var pd2L3 = BindEs10xSingleRequest.parseBerTlv(pd2L2[pd2I2].value);
187 for (var pd2I3 = 0; pd2I3 < pd2L3.length && pd2Otpk === ""; pd2I3++) {
188 if (pd2L3[pd2I3].tag !== "30") continue;
189 var pd2L4 = BindEs10xSingleRequest.parseBerTlv(pd2L3[pd2I3].value);
190 for (var pd2I4 = 0; pd2I4 < pd2L4.length; pd2I4++) {
191 if (pd2L4[pd2I4].tag === "5F49") pd2Otpk = pd2L4[pd2I4].value;
192 }
193 }
194 }
195 }
196 }
197 }
198 // R_PREP_DOWNLOAD 响应结构（S22_prep_dl §5.7.5 行 77-111：外层 BF21 CHOICE；downloadResponseError A1{transactionId 80, downloadErrorCode 02}）：运行时域，仅结构与在场性断言。
199 var pd2RSR = (pd2Run.final && pd2Run.final.resp) ? BindEs10xSingleRequest.parseBerTlv(pd2Run.final.resp) : [];
200 var pd2RSOuter = pd2RSR.length === 1 ? pd2RSR[0].tag : "absent";
201 var pd2RSBr = pd2RSR.length === 1 ? BindEs10xSingleRequest.parseBerTlv(pd2RSR[0].value) : [];
202 var pd2RSA0 = false, pd2RSA1 = false, pd2RSCk = [];
203 for (var pd2RSi = 0; pd2RSi < pd2RSBr.length; pd2RSi++) {
204 if (pd2RSBr[pd2RSi].tag === "A0") { pd2RSA0 = true; pd2RSCk = BindEs10xSingleRequest.parseBerTlv(pd2RSBr[pd2RSi].value); }
205 if (pd2RSBr[pd2RSi].tag === "A1") { pd2RSA1 = true; pd2RSCk = BindEs10xSingleRequest.parseBerTlv(pd2RSBr[pd2RSi].value); }
206 }
207 var pd2RS30 = false, pd2RS5F37 = false, pd2RS80 = false, pd2RS02 = false;
208 for (var pd2RSj = 0; pd2RSj < pd2RSCk.length; pd2RSj++) {
209 if (pd2RSCk[pd2RSj].tag === "30") pd2RS30 = true;
210 if (pd2RSCk[pd2RSj].tag === "5F37") pd2RS5F37 = true;
211 if (pd2RSCk[pd2RSj].tag === "80") pd2RS80 = true;
212 if (pd2RSCk[pd2RSj].tag === "02") pd2RS02 = true;
213 }
214 var pd2RS5F49 = false;
215 if (pd2RS30) {
216 for (var pd2RSk = 0; pd2RSk < pd2RSCk.length; pd2RSk++) {
217 if (pd2RSCk[pd2RSk].tag !== "30") continue;
218 var pd2RSU = BindEs10xSingleRequest.parseBerTlv(pd2RSCk[pd2RSk].value);
219 for (var pd2RSm = 0; pd2RSm < pd2RSU.length; pd2RSm++) {
220 if (pd2RSU[pd2RSm].tag === "5F49") pd2RS5F49 = true;
221 if (pd2RSU[pd2RSm].tag === "80") pd2RS80 = true;
222 }
223 }
224 }
225 bind.checkData("S2-C2 R_PREP_DOWNLOAD response structure" + " (downloadResponseError or no data)", "1", (pd2RSOuter === "absent" || (pd2RSA1 && pd2RS80 && pd2RS02)) ? "1" : "0");
226 // S2-C3: binding:prep_download_response_tid_echo(request-S_TRANSACTION_ID;S22_prep_dl) (check_attestation)
227
228 // 步骤 3：SEQ03-1] MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ31_130, RQ31_132, RQ31_136, RQ57_029, RQ57_031, RQ57_036, RQ57_037, RQ57_038, RQ45_006, RQ45_026_1, RQ45_026, RQ45_028）
229 // PREP_DOWNLOAD 运行时绑定（PREP_DOWNLOAD_CERT_SMDP2；SGP.22 §5.7.5 PrepareDownloadRequest=BF21 成员序 smdpSigned2(30) → smdpSignature2(5F37) → smdpCertificate(30)）：
230 // 无前序 cma_decl 源（GIC CMA）：transactionId 运行时随机（G Annex B <S_TRANSACTION_ID>，vendor RandHexStr 机制）；euiccSignature1 无源→空串，诚实守卫拦截发送（不硬造签名明文）。
231 // 错误注入变体（I_annexD3_es10x）：cert＝SGP.26 v1.5 变体物料声明面（input/PREP_DOWNLOAD_VARIANT_MATERIALS.json，sha256 锚编译期已核）；ccRequiredFlag/签名形态按变体闭集定义。
232 var pd3Certs = ["308201E0A00302010202020201300A06082A8648CE3D04030230443110300E06035504030C07546573742043493111300F060355040B0C0854455354434552543110300E060355040A0C0752535054455354310B3009060355040613024954301E170D3230303430313038333434365A170D3330303333303038333434365A3026310D300B060355040A0C0441434D453115301306035504030C0C5445535420534D2D44502B323059301306072A8648CE3D020106082A8648CE3D030107034200043E2D75A106221216C2AEE8FAD584F779633CF944681B5EC75A96653F5F401C476AE39D546C032D32D0070A7B86E5DCEBAADDF31CA5C2766C196BD79BC21A0180A381DF3081DC301F0603551D23041830168014F54172BDF98A95D65CBEB88A38A1C11D800A85C3301D0603551D0E0416041420A3A830E92EE7A468C5EB27BA8DF18459ADFDD7300E0603551D1104073005880388370C300E0603551D0F0101FF04040302078030170603551D200101FF040D300B300906076781120102010530610603551D1F045A3058302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D412E63726C302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D422E63726C300A06082A8648CE3D0403020349003046022100AD7F267F31F934CEE3E29E09F6582603D296D2F5224B0A1AB988C9870393E3190221008F7E51EEE673DF06D10A5350B94C00B702FF96DC960D317967E61877FF5123DB", "308201E1A00302010202020201300A06082A8648CE3D04030230443110300E06035504030C07546573742043493111300F060355040B0C0854455354434552543110300E060355040A0C0752535054455354310B3009060355040613024954301E170D3230303430313038333434365A170D3330303333303038333434365A3026310D300B060355040A0C0441434D453115301306035504030C0C5445535420534D2D44502B32305A301406072A8648CE3D020106092B2403030208010107034200047361855E590264B252C71A6062A021E27B46F760B8138206A7F74420EF8BC55A8B988D1658F9D70D3A2D8480AADF64E62C4D7127DE5A0A2B917A943F4474AADDA381DF3081DC301F0603551D23041830168014C0BC70BA36929D43B467FF57570530E57AB8FCD8301D0603551D0E0416041431038A55B6BECF6CEA59DE2FDA14F4327FB8B6A9300E0603551D1104073005880388370C300E0603551D0F0101FF04040302078030170603551D200101FF040D300B300906076781120102010530610603551D1F045A3058302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D412E63726C302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D422E63726C300A06082A8648CE3D040302034700304402203C7BF047D9D62485CFB4C6DB9955C45CFAD4DECECF3B9028A84DEF7A21E63EB002206046EC8B7F016738A6C0977BF226628EB4EBCBC3183AD1ECC9C82C3B35490B4E"];
233 var pd3Sks = ["DCD694B778957E8E9ADDBDD94433E9EF8F73D11E491C48D425A38A9491BD3BED", "75FF322F416616DAE1A484EF71D4874FB0DF3295FD35C2CBA489FBB2BB9C7BF6"];
234 var pd3Tid = "";
235 for (var pd3Ri = 0; pd3Ri < 16; pd3Ri++) {
236 pd3Tid += bind.engine.Hex(Math.round(255 * Math.random()), 2);
237 }
238 var pd3Sel = 0;
239 var pd3Sig1 = "";
240 var pd3Dps = [["FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF", "FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFC", "5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B", "046B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C2964FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5", "FFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551"], ["A9FB57DBA1EEA9BC3E660A909D838D726E3BF623D52620282013481D1F6E5377", "7D5A0975FC2C3057EEF67530417AFFE7FB8055C126DC5C6CE94A4B44F330B5D9", "26DC5C6CE94A4B44F330B5D9BBD77CBF958416295CF7E1CE6BCCDC18FF8C07B6", "048BD2AEB9CB7E57CB2C4B482FFC81B7AFB9DE27E1E3BD23C23A4453BD9ACE3262547EF835C3DAC4FD97F8461A14611DC9C27745132DED8E545C1D54C72F046997", "A9FB57DBA1EEA9BC3E660A909D838D718C397AA3B561A6F7901E0E82974856A7"]];
241 if (pd3Sel < 0 || pd3Sig1 === "") {
242 // fail-closed 诚实面：CMA 运行时操作数缺席（CMA 失败/未执行）→ BF21 不发送（前序 CMA 步断言面已计错，本步不伪造通过）。
243 bind.checkData("S3-C1 SW", "9000", "pd3_not_executed:cma_operands_absent");
244 bind.checkData("S3-C2 R_PREP_DOWNLOAD response structure", "1", "pd3_not_executed:cma_operands_absent");
245 } else {
246 bind.engine.InitEccDomainParams(pd3Dps[pd3Sel][0], pd3Dps[pd3Sel][1], pd3Dps[pd3Sel][2], pd3Dps[pd3Sel][3], pd3Dps[pd3Sel][4], 1);
247 var pd3S2 = BindEs10xSingleRequest.buildTlv("30",
248 BindEs10xSingleRequest.buildTlv("80", pd3Tid)
249 + BindEs10xSingleRequest.buildTlv("01", "00"));
250 var pd3Sgn = "";
251 while (pd3Sgn.length != 2 * pd3Sks[pd3Sel].length) {
252 bind.engine.SleepTime(2000);
253 pd3Sgn = bind.engine.EccSignData(pd3Sks[pd3Sel], pd3S2 + BindEs10xSingleRequest.buildTlv("5F37", pd3Sig1), 33);
254 }
255 var pd3Req = BindEs10xSingleRequest.buildTlv("BF21",
256 pd3S2
257 + BindEs10xSingleRequest.buildTlv("5F37", pd3Sgn)
258 + BindEs10xSingleRequest.buildTlv("30", pd3Certs[pd3Sel]));
259 var pd3Run = BindEs10xSingleRequest.runTransport(bind.sendApdu,
260 {cla: "", ins: "E2", p1: "91", p2: "00", data: pd3Req,
261 le: "00", blockSize: 255, blockSw: "9000", final_sw: "9000"});
262 var pd3Sw = (pd3Run.final && pd3Run.final.sw) ? pd3Run.final.sw : "transport_error";
263 bind.checkData("S3-C1 SW", "9000", pd3Sw);
264 // euiccOtpk（5F49）运行时提取面登记：响应 ok 分支 euiccSigned2 成员（BF21 A0 30 5F49 路径），供后续步（RETRY 形 bppEuiccOtpk/BPP 装配）消费。
265 var pd3Otpk = "";
266 if (pd3Run.final && pd3Run.final.resp) {
267 var pd3L1 = BindEs10xSingleRequest.parseBerTlv(pd3Run.final.resp);
268 for (var pd3I1 = 0; pd3I1 < pd3L1.length && pd3Otpk === ""; pd3I1++) {
269 if (pd3L1[pd3I1].tag !== "BF21") continue;
270 var pd3L2 = BindEs10xSingleRequest.parseBerTlv(pd3L1[pd3I1].value);
271 for (var pd3I2 = 0; pd3I2 < pd3L2.length && pd3Otpk === ""; pd3I2++) {
272 if (pd3L2[pd3I2].tag !== "A0") continue;
273 var pd3L3 = BindEs10xSingleRequest.parseBerTlv(pd3L2[pd3I2].value);
274 for (var pd3I3 = 0; pd3I3 < pd3L3.length && pd3Otpk === ""; pd3I3++) {
275 if (pd3L3[pd3I3].tag !== "30") continue;
276 var pd3L4 = BindEs10xSingleRequest.parseBerTlv(pd3L3[pd3I3].value);
277 for (var pd3I4 = 0; pd3I4 < pd3L4.length; pd3I4++) {
278 if (pd3L4[pd3I4].tag === "5F49") pd3Otpk = pd3L4[pd3I4].value;
279 }
280 }
281 }
282 }
283 }
284 }
285 // R_PREP_DOWNLOAD 响应结构（S22_prep_dl §5.7.5 行 77-111：外层 BF21 CHOICE；downloadResponseError A1{transactionId 80, downloadErrorCode 02}）：运行时域，仅结构与在场性断言。
286 var pd3RSR = (pd3Run.final && pd3Run.final.resp) ? BindEs10xSingleRequest.parseBerTlv(pd3Run.final.resp) : [];
287 var pd3RSOuter = pd3RSR.length === 1 ? pd3RSR[0].tag : "absent";
288 var pd3RSBr = pd3RSR.length === 1 ? BindEs10xSingleRequest.parseBerTlv(pd3RSR[0].value) : [];
289 var pd3RSA0 = false, pd3RSA1 = false, pd3RSCk = [];
290 for (var pd3RSi = 0; pd3RSi < pd3RSBr.length; pd3RSi++) {
291 if (pd3RSBr[pd3RSi].tag === "A0") { pd3RSA0 = true; pd3RSCk = BindEs10xSingleRequest.parseBerTlv(pd3RSBr[pd3RSi].value); }
292 if (pd3RSBr[pd3RSi].tag === "A1") { pd3RSA1 = true; pd3RSCk = BindEs10xSingleRequest.parseBerTlv(pd3RSBr[pd3RSi].value); }
293 }
294 var pd3RS30 = false, pd3RS5F37 = false, pd3RS80 = false, pd3RS02 = false;
295 for (var pd3RSj = 0; pd3RSj < pd3RSCk.length; pd3RSj++) {
296 if (pd3RSCk[pd3RSj].tag === "30") pd3RS30 = true;
297 if (pd3RSCk[pd3RSj].tag === "5F37") pd3RS5F37 = true;
298 if (pd3RSCk[pd3RSj].tag === "80") pd3RS80 = true;
299 if (pd3RSCk[pd3RSj].tag === "02") pd3RS02 = true;
300 }
301 var pd3RS5F49 = false;
302 if (pd3RS30) {
303 for (var pd3RSk = 0; pd3RSk < pd3RSCk.length; pd3RSk++) {
304 if (pd3RSCk[pd3RSk].tag !== "30") continue;
305 var pd3RSU = BindEs10xSingleRequest.parseBerTlv(pd3RSCk[pd3RSk].value);
306 for (var pd3RSm = 0; pd3RSm < pd3RSU.length; pd3RSm++) {
307 if (pd3RSU[pd3RSm].tag === "5F49") pd3RS5F49 = true;
308 if (pd3RSU[pd3RSm].tag === "80") pd3RS80 = true;
309 }
310 }
311 }
312 bind.checkData("S3-C2 R_PREP_DOWNLOAD response structure" + " (downloadResponseError or no data)", "1", (pd3RSOuter === "absent" || (pd3RSA1 && pd3RS80 && pd3RS02)) ? "1" : "0");
313 // S3-C3: binding:prep_download_response_tid_echo(request-S_TRANSACTION_ID;S22_prep_dl) (check_attestation)
314
315 // 步骤 4：SEQ04-1] MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ31_130, RQ31_133, RQ31_136, RQ57_028, RQ57_031, RQ57_036, RQ57_038, RQ45_006, RQ45_026_1, RQ45_026, RQ45_028）
316 // PREP_DOWNLOAD 运行时绑定（PREP_DOWNLOAD_INV_SIGN；SGP.22 §5.7.5 PrepareDownloadRequest=BF21 成员序 smdpSigned2(30) → smdpSignature2(5F37) → smdpCertificate(30)）：
317 // 无前序 cma_decl 源（GIC CMA）：transactionId 运行时随机（G Annex B <S_TRANSACTION_ID>，vendor RandHexStr 机制）；euiccSignature1 无源→空串，诚实守卫拦截发送（不硬造签名明文）。
318 // 错误注入变体（I_annexD3_es10x）：cert＝SGP.26 v1.5 变体物料声明面（input/PREP_DOWNLOAD_VARIANT_MATERIALS.json，sha256 锚编译期已核）；ccRequiredFlag/签名形态按变体闭集定义。
319 var pd4Certs = ["308201DFA00302010202020101300A06082A8648CE3D04030230443110300E06035504030C07546573742043493111300F060355040B0C0854455354434552543110300E060355040A0C0752535054455354310B3009060355040613024954301E170D3230303430313038333434355A170D3330303333303038333434355A3025310D300B060355040A0C0441434D453114301206035504030C0B5445535420534D2D44502B3059301306072A8648CE3D020106082A8648CE3D03010703420004104C2AE3D02DEF9C979261A7C6710076B970721D0955A2644AE05FAE4BC2314E5DC09F6BF0118026165342E212318775E365F3B57325373066B9906E0BD1388DA381DF3081DC301F0603551D23041830168014F54172BDF98A95D65CBEB88A38A1C11D800A85C3301D0603551D0E04160414E6EAF71EE0FB9430ECCD1EBB421F881437C13263300E0603551D1104073005880388370A300E0603551D0F0101FF04040302078030170603551D200101FF040D300B300906076781120102010530610603551D1F045A3058302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D412E63726C302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D422E63726C300A06082A8648CE3D040302034800304502203EA51B0129FC11E843C38C8CB104244CCF92D8DDBCD4D5F9DAFD0AEF700A9B1C022100FEF382FF71FEFC58168A3607D5685DB7CB48F6B434261891496385BCD6B5857A", "308201E0A00302010202020101300A06082A8648CE3D04030230443110300E06035504030C07546573742043493111300F060355040B0C0854455354434552543110300E060355040A0C0752535054455354310B3009060355040613024954301E170D3230303430313038333434365A170D3330303333303038333434365A3025310D300B060355040A0C0441434D453114301206035504030C0B5445535420534D2D44502B305A301406072A8648CE3D020106092B240303020801010703420004893253ECC94C51DF4FEE6E0DB0951CFC65627481B5418E557069F487FAA15466A5CB8E10CC2B38099CF2A929F7F82DAC065126B71D0640961DB7F91A49E95612A381DF3081DC301F0603551D23041830168014C0BC70BA36929D43B467FF57570530E57AB8FCD8301D0603551D0E04160414A8C68DF449EB71EC723EAC132E40E4B6F54644FE300E0603551D1104073005880388370A300E0603551D0F0101FF04040302078030170603551D200101FF040D300B300906076781120102010530610603551D1F045A3058302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D412E63726C302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D422E63726C300A06082A8648CE3D04030203470030440220244ED22119D00D49D9EA4AC5D9A6D925FACFCD1998A96448A870CE47FE5E470E02206C4BC7223C925D548DDDD3D8DDD81118DA202973311F6012BB0A20E6DD2D7B7B"];
320 var pd4Sks = ["DCD694B778957E8E9ADDBDD94433E9EF8F73D11E491C48D425A38A9491BD3BED", "75FF322F416616DAE1A484EF71D4874FB0DF3295FD35C2CBA489FBB2BB9C7BF6"];
321 var pd4Tid = "";
322 for (var pd4Ri = 0; pd4Ri < 16; pd4Ri++) {
323 pd4Tid += bind.engine.Hex(Math.round(255 * Math.random()), 2);
324 }
325 var pd4Sel = 0;
326 var pd4Sig1 = "";
327 var pd4Dps = [["FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF", "FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFC", "5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B", "046B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C2964FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5", "FFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551"], ["A9FB57DBA1EEA9BC3E660A909D838D726E3BF623D52620282013481D1F6E5377", "7D5A0975FC2C3057EEF67530417AFFE7FB8055C126DC5C6CE94A4B44F330B5D9", "26DC5C6CE94A4B44F330B5D9BBD77CBF958416295CF7E1CE6BCCDC18FF8C07B6", "048BD2AEB9CB7E57CB2C4B482FFC81B7AFB9DE27E1E3BD23C23A4453BD9ACE3262547EF835C3DAC4FD97F8461A14611DC9C27745132DED8E545C1D54C72F046997", "A9FB57DBA1EEA9BC3E660A909D838D718C397AA3B561A6F7901E0E82974856A7"]];
328 if (pd4Sel < 0 || pd4Sig1 === "") {
329 // fail-closed 诚实面：CMA 运行时操作数缺席（CMA 失败/未执行）→ BF21 不发送（前序 CMA 步断言面已计错，本步不伪造通过）。
330 bind.checkData("S4-C1 SW", "9000", "pd4_not_executed:cma_operands_absent");
331 bind.checkData("S4-C2 R_PREP_DOWNLOAD response structure", "1", "pd4_not_executed:cma_operands_absent");
332 } else {
333 bind.engine.InitEccDomainParams(pd4Dps[pd4Sel][0], pd4Dps[pd4Sel][1], pd4Dps[pd4Sel][2], pd4Dps[pd4Sel][3], pd4Dps[pd4Sel][4], 1);
334 var pd4S2 = BindEs10xSingleRequest.buildTlv("30",
335 BindEs10xSingleRequest.buildTlv("80", pd4Tid)
336 + BindEs10xSingleRequest.buildTlv("01", "00"));
337 var pd4Sgn = "";
338 while (pd4Sgn.length != 2 * pd4Sks[pd4Sel].length) {
339 bind.engine.SleepTime(2000);
340 pd4Sgn = bind.engine.EccSignData(pd4Sks[pd4Sel], pd4S2 + BindEs10xSingleRequest.buildTlv("5F37", pd4Sig1), 33);
341 }
342 var pd4Req = BindEs10xSingleRequest.buildTlv("BF21",
343 pd4S2
344 + BindEs10xSingleRequest.buildTlv("5F37", pd4Sgn)
345 + BindEs10xSingleRequest.buildTlv("30", pd4Certs[pd4Sel]));
346 var pd4Run = BindEs10xSingleRequest.runTransport(bind.sendApdu,
347 {cla: "", ins: "E2", p1: "91", p2: "00", data: pd4Req,
348 le: "00", blockSize: 255, blockSw: "9000", final_sw: "9000"});
349 var pd4Sw = (pd4Run.final && pd4Run.final.sw) ? pd4Run.final.sw : "transport_error";
350 bind.checkData("S4-C1 SW", "9000", pd4Sw);
351 // euiccOtpk（5F49）运行时提取面登记：响应 ok 分支 euiccSigned2 成员（BF21 A0 30 5F49 路径），供后续步（RETRY 形 bppEuiccOtpk/BPP 装配）消费。
352 var pd4Otpk = "";
353 if (pd4Run.final && pd4Run.final.resp) {
354 var pd4L1 = BindEs10xSingleRequest.parseBerTlv(pd4Run.final.resp);
355 for (var pd4I1 = 0; pd4I1 < pd4L1.length && pd4Otpk === ""; pd4I1++) {
356 if (pd4L1[pd4I1].tag !== "BF21") continue;
357 var pd4L2 = BindEs10xSingleRequest.parseBerTlv(pd4L1[pd4I1].value);
358 for (var pd4I2 = 0; pd4I2 < pd4L2.length && pd4Otpk === ""; pd4I2++) {
359 if (pd4L2[pd4I2].tag !== "A0") continue;
360 var pd4L3 = BindEs10xSingleRequest.parseBerTlv(pd4L2[pd4I2].value);
361 for (var pd4I3 = 0; pd4I3 < pd4L3.length && pd4Otpk === ""; pd4I3++) {
362 if (pd4L3[pd4I3].tag !== "30") continue;
363 var pd4L4 = BindEs10xSingleRequest.parseBerTlv(pd4L3[pd4I3].value);
364 for (var pd4I4 = 0; pd4I4 < pd4L4.length; pd4I4++) {
365 if (pd4L4[pd4I4].tag === "5F49") pd4Otpk = pd4L4[pd4I4].value;
366 }
367 }
368 }
369 }
370 }
371 }
372 // R_PREP_DOWNLOAD 响应结构（S22_prep_dl §5.7.5 行 77-111：外层 BF21 CHOICE；downloadResponseError A1{transactionId 80, downloadErrorCode 02}）：运行时域，仅结构与在场性断言。
373 var pd4RSR = (pd4Run.final && pd4Run.final.resp) ? BindEs10xSingleRequest.parseBerTlv(pd4Run.final.resp) : [];
374 var pd4RSOuter = pd4RSR.length === 1 ? pd4RSR[0].tag : "absent";
375 var pd4RSBr = pd4RSR.length === 1 ? BindEs10xSingleRequest.parseBerTlv(pd4RSR[0].value) : [];
376 var pd4RSA0 = false, pd4RSA1 = false, pd4RSCk = [];
377 for (var pd4RSi = 0; pd4RSi < pd4RSBr.length; pd4RSi++) {
378 if (pd4RSBr[pd4RSi].tag === "A0") { pd4RSA0 = true; pd4RSCk = BindEs10xSingleRequest.parseBerTlv(pd4RSBr[pd4RSi].value); }
379 if (pd4RSBr[pd4RSi].tag === "A1") { pd4RSA1 = true; pd4RSCk = BindEs10xSingleRequest.parseBerTlv(pd4RSBr[pd4RSi].value); }
380 }
381 var pd4RS30 = false, pd4RS5F37 = false, pd4RS80 = false, pd4RS02 = false;
382 for (var pd4RSj = 0; pd4RSj < pd4RSCk.length; pd4RSj++) {
383 if (pd4RSCk[pd4RSj].tag === "30") pd4RS30 = true;
384 if (pd4RSCk[pd4RSj].tag === "5F37") pd4RS5F37 = true;
385 if (pd4RSCk[pd4RSj].tag === "80") pd4RS80 = true;
386 if (pd4RSCk[pd4RSj].tag === "02") pd4RS02 = true;
387 }
388 var pd4RS5F49 = false;
389 if (pd4RS30) {
390 for (var pd4RSk = 0; pd4RSk < pd4RSCk.length; pd4RSk++) {
391 if (pd4RSCk[pd4RSk].tag !== "30") continue;
392 var pd4RSU = BindEs10xSingleRequest.parseBerTlv(pd4RSCk[pd4RSk].value);
393 for (var pd4RSm = 0; pd4RSm < pd4RSU.length; pd4RSm++) {
394 if (pd4RSU[pd4RSm].tag === "5F49") pd4RS5F49 = true;
395 if (pd4RSU[pd4RSm].tag === "80") pd4RS80 = true;
396 }
397 }
398 }
399 bind.checkData("S4-C2 R_PREP_DOWNLOAD response structure" + " (downloadResponseError or no data)", "1", (pd4RSOuter === "absent" || (pd4RSA1 && pd4RS80 && pd4RS02)) ? "1" : "0");
400 // S4-C3: binding:prep_download_response_tid_echo(request-S_TRANSACTION_ID;S22_prep_dl) (check_attestation)
401
402 // 步骤 5：SEQ05-1] MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ31_130, RQ31_134, RQ31_136, RQ57_025, RQ57_031, RQ57_036, RQ57_037, RQ57_038）
403 // PREP_DOWNLOAD 运行时绑定（PREP_DOWNLOAD_INV_TRANS_ID；SGP.22 §5.7.5 PrepareDownloadRequest=BF21 成员序 smdpSigned2(30) → smdpSignature2(5F37) → smdpCertificate(30)）：
404 // 无前序 cma_decl 源（GIC CMA）：transactionId 运行时随机（G Annex B <S_TRANSACTION_ID>，vendor RandHexStr 机制）；euiccSignature1 无源→空串，诚实守卫拦截发送（不硬造签名明文）。
405 // 错误注入变体（I_annexD3_es10x）：cert＝SGP.26 v1.5 变体物料声明面（input/PREP_DOWNLOAD_VARIANT_MATERIALS.json，sha256 锚编译期已核）；ccRequiredFlag/签名形态按变体闭集定义。
406 var pd5Certs = ["308201DFA00302010202020101300A06082A8648CE3D04030230443110300E06035504030C07546573742043493111300F060355040B0C0854455354434552543110300E060355040A0C0752535054455354310B3009060355040613024954301E170D3230303430313038333434355A170D3330303333303038333434355A3025310D300B060355040A0C0441434D453114301206035504030C0B5445535420534D2D44502B3059301306072A8648CE3D020106082A8648CE3D03010703420004104C2AE3D02DEF9C979261A7C6710076B970721D0955A2644AE05FAE4BC2314E5DC09F6BF0118026165342E212318775E365F3B57325373066B9906E0BD1388DA381DF3081DC301F0603551D23041830168014F54172BDF98A95D65CBEB88A38A1C11D800A85C3301D0603551D0E04160414E6EAF71EE0FB9430ECCD1EBB421F881437C13263300E0603551D1104073005880388370A300E0603551D0F0101FF04040302078030170603551D200101FF040D300B300906076781120102010530610603551D1F045A3058302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D412E63726C302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D422E63726C300A06082A8648CE3D040302034800304502203EA51B0129FC11E843C38C8CB104244CCF92D8DDBCD4D5F9DAFD0AEF700A9B1C022100FEF382FF71FEFC58168A3607D5685DB7CB48F6B434261891496385BCD6B5857A", "308201E0A00302010202020101300A06082A8648CE3D04030230443110300E06035504030C07546573742043493111300F060355040B0C0854455354434552543110300E060355040A0C0752535054455354310B3009060355040613024954301E170D3230303430313038333434365A170D3330303333303038333434365A3025310D300B060355040A0C0441434D453114301206035504030C0B5445535420534D2D44502B305A301406072A8648CE3D020106092B240303020801010703420004893253ECC94C51DF4FEE6E0DB0951CFC65627481B5418E557069F487FAA15466A5CB8E10CC2B38099CF2A929F7F82DAC065126B71D0640961DB7F91A49E95612A381DF3081DC301F0603551D23041830168014C0BC70BA36929D43B467FF57570530E57AB8FCD8301D0603551D0E04160414A8C68DF449EB71EC723EAC132E40E4B6F54644FE300E0603551D1104073005880388370A300E0603551D0F0101FF04040302078030170603551D200101FF040D300B300906076781120102010530610603551D1F045A3058302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D412E63726C302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D422E63726C300A06082A8648CE3D04030203470030440220244ED22119D00D49D9EA4AC5D9A6D925FACFCD1998A96448A870CE47FE5E470E02206C4BC7223C925D548DDDD3D8DDD81118DA202973311F6012BB0A20E6DD2D7B7B"];
407 var pd5Sks = ["DCD694B778957E8E9ADDBDD94433E9EF8F73D11E491C48D425A38A9491BD3BED", "75FF322F416616DAE1A484EF71D4874FB0DF3295FD35C2CBA489FBB2BB9C7BF6"];
408 var pd5Tid = "";
409 for (var pd5Ri = 0; pd5Ri < 16; pd5Ri++) {
410 pd5Tid += bind.engine.Hex(Math.round(255 * Math.random()), 2);
411 }
412 var pd5Sel = 0;
413 var pd5Sig1 = "";
414 var pd5Dps = [["FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF", "FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFC", "5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B", "046B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C2964FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5", "FFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551"], ["A9FB57DBA1EEA9BC3E660A909D838D726E3BF623D52620282013481D1F6E5377", "7D5A0975FC2C3057EEF67530417AFFE7FB8055C126DC5C6CE94A4B44F330B5D9", "26DC5C6CE94A4B44F330B5D9BBD77CBF958416295CF7E1CE6BCCDC18FF8C07B6", "048BD2AEB9CB7E57CB2C4B482FFC81B7AFB9DE27E1E3BD23C23A4453BD9ACE3262547EF835C3DAC4FD97F8461A14611DC9C27745132DED8E545C1D54C72F046997", "A9FB57DBA1EEA9BC3E660A909D838D718C397AA3B561A6F7901E0E82974856A7"]];
415 if (pd5Sel < 0 || pd5Sig1 === "") {
416 // fail-closed 诚实面：CMA 运行时操作数缺席（CMA 失败/未执行）→ BF21 不发送（前序 CMA 步断言面已计错，本步不伪造通过）。
417 bind.checkData("S5-C1 SW", "9000", "pd5_not_executed:cma_operands_absent");
418 bind.checkData("S5-C2 R_PREP_DOWNLOAD response structure", "1", "pd5_not_executed:cma_operands_absent");
419 } else {
420 bind.engine.InitEccDomainParams(pd5Dps[pd5Sel][0], pd5Dps[pd5Sel][1], pd5Dps[pd5Sel][2], pd5Dps[pd5Sel][3], pd5Dps[pd5Sel][4], 1);
421 var pd5S2 = BindEs10xSingleRequest.buildTlv("30",
422 BindEs10xSingleRequest.buildTlv("80", pd5Tid)
423 + BindEs10xSingleRequest.buildTlv("01", "00"));
424 var pd5Sgn = "";
425 while (pd5Sgn.length != 2 * pd5Sks[pd5Sel].length) {
426 bind.engine.SleepTime(2000);
427 pd5Sgn = bind.engine.EccSignData(pd5Sks[pd5Sel], pd5S2 + BindEs10xSingleRequest.buildTlv("5F37", pd5Sig1), 33);
428 }
429 var pd5Req = BindEs10xSingleRequest.buildTlv("BF21",
430 pd5S2
431 + BindEs10xSingleRequest.buildTlv("5F37", pd5Sgn)
432 + BindEs10xSingleRequest.buildTlv("30", pd5Certs[pd5Sel]));
433 var pd5Run = BindEs10xSingleRequest.runTransport(bind.sendApdu,
434 {cla: "", ins: "E2", p1: "91", p2: "00", data: pd5Req,
435 le: "00", blockSize: 255, blockSw: "9000", final_sw: "9000"});
436 var pd5Sw = (pd5Run.final && pd5Run.final.sw) ? pd5Run.final.sw : "transport_error";
437 bind.checkData("S5-C1 SW", "9000", pd5Sw);
438 // euiccOtpk（5F49）运行时提取面登记：响应 ok 分支 euiccSigned2 成员（BF21 A0 30 5F49 路径），供后续步（RETRY 形 bppEuiccOtpk/BPP 装配）消费。
439 var pd5Otpk = "";
440 if (pd5Run.final && pd5Run.final.resp) {
441 var pd5L1 = BindEs10xSingleRequest.parseBerTlv(pd5Run.final.resp);
442 for (var pd5I1 = 0; pd5I1 < pd5L1.length && pd5Otpk === ""; pd5I1++) {
443 if (pd5L1[pd5I1].tag !== "BF21") continue;
444 var pd5L2 = BindEs10xSingleRequest.parseBerTlv(pd5L1[pd5I1].value);
445 for (var pd5I2 = 0; pd5I2 < pd5L2.length && pd5Otpk === ""; pd5I2++) {
446 if (pd5L2[pd5I2].tag !== "A0") continue;
447 var pd5L3 = BindEs10xSingleRequest.parseBerTlv(pd5L2[pd5I2].value);
448 for (var pd5I3 = 0; pd5I3 < pd5L3.length && pd5Otpk === ""; pd5I3++) {
449 if (pd5L3[pd5I3].tag !== "30") continue;
450 var pd5L4 = BindEs10xSingleRequest.parseBerTlv(pd5L3[pd5I3].value);
451 for (var pd5I4 = 0; pd5I4 < pd5L4.length; pd5I4++) {
452 if (pd5L4[pd5I4].tag === "5F49") pd5Otpk = pd5L4[pd5I4].value;
453 }
454 }
455 }
456 }
457 }
458 }
459 // R_PREP_DOWNLOAD 响应结构（S22_prep_dl §5.7.5 行 77-111：外层 BF21 CHOICE；downloadResponseError A1{transactionId 80, downloadErrorCode 02}）：运行时域，仅结构与在场性断言。
460 var pd5RSR = (pd5Run.final && pd5Run.final.resp) ? BindEs10xSingleRequest.parseBerTlv(pd5Run.final.resp) : [];
461 var pd5RSOuter = pd5RSR.length === 1 ? pd5RSR[0].tag : "absent";
462 var pd5RSBr = pd5RSR.length === 1 ? BindEs10xSingleRequest.parseBerTlv(pd5RSR[0].value) : [];
463 var pd5RSA0 = false, pd5RSA1 = false, pd5RSCk = [];
464 for (var pd5RSi = 0; pd5RSi < pd5RSBr.length; pd5RSi++) {
465 if (pd5RSBr[pd5RSi].tag === "A0") { pd5RSA0 = true; pd5RSCk = BindEs10xSingleRequest.parseBerTlv(pd5RSBr[pd5RSi].value); }
466 if (pd5RSBr[pd5RSi].tag === "A1") { pd5RSA1 = true; pd5RSCk = BindEs10xSingleRequest.parseBerTlv(pd5RSBr[pd5RSi].value); }
467 }
468 var pd5RS30 = false, pd5RS5F37 = false, pd5RS80 = false, pd5RS02 = false;
469 for (var pd5RSj = 0; pd5RSj < pd5RSCk.length; pd5RSj++) {
470 if (pd5RSCk[pd5RSj].tag === "30") pd5RS30 = true;
471 if (pd5RSCk[pd5RSj].tag === "5F37") pd5RS5F37 = true;
472 if (pd5RSCk[pd5RSj].tag === "80") pd5RS80 = true;
473 if (pd5RSCk[pd5RSj].tag === "02") pd5RS02 = true;
474 }
475 var pd5RS5F49 = false;
476 if (pd5RS30) {
477 for (var pd5RSk = 0; pd5RSk < pd5RSCk.length; pd5RSk++) {
478 if (pd5RSCk[pd5RSk].tag !== "30") continue;
479 var pd5RSU = BindEs10xSingleRequest.parseBerTlv(pd5RSCk[pd5RSk].value);
480 for (var pd5RSm = 0; pd5RSm < pd5RSU.length; pd5RSm++) {
481 if (pd5RSU[pd5RSm].tag === "5F49") pd5RS5F49 = true;
482 if (pd5RSU[pd5RSm].tag === "80") pd5RS80 = true;
483 }
484 }
485 }
486 bind.checkData("S5-C2 R_PREP_DOWNLOAD response structure" + " (downloadResponseError or no data)", "1", (pd5RSOuter === "absent" || (pd5RSA1 && pd5RS80 && pd5RS02)) ? "1" : "0");
487 // S5-C3: binding:prep_download_variant_tid_any_value_accepted(INVALID_TRANSACTION_ID|NO_AUTH;I_annexD3) (check_attestation)
488
489 // 步骤 6：SEQ06-IC3] MTD_STORE_DATA（tc_step）
490 // <L> length binding and the conditional 61XX + GET RESPONSE chain (D.4.2) are CasBind internal state (chaining rule).
491 var sdCla6 = s14.chan !== null ? (s14.chan <= 3 ? 128 + s14.chan : 188 + s14.chan).toString(16).toUpperCase() : null;
492 var s6 = bind.sendApdu(sdCla6, "E2", "91", "00", "BF2000", "00", "9000");
493 bind.checkData("S6-C1 SW", "9000", s6.sw);
494 // geca-proc ES10b Info 响应面（R_EUICC_INFO1，SGP.22 §5.7.7/§5.7.8 结构机械转录；响应外层 tag = 请求 tag）：绑定层结构步行 + 在场性断言。
495 var gw6 = BindGecaProc.parseGecaResponse(s6.resp, {outer: "BF20", required: ["82", "A9", "AA"], optional: []});
496 bind.checkData("S6-C2 R_EUICC_INFO1 outer tag", "BF20", gw6.outer_tag === null ? "absent" : gw6.outer_tag);
497 bind.checkData("S6-C2 R_EUICC_INFO1 required members present", "1", gw6.ok ? "1" : "0");
498 // S6-C3: kind 'requirement' pattern '' has no static generation face (corpus vacuum; see CaseIR unresolved).
499 // S6-C3: binding:prep_download_ci_cert_selection(highest-priority-CI;SGP.26) (check_attestation)
500
501 // 步骤 7：SEQ06-1] MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ31_130, RQ31_136, RQ57_031, RQ57_026, RQ57_036, RQ57_037, RQ57_038）
502 // PREP_DOWNLOAD 运行时绑定（PREP_DOWNLOAD_NO_AUTH；SGP.22 §5.7.5 PrepareDownloadRequest=BF21 成员序 smdpSigned2(30) → smdpSignature2(5F37) → smdpCertificate(30)）：
503 // 无前序 cma_decl 源（GIC CMA）：transactionId 运行时随机（G Annex B <S_TRANSACTION_ID>，vendor RandHexStr 机制）；euiccSignature1 无源→空串，诚实守卫拦截发送（不硬造签名明文）。
504 // 错误注入变体（I_annexD3_es10x）：cert＝SGP.26 v1.5 变体物料声明面（input/PREP_DOWNLOAD_VARIANT_MATERIALS.json，sha256 锚编译期已核）；ccRequiredFlag/签名形态按变体闭集定义。
505 var pd7Certs = ["308201DFA00302010202020101300A06082A8648CE3D04030230443110300E06035504030C07546573742043493111300F060355040B0C0854455354434552543110300E060355040A0C0752535054455354310B3009060355040613024954301E170D3230303430313038333434355A170D3330303333303038333434355A3025310D300B060355040A0C0441434D453114301206035504030C0B5445535420534D2D44502B3059301306072A8648CE3D020106082A8648CE3D03010703420004104C2AE3D02DEF9C979261A7C6710076B970721D0955A2644AE05FAE4BC2314E5DC09F6BF0118026165342E212318775E365F3B57325373066B9906E0BD1388DA381DF3081DC301F0603551D23041830168014F54172BDF98A95D65CBEB88A38A1C11D800A85C3301D0603551D0E04160414E6EAF71EE0FB9430ECCD1EBB421F881437C13263300E0603551D1104073005880388370A300E0603551D0F0101FF04040302078030170603551D200101FF040D300B300906076781120102010530610603551D1F045A3058302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D412E63726C302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D422E63726C300A06082A8648CE3D040302034800304502203EA51B0129FC11E843C38C8CB104244CCF92D8DDBCD4D5F9DAFD0AEF700A9B1C022100FEF382FF71FEFC58168A3607D5685DB7CB48F6B434261891496385BCD6B5857A", "308201E0A00302010202020101300A06082A8648CE3D04030230443110300E06035504030C07546573742043493111300F060355040B0C0854455354434552543110300E060355040A0C0752535054455354310B3009060355040613024954301E170D3230303430313038333434365A170D3330303333303038333434365A3025310D300B060355040A0C0441434D453114301206035504030C0B5445535420534D2D44502B305A301406072A8648CE3D020106092B240303020801010703420004893253ECC94C51DF4FEE6E0DB0951CFC65627481B5418E557069F487FAA15466A5CB8E10CC2B38099CF2A929F7F82DAC065126B71D0640961DB7F91A49E95612A381DF3081DC301F0603551D23041830168014C0BC70BA36929D43B467FF57570530E57AB8FCD8301D0603551D0E04160414A8C68DF449EB71EC723EAC132E40E4B6F54644FE300E0603551D1104073005880388370A300E0603551D0F0101FF04040302078030170603551D200101FF040D300B300906076781120102010530610603551D1F045A3058302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D412E63726C302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D422E63726C300A06082A8648CE3D04030203470030440220244ED22119D00D49D9EA4AC5D9A6D925FACFCD1998A96448A870CE47FE5E470E02206C4BC7223C925D548DDDD3D8DDD81118DA202973311F6012BB0A20E6DD2D7B7B"];
506 var pd7Sks = ["DCD694B778957E8E9ADDBDD94433E9EF8F73D11E491C48D425A38A9491BD3BED", "75FF322F416616DAE1A484EF71D4874FB0DF3295FD35C2CBA489FBB2BB9C7BF6"];
507 var pd7Tid = "";
508 for (var pd7Ri = 0; pd7Ri < 16; pd7Ri++) {
509 pd7Tid += bind.engine.Hex(Math.round(255 * Math.random()), 2);
510 }
511 var pd7Sel = 0;
512 var pd7Sig1 = "";
513 var pd7Dps = [["FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF", "FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFC", "5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B", "046B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C2964FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5", "FFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551"], ["A9FB57DBA1EEA9BC3E660A909D838D726E3BF623D52620282013481D1F6E5377", "7D5A0975FC2C3057EEF67530417AFFE7FB8055C126DC5C6CE94A4B44F330B5D9", "26DC5C6CE94A4B44F330B5D9BBD77CBF958416295CF7E1CE6BCCDC18FF8C07B6", "048BD2AEB9CB7E57CB2C4B482FFC81B7AFB9DE27E1E3BD23C23A4453BD9ACE3262547EF835C3DAC4FD97F8461A14611DC9C27745132DED8E545C1D54C72F046997", "A9FB57DBA1EEA9BC3E660A909D838D718C397AA3B561A6F7901E0E82974856A7"]];
514 if (pd7Sel < 0 || pd7Sig1 === "") {
515 // fail-closed 诚实面：CMA 运行时操作数缺席（CMA 失败/未执行）→ BF21 不发送（前序 CMA 步断言面已计错，本步不伪造通过）。
516 bind.checkData("S7-C1 SW", "9000", "pd7_not_executed:cma_operands_absent");
517 bind.checkData("S7-C2 R_PREP_DOWNLOAD response structure", "1", "pd7_not_executed:cma_operands_absent");
518 } else {
519 bind.engine.InitEccDomainParams(pd7Dps[pd7Sel][0], pd7Dps[pd7Sel][1], pd7Dps[pd7Sel][2], pd7Dps[pd7Sel][3], pd7Dps[pd7Sel][4], 1);
520 var pd7S2 = BindEs10xSingleRequest.buildTlv("30",
521 BindEs10xSingleRequest.buildTlv("80", pd7Tid)
522 + BindEs10xSingleRequest.buildTlv("01", "00"));
523 var pd7Sgn = "";
524 while (pd7Sgn.length != 2 * pd7Sks[pd7Sel].length) {
525 bind.engine.SleepTime(2000);
526 pd7Sgn = bind.engine.EccSignData(pd7Sks[pd7Sel], pd7S2 + BindEs10xSingleRequest.buildTlv("5F37", pd7Sig1), 33);
527 }
528 var pd7Req = BindEs10xSingleRequest.buildTlv("BF21",
529 pd7S2
530 + BindEs10xSingleRequest.buildTlv("5F37", pd7Sgn)
531 + BindEs10xSingleRequest.buildTlv("30", pd7Certs[pd7Sel]));
532 var pd7Run = BindEs10xSingleRequest.runTransport(bind.sendApdu,
533 {cla: "", ins: "E2", p1: "91", p2: "00", data: pd7Req,
534 le: "00", blockSize: 255, blockSw: "9000", final_sw: "9000"});
535 var pd7Sw = (pd7Run.final && pd7Run.final.sw) ? pd7Run.final.sw : "transport_error";
536 bind.checkData("S7-C1 SW", "9000", pd7Sw);
537 // euiccOtpk（5F49）运行时提取面登记：响应 ok 分支 euiccSigned2 成员（BF21 A0 30 5F49 路径），供后续步（RETRY 形 bppEuiccOtpk/BPP 装配）消费。
538 var pd7Otpk = "";
539 if (pd7Run.final && pd7Run.final.resp) {
540 var pd7L1 = BindEs10xSingleRequest.parseBerTlv(pd7Run.final.resp);
541 for (var pd7I1 = 0; pd7I1 < pd7L1.length && pd7Otpk === ""; pd7I1++) {
542 if (pd7L1[pd7I1].tag !== "BF21") continue;
543 var pd7L2 = BindEs10xSingleRequest.parseBerTlv(pd7L1[pd7I1].value);
544 for (var pd7I2 = 0; pd7I2 < pd7L2.length && pd7Otpk === ""; pd7I2++) {
545 if (pd7L2[pd7I2].tag !== "A0") continue;
546 var pd7L3 = BindEs10xSingleRequest.parseBerTlv(pd7L2[pd7I2].value);
547 for (var pd7I3 = 0; pd7I3 < pd7L3.length && pd7Otpk === ""; pd7I3++) {
548 if (pd7L3[pd7I3].tag !== "30") continue;
549 var pd7L4 = BindEs10xSingleRequest.parseBerTlv(pd7L3[pd7I3].value);
550 for (var pd7I4 = 0; pd7I4 < pd7L4.length; pd7I4++) {
551 if (pd7L4[pd7I4].tag === "5F49") pd7Otpk = pd7L4[pd7I4].value;
552 }
553 }
554 }
555 }
556 }
557 }
558 // R_PREP_DOWNLOAD 响应结构（S22_prep_dl §5.7.5 行 77-111：外层 BF21 CHOICE；downloadResponseError A1{transactionId 80, downloadErrorCode 02}）：运行时域，仅结构与在场性断言。
559 var pd7RSR = (pd7Run.final && pd7Run.final.resp) ? BindEs10xSingleRequest.parseBerTlv(pd7Run.final.resp) : [];
560 var pd7RSOuter = pd7RSR.length === 1 ? pd7RSR[0].tag : "absent";
561 var pd7RSBr = pd7RSR.length === 1 ? BindEs10xSingleRequest.parseBerTlv(pd7RSR[0].value) : [];
562 var pd7RSA0 = false, pd7RSA1 = false, pd7RSCk = [];
563 for (var pd7RSi = 0; pd7RSi < pd7RSBr.length; pd7RSi++) {
564 if (pd7RSBr[pd7RSi].tag === "A0") { pd7RSA0 = true; pd7RSCk = BindEs10xSingleRequest.parseBerTlv(pd7RSBr[pd7RSi].value); }
565 if (pd7RSBr[pd7RSi].tag === "A1") { pd7RSA1 = true; pd7RSCk = BindEs10xSingleRequest.parseBerTlv(pd7RSBr[pd7RSi].value); }
566 }
567 var pd7RS30 = false, pd7RS5F37 = false, pd7RS80 = false, pd7RS02 = false;
568 for (var pd7RSj = 0; pd7RSj < pd7RSCk.length; pd7RSj++) {
569 if (pd7RSCk[pd7RSj].tag === "30") pd7RS30 = true;
570 if (pd7RSCk[pd7RSj].tag === "5F37") pd7RS5F37 = true;
571 if (pd7RSCk[pd7RSj].tag === "80") pd7RS80 = true;
572 if (pd7RSCk[pd7RSj].tag === "02") pd7RS02 = true;
573 }
574 var pd7RS5F49 = false;
575 if (pd7RS30) {
576 for (var pd7RSk = 0; pd7RSk < pd7RSCk.length; pd7RSk++) {
577 if (pd7RSCk[pd7RSk].tag !== "30") continue;
578 var pd7RSU = BindEs10xSingleRequest.parseBerTlv(pd7RSCk[pd7RSk].value);
579 for (var pd7RSm = 0; pd7RSm < pd7RSU.length; pd7RSm++) {
580 if (pd7RSU[pd7RSm].tag === "5F49") pd7RS5F49 = true;
581 if (pd7RSU[pd7RSm].tag === "80") pd7RS80 = true;
582 }
583 }
584 }
585 bind.checkData("S7-C2 R_PREP_DOWNLOAD response structure" + " (downloadResponseError or no data)", "1", (pd7RSOuter === "absent" || (pd7RSA1 && pd7RS80 && pd7RS02)) ? "1" : "0");
586 // S7-C3: binding:prep_download_variant_tid_any_value_accepted(INVALID_TRANSACTION_ID|NO_AUTH;I_annexD3) (check_attestation)
587
588 // 步骤 8：SEQ07-1] MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ31_130, RQ31_134, RQ31_136, RQ57_025, RQ57_031, RQ57_036, RQ57_037, RQ57_038, RQ45_006, RQ45_026_1, RQ45_026, RQ45_028）
589 // PREP_DOWNLOAD 运行时绑定（PREP_DOWN_INV_CURVE；SGP.22 §5.7.5 PrepareDownloadRequest=BF21 成员序 smdpSigned2(30) → smdpSignature2(5F37) → smdpCertificate(30)）：
590 // 无前序 cma_decl 源（GIC CMA）：transactionId 运行时随机（G Annex B <S_TRANSACTION_ID>，vendor RandHexStr 机制）；euiccSignature1 无源→空串，诚实守卫拦截发送（不硬造签名明文）。
591 // 错误注入变体（I_annexD3_es10x）：cert＝SGP.26 v1.5 变体物料声明面（input/PREP_DOWNLOAD_VARIANT_MATERIALS.json，sha256 锚编译期已核）；ccRequiredFlag/签名形态按变体闭集定义。
592 var pd8Certs = ["308201CFA00302010202020901300A06082A8648CE3D04030230443110300E06035504030C07546573742043493111300F060355040B0C0854455354434552543110300E060355040A0C0752535054455354310B3009060355040613024954301E170D3230303430393135323333345A170D3330303430373135323333345A3025310D300B060355040A0C0441434D453114301206035504030C0B5445535420534D2D44502B3049301306072A8648CE3D020106082A8648CE3D03010103320004B833DE8CAA3B8C34F017E2336A1702CC316FDAC57970FB74FD1112F9538358F6311CAC726280875CD0F345ECD44BD0BDA381DF3081DC301F0603551D23041830168014F54172BDF98A95D65CBEB88A38A1C11D800A85C3301D0603551D0E04160414B549B2F12BFB70B8BE103EA56ED9D8211E62AB89300E0603551D1104073005880388370A300E0603551D0F0101FF04040302078030170603551D200101FF040D300B300906076781120102010530610603551D1F045A3058302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D412E63726C302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D422E63726C300A06082A8648CE3D040302034700304402207DF2501A65D3105451D3CE225FA4FA6B861363A9FEADB2225E1B201872F5DD0702205D68B00BE432A9E8EFBED6F1C1155586EE7DB29FC58F4CB4D9DE60C36705B919", "308201D0A00302010202020901300A06082A8648CE3D04030230443110300E06035504030C07546573742043493111300F060355040B0C0854455354434552543110300E060355040A0C0752535054455354310B3009060355040613024954301E170D3230303430393135323333345A170D3330303430373135323333345A3025310D300B060355040A0C0441434D453114301206035504030C0B5445535420534D2D44502B304A301406072A8648CE3D020106092B24030302080101030332000462864AE7B8A5376473177E86A09162C2BC6D14D05BF932EF50F92FA0BEBC693A19D21611B76C173AC397CD2B39B1C4AEA381DF3081DC301F0603551D23041830168014C0BC70BA36929D43B467FF57570530E57AB8FCD8301D0603551D0E04160414E9B402A455F7CEA525A1565D167D94A30CB1A55E300E0603551D1104073005880388370A300E0603551D0F0101FF04040302078030170603551D200101FF040D300B300906076781120102010530610603551D1F045A3058302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D412E63726C302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D422E63726C300A06082A8648CE3D040302034700304402200D22D098327B7DE35E6AC1BCA12939B48869D0C76C38A5BBCE43397D7194FD4402200E562320249C7D596B850BC585E3D86A00CD7648B8D346D112A8EFED38938A03"];
593 var pd8Sks = ["DCD694B778957E8E9ADDBDD94433E9EF8F73D11E491C48D425A38A9491BD3BED", "75FF322F416616DAE1A484EF71D4874FB0DF3295FD35C2CBA489FBB2BB9C7BF6"];
594 var pd8Tid = "";
595 for (var pd8Ri = 0; pd8Ri < 16; pd8Ri++) {
596 pd8Tid += bind.engine.Hex(Math.round(255 * Math.random()), 2);
597 }
598 var pd8Sel = 0;
599 var pd8Sig1 = "";
600 var pd8Dps = [["FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF", "FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFC", "5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B", "046B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C2964FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5", "FFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551"], ["A9FB57DBA1EEA9BC3E660A909D838D726E3BF623D52620282013481D1F6E5377", "7D5A0975FC2C3057EEF67530417AFFE7FB8055C126DC5C6CE94A4B44F330B5D9", "26DC5C6CE94A4B44F330B5D9BBD77CBF958416295CF7E1CE6BCCDC18FF8C07B6", "048BD2AEB9CB7E57CB2C4B482FFC81B7AFB9DE27E1E3BD23C23A4453BD9ACE3262547EF835C3DAC4FD97F8461A14611DC9C27745132DED8E545C1D54C72F046997", "A9FB57DBA1EEA9BC3E660A909D838D718C397AA3B561A6F7901E0E82974856A7"]];
601 if (pd8Sel < 0 || pd8Sig1 === "") {
602 // fail-closed 诚实面：CMA 运行时操作数缺席（CMA 失败/未执行）→ BF21 不发送（前序 CMA 步断言面已计错，本步不伪造通过）。
603 bind.checkData("S8-C1 SW", "9000", "pd8_not_executed:cma_operands_absent");
604 bind.checkData("S8-C2 R_PREP_DOWNLOAD response structure", "1", "pd8_not_executed:cma_operands_absent");
605 } else {
606 bind.engine.InitEccDomainParams(pd8Dps[pd8Sel][0], pd8Dps[pd8Sel][1], pd8Dps[pd8Sel][2], pd8Dps[pd8Sel][3], pd8Dps[pd8Sel][4], 1);
607 var pd8S2 = BindEs10xSingleRequest.buildTlv("30",
608 BindEs10xSingleRequest.buildTlv("80", pd8Tid)
609 + BindEs10xSingleRequest.buildTlv("01", "00"));
610 var pd8Sgn = "";
611 while (pd8Sgn.length != 2 * pd8Sks[pd8Sel].length) {
612 bind.engine.SleepTime(2000);
613 pd8Sgn = bind.engine.EccSignData(pd8Sks[pd8Sel], pd8S2 + BindEs10xSingleRequest.buildTlv("5F37", pd8Sig1), 33);
614 }
615 var pd8Req = BindEs10xSingleRequest.buildTlv("BF21",
616 pd8S2
617 + BindEs10xSingleRequest.buildTlv("5F37", pd8Sgn)
618 + BindEs10xSingleRequest.buildTlv("30", pd8Certs[pd8Sel]));
619 var pd8Run = BindEs10xSingleRequest.runTransport(bind.sendApdu,
620 {cla: "", ins: "E2", p1: "91", p2: "00", data: pd8Req,
621 le: "00", blockSize: 255, blockSw: "9000", final_sw: "9000"});
622 var pd8Sw = (pd8Run.final && pd8Run.final.sw) ? pd8Run.final.sw : "transport_error";
623 bind.checkData("S8-C1 SW", "9000", pd8Sw);
624 // euiccOtpk（5F49）运行时提取面登记：响应 ok 分支 euiccSigned2 成员（BF21 A0 30 5F49 路径），供后续步（RETRY 形 bppEuiccOtpk/BPP 装配）消费。
625 var pd8Otpk = "";
626 if (pd8Run.final && pd8Run.final.resp) {
627 var pd8L1 = BindEs10xSingleRequest.parseBerTlv(pd8Run.final.resp);
628 for (var pd8I1 = 0; pd8I1 < pd8L1.length && pd8Otpk === ""; pd8I1++) {
629 if (pd8L1[pd8I1].tag !== "BF21") continue;
630 var pd8L2 = BindEs10xSingleRequest.parseBerTlv(pd8L1[pd8I1].value);
631 for (var pd8I2 = 0; pd8I2 < pd8L2.length && pd8Otpk === ""; pd8I2++) {
632 if (pd8L2[pd8I2].tag !== "A0") continue;
633 var pd8L3 = BindEs10xSingleRequest.parseBerTlv(pd8L2[pd8I2].value);
634 for (var pd8I3 = 0; pd8I3 < pd8L3.length && pd8Otpk === ""; pd8I3++) {
635 if (pd8L3[pd8I3].tag !== "30") continue;
636 var pd8L4 = BindEs10xSingleRequest.parseBerTlv(pd8L3[pd8I3].value);
637 for (var pd8I4 = 0; pd8I4 < pd8L4.length; pd8I4++) {
638 if (pd8L4[pd8I4].tag === "5F49") pd8Otpk = pd8L4[pd8I4].value;
639 }
640 }
641 }
642 }
643 }
644 }
645 // R_PREP_DOWNLOAD 响应结构（S22_prep_dl §5.7.5 行 77-111：外层 BF21 CHOICE；downloadResponseError A1{transactionId 80, downloadErrorCode 02}）：运行时域，仅结构与在场性断言。
646 var pd8RSR = (pd8Run.final && pd8Run.final.resp) ? BindEs10xSingleRequest.parseBerTlv(pd8Run.final.resp) : [];
647 var pd8RSOuter = pd8RSR.length === 1 ? pd8RSR[0].tag : "absent";
648 var pd8RSBr = pd8RSR.length === 1 ? BindEs10xSingleRequest.parseBerTlv(pd8RSR[0].value) : [];
649 var pd8RSA0 = false, pd8RSA1 = false, pd8RSCk = [];
650 for (var pd8RSi = 0; pd8RSi < pd8RSBr.length; pd8RSi++) {
651 if (pd8RSBr[pd8RSi].tag === "A0") { pd8RSA0 = true; pd8RSCk = BindEs10xSingleRequest.parseBerTlv(pd8RSBr[pd8RSi].value); }
652 if (pd8RSBr[pd8RSi].tag === "A1") { pd8RSA1 = true; pd8RSCk = BindEs10xSingleRequest.parseBerTlv(pd8RSBr[pd8RSi].value); }
653 }
654 var pd8RS30 = false, pd8RS5F37 = false, pd8RS80 = false, pd8RS02 = false;
655 for (var pd8RSj = 0; pd8RSj < pd8RSCk.length; pd8RSj++) {
656 if (pd8RSCk[pd8RSj].tag === "30") pd8RS30 = true;
657 if (pd8RSCk[pd8RSj].tag === "5F37") pd8RS5F37 = true;
658 if (pd8RSCk[pd8RSj].tag === "80") pd8RS80 = true;
659 if (pd8RSCk[pd8RSj].tag === "02") pd8RS02 = true;
660 }
661 var pd8RS5F49 = false;
662 if (pd8RS30) {
663 for (var pd8RSk = 0; pd8RSk < pd8RSCk.length; pd8RSk++) {
664 if (pd8RSCk[pd8RSk].tag !== "30") continue;
665 var pd8RSU = BindEs10xSingleRequest.parseBerTlv(pd8RSCk[pd8RSk].value);
666 for (var pd8RSm = 0; pd8RSm < pd8RSU.length; pd8RSm++) {
667 if (pd8RSU[pd8RSm].tag === "5F49") pd8RS5F49 = true;
668 if (pd8RSU[pd8RSm].tag === "80") pd8RS80 = true;
669 }
670 }
671 }
672 bind.checkData("S8-C2 R_PREP_DOWNLOAD response structure" + " (downloadResponseError or no data)", "1", (pd8RSOuter === "absent" || (pd8RSA1 && pd8RS80 && pd8RS02)) ? "1" : "0");
673 // S8-C3: binding:prep_download_response_tid_echo(request-S_TRANSACTION_ID;S22_prep_dl) (check_attestation)
674
675 // 步骤 9：SEQ08-1] MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ31_130, RQ31_131, RQ31_136, RQ57_027, RQ57_030, RQ57_031, RQ57_036, RQ57_037, RQ57_038, RQ45_006, RQ45_026_1, RQ45_026, RQ45_028, RQ45_030）
676 // PREP_DOWNLOAD 运行时绑定（PREP_DOWNLOAD_INV_OID；SGP.22 §5.7.5 PrepareDownloadRequest=BF21 成员序 smdpSigned2(30) → smdpSignature2(5F37) → smdpCertificate(30)）：
677 // 无前序 cma_decl 源（GIC CMA）：transactionId 运行时随机（G Annex B <S_TRANSACTION_ID>，vendor RandHexStr 机制）；euiccSignature1 无源→空串，诚实守卫拦截发送（不硬造签名明文）。
678 // 错误注入变体（I_annexD3_es10x）：cert＝SGP.26 v1.5 变体物料声明面（input/PREP_DOWNLOAD_VARIANT_MATERIALS.json，sha256 锚编译期已核）；ccRequiredFlag/签名形态按变体闭集定义。
679 var pd9Certs = ["308201DFA00302010202020100300A06082A8648CE3D04030230443110300E06035504030C07546573742043493111300F060355040B0C0854455354434552543110300E060355040A0C0752535054455354310B3009060355040613024954301E170D3230303430313038333133305A170D3330303333303038333133305A3025310D300B060355040A0C0441434D453114301206035504030C0B5445535420534D2D44502B3059301306072A8648CE3D020106082A8648CE3D030107034200044DFED4F4694791BF1695CEA0307A35B418019695387BB75B7D2447B6B5209F0445AE4E5E521CD13888D75FE07C8580222AE20DBAAC1D77CD76304993421BD739A381DF3081DC301F0603551D23041830168014F54172BDF98A95D65CBEB88A38A1C11D800A85C3301D0603551D0E04160414BD5A82CC1A96602118BA7560A1FF83A78B210BE5300E0603551D1104073005880388370A300E0603551D0F0101FF04040302078030170603551D200101FF040D300B300906076781120102010430610603551D1F045A3058302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D412E63726C302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D422E63726C300A06082A8648CE3D040302034700304402200823EE7DFA5E3DD07838E930F81BC34AE99F06CBA35927FE9E502C464DC1FEE302200D2D4087DB01A5382D21690AC0488B15067FB2460D336332446CA99F08A8A4EF", "308201E0A00302010202020100300A06082A8648CE3D04030230443110300E06035504030C07546573742043493111300F060355040B0C0854455354434552543110300E060355040A0C0752535054455354310B3009060355040613024954301E170D3230303430313038333133305A170D3330303333303038333133305A3025310D300B060355040A0C0441434D453114301206035504030C0B5445535420534D2D44502B305A301406072A8648CE3D020106092B240303020801010703420004255D7DAF00EF841D76FA7A63D63EB3FE6C9F70492D381923F8F8BD7B24F3C5AD168EBE3B09DD80F29E7FFD24A4D1BE747F8323E472928396DDE9E0151CEABA18A381DF3081DC301F0603551D23041830168014C0BC70BA36929D43B467FF57570530E57AB8FCD8301D0603551D0E0416041479A4BD4D78FF4734BC6045CF9196244A1FB84BEB300E0603551D1104073005880388370A300E0603551D0F0101FF04040302078030170603551D200101FF040D300B300906076781120102010430610603551D1F045A3058302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D412E63726C302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D422E63726C300A06082A8648CE3D0403020347003044022003078BD459045184BC50C1397141F8B90398E6B81737EC703403D5CB0DC0DFC302201A38E7FC84D3DB1179FBB17199231F2D635ED7A8AB4049774057B0ACDF726063"];
680 var pd9Sks = ["DCD694B778957E8E9ADDBDD94433E9EF8F73D11E491C48D425A38A9491BD3BED", "75FF322F416616DAE1A484EF71D4874FB0DF3295FD35C2CBA489FBB2BB9C7BF6"];
681 var pd9Tid = "";
682 for (var pd9Ri = 0; pd9Ri < 16; pd9Ri++) {
683 pd9Tid += bind.engine.Hex(Math.round(255 * Math.random()), 2);
684 }
685 var pd9Sel = 0;
686 var pd9Sig1 = "";
687 var pd9Dps = [["FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF", "FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFC", "5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B", "046B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C2964FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5", "FFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551"], ["A9FB57DBA1EEA9BC3E660A909D838D726E3BF623D52620282013481D1F6E5377", "7D5A0975FC2C3057EEF67530417AFFE7FB8055C126DC5C6CE94A4B44F330B5D9", "26DC5C6CE94A4B44F330B5D9BBD77CBF958416295CF7E1CE6BCCDC18FF8C07B6", "048BD2AEB9CB7E57CB2C4B482FFC81B7AFB9DE27E1E3BD23C23A4453BD9ACE3262547EF835C3DAC4FD97F8461A14611DC9C27745132DED8E545C1D54C72F046997", "A9FB57DBA1EEA9BC3E660A909D838D718C397AA3B561A6F7901E0E82974856A7"]];
688 if (pd9Sel < 0 || pd9Sig1 === "") {
689 // fail-closed 诚实面：CMA 运行时操作数缺席（CMA 失败/未执行）→ BF21 不发送（前序 CMA 步断言面已计错，本步不伪造通过）。
690 bind.checkData("S9-C1 SW", "9000", "pd9_not_executed:cma_operands_absent");
691 bind.checkData("S9-C2 R_PREP_DOWNLOAD response structure", "1", "pd9_not_executed:cma_operands_absent");
692 } else {
693 bind.engine.InitEccDomainParams(pd9Dps[pd9Sel][0], pd9Dps[pd9Sel][1], pd9Dps[pd9Sel][2], pd9Dps[pd9Sel][3], pd9Dps[pd9Sel][4], 1);
694 var pd9S2 = BindEs10xSingleRequest.buildTlv("30",
695 BindEs10xSingleRequest.buildTlv("80", pd9Tid)
696 + BindEs10xSingleRequest.buildTlv("01", "00"));
697 var pd9Sgn = "";
698 while (pd9Sgn.length != 2 * pd9Sks[pd9Sel].length) {
699 bind.engine.SleepTime(2000);
700 pd9Sgn = bind.engine.EccSignData(pd9Sks[pd9Sel], pd9S2 + BindEs10xSingleRequest.buildTlv("5F37", pd9Sig1), 33);
701 }
702 var pd9Req = BindEs10xSingleRequest.buildTlv("BF21",
703 pd9S2
704 + BindEs10xSingleRequest.buildTlv("5F37", pd9Sgn)
705 + BindEs10xSingleRequest.buildTlv("30", pd9Certs[pd9Sel]));
706 var pd9Run = BindEs10xSingleRequest.runTransport(bind.sendApdu,
707 {cla: "", ins: "E2", p1: "91", p2: "00", data: pd9Req,
708 le: "00", blockSize: 255, blockSw: "9000", final_sw: "9000"});
709 var pd9Sw = (pd9Run.final && pd9Run.final.sw) ? pd9Run.final.sw : "transport_error";
710 bind.checkData("S9-C1 SW", "9000", pd9Sw);
711 // euiccOtpk（5F49）运行时提取面登记：响应 ok 分支 euiccSigned2 成员（BF21 A0 30 5F49 路径），供后续步（RETRY 形 bppEuiccOtpk/BPP 装配）消费。
712 var pd9Otpk = "";
713 if (pd9Run.final && pd9Run.final.resp) {
714 var pd9L1 = BindEs10xSingleRequest.parseBerTlv(pd9Run.final.resp);
715 for (var pd9I1 = 0; pd9I1 < pd9L1.length && pd9Otpk === ""; pd9I1++) {
716 if (pd9L1[pd9I1].tag !== "BF21") continue;
717 var pd9L2 = BindEs10xSingleRequest.parseBerTlv(pd9L1[pd9I1].value);
718 for (var pd9I2 = 0; pd9I2 < pd9L2.length && pd9Otpk === ""; pd9I2++) {
719 if (pd9L2[pd9I2].tag !== "A0") continue;
720 var pd9L3 = BindEs10xSingleRequest.parseBerTlv(pd9L2[pd9I2].value);
721 for (var pd9I3 = 0; pd9I3 < pd9L3.length && pd9Otpk === ""; pd9I3++) {
722 if (pd9L3[pd9I3].tag !== "30") continue;
723 var pd9L4 = BindEs10xSingleRequest.parseBerTlv(pd9L3[pd9I3].value);
724 for (var pd9I4 = 0; pd9I4 < pd9L4.length; pd9I4++) {
725 if (pd9L4[pd9I4].tag === "5F49") pd9Otpk = pd9L4[pd9I4].value;
726 }
727 }
728 }
729 }
730 }
731 }
732 // R_PREP_DOWNLOAD 响应结构（S22_prep_dl §5.7.5 行 77-111：外层 BF21 CHOICE；downloadResponseError A1{transactionId 80, downloadErrorCode 02}）：运行时域，仅结构与在场性断言。
733 var pd9RSR = (pd9Run.final && pd9Run.final.resp) ? BindEs10xSingleRequest.parseBerTlv(pd9Run.final.resp) : [];
734 var pd9RSOuter = pd9RSR.length === 1 ? pd9RSR[0].tag : "absent";
735 var pd9RSBr = pd9RSR.length === 1 ? BindEs10xSingleRequest.parseBerTlv(pd9RSR[0].value) : [];
736 var pd9RSA0 = false, pd9RSA1 = false, pd9RSCk = [];
737 for (var pd9RSi = 0; pd9RSi < pd9RSBr.length; pd9RSi++) {
738 if (pd9RSBr[pd9RSi].tag === "A0") { pd9RSA0 = true; pd9RSCk = BindEs10xSingleRequest.parseBerTlv(pd9RSBr[pd9RSi].value); }
739 if (pd9RSBr[pd9RSi].tag === "A1") { pd9RSA1 = true; pd9RSCk = BindEs10xSingleRequest.parseBerTlv(pd9RSBr[pd9RSi].value); }
740 }
741 var pd9RS30 = false, pd9RS5F37 = false, pd9RS80 = false, pd9RS02 = false;
742 for (var pd9RSj = 0; pd9RSj < pd9RSCk.length; pd9RSj++) {
743 if (pd9RSCk[pd9RSj].tag === "30") pd9RS30 = true;
744 if (pd9RSCk[pd9RSj].tag === "5F37") pd9RS5F37 = true;
745 if (pd9RSCk[pd9RSj].tag === "80") pd9RS80 = true;
746 if (pd9RSCk[pd9RSj].tag === "02") pd9RS02 = true;
747 }
748 var pd9RS5F49 = false;
749 if (pd9RS30) {
750 for (var pd9RSk = 0; pd9RSk < pd9RSCk.length; pd9RSk++) {
751 if (pd9RSCk[pd9RSk].tag !== "30") continue;
752 var pd9RSU = BindEs10xSingleRequest.parseBerTlv(pd9RSCk[pd9RSk].value);
753 for (var pd9RSm = 0; pd9RSm < pd9RSU.length; pd9RSm++) {
754 if (pd9RSU[pd9RSm].tag === "5F49") pd9RS5F49 = true;
755 if (pd9RSU[pd9RSm].tag === "80") pd9RS80 = true;
756 }
757 }
758 }
759 bind.checkData("S9-C2 R_PREP_DOWNLOAD response structure" + " (downloadResponseError or no data)", "1", (pd9RSOuter === "absent" || (pd9RSA1 && pd9RS80 && pd9RS02)) ? "1" : "0");
760 // S9-C3: binding:prep_download_response_tid_echo(request-S_TRANSACTION_ID;S22_prep_dl) (check_attestation)
761}
762
完整 unified diff
行级差异：新增 760 行 / 删除 323 行（以 -man 为基准，unified 上下文 3 行）。
展开 diff（1088 行）
--- -man
+++ -cas
@@ -1,325 +1,762 @@
-// slice of Import\TestCase_SGP_23.js - cases: TC_eUICC_ES10b_PrepareDownloadErrorCases_01_Error_No_Hashed_Confirmation_Code_but_with_Confirmation_Code_Required_Flag_set_to_TRUE + TC_eUICC_ES10b_PrepareDownloadErrorCases_02_Error_With_incorrect_CERT_DPpb_ECDSA + TC_eUICC_ES10b_PrepareDownloadErrorCases_03_Error_CERT_DPpb_ECDSA_and_CERT_DPauth_ECDSA_not_belonging_to_the_same_entity + TC_eUICC_ES10b_PrepareDownloadErrorCases_04_Error_With_invalid_SM_DP_signature + TC_eUICC_ES10b_PrepareDownloadErrorCases_05_Error_With_invalid_Transaction_ID + TC_eUICC_ES10b_PrepareDownloadErrorCases_06_Error_SM_DP_has_not_been_previously_authenticated + TC_eUICC_ES10b_PrepareDownloadErrorCases_07_Error_Unsupported_curve + TC_eUICC_ES10b_PrepareDownloadErrorCases_08_Error_Invalid_Certificate_Role_OID (extracted verbatim)
-
-function TC_eUICC_ES10b_PrepareDownloadErrorCases_01_Error_No_Hashed_Confirmation_Code_but_with_Confirmation_Code_Required_Flag_set_to_TRUE()
-{
- tracenamestr = "执行PrepareDownload，不带hashCc，但ccRequiredFlag为TRUE";
- curDis.TraceStart(sno++,tracenamestr);
-
- curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
- Ini_powerOn_eUICC_LPAe_not_activate();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
- TS_MANAGE_CHANNEL_OPEN();
-
- curLogicChannel = 1;
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
- TS_SELECT("Select ISD",ISD_R_AID,"9000");
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
- var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL1_DATA);
- Profile_load_procedure.ICCID = ICCID_OP_PROF1;
- Profile_load_procedure.ES10b_GetEUICCInfo1();
-
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
- Profile_load_procedure.ES10b_GetEUICCChallenge();
-
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
- Profile_load_procedure.ES10b_AuthenticateServer();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest,确认码标记为true，但不包含Confirmation Code；");
- Profile_load_procedure.ccRequiredFlag = "FF";
- Profile_load_procedure.PrepareDownloadisErrorTest = true;
- Profile_load_procedure.preparedownloadErrorCode = DownloadErrorCode.undefinedError;
- Profile_load_procedure.ES10b_PrepareDownload();
-
- RecoverCard();
-}
-
-function TC_eUICC_ES10b_PrepareDownloadErrorCases_02_Error_With_incorrect_CERT_DPpb_ECDSA()
-{
- tracenamestr = "执行PrepareDownload，使用不正确的CERT.DPpb.ECDSA（即无效签名）";
- curDis.TraceStart(sno++,tracenamestr);
-
- curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
- Ini_powerOn_eUICC_LPAe_not_activate();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
- TS_MANAGE_CHANNEL_OPEN();
-
- curLogicChannel = 1;
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
- TS_SELECT("Select ISD",ISD_R_AID,"9000");
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
- var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL1_DATA);
- Profile_load_procedure.ICCID = ICCID_OP_PROF1;
- Profile_load_procedure.ES10b_GetEUICCInfo1();
-
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
- Profile_load_procedure.ES10b_GetEUICCChallenge();
-
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
- Profile_load_procedure.ES10b_AuthenticateServer();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest，使用错误的CERT.DPpb.ECDSA（比如签名错）；");
- Profile_load_procedure.DPbpInforObj.Cert = CERT_S_SM_DPpb_INV_SIGN_NIST;
- Profile_load_procedure.PrepareDownloadisErrorTest = true;
- Profile_load_procedure.preparedownloadErrorCode = DownloadErrorCode.invalidCertificate;
- Profile_load_procedure.ES10b_PrepareDownload();
-
- RecoverCard();
-}
-
-function TC_eUICC_ES10b_PrepareDownloadErrorCases_03_Error_CERT_DPpb_ECDSA_and_CERT_DPauth_ECDSA_not_belonging_to_the_same_entity()
-{
- tracenamestr = "执行PrepareDownload，CERT.DPpb.ECDSA和CERT.DPauth.ECDSA不属于同一实体";
- curDis.TraceStart(sno++,tracenamestr);
-
- curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
- Ini_powerOn_eUICC_LPAe_not_activate();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
- TS_MANAGE_CHANNEL_OPEN();
-
- curLogicChannel = 1;
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
- TS_SELECT("Select ISD",ISD_R_AID,"9000");
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
-
- var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL1_DATA);
- Profile_load_procedure.ICCID = ICCID_OP_PROF1;
- Profile_load_procedure.ES10b_GetEUICCInfo1();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
- Profile_load_procedure.ES10b_GetEUICCChallenge();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
- Profile_load_procedure.ES10b_AuthenticateServer();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest，使用错误的CERT.DPpb.ECDSA（错误的OID）；");
- Profile_load_procedure.DPbpInforObj.Cert = CERT_S_SM_DP2pb_ECDSA_NIST;
- Profile_load_procedure.PrepareDownloadisErrorTest = true;
- Profile_load_procedure.preparedownloadErrorCode = DownloadErrorCode.invalidCertificate;
- Profile_load_procedure.ES10b_PrepareDownload();
-
- RecoverCard();
-
-}
-
-function TC_eUICC_ES10b_PrepareDownloadErrorCases_04_Error_With_invalid_SM_DP_signature()
-{
- tracenamestr = "执行PrepareDownload，SM-DP+签名无效";
- curDis.TraceStart(sno++,tracenamestr);
-
- curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
- Ini_powerOn_eUICC_LPAe_not_activate();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
- TS_MANAGE_CHANNEL_OPEN();
-
- curLogicChannel = 1;
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
- TS_SELECT("Select ISD",ISD_R_AID,"9000");
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
-
- var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL1_DATA);
- Profile_load_procedure.ICCID = ICCID_OP_PROF1;
- Profile_load_procedure.ES10b_GetEUICCInfo1();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
- Profile_load_procedure.ES10b_GetEUICCChallenge();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
- Profile_load_procedure.ES10b_AuthenticateServer();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest，使用无效的SM-DP+签名；");
- Profile_load_procedure.DPbpInforObj.D_key = curStrHandle.RandHexStr(32);
- Profile_load_procedure.PrepareDownloadisErrorTest = true;
- Profile_load_procedure.preparedownloadErrorCode = DownloadErrorCode.invalidSignature;
- Profile_load_procedure.ES10b_PrepareDownload();
-
- RecoverCard();
-
-}
-
-function TC_eUICC_ES10b_PrepareDownloadErrorCases_05_Error_With_invalid_Transaction_ID()
-{
- tracenamestr = "执行PrepareDownload，Transaction ID无效";
- curDis.TraceStart(sno++,tracenamestr);
-
- curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
- Ini_powerOn_eUICC_LPAe_not_activate();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
- TS_MANAGE_CHANNEL_OPEN();
-
- curLogicChannel = 1;
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
- TS_SELECT("Select ISD",ISD_R_AID,"9000");
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
-
- var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL1_DATA);
- Profile_load_procedure.ICCID = ICCID_OP_PROF1;
- Profile_load_procedure.ES10b_GetEUICCInfo1();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
- Profile_load_procedure.ES10b_GetEUICCChallenge();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
- Profile_load_procedure.ES10b_AuthenticateServer();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest，使用无效的Transaction ID；");
- Profile_load_procedure.transactionId = curStrHandle.RandHexStr(16);
- Profile_load_procedure.PrepareDownloadisErrorTest = true;
- Profile_load_procedure.preparedownloadErrorCode = DownloadErrorCode.invalidTransactionId;
- Profile_load_procedure.ES10b_PrepareDownload();
-
- RecoverCard();
-}
-
-function TC_eUICC_ES10b_PrepareDownloadErrorCases_06_Error_SM_DP_has_not_been_previously_authenticated()
-{
- tracenamestr = "执行PrepareDownload，SM-DP+未经过认证";
- curDis.TraceStart(sno++,tracenamestr);
-
- curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
- Ini_powerOn_eUICC_LPAe_not_activate();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
- TS_MANAGE_CHANNEL_OPEN();
-
- curLogicChannel = 1;
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
- TS_SELECT("Select ISD",ISD_R_AID,"9000");
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
-
- var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL1_DATA);
- Profile_load_procedure.ICCID = ICCID_OP_PROF1;
- Profile_load_procedure.ES10b_GetEUICCInfo1();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
- Profile_load_procedure.ES10b_GetEUICCChallenge();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
- Profile_load_procedure.ES10b_AuthenticateServer();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest；");
- Profile_load_procedure.ES10b_PrepareDownload();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
- TS_SELECT("Select ISD",ISD_R_AID,"9000");
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
-
- Profile_load_procedure.ICCID = ICCID_OP_PROF1;
- Profile_load_procedure.ES10b_GetEUICCInfo1();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
- Profile_load_procedure.ES10b_GetEUICCChallenge();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest,前面没有安全认证；");
- Profile_load_procedure.transactionId = curStrHandle.RandHexStr(16);
- Profile_load_procedure.PrepareDownloadisErrorTest = true;
- Profile_load_procedure.preparedownloadErrorCode = DownloadErrorCode.noSessionContext;
- Profile_load_procedure.ES10b_PrepareDownload();
-
- RecoverCard();
-
-}
-
-function TC_eUICC_ES10b_PrepareDownloadErrorCases_07_Error_Unsupported_curve()
-{
- if(!Card_Have_ECC_Cert)
- return;
-
- tracenamestr = "执行PrepareDownload，使用不支持的曲线";
- curDis.TraceStart(sno++,tracenamestr);
-
- curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
- Ini_powerOn_eUICC_LPAe_not_activate();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
- TS_MANAGE_CHANNEL_OPEN();
-
- curLogicChannel = 1;
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
- TS_SELECT("Select ISD",ISD_R_AID,"9000");
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
-
- var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL1_DATA);
- Profile_load_procedure.ICCID = ICCID_OP_PROF1;
-
- pkId_CI_ForVerification = pkId_CI_ECDSA_NIST;
- pkId_CI_ForSigning = pkId_CI_ECDSA_NIST;
-
- Profile_load_procedure.ES10b_GetEUICCInfo1();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
- Profile_load_procedure.ES10b_GetEUICCChallenge();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
- Profile_load_procedure.ES10b_AuthenticateServer();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest，证书使用不支持的曲线算法；");
- Profile_load_procedure.DPbpInforObj.Cert = CERT_S_SM_DPpb_INV_CURVE_NIST192;
- Profile_load_procedure.PrepareDownloadisErrorTest = true;
- Profile_load_procedure.preparedownloadErrorCode = DownloadErrorCode.unsupportedCurve;
- Profile_load_procedure.ES10b_PrepareDownload();
-
- RecoverCard();
-
-}
-
-function TC_eUICC_ES10b_PrepareDownloadErrorCases_08_Error_Invalid_Certificate_Role_OID()
-{
- tracenamestr = "执行PrepareDownload，使用无效的证书Role OID";
- curDis.TraceStart(sno++,tracenamestr);
-
- curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
- Ini_powerOn_eUICC_LPAe_not_activate();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
- TS_MANAGE_CHANNEL_OPEN();
-
- curLogicChannel = 1;
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
- TS_SELECT("Select ISD",ISD_R_AID,"9000");
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
-
- var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL1_DATA);
- Profile_load_procedure.ICCID = ICCID_OP_PROF1;
- Profile_load_procedure.ES10b_GetEUICCInfo1();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
- Profile_load_procedure.ES10b_GetEUICCChallenge();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
- Profile_load_procedure.ES10b_AuthenticateServer();
-
- curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest，证书使用无效的Certificate Role OID；");
- Profile_load_procedure.DPbpInforObj.Cert = CERT_S_SM_DPauth_ECDSA_NIST;
- Profile_load_procedure.PrepareDownloadisErrorTest = true;
- Profile_load_procedure.preparedownloadErrorCode = DownloadErrorCode.invalidCertificate;
- Profile_load_procedure.ES10b_PrepareDownload();
-
- RecoverCard();
+// Author: 卡思Cas智能体
+// Date: 20261005-152741
+// Function: （purpose 原文未由 SGP.23 该 TC 提供，corpus vacuum 登记）TC_eUICC_ES10b.PrepareDownloadErrorCases，Test Sequence #01-#08 Error (all 8 sequences)，适用性 M。
+// Test points: ICH-SEQ06-IC1-K1-C1 ATR_present；ICH-SEQ06-IC1-K2-C2 FCP_Template
+// ICH-SEQ06-IC1-K2-C4 SW；ICH-SEQ06-IC1-K3-C4 SW；ICH-SEQ06-IC1-K4-C4 final SW
+// ICH-SEQ06-IC2-K1-C4 SW；ICH-SEQ06-IC2-K1-C3 CHANNEL_NUMBER extracted；ICH-SEQ06-IC2-K2-C4 SW
+// S1-C2 R_PREP_DOWNLOAD response structure；S2-C1 SW；S2-C2 R_PREP_DOWNLOAD response structure
+// S3-C1 SW；S3-C2 R_PREP_DOWNLOAD response structure；S4-C1 SW
+// S4-C2 R_PREP_DOWNLOAD response structure；S5-C1 SW；S5-C2 R_PREP_DOWNLOAD response structure
+// S6-C1 SW；S6-C2 R_EUICC_INFO1 outer tag；S6-C2 R_EUICC_INFO1 required members present；S7-C1 SW
+// S7-C2 R_PREP_DOWNLOAD response structure；S8-C1 SW；S8-C2 R_PREP_DOWNLOAD response structure
+// S9-C1 SW；S9-C2 R_PREP_DOWNLOAD response structure
+// 本函数由 CaseIR 4.2.10.2.4 编译生成（fullwave-blindgen-live-70-W1-laneA2，SGP.23 v1.16 × SGP.22 v2.7）：字节权威=CaseIR，非誊录黄金脚本。
+// Value-free template: every data byte is injected from CaseIR fields; no scaffold globals (see docs/speconly/compile-symbol-migration.md).
+// 适用性 M：编译期门，运行时由 harness 环境前置承担。
+function TC_eUICC_ES10b_PrepareDownloadErrorCases_01_08_Error_all_8_sequences() {
+ var bind = curBind;
+ // TC-GEN-1 eUICC: The PROFILE_OPERATIONAL1 is not loaded on the eUICC.: declared unexpanded (non-PROC row or K corpus vacuum; see CaseIR open_items).
+ // TC-GEN-2 eUICC: S_Device 与 eUICC 通信已初始化，S_LPAd 已选 ISD-R；eUICC 与 S_SM-DP+ 已成功执行 Common Mutual Authentication；#GET_EUICC_INFO1、#GET_EUICC_CHALLENGE、#AUTHENTICATE_SMDP 已发送；签名与验证选用同一 GSMA CI。: declared unexpanded (non-PROC row or K corpus vacuum; see CaseIR open_items).
+ // SEQ01-IC1 <S_HASHED_CC> = MTD_GENERATE_HASHED_CC(#CONFIRMATION_CODE1, <S_TRANSACTION_ID>)（测试工具侧计算，H_annexC1_methods 表1228）: declared unexpanded (non-PROC row or K corpus vacuum; see CaseIR open_items).
+ // SEQ06-IC-T1 eUICC: No Common Mutual Authentication procedure has been executed between the eUICC and the S_SM-DP+（覆盖本 TC 最后一条 general initial condition）: declared unexpanded (non-PROC row or K corpus vacuum; see CaseIR open_items).
+
+ // IC head inline (initial_conditions → PROC_EUICC_INITIALIZATION_SEQUENCE, K row 1)：RESET（K 语料机械展开）
+ var s10 = bind.resetAndAtr();
+ bind.checkData("ICH-SEQ06-IC1-K1-C1 ATR_present", "1", s10.atr_hex !== "" ? "1" : "0");
+
+ // IC head inline (initial_conditions → PROC_EUICC_INITIALIZATION_SEQUENCE, K row 2)：SELECT_MF（K 语料机械展开）
+ // FCP outer tag not materialized from clause: tag-face asserted only when corpus fixes the tag byte (e.g. TS 102 221 FCP '62').
+ var s11 = bind.sendApdu("00", "A4", "00", "04", "3F00", "00", "9000");
+ bind.checkData("ICH-SEQ06-IC1-K2-C2 FCP_Template", "1", s11.resp.length > 0 ? "1" : "0");
+ bind.checkData("ICH-SEQ06-IC1-K2-C4 SW", "9000", s11.sw);
+
+ // IC head inline (initial_conditions → PROC_EUICC_INITIALIZATION_SEQUENCE, K row 3)：TERMINAL_CAPABILITY_LPAd（K 语料机械展开）
+ var s12 = bind.sendApdu("80", "AA", "00", "00", "A9058100830107", null, "9000");
+ bind.checkData("ICH-SEQ06-IC1-K3-C4 SW", "9000", s12.sw);
+
+ // IC head inline (initial_conditions → PROC_EUICC_INITIALIZATION_SEQUENCE, K row 4)：TERMINAL_PROFILE（K 语料机械展开）
+ var steady13 = bind.runToSteadyState(function () {
+ return bind.sendTerminalProfile("FFFFFFFF7F9D00DFBF00001FE2000000C7EB0000000168005000000000000200", "9000");
+ });
+ bind.checkData("ICH-SEQ06-IC1-K4-C4 final SW", "9000", steady13.final.sw);
+
+ // IC head inline (initial_conditions → PROC_OPEN_LOGICAL_CHANNEL_AND_SELECT_ISDR, K row 1)：MANAGE_CHANNEL_OPEN（K 语料机械展开）
+ // CHANNEL_NUMBER extraction and dynamic CLA rebinding are CasBind internal state (chaining rule; no generated-code re-implementation).
+ var s14 = bind.manageChannelOpen("9000");
+ bind.checkData("ICH-SEQ06-IC2-K1-C4 SW", "9000", s14.sw);
+ bind.checkData("ICH-SEQ06-IC2-K1-C3 CHANNEL_NUMBER extracted", "1", s14.chan !== null ? "1" : "0");
+
+ // IC head inline (initial_conditions → PROC_OPEN_LOGICAL_CHANNEL_AND_SELECT_ISDR, K row 2)：MTD_SELECT（K 语料机械展开）
+ // CLA = bound channel (cla_rule) and <L> length binding are CasBind internal state (chaining rule; no generated-code re-implementation).
+ var s15 = bind.sendApdu(null, "A4", "04", "00", "A0000005591010FFFFFFFF8900000100", null, "9000");
+ // MTD_SELECT expected face is SW-only (K Annex C.2 open-channel procedure step 2: no FCI content assertion in corpus); no fabricated template parse.
+ bind.checkData("ICH-SEQ06-IC2-K2-C4 SW", "9000", s15.sw);
+
+ // 步骤 1：SEQ01-1] MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ31_130, RQ31_135, RQ31_136, RQ57_031, RQ57_036, RQ57_037, RQ57_038）
+ // PREP_DOWNLOAD 运行时绑定（PREP_DOWNLOAD_INVALID_CC；SGP.22 §5.7.5 PrepareDownloadRequest=BF21 成员序 smdpSigned2(30) → smdpSignature2(5F37) → smdpCertificate(30)）：
+ // 无前序 cma_decl 源（GIC CMA）：transactionId 运行时随机（G Annex B <S_TRANSACTION_ID>，vendor RandHexStr 机制）；euiccSignature1 无源→空串，诚实守卫拦截发送（不硬造签名明文）。
+ // 错误注入变体（I_annexD3_es10x）：cert＝SGP.26 v1.5 变体物料声明面（input/PREP_DOWNLOAD_VARIANT_MATERIALS.json，sha256 锚编译期已核）；ccRequiredFlag/签名形态按变体闭集定义。
+ var pd1Certs = ["308201DFA00302010202020101300A06082A8648CE3D04030230443110300E06035504030C07546573742043493111300F060355040B0C0854455354434552543110300E060355040A0C0752535054455354310B3009060355040613024954301E170D3230303430313038333434355A170D3330303333303038333434355A3025310D300B060355040A0C0441434D453114301206035504030C0B5445535420534D2D44502B3059301306072A8648CE3D020106082A8648CE3D03010703420004104C2AE3D02DEF9C979261A7C6710076B970721D0955A2644AE05FAE4BC2314E5DC09F6BF0118026165342E212318775E365F3B57325373066B9906E0BD1388DA381DF3081DC301F0603551D23041830168014F54172BDF98A95D65CBEB88A38A1C11D800A85C3301D0603551D0E04160414E6EAF71EE0FB9430ECCD1EBB421F881437C13263300E0603551D1104073005880388370A300E0603551D0F0101FF04040302078030170603551D200101FF040D300B300906076781120102010530610603551D1F045A3058302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D412E63726C302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D422E63726C300A06082A8648CE3D040302034800304502203EA51B0129FC11E843C38C8CB104244CCF92D8DDBCD4D5F9DAFD0AEF700A9B1C022100FEF382FF71FEFC58168A3607D5685DB7CB48F6B434261891496385BCD6B5857A", "308201E0A00302010202020101300A06082A8648CE3D04030230443110300E06035504030C07546573742043493111300F060355040B0C0854455354434552543110300E060355040A0C0752535054455354310B3009060355040613024954301E170D3230303430313038333434365A170D3330303333303038333434365A3025310D300B060355040A0C0441434D453114301206035504030C0B5445535420534D2D44502B305A301406072A8648CE3D020106092B240303020801010703420004893253ECC94C51DF4FEE6E0DB0951CFC65627481B5418E557069F487FAA15466A5CB8E10CC2B38099CF2A929F7F82DAC065126B71D0640961DB7F91A49E95612A381DF3081DC301F0603551D23041830168014C0BC70BA36929D43B467FF57570530E57AB8FCD8301D0603551D0E04160414A8C68DF449EB71EC723EAC132E40E4B6F54644FE300E0603551D1104073005880388370A300E0603551D0F0101FF04040302078030170603551D200101FF040D300B300906076781120102010530610603551D1F045A3058302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D412E63726C302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D422E63726C300A06082A8648CE3D04030203470030440220244ED22119D00D49D9EA4AC5D9A6D925FACFCD1998A96448A870CE47FE5E470E02206C4BC7223C925D548DDDD3D8DDD81118DA202973311F6012BB0A20E6DD2D7B7B"];
+ var pd1Sks = ["DCD694B778957E8E9ADDBDD94433E9EF8F73D11E491C48D425A38A9491BD3BED", "75FF322F416616DAE1A484EF71D4874FB0DF3295FD35C2CBA489FBB2BB9C7BF6"];
+ var pd1Tid = "";
+ for (var pd1Ri = 0; pd1Ri < 16; pd1Ri++) {
+ pd1Tid += bind.engine.Hex(Math.round(255 * Math.random()), 2);
+ }
+ var pd1Sel = 0;
+ var pd1Sig1 = "";
+ var pd1Dps = [["FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF", "FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFC", "5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B", "046B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C2964FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5", "FFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551"], ["A9FB57DBA1EEA9BC3E660A909D838D726E3BF623D52620282013481D1F6E5377", "7D5A0975FC2C3057EEF67530417AFFE7FB8055C126DC5C6CE94A4B44F330B5D9", "26DC5C6CE94A4B44F330B5D9BBD77CBF958416295CF7E1CE6BCCDC18FF8C07B6", "048BD2AEB9CB7E57CB2C4B482FFC81B7AFB9DE27E1E3BD23C23A4453BD9ACE3262547EF835C3DAC4FD97F8461A14611DC9C27745132DED8E545C1D54C72F046997", "A9FB57DBA1EEA9BC3E660A909D838D718C397AA3B561A6F7901E0E82974856A7"]];
+ if (pd1Sel < 0 || pd1Sig1 === "") {
+ // fail-closed 诚实面：CMA 运行时操作数缺席（CMA 失败/未执行）→ BF21 不发送（前序 CMA 步断言面已计错，本步不伪造通过）。
+ bind.checkData("S1-C2 R_PREP_DOWNLOAD response structure", "1", "pd1_not_executed:cma_operands_absent");
+ } else {
+ bind.engine.InitEccDomainParams(pd1Dps[pd1Sel][0], pd1Dps[pd1Sel][1], pd1Dps[pd1Sel][2], pd1Dps[pd1Sel][3], pd1Dps[pd1Sel][4], 1);
+ var pd1S2 = BindEs10xSingleRequest.buildTlv("30",
+ BindEs10xSingleRequest.buildTlv("80", pd1Tid)
+ + BindEs10xSingleRequest.buildTlv("01", "FF"));
+ var pd1Sgn = "";
+ while (pd1Sgn.length != 2 * pd1Sks[pd1Sel].length) {
+ bind.engine.SleepTime(2000);
+ pd1Sgn = bind.engine.EccSignData(pd1Sks[pd1Sel], pd1S2 + BindEs10xSingleRequest.buildTlv("5F37", pd1Sig1), 33);
+ }
+ var pd1Req = BindEs10xSingleRequest.buildTlv("BF21",
+ pd1S2
+ + BindEs10xSingleRequest.buildTlv("5F37", pd1Sgn)
+ + BindEs10xSingleRequest.buildTlv("30", pd1Certs[pd1Sel]));
+ var pd1Run = BindEs10xSingleRequest.runTransport(bind.sendApdu,
+ {cla: "", ins: "E2", p1: "91", p2: "00", data: pd1Req,
+ le: "00", blockSize: 255, blockSw: "9000", final_sw: "9000"});
+ var pd1Sw = (pd1Run.final && pd1Run.final.sw) ? pd1Run.final.sw : "transport_error";
+ // euiccOtpk（5F49）运行时提取面登记：响应 ok 分支 euiccSigned2 成员（BF21 A0 30 5F49 路径），供后续步（RETRY 形 bppEuiccOtpk/BPP 装配）消费。
+ var pd1Otpk = "";
+ if (pd1Run.final && pd1Run.final.resp) {
+ var pd1L1 = BindEs10xSingleRequest.parseBerTlv(pd1Run.final.resp);
+ for (var pd1I1 = 0; pd1I1 < pd1L1.length && pd1Otpk === ""; pd1I1++) {
+ if (pd1L1[pd1I1].tag !== "BF21") continue;
+ var pd1L2 = BindEs10xSingleRequest.parseBerTlv(pd1L1[pd1I1].value);
+ for (var pd1I2 = 0; pd1I2 < pd1L2.length && pd1Otpk === ""; pd1I2++) {
+ if (pd1L2[pd1I2].tag !== "A0") continue;
+ var pd1L3 = BindEs10xSingleRequest.parseBerTlv(pd1L2[pd1I2].value);
+ for (var pd1I3 = 0; pd1I3 < pd1L3.length && pd1Otpk === ""; pd1I3++) {
+ if (pd1L3[pd1I3].tag !== "30") continue;
+ var pd1L4 = BindEs10xSingleRequest.parseBerTlv(pd1L3[pd1I3].value);
+ for (var pd1I4 = 0; pd1I4 < pd1L4.length; pd1I4++) {
+ if (pd1L4[pd1I4].tag === "5F49") pd1Otpk = pd1L4[pd1I4].value;
+ }
+ }
+ }
+ }
+ }
+ }
+ // R_PREP_DOWNLOAD 响应结构（S22_prep_dl §5.7.5 行 77-111：外层 BF21 CHOICE；downloadResponseError A1{transactionId 80, downloadErrorCode 02}）：运行时域，仅结构与在场性断言。
+ var pd1RSR = (pd1Run.final && pd1Run.final.resp) ? BindEs10xSingleRequest.parseBerTlv(pd1Run.final.resp) : [];
+ var pd1RSOuter = pd1RSR.length === 1 ? pd1RSR[0].tag : "absent";
+ var pd1RSBr = pd1RSR.length === 1 ? BindEs10xSingleRequest.parseBerTlv(pd1RSR[0].value) : [];
+ var pd1RSA0 = false, pd1RSA1 = false, pd1RSCk = [];
+ for (var pd1RSi = 0; pd1RSi < pd1RSBr.length; pd1RSi++) {
+ if (pd1RSBr[pd1RSi].tag === "A0") { pd1RSA0 = true; pd1RSCk = BindEs10xSingleRequest.parseBerTlv(pd1RSBr[pd1RSi].value); }
+ if (pd1RSBr[pd1RSi].tag === "A1") { pd1RSA1 = true; pd1RSCk = BindEs10xSingleRequest.parseBerTlv(pd1RSBr[pd1RSi].value); }
+ }
+ var pd1RS30 = false, pd1RS5F37 = false, pd1RS80 = false, pd1RS02 = false;
+ for (var pd1RSj = 0; pd1RSj < pd1RSCk.length; pd1RSj++) {
+ if (pd1RSCk[pd1RSj].tag === "30") pd1RS30 = true;
+ if (pd1RSCk[pd1RSj].tag === "5F37") pd1RS5F37 = true;
+ if (pd1RSCk[pd1RSj].tag === "80") pd1RS80 = true;
+ if (pd1RSCk[pd1RSj].tag === "02") pd1RS02 = true;
+ }
+ var pd1RS5F49 = false;
+ if (pd1RS30) {
+ for (var pd1RSk = 0; pd1RSk < pd1RSCk.length; pd1RSk++) {
+ if (pd1RSCk[pd1RSk].tag !== "30") continue;
+ var pd1RSU = BindEs10xSingleRequest.parseBerTlv(pd1RSCk[pd1RSk].value);
+ for (var pd1RSm = 0; pd1RSm < pd1RSU.length; pd1RSm++) {
+ if (pd1RSU[pd1RSm].tag === "5F49") pd1RS5F49 = true;
+ if (pd1RSU[pd1RSm].tag === "80") pd1RS80 = true;
+ }
+ }
+ }
+ bind.checkData("S1-C2 R_PREP_DOWNLOAD response structure" + " (downloadResponseError or no data)", "1", (pd1RSOuter === "absent" || (pd1RSA1 && pd1RS80 && pd1RS02)) ? "1" : "0");
+ // S1-C1: binding:prep_download_variant_error_status_disjunctive(error-swp|downloadResponseError;I_annexD3) (check_attestation)
+ // S1-C3: binding:prep_download_variant_error_no_response(ANY_SW_IN_ERROR;G-annexB) (check_attestation)
+
+ // 步骤 2：SEQ02-1] MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ31_130, RQ31_131, RQ31_136, RQ57_027, RQ57_030, RQ57_031, RQ57_036, RQ57_037, RQ57_038, RQ45_006, RQ45_026_1, RQ45_026, RQ45_028）
+ // PREP_DOWNLOAD 运行时绑定（PREP_DOWNLOAD_INV_CERT；SGP.22 §5.7.5 PrepareDownloadRequest=BF21 成员序 smdpSigned2(30) → smdpSignature2(5F37) → smdpCertificate(30)）：
+ // 无前序 cma_decl 源（GIC CMA）：transactionId 运行时随机（G Annex B <S_TRANSACTION_ID>，vendor RandHexStr 机制）；euiccSignature1 无源→空串，诚实守卫拦截发送（不硬造签名明文）。
+ // 错误注入变体（I_annexD3_es10x）：cert＝SGP.26 v1.5 变体物料声明面（input/PREP_DOWNLOAD_VARIANT_MATERIALS.json，sha256 锚编译期已核）；ccRequiredFlag/签名形态按变体闭集定义。
+ var pd2Certs = ["308201DFA00302010202020101300A06082A8648CE3D04030230443110300E06035504030C07546573742043493111300F060355040B0C0854455354434552543110300E060355040A0C0752535054455354310B3009060355040613024954301E170D3230303430313038333434355A170D3330303333303038333434355A3025310D300B060355040A0C0441434D453114301206035504030C0B5445535420534D2D44502B3059301306072A8648CE3D020106082A8648CE3D03010703420004104C2AE3D02DEF9C979261A7C6710076B970721D0955A2644AE05FAE4BC2314E5DC09F6BF0118026165342E212318775E365F3B57325373066B9906E0BD1388DA381DF3081DC301F0603551D23041830168014F54172BDF98A95D65CBEB88A38A1C11D800A85C3301D0603551D0E04160414E6EAF71EE0FB9430ECCD1EBB421F881437C13263300E0603551D1104073005880388370A300E0603551D0F0101FF04040302078030170603551D200101FF040D300B300906076781120102010530610603551D1F045A3058302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D412E63726C302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D422E63726C300A06082A8648CE3D040302034800304502203EA51B0129FC11E843C38C8CB104244CCF92D8DDBCD4D5F9DAFD0AEF71200A256211089EF382FF71FEFC58168A3607D5685DB7CB48F6B434261891496385BCD6B5857A", "308201E0A00302010202020101300A06082A8648CE3D04030230443110300E06035504030C07546573742043493111300F060355040B0C0854455354434552543110300E060355040A0C0752535054455354310B3009060355040613024954301E170D3230303430313038333434365A170D3330303333303038333434365A3025310D300B060355040A0C0441434D453114301206035504030C0B5445535420534D2D44502B305A301406072A8648CE3D020106092B240303020801010703420004893253ECC94C51DF4FEE6E0DB0951CFC65627481B5418E557069F487FAA15466A5CB8E10CC2B38099CF2A929F7F82DAC065126B71D0640961DB7F91A49E95612A381DF3081DC301F0603551D23041830168014C0BC70BA36929D43B467FF57570530E57AB8FCD8301D0603551D0E04160414A8C68DF449EB71EC723EAC132E40E4B6F54644FE300E0603551D1104073005880388370A300E0603551D0F0101FF04040302078030170603551D200101FF040D300B300906076781120102010530610603551D1F045A3058302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D412E63726C302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D422E63726C300A06082A8648CE3D04030203470030440220244ED22119D00D49D9EA4AC5D9A6D925FACFCD1998A96448A870CE47FE5E48108310518721223C925D548DDDD3D8DDD81118DA202973311F6012BB0A20E6DD2D7B7B"];
+ var pd2Sks = ["DCD694B778957E8E9ADDBDD94433E9EF8F73D11E491C48D425A38A9491BD3BED", "75FF322F416616DAE1A484EF71D4874FB0DF3295FD35C2CBA489FBB2BB9C7BF6"];
+ var pd2Tid = "";
+ for (var pd2Ri = 0; pd2Ri < 16; pd2Ri++) {
+ pd2Tid += bind.engine.Hex(Math.round(255 * Math.random()), 2);
+ }
+ var pd2Sel = 0;
+ var pd2Sig1 = "";
+ var pd2Dps = [["FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF", "FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFC", "5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B", "046B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C2964FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5", "FFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551"], ["A9FB57DBA1EEA9BC3E660A909D838D726E3BF623D52620282013481D1F6E5377", "7D5A0975FC2C3057EEF67530417AFFE7FB8055C126DC5C6CE94A4B44F330B5D9", "26DC5C6CE94A4B44F330B5D9BBD77CBF958416295CF7E1CE6BCCDC18FF8C07B6", "048BD2AEB9CB7E57CB2C4B482FFC81B7AFB9DE27E1E3BD23C23A4453BD9ACE3262547EF835C3DAC4FD97F8461A14611DC9C27745132DED8E545C1D54C72F046997", "A9FB57DBA1EEA9BC3E660A909D838D718C397AA3B561A6F7901E0E82974856A7"]];
+ if (pd2Sel < 0 || pd2Sig1 === "") {
+ // fail-closed 诚实面：CMA 运行时操作数缺席（CMA 失败/未执行）→ BF21 不发送（前序 CMA 步断言面已计错，本步不伪造通过）。
+ bind.checkData("S2-C1 SW", "9000", "pd2_not_executed:cma_operands_absent");
+ bind.checkData("S2-C2 R_PREP_DOWNLOAD response structure", "1", "pd2_not_executed:cma_operands_absent");
+ } else {
+ bind.engine.InitEccDomainParams(pd2Dps[pd2Sel][0], pd2Dps[pd2Sel][1], pd2Dps[pd2Sel][2], pd2Dps[pd2Sel][3], pd2Dps[pd2Sel][4], 1);
+ var pd2S2 = BindEs10xSingleRequest.buildTlv("30",
+ BindEs10xSingleRequest.buildTlv("80", pd2Tid)
+ + BindEs10xSingleRequest.buildTlv("01", "00"));
+ var pd2Sgn = "";
+ while (pd2Sgn.length != 2 * pd2Sks[pd2Sel].length) {
+ bind.engine.SleepTime(2000);
+ pd2Sgn = bind.engine.EccSignData(pd2Sks[pd2Sel], pd2S2 + BindEs10xSingleRequest.buildTlv("5F37", pd2Sig1), 33);
+ }
+ var pd2Req = BindEs10xSingleRequest.buildTlv("BF21",
+ pd2S2
+ + BindEs10xSingleRequest.buildTlv("5F37", pd2Sgn)
+ + BindEs10xSingleRequest.buildTlv("30", pd2Certs[pd2Sel]));
+ var pd2Run = BindEs10xSingleRequest.runTransport(bind.sendApdu,
+ {cla: "", ins: "E2", p1: "91", p2: "00", data: pd2Req,
+ le: "00", blockSize: 255, blockSw: "9000", final_sw: "9000"});
+ var pd2Sw = (pd2Run.final && pd2Run.final.sw) ? pd2Run.final.sw : "transport_error";
+ bind.checkData("S2-C1 SW", "9000", pd2Sw);
+ // euiccOtpk（5F49）运行时提取面登记：响应 ok 分支 euiccSigned2 成员（BF21 A0 30 5F49 路径），供后续步（RETRY 形 bppEuiccOtpk/BPP 装配）消费。
+ var pd2Otpk = "";
+ if (pd2Run.final && pd2Run.final.resp) {
+ var pd2L1 = BindEs10xSingleRequest.parseBerTlv(pd2Run.final.resp);
+ for (var pd2I1 = 0; pd2I1 < pd2L1.length && pd2Otpk === ""; pd2I1++) {
+ if (pd2L1[pd2I1].tag !== "BF21") continue;
+ var pd2L2 = BindEs10xSingleRequest.parseBerTlv(pd2L1[pd2I1].value);
+ for (var pd2I2 = 0; pd2I2 < pd2L2.length && pd2Otpk === ""; pd2I2++) {
+ if (pd2L2[pd2I2].tag !== "A0") continue;
+ var pd2L3 = BindEs10xSingleRequest.parseBerTlv(pd2L2[pd2I2].value);
+ for (var pd2I3 = 0; pd2I3 < pd2L3.length && pd2Otpk === ""; pd2I3++) {
+ if (pd2L3[pd2I3].tag !== "30") continue;
+ var pd2L4 = BindEs10xSingleRequest.parseBerTlv(pd2L3[pd2I3].value);
+ for (var pd2I4 = 0; pd2I4 < pd2L4.length; pd2I4++) {
+ if (pd2L4[pd2I4].tag === "5F49") pd2Otpk = pd2L4[pd2I4].value;
+ }
+ }
+ }
+ }
+ }
+ }
+ // R_PREP_DOWNLOAD 响应结构（S22_prep_dl §5.7.5 行 77-111：外层 BF21 CHOICE；downloadResponseError A1{transactionId 80, downloadErrorCode 02}）：运行时域，仅结构与在场性断言。
+ var pd2RSR = (pd2Run.final && pd2Run.final.resp) ? BindEs10xSingleRequest.parseBerTlv(pd2Run.final.resp) : [];
+ var pd2RSOuter = pd2RSR.length === 1 ? pd2RSR[0].tag : "absent";
+ var pd2RSBr = pd2RSR.length === 1 ? BindEs10xSingleRequest.parseBerTlv(pd2RSR[0].value) : [];
+ var pd2RSA0 = false, pd2RSA1 = false, pd2RSCk = [];
+ for (var pd2RSi = 0; pd2RSi < pd2RSBr.length; pd2RSi++) {
+ if (pd2RSBr[pd2RSi].tag === "A0") { pd2RSA0 = true; pd2RSCk = BindEs10xSingleRequest.parseBerTlv(pd2RSBr[pd2RSi].value); }
+ if (pd2RSBr[pd2RSi].tag === "A1") { pd2RSA1 = true; pd2RSCk = BindEs10xSingleRequest.parseBerTlv(pd2RSBr[pd2RSi].value); }
+ }
+ var pd2RS30 = false, pd2RS5F37 = false, pd2RS80 = false, pd2RS02 = false;
+ for (var pd2RSj = 0; pd2RSj < pd2RSCk.length; pd2RSj++) {
+ if (pd2RSCk[pd2RSj].tag === "30") pd2RS30 = true;
+ if (pd2RSCk[pd2RSj].tag === "5F37") pd2RS5F37 = true;
+ if (pd2RSCk[pd2RSj].tag === "80") pd2RS80 = true;
+ if (pd2RSCk[pd2RSj].tag === "02") pd2RS02 = true;
+ }
+ var pd2RS5F49 = false;
+ if (pd2RS30) {
+ for (var pd2RSk = 0; pd2RSk < pd2RSCk.length; pd2RSk++) {
+ if (pd2RSCk[pd2RSk].tag !== "30") continue;
+ var pd2RSU = BindEs10xSingleRequest.parseBerTlv(pd2RSCk[pd2RSk].value);
+ for (var pd2RSm = 0; pd2RSm < pd2RSU.length; pd2RSm++) {
+ if (pd2RSU[pd2RSm].tag === "5F49") pd2RS5F49 = true;
+ if (pd2RSU[pd2RSm].tag === "80") pd2RS80 = true;
+ }
+ }
+ }
+ bind.checkData("S2-C2 R_PREP_DOWNLOAD response structure" + " (downloadResponseError or no data)", "1", (pd2RSOuter === "absent" || (pd2RSA1 && pd2RS80 && pd2RS02)) ? "1" : "0");
+ // S2-C3: binding:prep_download_response_tid_echo(request-S_TRANSACTION_ID;S22_prep_dl) (check_attestation)
+
+ // 步骤 3：SEQ03-1] MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ31_130, RQ31_132, RQ31_136, RQ57_029, RQ57_031, RQ57_036, RQ57_037, RQ57_038, RQ45_006, RQ45_026_1, RQ45_026, RQ45_028）
+ // PREP_DOWNLOAD 运行时绑定（PREP_DOWNLOAD_CERT_SMDP2；SGP.22 §5.7.5 PrepareDownloadRequest=BF21 成员序 smdpSigned2(30) → smdpSignature2(5F37) → smdpCertificate(30)）：
+ // 无前序 cma_decl 源（GIC CMA）：transactionId 运行时随机（G Annex B <S_TRANSACTION_ID>，vendor RandHexStr 机制）；euiccSignature1 无源→空串，诚实守卫拦截发送（不硬造签名明文）。
+ // 错误注入变体（I_annexD3_es10x）：cert＝SGP.26 v1.5 变体物料声明面（input/PREP_DOWNLOAD_VARIANT_MATERIALS.json，sha256 锚编译期已核）；ccRequiredFlag/签名形态按变体闭集定义。
+ var pd3Certs = ["308201E0A00302010202020201300A06082A8648CE3D04030230443110300E06035504030C07546573742043493111300F060355040B0C0854455354434552543110300E060355040A0C0752535054455354310B3009060355040613024954301E170D3230303430313038333434365A170D3330303333303038333434365A3026310D300B060355040A0C0441434D453115301306035504030C0C5445535420534D2D44502B323059301306072A8648CE3D020106082A8648CE3D030107034200043E2D75A106221216C2AEE8FAD584F779633CF944681B5EC75A96653F5F401C476AE39D546C032D32D0070A7B86E5DCEBAADDF31CA5C2766C196BD79BC21A0180A381DF3081DC301F0603551D23041830168014F54172BDF98A95D65CBEB88A38A1C11D800A85C3301D0603551D0E0416041420A3A830E92EE7A468C5EB27BA8DF18459ADFDD7300E0603551D1104073005880388370C300E0603551D0F0101FF04040302078030170603551D200101FF040D300B300906076781120102010530610603551D1F045A3058302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D412E63726C302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D422E63726C300A06082A8648CE3D0403020349003046022100AD7F267F31F934CEE3E29E09F6582603D296D2F5224B0A1AB988C9870393E3190221008F7E51EEE673DF06D10A5350B94C00B702FF96DC960D317967E61877FF5123DB", "308201E1A00302010202020201300A06082A8648CE3D04030230443110300E06035504030C07546573742043493111300F060355040B0C0854455354434552543110300E060355040A0C0752535054455354310B3009060355040613024954301E170D3230303430313038333434365A170D3330303333303038333434365A3026310D300B060355040A0C0441434D453115301306035504030C0C5445535420534D2D44502B32305A301406072A8648CE3D020106092B2403030208010107034200047361855E590264B252C71A6062A021E27B46F760B8138206A7F74420EF8BC55A8B988D1658F9D70D3A2D8480AADF64E62C4D7127DE5A0A2B917A943F4474AADDA381DF3081DC301F0603551D23041830168014C0BC70BA36929D43B467FF57570530E57AB8FCD8301D0603551D0E0416041431038A55B6BECF6CEA59DE2FDA14F4327FB8B6A9300E0603551D1104073005880388370C300E0603551D0F0101FF04040302078030170603551D200101FF040D300B300906076781120102010530610603551D1F045A3058302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D412E63726C302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D422E63726C300A06082A8648CE3D040302034700304402203C7BF047D9D62485CFB4C6DB9955C45CFAD4DECECF3B9028A84DEF7A21E63EB002206046EC8B7F016738A6C0977BF226628EB4EBCBC3183AD1ECC9C82C3B35490B4E"];
+ var pd3Sks = ["DCD694B778957E8E9ADDBDD94433E9EF8F73D11E491C48D425A38A9491BD3BED", "75FF322F416616DAE1A484EF71D4874FB0DF3295FD35C2CBA489FBB2BB9C7BF6"];
+ var pd3Tid = "";
+ for (var pd3Ri = 0; pd3Ri < 16; pd3Ri++) {
+ pd3Tid += bind.engine.Hex(Math.round(255 * Math.random()), 2);
+ }
+ var pd3Sel = 0;
+ var pd3Sig1 = "";
+ var pd3Dps = [["FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF", "FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFC", "5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B", "046B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C2964FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5", "FFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551"], ["A9FB57DBA1EEA9BC3E660A909D838D726E3BF623D52620282013481D1F6E5377", "7D5A0975FC2C3057EEF67530417AFFE7FB8055C126DC5C6CE94A4B44F330B5D9", "26DC5C6CE94A4B44F330B5D9BBD77CBF958416295CF7E1CE6BCCDC18FF8C07B6", "048BD2AEB9CB7E57CB2C4B482FFC81B7AFB9DE27E1E3BD23C23A4453BD9ACE3262547EF835C3DAC4FD97F8461A14611DC9C27745132DED8E545C1D54C72F046997", "A9FB57DBA1EEA9BC3E660A909D838D718C397AA3B561A6F7901E0E82974856A7"]];
+ if (pd3Sel < 0 || pd3Sig1 === "") {
+ // fail-closed 诚实面：CMA 运行时操作数缺席（CMA 失败/未执行）→ BF21 不发送（前序 CMA 步断言面已计错，本步不伪造通过）。
+ bind.checkData("S3-C1 SW", "9000", "pd3_not_executed:cma_operands_absent");
+ bind.checkData("S3-C2 R_PREP_DOWNLOAD response structure", "1", "pd3_not_executed:cma_operands_absent");
+ } else {
+ bind.engine.InitEccDomainParams(pd3Dps[pd3Sel][0], pd3Dps[pd3Sel][1], pd3Dps[pd3Sel][2], pd3Dps[pd3Sel][3], pd3Dps[pd3Sel][4], 1);
+ var pd3S2 = BindEs10xSingleRequest.buildTlv("30",
+ BindEs10xSingleRequest.buildTlv("80", pd3Tid)
+ + BindEs10xSingleRequest.buildTlv("01", "00"));
+ var pd3Sgn = "";
+ while (pd3Sgn.length != 2 * pd3Sks[pd3Sel].length) {
+ bind.engine.SleepTime(2000);
+ pd3Sgn = bind.engine.EccSignData(pd3Sks[pd3Sel], pd3S2 + BindEs10xSingleRequest.buildTlv("5F37", pd3Sig1), 33);
+ }
+ var pd3Req = BindEs10xSingleRequest.buildTlv("BF21",
+ pd3S2
+ + BindEs10xSingleRequest.buildTlv("5F37", pd3Sgn)
+ + BindEs10xSingleRequest.buildTlv("30", pd3Certs[pd3Sel]));
+ var pd3Run = BindEs10xSingleRequest.runTransport(bind.sendApdu,
+ {cla: "", ins: "E2", p1: "91", p2: "00", data: pd3Req,
+ le: "00", blockSize: 255, blockSw: "9000", final_sw: "9000"});
+ var pd3Sw = (pd3Run.final && pd3Run.final.sw) ? pd3Run.final.sw : "transport_error";
+ bind.checkData("S3-C1 SW", "9000", pd3Sw);
+ // euiccOtpk（5F49）运行时提取面登记：响应 ok 分支 euiccSigned2 成员（BF21 A0 30 5F49 路径），供后续步（RETRY 形 bppEuiccOtpk/BPP 装配）消费。
+ var pd3Otpk = "";
+ if (pd3Run.final && pd3Run.final.resp) {
+ var pd3L1 = BindEs10xSingleRequest.parseBerTlv(pd3Run.final.resp);
+ for (var pd3I1 = 0; pd3I1 < pd3L1.length && pd3Otpk === ""; pd3I1++) {
+ if (pd3L1[pd3I1].tag !== "BF21") continue;
+ var pd3L2 = BindEs10xSingleRequest.parseBerTlv(pd3L1[pd3I1].value);
+ for (var pd3I2 = 0; pd3I2 < pd3L2.length && pd3Otpk === ""; pd3I2++) {
+ if (pd3L2[pd3I2].tag !== "A0") continue;
+ var pd3L3 = BindEs10xSingleRequest.parseBerTlv(pd3L2[pd3I2].value);
+ for (var pd3I3 = 0; pd3I3 < pd3L3.length && pd3Otpk === ""; pd3I3++) {
+ if (pd3L3[pd3I3].tag !== "30") continue;
+ var pd3L4 = BindEs10xSingleRequest.parseBerTlv(pd3L3[pd3I3].value);
+ for (var pd3I4 = 0; pd3I4 < pd3L4.length; pd3I4++) {
+ if (pd3L4[pd3I4].tag === "5F49") pd3Otpk = pd3L4[pd3I4].value;
+ }
+ }
+ }
+ }
+ }
+ }
+ // R_PREP_DOWNLOAD 响应结构（S22_prep_dl §5.7.5 行 77-111：外层 BF21 CHOICE；downloadResponseError A1{transactionId 80, downloadErrorCode 02}）：运行时域，仅结构与在场性断言。
+ var pd3RSR = (pd3Run.final && pd3Run.final.resp) ? BindEs10xSingleRequest.parseBerTlv(pd3Run.final.resp) : [];
+ var pd3RSOuter = pd3RSR.length === 1 ? pd3RSR[0].tag : "absent";
+ var pd3RSBr = pd3RSR.length === 1 ? BindEs10xSingleRequest.parseBerTlv(pd3RSR[0].value) : [];
+ var pd3RSA0 = false, pd3RSA1 = false, pd3RSCk = [];
+ for (var pd3RSi = 0; pd3RSi < pd3RSBr.length; pd3RSi++) {
+ if (pd3RSBr[pd3RSi].tag === "A0") { pd3RSA0 = true; pd3RSCk = BindEs10xSingleRequest.parseBerTlv(pd3RSBr[pd3RSi].value); }
+ if (pd3RSBr[pd3RSi].tag === "A1") { pd3RSA1 = true; pd3RSCk = BindEs10xSingleRequest.parseBerTlv(pd3RSBr[pd3RSi].value); }
+ }
+ var pd3RS30 = false, pd3RS5F37 = false, pd3RS80 = false, pd3RS02 = false;
+ for (var pd3RSj = 0; pd3RSj < pd3RSCk.length; pd3RSj++) {
+ if (pd3RSCk[pd3RSj].tag === "30") pd3RS30 = true;
+ if (pd3RSCk[pd3RSj].tag === "5F37") pd3RS5F37 = true;
+ if (pd3RSCk[pd3RSj].tag === "80") pd3RS80 = true;
+ if (pd3RSCk[pd3RSj].tag === "02") pd3RS02 = true;
+ }
+ var pd3RS5F49 = false;
+ if (pd3RS30) {
+ for (var pd3RSk = 0; pd3RSk < pd3RSCk.length; pd3RSk++) {
+ if (pd3RSCk[pd3RSk].tag !== "30") continue;
+ var pd3RSU = BindEs10xSingleRequest.parseBerTlv(pd3RSCk[pd3RSk].value);
+ for (var pd3RSm = 0; pd3RSm < pd3RSU.length; pd3RSm++) {
+ if (pd3RSU[pd3RSm].tag === "5F49") pd3RS5F49 = true;
+ if (pd3RSU[pd3RSm].tag === "80") pd3RS80 = true;
+ }
+ }
+ }
+ bind.checkData("S3-C2 R_PREP_DOWNLOAD response structure" + " (downloadResponseError or no data)", "1", (pd3RSOuter === "absent" || (pd3RSA1 && pd3RS80 && pd3RS02)) ? "1" : "0");
+ // S3-C3: binding:prep_download_response_tid_echo(request-S_TRANSACTION_ID;S22_prep_dl) (check_attestation)
+
+ // 步骤 4：SEQ04-1] MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ31_130, RQ31_133, RQ31_136, RQ57_028, RQ57_031, RQ57_036, RQ57_038, RQ45_006, RQ45_026_1, RQ45_026, RQ45_028）
+ // PREP_DOWNLOAD 运行时绑定（PREP_DOWNLOAD_INV_SIGN；SGP.22 §5.7.5 PrepareDownloadRequest=BF21 成员序 smdpSigned2(30) → smdpSignature2(5F37) → smdpCertificate(30)）：
+ // 无前序 cma_decl 源（GIC CMA）：transactionId 运行时随机（G Annex B <S_TRANSACTION_ID>，vendor RandHexStr 机制）；euiccSignature1 无源→空串，诚实守卫拦截发送（不硬造签名明文）。
+ // 错误注入变体（I_annexD3_es10x）：cert＝SGP.26 v1.5 变体物料声明面（input/PREP_DOWNLOAD_VARIANT_MATERIALS.json，sha256 锚编译期已核）；ccRequiredFlag/签名形态按变体闭集定义。
+ var pd4Certs = ["308201DFA00302010202020101300A06082A8648CE3D04030230443110300E06035504030C07546573742043493111300F060355040B0C0854455354434552543110300E060355040A0C0752535054455354310B3009060355040613024954301E170D3230303430313038333434355A170D3330303333303038333434355A3025310D300B060355040A0C0441434D453114301206035504030C0B5445535420534D2D44502B3059301306072A8648CE3D020106082A8648CE3D03010703420004104C2AE3D02DEF9C979261A7C6710076B970721D0955A2644AE05FAE4BC2314E5DC09F6BF0118026165342E212318775E365F3B57325373066B9906E0BD1388DA381DF3081DC301F0603551D23041830168014F54172BDF98A95D65CBEB88A38A1C11D800A85C3301D0603551D0E04160414E6EAF71EE0FB9430ECCD1EBB421F881437C13263300E0603551D1104073005880388370A300E0603551D0F0101FF04040302078030170603551D200101FF040D300B300906076781120102010530610603551D1F045A3058302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D412E63726C302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D422E63726C300A06082A8648CE3D040302034800304502203EA51B0129FC11E843C38C8CB104244CCF92D8DDBCD4D5F9DAFD0AEF700A9B1C022100FEF382FF71FEFC58168A3607D5685DB7CB48F6B434261891496385BCD6B5857A", "308201E0A00302010202020101300A06082A8648CE3D04030230443110300E06035504030C07546573742043493111300F060355040B0C0854455354434552543110300E060355040A0C0752535054455354310B3009060355040613024954301E170D3230303430313038333434365A170D3330303333303038333434365A3025310D300B060355040A0C0441434D453114301206035504030C0B5445535420534D2D44502B305A301406072A8648CE3D020106092B240303020801010703420004893253ECC94C51DF4FEE6E0DB0951CFC65627481B5418E557069F487FAA15466A5CB8E10CC2B38099CF2A929F7F82DAC065126B71D0640961DB7F91A49E95612A381DF3081DC301F0603551D23041830168014C0BC70BA36929D43B467FF57570530E57AB8FCD8301D0603551D0E04160414A8C68DF449EB71EC723EAC132E40E4B6F54644FE300E0603551D1104073005880388370A300E0603551D0F0101FF04040302078030170603551D200101FF040D300B300906076781120102010530610603551D1F045A3058302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D412E63726C302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D422E63726C300A06082A8648CE3D04030203470030440220244ED22119D00D49D9EA4AC5D9A6D925FACFCD1998A96448A870CE47FE5E470E02206C4BC7223C925D548DDDD3D8DDD81118DA202973311F6012BB0A20E6DD2D7B7B"];
+ var pd4Sks = ["DCD694B778957E8E9ADDBDD94433E9EF8F73D11E491C48D425A38A9491BD3BED", "75FF322F416616DAE1A484EF71D4874FB0DF3295FD35C2CBA489FBB2BB9C7BF6"];
+ var pd4Tid = "";
+ for (var pd4Ri = 0; pd4Ri < 16; pd4Ri++) {
+ pd4Tid += bind.engine.Hex(Math.round(255 * Math.random()), 2);
+ }
+ var pd4Sel = 0;
+ var pd4Sig1 = "";
+ var pd4Dps = [["FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF", "FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFC", "5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B", "046B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C2964FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5", "FFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551"], ["A9FB57DBA1EEA9BC3E660A909D838D726E3BF623D52620282013481D1F6E5377", "7D5A0975FC2C3057EEF67530417AFFE7FB8055C126DC5C6CE94A4B44F330B5D9", "26DC5C6CE94A4B44F330B5D9BBD77CBF958416295CF7E1CE6BCCDC18FF8C07B6", "048BD2AEB9CB7E57CB2C4B482FFC81B7AFB9DE27E1E3BD23C23A4453BD9ACE3262547EF835C3DAC4FD97F8461A14611DC9C27745132DED8E545C1D54C72F046997", "A9FB57DBA1EEA9BC3E660A909D838D718C397AA3B561A6F7901E0E82974856A7"]];
+ if (pd4Sel < 0 || pd4Sig1 === "") {
+ // fail-closed 诚实面：CMA 运行时操作数缺席（CMA 失败/未执行）→ BF21 不发送（前序 CMA 步断言面已计错，本步不伪造通过）。
+ bind.checkData("S4-C1 SW", "9000", "pd4_not_executed:cma_operands_absent");
+ bind.checkData("S4-C2 R_PREP_DOWNLOAD response structure", "1", "pd4_not_executed:cma_operands_absent");
+ } else {
+ bind.engine.InitEccDomainParams(pd4Dps[pd4Sel][0], pd4Dps[pd4Sel][1], pd4Dps[pd4Sel][2], pd4Dps[pd4Sel][3], pd4Dps[pd4Sel][4], 1);
+ var pd4S2 = BindEs10xSingleRequest.buildTlv("30",
+ BindEs10xSingleRequest.buildTlv("80", pd4Tid)
+ + BindEs10xSingleRequest.buildTlv("01", "00"));
+ var pd4Sgn = "";
+ while (pd4Sgn.length != 2 * pd4Sks[pd4Sel].length) {
+ bind.engine.SleepTime(2000);
+ pd4Sgn = bind.engine.EccSignData(pd4Sks[pd4Sel], pd4S2 + BindEs10xSingleRequest.buildTlv("5F37", pd4Sig1), 33);
+ }
+ var pd4Req = BindEs10xSingleRequest.buildTlv("BF21",
+ pd4S2
+ + BindEs10xSingleRequest.buildTlv("5F37", pd4Sgn)
+ + BindEs10xSingleRequest.buildTlv("30", pd4Certs[pd4Sel]));
+ var pd4Run = BindEs10xSingleRequest.runTransport(bind.sendApdu,
+ {cla: "", ins: "E2", p1: "91", p2: "00", data: pd4Req,
+ le: "00", blockSize: 255, blockSw: "9000", final_sw: "9000"});
+ var pd4Sw = (pd4Run.final && pd4Run.final.sw) ? pd4Run.final.sw : "transport_error";
+ bind.checkData("S4-C1 SW", "9000", pd4Sw);
+ // euiccOtpk（5F49）运行时提取面登记：响应 ok 分支 euiccSigned2 成员（BF21 A0 30 5F49 路径），供后续步（RETRY 形 bppEuiccOtpk/BPP 装配）消费。
+ var pd4Otpk = "";
+ if (pd4Run.final && pd4Run.final.resp) {
+ var pd4L1 = BindEs10xSingleRequest.parseBerTlv(pd4Run.final.resp);
+ for (var pd4I1 = 0; pd4I1 < pd4L1.length && pd4Otpk === ""; pd4I1++) {
+ if (pd4L1[pd4I1].tag !== "BF21") continue;
+ var pd4L2 = BindEs10xSingleRequest.parseBerTlv(pd4L1[pd4I1].value);
+ for (var pd4I2 = 0; pd4I2 < pd4L2.length && pd4Otpk === ""; pd4I2++) {
+ if (pd4L2[pd4I2].tag !== "A0") continue;
+ var pd4L3 = BindEs10xSingleRequest.parseBerTlv(pd4L2[pd4I2].value);
+ for (var pd4I3 = 0; pd4I3 < pd4L3.length && pd4Otpk === ""; pd4I3++) {
+ if (pd4L3[pd4I3].tag !== "30") continue;
+ var pd4L4 = BindEs10xSingleRequest.parseBerTlv(pd4L3[pd4I3].value);
+ for (var pd4I4 = 0; pd4I4 < pd4L4.length; pd4I4++) {
+ if (pd4L4[pd4I4].tag === "5F49") pd4Otpk = pd4L4[pd4I4].value;
+ }
+ }
+ }
+ }
+ }
+ }
+ // R_PREP_DOWNLOAD 响应结构（S22_prep_dl §5.7.5 行 77-111：外层 BF21 CHOICE；downloadResponseError A1{transactionId 80, downloadErrorCode 02}）：运行时域，仅结构与在场性断言。
+ var pd4RSR = (pd4Run.final && pd4Run.final.resp) ? BindEs10xSingleRequest.parseBerTlv(pd4Run.final.resp) : [];
+ var pd4RSOuter = pd4RSR.length === 1 ? pd4RSR[0].tag : "absent";
+ var pd4RSBr = pd4RSR.length === 1 ? BindEs10xSingleRequest.parseBerTlv(pd4RSR[0].value) : [];
+ var pd4RSA0 = false, pd4RSA1 = false, pd4RSCk = [];
+ for (var pd4RSi = 0; pd4RSi < pd4RSBr.length; pd4RSi++) {
+ if (pd4RSBr[pd4RSi].tag === "A0") { pd4RSA0 = true; pd4RSCk = BindEs10xSingleRequest.parseBerTlv(pd4RSBr[pd4RSi].value); }
+ if (pd4RSBr[pd4RSi].tag === "A1") { pd4RSA1 = true; pd4RSCk = BindEs10xSingleRequest.parseBerTlv(pd4RSBr[pd4RSi].value); }
+ }
+ var pd4RS30 = false, pd4RS5F37 = false, pd4RS80 = false, pd4RS02 = false;
+ for (var pd4RSj = 0; pd4RSj < pd4RSCk.length; pd4RSj++) {
+ if (pd4RSCk[pd4RSj].tag === "30") pd4RS30 = true;
+ if (pd4RSCk[pd4RSj].tag === "5F37") pd4RS5F37 = true;
+ if (pd4RSCk[pd4RSj].tag === "80") pd4RS80 = true;
+ if (pd4RSCk[pd4RSj].tag === "02") pd4RS02 = true;
+ }
+ var pd4RS5F49 = false;
+ if (pd4RS30) {
+ for (var pd4RSk = 0; pd4RSk < pd4RSCk.length; pd4RSk++) {
+ if (pd4RSCk[pd4RSk].tag !== "30") continue;
+ var pd4RSU = BindEs10xSingleRequest.parseBerTlv(pd4RSCk[pd4RSk].value);
+ for (var pd4RSm = 0; pd4RSm < pd4RSU.length; pd4RSm++) {
+ if (pd4RSU[pd4RSm].tag === "5F49") pd4RS5F49 = true;
+ if (pd4RSU[pd4RSm].tag === "80") pd4RS80 = true;
+ }
+ }
+ }
+ bind.checkData("S4-C2 R_PREP_DOWNLOAD response structure" + " (downloadResponseError or no data)", "1", (pd4RSOuter === "absent" || (pd4RSA1 && pd4RS80 && pd4RS02)) ? "1" : "0");
+ // S4-C3: binding:prep_download_response_tid_echo(request-S_TRANSACTION_ID;S22_prep_dl) (check_attestation)
+
+ // 步骤 5：SEQ05-1] MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ31_130, RQ31_134, RQ31_136, RQ57_025, RQ57_031, RQ57_036, RQ57_037, RQ57_038）
+ // PREP_DOWNLOAD 运行时绑定（PREP_DOWNLOAD_INV_TRANS_ID；SGP.22 §5.7.5 PrepareDownloadRequest=BF21 成员序 smdpSigned2(30) → smdpSignature2(5F37) → smdpCertificate(30)）：
+ // 无前序 cma_decl 源（GIC CMA）：transactionId 运行时随机（G Annex B <S_TRANSACTION_ID>，vendor RandHexStr 机制）；euiccSignature1 无源→空串，诚实守卫拦截发送（不硬造签名明文）。
+ // 错误注入变体（I_annexD3_es10x）：cert＝SGP.26 v1.5 变体物料声明面（input/PREP_DOWNLOAD_VARIANT_MATERIALS.json，sha256 锚编译期已核）；ccRequiredFlag/签名形态按变体闭集定义。
+ var pd5Certs = ["308201DFA00302010202020101300A06082A8648CE3D04030230443110300E06035504030C07546573742043493111300F060355040B0C0854455354434552543110300E060355040A0C0752535054455354310B3009060355040613024954301E170D3230303430313038333434355A170D3330303333303038333434355A3025310D300B060355040A0C0441434D453114301206035504030C0B5445535420534D2D44502B3059301306072A8648CE3D020106082A8648CE3D03010703420004104C2AE3D02DEF9C979261A7C6710076B970721D0955A2644AE05FAE4BC2314E5DC09F6BF0118026165342E212318775E365F3B57325373066B9906E0BD1388DA381DF3081DC301F0603551D23041830168014F54172BDF98A95D65CBEB88A38A1C11D800A85C3301D0603551D0E04160414E6EAF71EE0FB9430ECCD1EBB421F881437C13263300E0603551D1104073005880388370A300E0603551D0F0101FF04040302078030170603551D200101FF040D300B300906076781120102010530610603551D1F045A3058302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D412E63726C302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D422E63726C300A06082A8648CE3D040302034800304502203EA51B0129FC11E843C38C8CB104244CCF92D8DDBCD4D5F9DAFD0AEF700A9B1C022100FEF382FF71FEFC58168A3607D5685DB7CB48F6B434261891496385BCD6B5857A", "308201E0A00302010202020101300A06082A8648CE3D04030230443110300E06035504030C07546573742043493111300F060355040B0C0854455354434552543110300E060355040A0C0752535054455354310B3009060355040613024954301E170D3230303430313038333434365A170D3330303333303038333434365A3025310D300B060355040A0C0441434D453114301206035504030C0B5445535420534D2D44502B305A301406072A8648CE3D020106092B240303020801010703420004893253ECC94C51DF4FEE6E0DB0951CFC65627481B5418E557069F487FAA15466A5CB8E10CC2B38099CF2A929F7F82DAC065126B71D0640961DB7F91A49E95612A381DF3081DC301F0603551D23041830168014C0BC70BA36929D43B467FF57570530E57AB8FCD8301D0603551D0E04160414A8C68DF449EB71EC723EAC132E40E4B6F54644FE300E0603551D1104073005880388370A300E0603551D0F0101FF04040302078030170603551D200101FF040D300B300906076781120102010530610603551D1F045A3058302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D412E63726C302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D422E63726C300A06082A8648CE3D04030203470030440220244ED22119D00D49D9EA4AC5D9A6D925FACFCD1998A96448A870CE47FE5E470E02206C4BC7223C925D548DDDD3D8DDD81118DA202973311F6012BB0A20E6DD2D7B7B"];
+ var pd5Sks = ["DCD694B778957E8E9ADDBDD94433E9EF8F73D11E491C48D425A38A9491BD3BED", "75FF322F416616DAE1A484EF71D4874FB0DF3295FD35C2CBA489FBB2BB9C7BF6"];
+ var pd5Tid = "";
+ for (var pd5Ri = 0; pd5Ri < 16; pd5Ri++) {
+ pd5Tid += bind.engine.Hex(Math.round(255 * Math.random()), 2);
+ }
+ var pd5Sel = 0;
+ var pd5Sig1 = "";
+ var pd5Dps = [["FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF", "FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFC", "5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B", "046B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C2964FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5", "FFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551"], ["A9FB57DBA1EEA9BC3E660A909D838D726E3BF623D52620282013481D1F6E5377", "7D5A0975FC2C3057EEF67530417AFFE7FB8055C126DC5C6CE94A4B44F330B5D9", "26DC5C6CE94A4B44F330B5D9BBD77CBF958416295CF7E1CE6BCCDC18FF8C07B6", "048BD2AEB9CB7E57CB2C4B482FFC81B7AFB9DE27E1E3BD23C23A4453BD9ACE3262547EF835C3DAC4FD97F8461A14611DC9C27745132DED8E545C1D54C72F046997", "A9FB57DBA1EEA9BC3E660A909D838D718C397AA3B561A6F7901E0E82974856A7"]];
+ if (pd5Sel < 0 || pd5Sig1 === "") {
+ // fail-closed 诚实面：CMA 运行时操作数缺席（CMA 失败/未执行）→ BF21 不发送（前序 CMA 步断言面已计错，本步不伪造通过）。
+ bind.checkData("S5-C1 SW", "9000", "pd5_not_executed:cma_operands_absent");
+ bind.checkData("S5-C2 R_PREP_DOWNLOAD response structure", "1", "pd5_not_executed:cma_operands_absent");
+ } else {
+ bind.engine.InitEccDomainParams(pd5Dps[pd5Sel][0], pd5Dps[pd5Sel][1], pd5Dps[pd5Sel][2], pd5Dps[pd5Sel][3], pd5Dps[pd5Sel][4], 1);
+ var pd5S2 = BindEs10xSingleRequest.buildTlv("30",
+ BindEs10xSingleRequest.buildTlv("80", pd5Tid)
+ + BindEs10xSingleRequest.buildTlv("01", "00"));
+ var pd5Sgn = "";
+ while (pd5Sgn.length != 2 * pd5Sks[pd5Sel].length) {
+ bind.engine.SleepTime(2000);
+ pd5Sgn = bind.engine.EccSignData(pd5Sks[pd5Sel], pd5S2 + BindEs10xSingleRequest.buildTlv("5F37", pd5Sig1), 33);
+ }
+ var pd5Req = BindEs10xSingleRequest.buildTlv("BF21",
+ pd5S2
+ + BindEs10xSingleRequest.buildTlv("5F37", pd5Sgn)
+ + BindEs10xSingleRequest.buildTlv("30", pd5Certs[pd5Sel]));
+ var pd5Run = BindEs10xSingleRequest.runTransport(bind.sendApdu,
+ {cla: "", ins: "E2", p1: "91", p2: "00", data: pd5Req,
+ le: "00", blockSize: 255, blockSw: "9000", final_sw: "9000"});
+ var pd5Sw = (pd5Run.final && pd5Run.final.sw) ? pd5Run.final.sw : "transport_error";
+ bind.checkData("S5-C1 SW", "9000", pd5Sw);
+ // euiccOtpk（5F49）运行时提取面登记：响应 ok 分支 euiccSigned2 成员（BF21 A0 30 5F49 路径），供后续步（RETRY 形 bppEuiccOtpk/BPP 装配）消费。
+ var pd5Otpk = "";
+ if (pd5Run.final && pd5Run.final.resp) {
+ var pd5L1 = BindEs10xSingleRequest.parseBerTlv(pd5Run.final.resp);
+ for (var pd5I1 = 0; pd5I1 < pd5L1.length && pd5Otpk === ""; pd5I1++) {
+ if (pd5L1[pd5I1].tag !== "BF21") continue;
+ var pd5L2 = BindEs10xSingleRequest.parseBerTlv(pd5L1[pd5I1].value);
+ for (var pd5I2 = 0; pd5I2 < pd5L2.length && pd5Otpk === ""; pd5I2++) {
+ if (pd5L2[pd5I2].tag !== "A0") continue;
+ var pd5L3 = BindEs10xSingleRequest.parseBerTlv(pd5L2[pd5I2].value);
+ for (var pd5I3 = 0; pd5I3 < pd5L3.length && pd5Otpk === ""; pd5I3++) {
+ if (pd5L3[pd5I3].tag !== "30") continue;
+ var pd5L4 = BindEs10xSingleRequest.parseBerTlv(pd5L3[pd5I3].value);
+ for (var pd5I4 = 0; pd5I4 < pd5L4.length; pd5I4++) {
+ if (pd5L4[pd5I4].tag === "5F49") pd5Otpk = pd5L4[pd5I4].value;
+ }
+ }
+ }
+ }
+ }
+ }
+ // R_PREP_DOWNLOAD 响应结构（S22_prep_dl §5.7.5 行 77-111：外层 BF21 CHOICE；downloadResponseError A1{transactionId 80, downloadErrorCode 02}）：运行时域，仅结构与在场性断言。
+ var pd5RSR = (pd5Run.final && pd5Run.final.resp) ? BindEs10xSingleRequest.parseBerTlv(pd5Run.final.resp) : [];
+ var pd5RSOuter = pd5RSR.length === 1 ? pd5RSR[0].tag : "absent";
+ var pd5RSBr = pd5RSR.length === 1 ? BindEs10xSingleRequest.parseBerTlv(pd5RSR[0].value) : [];
+ var pd5RSA0 = false, pd5RSA1 = false, pd5RSCk = [];
+ for (var pd5RSi = 0; pd5RSi < pd5RSBr.length; pd5RSi++) {
+ if (pd5RSBr[pd5RSi].tag === "A0") { pd5RSA0 = true; pd5RSCk = BindEs10xSingleRequest.parseBerTlv(pd5RSBr[pd5RSi].value); }
+ if (pd5RSBr[pd5RSi].tag === "A1") { pd5RSA1 = true; pd5RSCk = BindEs10xSingleRequest.parseBerTlv(pd5RSBr[pd5RSi].value); }
+ }
+ var pd5RS30 = false, pd5RS5F37 = false, pd5RS80 = false, pd5RS02 = false;
+ for (var pd5RSj = 0; pd5RSj < pd5RSCk.length; pd5RSj++) {
+ if (pd5RSCk[pd5RSj].tag === "30") pd5RS30 = true;
+ if (pd5RSCk[pd5RSj].tag === "5F37") pd5RS5F37 = true;
+ if (pd5RSCk[pd5RSj].tag === "80") pd5RS80 = true;
+ if (pd5RSCk[pd5RSj].tag === "02") pd5RS02 = true;
+ }
+ var pd5RS5F49 = false;
+ if (pd5RS30) {
+ for (var pd5RSk = 0; pd5RSk < pd5RSCk.length; pd5RSk++) {
+ if (pd5RSCk[pd5RSk].tag !== "30") continue;
+ var pd5RSU = BindEs10xSingleRequest.parseBerTlv(pd5RSCk[pd5RSk].value);
+ for (var pd5RSm = 0; pd5RSm < pd5RSU.length; pd5RSm++) {
+ if (pd5RSU[pd5RSm].tag === "5F49") pd5RS5F49 = true;
+ if (pd5RSU[pd5RSm].tag === "80") pd5RS80 = true;
+ }
+ }
+ }
+ bind.checkData("S5-C2 R_PREP_DOWNLOAD response structure" + " (downloadResponseError or no data)", "1", (pd5RSOuter === "absent" || (pd5RSA1 && pd5RS80 && pd5RS02)) ? "1" : "0");
+ // S5-C3: binding:prep_download_variant_tid_any_value_accepted(INVALID_TRANSACTION_ID|NO_AUTH;I_annexD3) (check_attestation)
+
+ // 步骤 6：SEQ06-IC3] MTD_STORE_DATA（tc_step）
+ // <L> length binding and the conditional 61XX + GET RESPONSE chain (D.4.2) are CasBind internal state (chaining rule).
+ var sdCla6 = s14.chan !== null ? (s14.chan <= 3 ? 128 + s14.chan : 188 + s14.chan).toString(16).toUpperCase() : null;
+ var s6 = bind.sendApdu(sdCla6, "E2", "91", "00", "BF2000", "00", "9000");
+ bind.checkData("S6-C1 SW", "9000", s6.sw);
+ // geca-proc ES10b Info 响应面（R_EUICC_INFO1，SGP.22 §5.7.7/§5.7.8 结构机械转录；响应外层 tag = 请求 tag）：绑定层结构步行 + 在场性断言。
+ var gw6 = BindGecaProc.parseGecaResponse(s6.resp, {outer: "BF20", required: ["82", "A9", "AA"], optional: []});
+ bind.checkData("S6-C2 R_EUICC_INFO1 outer tag", "BF20", gw6.outer_tag === null ? "absent" : gw6.outer_tag);
+ bind.checkData("S6-C2 R_EUICC_INFO1 required members present", "1", gw6.ok ? "1" : "0");
+ // S6-C3: kind 'requirement' pattern '' has no static generation face (corpus vacuum; see CaseIR unresolved).
+ // S6-C3: binding:prep_download_ci_cert_selection(highest-priority-CI;SGP.26) (check_attestation)
+
+ // 步骤 7：SEQ06-1] MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ31_130, RQ31_136, RQ57_031, RQ57_026, RQ57_036, RQ57_037, RQ57_038）
+ // PREP_DOWNLOAD 运行时绑定（PREP_DOWNLOAD_NO_AUTH；SGP.22 §5.7.5 PrepareDownloadRequest=BF21 成员序 smdpSigned2(30) → smdpSignature2(5F37) → smdpCertificate(30)）：
+ // 无前序 cma_decl 源（GIC CMA）：transactionId 运行时随机（G Annex B <S_TRANSACTION_ID>，vendor RandHexStr 机制）；euiccSignature1 无源→空串，诚实守卫拦截发送（不硬造签名明文）。
+ // 错误注入变体（I_annexD3_es10x）：cert＝SGP.26 v1.5 变体物料声明面（input/PREP_DOWNLOAD_VARIANT_MATERIALS.json，sha256 锚编译期已核）；ccRequiredFlag/签名形态按变体闭集定义。
+ var pd7Certs = ["308201DFA00302010202020101300A06082A8648CE3D04030230443110300E06035504030C07546573742043493111300F060355040B0C0854455354434552543110300E060355040A0C0752535054455354310B3009060355040613024954301E170D3230303430313038333434355A170D3330303333303038333434355A3025310D300B060355040A0C0441434D453114301206035504030C0B5445535420534D2D44502B3059301306072A8648CE3D020106082A8648CE3D03010703420004104C2AE3D02DEF9C979261A7C6710076B970721D0955A2644AE05FAE4BC2314E5DC09F6BF0118026165342E212318775E365F3B57325373066B9906E0BD1388DA381DF3081DC301F0603551D23041830168014F54172BDF98A95D65CBEB88A38A1C11D800A85C3301D0603551D0E04160414E6EAF71EE0FB9430ECCD1EBB421F881437C13263300E0603551D1104073005880388370A300E0603551D0F0101FF04040302078030170603551D200101FF040D300B300906076781120102010530610603551D1F045A3058302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D412E63726C302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D422E63726C300A06082A8648CE3D040302034800304502203EA51B0129FC11E843C38C8CB104244CCF92D8DDBCD4D5F9DAFD0AEF700A9B1C022100FEF382FF71FEFC58168A3607D5685DB7CB48F6B434261891496385BCD6B5857A", "308201E0A00302010202020101300A06082A8648CE3D04030230443110300E06035504030C07546573742043493111300F060355040B0C0854455354434552543110300E060355040A0C0752535054455354310B3009060355040613024954301E170D3230303430313038333434365A170D3330303333303038333434365A3025310D300B060355040A0C0441434D453114301206035504030C0B5445535420534D2D44502B305A301406072A8648CE3D020106092B240303020801010703420004893253ECC94C51DF4FEE6E0DB0951CFC65627481B5418E557069F487FAA15466A5CB8E10CC2B38099CF2A929F7F82DAC065126B71D0640961DB7F91A49E95612A381DF3081DC301F0603551D23041830168014C0BC70BA36929D43B467FF57570530E57AB8FCD8301D0603551D0E04160414A8C68DF449EB71EC723EAC132E40E4B6F54644FE300E0603551D1104073005880388370A300E0603551D0F0101FF04040302078030170603551D200101FF040D300B300906076781120102010530610603551D1F045A3058302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D412E63726C302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D422E63726C300A06082A8648CE3D04030203470030440220244ED22119D00D49D9EA4AC5D9A6D925FACFCD1998A96448A870CE47FE5E470E02206C4BC7223C925D548DDDD3D8DDD81118DA202973311F6012BB0A20E6DD2D7B7B"];
+ var pd7Sks = ["DCD694B778957E8E9ADDBDD94433E9EF8F73D11E491C48D425A38A9491BD3BED", "75FF322F416616DAE1A484EF71D4874FB0DF3295FD35C2CBA489FBB2BB9C7BF6"];
+ var pd7Tid = "";
+ for (var pd7Ri = 0; pd7Ri < 16; pd7Ri++) {
+ pd7Tid += bind.engine.Hex(Math.round(255 * Math.random()), 2);
+ }
+ var pd7Sel = 0;
+ var pd7Sig1 = "";
+ var pd7Dps = [["FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF", "FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFC", "5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B", "046B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C2964FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5", "FFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551"], ["A9FB57DBA1EEA9BC3E660A909D838D726E3BF623D52620282013481D1F6E5377", "7D5A0975FC2C3057EEF67530417AFFE7FB8055C126DC5C6CE94A4B44F330B5D9", "26DC5C6CE94A4B44F330B5D9BBD77CBF958416295CF7E1CE6BCCDC18FF8C07B6", "048BD2AEB9CB7E57CB2C4B482FFC81B7AFB9DE27E1E3BD23C23A4453BD9ACE3262547EF835C3DAC4FD97F8461A14611DC9C27745132DED8E545C1D54C72F046997", "A9FB57DBA1EEA9BC3E660A909D838D718C397AA3B561A6F7901E0E82974856A7"]];
+ if (pd7Sel < 0 || pd7Sig1 === "") {
+ // fail-closed 诚实面：CMA 运行时操作数缺席（CMA 失败/未执行）→ BF21 不发送（前序 CMA 步断言面已计错，本步不伪造通过）。
+ bind.checkData("S7-C1 SW", "9000", "pd7_not_executed:cma_operands_absent");
+ bind.checkData("S7-C2 R_PREP_DOWNLOAD response structure", "1", "pd7_not_executed:cma_operands_absent");
+ } else {
+ bind.engine.InitEccDomainParams(pd7Dps[pd7Sel][0], pd7Dps[pd7Sel][1], pd7Dps[pd7Sel][2], pd7Dps[pd7Sel][3], pd7Dps[pd7Sel][4], 1);
+ var pd7S2 = BindEs10xSingleRequest.buildTlv("30",
+ BindEs10xSingleRequest.buildTlv("80", pd7Tid)
+ + BindEs10xSingleRequest.buildTlv("01", "00"));
+ var pd7Sgn = "";
+ while (pd7Sgn.length != 2 * pd7Sks[pd7Sel].length) {
+ bind.engine.SleepTime(2000);
+ pd7Sgn = bind.engine.EccSignData(pd7Sks[pd7Sel], pd7S2 + BindEs10xSingleRequest.buildTlv("5F37", pd7Sig1), 33);
+ }
+ var pd7Req = BindEs10xSingleRequest.buildTlv("BF21",
+ pd7S2
+ + BindEs10xSingleRequest.buildTlv("5F37", pd7Sgn)
+ + BindEs10xSingleRequest.buildTlv("30", pd7Certs[pd7Sel]));
+ var pd7Run = BindEs10xSingleRequest.runTransport(bind.sendApdu,
+ {cla: "", ins: "E2", p1: "91", p2: "00", data: pd7Req,
+ le: "00", blockSize: 255, blockSw: "9000", final_sw: "9000"});
+ var pd7Sw = (pd7Run.final && pd7Run.final.sw) ? pd7Run.final.sw : "transport_error";
+ bind.checkData("S7-C1 SW", "9000", pd7Sw);
+ // euiccOtpk（5F49）运行时提取面登记：响应 ok 分支 euiccSigned2 成员（BF21 A0 30 5F49 路径），供后续步（RETRY 形 bppEuiccOtpk/BPP 装配）消费。
+ var pd7Otpk = "";
+ if (pd7Run.final && pd7Run.final.resp) {
+ var pd7L1 = BindEs10xSingleRequest.parseBerTlv(pd7Run.final.resp);
+ for (var pd7I1 = 0; pd7I1 < pd7L1.length && pd7Otpk === ""; pd7I1++) {
+ if (pd7L1[pd7I1].tag !== "BF21") continue;
+ var pd7L2 = BindEs10xSingleRequest.parseBerTlv(pd7L1[pd7I1].value);
+ for (var pd7I2 = 0; pd7I2 < pd7L2.length && pd7Otpk === ""; pd7I2++) {
+ if (pd7L2[pd7I2].tag !== "A0") continue;
+ var pd7L3 = BindEs10xSingleRequest.parseBerTlv(pd7L2[pd7I2].value);
+ for (var pd7I3 = 0; pd7I3 < pd7L3.length && pd7Otpk === ""; pd7I3++) {
+ if (pd7L3[pd7I3].tag !== "30") continue;
+ var pd7L4 = BindEs10xSingleRequest.parseBerTlv(pd7L3[pd7I3].value);
+ for (var pd7I4 = 0; pd7I4 < pd7L4.length; pd7I4++) {
+ if (pd7L4[pd7I4].tag === "5F49") pd7Otpk = pd7L4[pd7I4].value;
+ }
+ }
+ }
+ }
+ }
+ }
+ // R_PREP_DOWNLOAD 响应结构（S22_prep_dl §5.7.5 行 77-111：外层 BF21 CHOICE；downloadResponseError A1{transactionId 80, downloadErrorCode 02}）：运行时域，仅结构与在场性断言。
+ var pd7RSR = (pd7Run.final && pd7Run.final.resp) ? BindEs10xSingleRequest.parseBerTlv(pd7Run.final.resp) : [];
+ var pd7RSOuter = pd7RSR.length === 1 ? pd7RSR[0].tag : "absent";
+ var pd7RSBr = pd7RSR.length === 1 ? BindEs10xSingleRequest.parseBerTlv(pd7RSR[0].value) : [];
+ var pd7RSA0 = false, pd7RSA1 = false, pd7RSCk = [];
+ for (var pd7RSi = 0; pd7RSi < pd7RSBr.length; pd7RSi++) {
+ if (pd7RSBr[pd7RSi].tag === "A0") { pd7RSA0 = true; pd7RSCk = BindEs10xSingleRequest.parseBerTlv(pd7RSBr[pd7RSi].value); }
+ if (pd7RSBr[pd7RSi].tag === "A1") { pd7RSA1 = true; pd7RSCk = BindEs10xSingleRequest.parseBerTlv(pd7RSBr[pd7RSi].value); }
+ }
+ var pd7RS30 = false, pd7RS5F37 = false, pd7RS80 = false, pd7RS02 = false;
+ for (var pd7RSj = 0; pd7RSj < pd7RSCk.length; pd7RSj++) {
+ if (pd7RSCk[pd7RSj].tag === "30") pd7RS30 = true;
+ if (pd7RSCk[pd7RSj].tag === "5F37") pd7RS5F37 = true;
+ if (pd7RSCk[pd7RSj].tag === "80") pd7RS80 = true;
+ if (pd7RSCk[pd7RSj].tag === "02") pd7RS02 = true;
+ }
+ var pd7RS5F49 = false;
+ if (pd7RS30) {
+ for (var pd7RSk = 0; pd7RSk < pd7RSCk.length; pd7RSk++) {
+ if (pd7RSCk[pd7RSk].tag !== "30") continue;
+ var pd7RSU = BindEs10xSingleRequest.parseBerTlv(pd7RSCk[pd7RSk].value);
+ for (var pd7RSm = 0; pd7RSm < pd7RSU.length; pd7RSm++) {
+ if (pd7RSU[pd7RSm].tag === "5F49") pd7RS5F49 = true;
+ if (pd7RSU[pd7RSm].tag === "80") pd7RS80 = true;
+ }
+ }
+ }
+ bind.checkData("S7-C2 R_PREP_DOWNLOAD response structure" + " (downloadResponseError or no data)", "1", (pd7RSOuter === "absent" || (pd7RSA1 && pd7RS80 && pd7RS02)) ? "1" : "0");
+ // S7-C3: binding:prep_download_variant_tid_any_value_accepted(INVALID_TRANSACTION_ID|NO_AUTH;I_annexD3) (check_attestation)
+
+ // 步骤 8：SEQ07-1] MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ31_130, RQ31_134, RQ31_136, RQ57_025, RQ57_031, RQ57_036, RQ57_037, RQ57_038, RQ45_006, RQ45_026_1, RQ45_026, RQ45_028）
+ // PREP_DOWNLOAD 运行时绑定（PREP_DOWN_INV_CURVE；SGP.22 §5.7.5 PrepareDownloadRequest=BF21 成员序 smdpSigned2(30) → smdpSignature2(5F37) → smdpCertificate(30)）：
+ // 无前序 cma_decl 源（GIC CMA）：transactionId 运行时随机（G Annex B <S_TRANSACTION_ID>，vendor RandHexStr 机制）；euiccSignature1 无源→空串，诚实守卫拦截发送（不硬造签名明文）。
+ // 错误注入变体（I_annexD3_es10x）：cert＝SGP.26 v1.5 变体物料声明面（input/PREP_DOWNLOAD_VARIANT_MATERIALS.json，sha256 锚编译期已核）；ccRequiredFlag/签名形态按变体闭集定义。
+ var pd8Certs = ["308201CFA00302010202020901300A06082A8648CE3D04030230443110300E06035504030C07546573742043493111300F060355040B0C0854455354434552543110300E060355040A0C0752535054455354310B3009060355040613024954301E170D3230303430393135323333345A170D3330303430373135323333345A3025310D300B060355040A0C0441434D453114301206035504030C0B5445535420534D2D44502B3049301306072A8648CE3D020106082A8648CE3D03010103320004B833DE8CAA3B8C34F017E2336A1702CC316FDAC57970FB74FD1112F9538358F6311CAC726280875CD0F345ECD44BD0BDA381DF3081DC301F0603551D23041830168014F54172BDF98A95D65CBEB88A38A1C11D800A85C3301D0603551D0E04160414B549B2F12BFB70B8BE103EA56ED9D8211E62AB89300E0603551D1104073005880388370A300E0603551D0F0101FF04040302078030170603551D200101FF040D300B300906076781120102010530610603551D1F045A3058302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D412E63726C302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D422E63726C300A06082A8648CE3D040302034700304402207DF2501A65D3105451D3CE225FA4FA6B861363A9FEADB2225E1B201872F5DD0702205D68B00BE432A9E8EFBED6F1C1155586EE7DB29FC58F4CB4D9DE60C36705B919", "308201D0A00302010202020901300A06082A8648CE3D04030230443110300E06035504030C07546573742043493111300F060355040B0C0854455354434552543110300E060355040A0C0752535054455354310B3009060355040613024954301E170D3230303430393135323333345A170D3330303430373135323333345A3025310D300B060355040A0C0441434D453114301206035504030C0B5445535420534D2D44502B304A301406072A8648CE3D020106092B24030302080101030332000462864AE7B8A5376473177E86A09162C2BC6D14D05BF932EF50F92FA0BEBC693A19D21611B76C173AC397CD2B39B1C4AEA381DF3081DC301F0603551D23041830168014C0BC70BA36929D43B467FF57570530E57AB8FCD8301D0603551D0E04160414E9B402A455F7CEA525A1565D167D94A30CB1A55E300E0603551D1104073005880388370A300E0603551D0F0101FF04040302078030170603551D200101FF040D300B300906076781120102010530610603551D1F045A3058302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D412E63726C302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D422E63726C300A06082A8648CE3D040302034700304402200D22D098327B7DE35E6AC1BCA12939B48869D0C76C38A5BBCE43397D7194FD4402200E562320249C7D596B850BC585E3D86A00CD7648B8D346D112A8EFED38938A03"];
+ var pd8Sks = ["DCD694B778957E8E9ADDBDD94433E9EF8F73D11E491C48D425A38A9491BD3BED", "75FF322F416616DAE1A484EF71D4874FB0DF3295FD35C2CBA489FBB2BB9C7BF6"];
+ var pd8Tid = "";
+ for (var pd8Ri = 0; pd8Ri < 16; pd8Ri++) {
+ pd8Tid += bind.engine.Hex(Math.round(255 * Math.random()), 2);
+ }
+ var pd8Sel = 0;
+ var pd8Sig1 = "";
+ var pd8Dps = [["FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF", "FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFC", "5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B", "046B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C2964FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5", "FFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551"], ["A9FB57DBA1EEA9BC3E660A909D838D726E3BF623D52620282013481D1F6E5377", "7D5A0975FC2C3057EEF67530417AFFE7FB8055C126DC5C6CE94A4B44F330B5D9", "26DC5C6CE94A4B44F330B5D9BBD77CBF958416295CF7E1CE6BCCDC18FF8C07B6", "048BD2AEB9CB7E57CB2C4B482FFC81B7AFB9DE27E1E3BD23C23A4453BD9ACE3262547EF835C3DAC4FD97F8461A14611DC9C27745132DED8E545C1D54C72F046997", "A9FB57DBA1EEA9BC3E660A909D838D718C397AA3B561A6F7901E0E82974856A7"]];
+ if (pd8Sel < 0 || pd8Sig1 === "") {
+ // fail-closed 诚实面：CMA 运行时操作数缺席（CMA 失败/未执行）→ BF21 不发送（前序 CMA 步断言面已计错，本步不伪造通过）。
+ bind.checkData("S8-C1 SW", "9000", "pd8_not_executed:cma_operands_absent");
+ bind.checkData("S8-C2 R_PREP_DOWNLOAD response structure", "1", "pd8_not_executed:cma_operands_absent");
+ } else {
+ bind.engine.InitEccDomainParams(pd8Dps[pd8Sel][0], pd8Dps[pd8Sel][1], pd8Dps[pd8Sel][2], pd8Dps[pd8Sel][3], pd8Dps[pd8Sel][4], 1);
+ var pd8S2 = BindEs10xSingleRequest.buildTlv("30",
+ BindEs10xSingleRequest.buildTlv("80", pd8Tid)
+ + BindEs10xSingleRequest.buildTlv("01", "00"));
+ var pd8Sgn = "";
+ while (pd8Sgn.length != 2 * pd8Sks[pd8Sel].length) {
+ bind.engine.SleepTime(2000);
+ pd8Sgn = bind.engine.EccSignData(pd8Sks[pd8Sel], pd8S2 + BindEs10xSingleRequest.buildTlv("5F37", pd8Sig1), 33);
+ }
+ var pd8Req = BindEs10xSingleRequest.buildTlv("BF21",
+ pd8S2
+ + BindEs10xSingleRequest.buildTlv("5F37", pd8Sgn)
+ + BindEs10xSingleRequest.buildTlv("30", pd8Certs[pd8Sel]));
+ var pd8Run = BindEs10xSingleRequest.runTransport(bind.sendApdu,
+ {cla: "", ins: "E2", p1: "91", p2: "00", data: pd8Req,
+ le: "00", blockSize: 255, blockSw: "9000", final_sw: "9000"});
+ var pd8Sw = (pd8Run.final && pd8Run.final.sw) ? pd8Run.final.sw : "transport_error";
+ bind.checkData("S8-C1 SW", "9000", pd8Sw);
+ // euiccOtpk（5F49）运行时提取面登记：响应 ok 分支 euiccSigned2 成员（BF21 A0 30 5F49 路径），供后续步（RETRY 形 bppEuiccOtpk/BPP 装配）消费。
+ var pd8Otpk = "";
+ if (pd8Run.final && pd8Run.final.resp) {
+ var pd8L1 = BindEs10xSingleRequest.parseBerTlv(pd8Run.final.resp);
+ for (var pd8I1 = 0; pd8I1 < pd8L1.length && pd8Otpk === ""; pd8I1++) {
+ if (pd8L1[pd8I1].tag !== "BF21") continue;
+ var pd8L2 = BindEs10xSingleRequest.parseBerTlv(pd8L1[pd8I1].value);
+ for (var pd8I2 = 0; pd8I2 < pd8L2.length && pd8Otpk === ""; pd8I2++) {
+ if (pd8L2[pd8I2].tag !== "A0") continue;
+ var pd8L3 = BindEs10xSingleRequest.parseBerTlv(pd8L2[pd8I2].value);
+ for (var pd8I3 = 0; pd8I3 < pd8L3.length && pd8Otpk === ""; pd8I3++) {
+ if (pd8L3[pd8I3].tag !== "30") continue;
+ var pd8L4 = BindEs10xSingleRequest.parseBerTlv(pd8L3[pd8I3].value);
+ for (var pd8I4 = 0; pd8I4 < pd8L4.length; pd8I4++) {
+ if (pd8L4[pd8I4].tag === "5F49") pd8Otpk = pd8L4[pd8I4].value;
+ }
+ }
+ }
+ }
+ }
+ }
+ // R_PREP_DOWNLOAD 响应结构（S22_prep_dl §5.7.5 行 77-111：外层 BF21 CHOICE；downloadResponseError A1{transactionId 80, downloadErrorCode 02}）：运行时域，仅结构与在场性断言。
+ var pd8RSR = (pd8Run.final && pd8Run.final.resp) ? BindEs10xSingleRequest.parseBerTlv(pd8Run.final.resp) : [];
+ var pd8RSOuter = pd8RSR.length === 1 ? pd8RSR[0].tag : "absent";
+ var pd8RSBr = pd8RSR.length === 1 ? BindEs10xSingleRequest.parseBerTlv(pd8RSR[0].value) : [];
+ var pd8RSA0 = false, pd8RSA1 = false, pd8RSCk = [];
+ for (var pd8RSi = 0; pd8RSi < pd8RSBr.length; pd8RSi++) {
+ if (pd8RSBr[pd8RSi].tag === "A0") { pd8RSA0 = true; pd8RSCk = BindEs10xSingleRequest.parseBerTlv(pd8RSBr[pd8RSi].value); }
+ if (pd8RSBr[pd8RSi].tag === "A1") { pd8RSA1 = true; pd8RSCk = BindEs10xSingleRequest.parseBerTlv(pd8RSBr[pd8RSi].value); }
+ }
+ var pd8RS30 = false, pd8RS5F37 = false, pd8RS80 = false, pd8RS02 = false;
+ for (var pd8RSj = 0; pd8RSj < pd8RSCk.length; pd8RSj++) {
+ if (pd8RSCk[pd8RSj].tag === "30") pd8RS30 = true;
+ if (pd8RSCk[pd8RSj].tag === "5F37") pd8RS5F37 = true;
+ if (pd8RSCk[pd8RSj].tag === "80") pd8RS80 = true;
+ if (pd8RSCk[pd8RSj].tag === "02") pd8RS02 = true;
+ }
+ var pd8RS5F49 = false;
+ if (pd8RS30) {
+ for (var pd8RSk = 0; pd8RSk < pd8RSCk.length; pd8RSk++) {
+ if (pd8RSCk[pd8RSk].tag !== "30") continue;
+ var pd8RSU = BindEs10xSingleRequest.parseBerTlv(pd8RSCk[pd8RSk].value);
+ for (var pd8RSm = 0; pd8RSm < pd8RSU.length; pd8RSm++) {
+ if (pd8RSU[pd8RSm].tag === "5F49") pd8RS5F49 = true;
+ if (pd8RSU[pd8RSm].tag === "80") pd8RS80 = true;
+ }
+ }
+ }
+ bind.checkData("S8-C2 R_PREP_DOWNLOAD response structure" + " (downloadResponseError or no data)", "1", (pd8RSOuter === "absent" || (pd8RSA1 && pd8RS80 && pd8RS02)) ? "1" : "0");
+ // S8-C3: binding:prep_download_response_tid_echo(request-S_TRANSACTION_ID;S22_prep_dl) (check_attestation)
+
+ // 步骤 9：SEQ08-1] MTD_STORE_DATA_SCRIPT（tc_step；REQ: RQ31_130, RQ31_131, RQ31_136, RQ57_027, RQ57_030, RQ57_031, RQ57_036, RQ57_037, RQ57_038, RQ45_006, RQ45_026_1, RQ45_026, RQ45_028, RQ45_030）
+ // PREP_DOWNLOAD 运行时绑定（PREP_DOWNLOAD_INV_OID；SGP.22 §5.7.5 PrepareDownloadRequest=BF21 成员序 smdpSigned2(30) → smdpSignature2(5F37) → smdpCertificate(30)）：
+ // 无前序 cma_decl 源（GIC CMA）：transactionId 运行时随机（G Annex B <S_TRANSACTION_ID>，vendor RandHexStr 机制）；euiccSignature1 无源→空串，诚实守卫拦截发送（不硬造签名明文）。
+ // 错误注入变体（I_annexD3_es10x）：cert＝SGP.26 v1.5 变体物料声明面（input/PREP_DOWNLOAD_VARIANT_MATERIALS.json，sha256 锚编译期已核）；ccRequiredFlag/签名形态按变体闭集定义。
+ var pd9Certs = ["308201DFA00302010202020100300A06082A8648CE3D04030230443110300E06035504030C07546573742043493111300F060355040B0C0854455354434552543110300E060355040A0C0752535054455354310B3009060355040613024954301E170D3230303430313038333133305A170D3330303333303038333133305A3025310D300B060355040A0C0441434D453114301206035504030C0B5445535420534D2D44502B3059301306072A8648CE3D020106082A8648CE3D030107034200044DFED4F4694791BF1695CEA0307A35B418019695387BB75B7D2447B6B5209F0445AE4E5E521CD13888D75FE07C8580222AE20DBAAC1D77CD76304993421BD739A381DF3081DC301F0603551D23041830168014F54172BDF98A95D65CBEB88A38A1C11D800A85C3301D0603551D0E04160414BD5A82CC1A96602118BA7560A1FF83A78B210BE5300E0603551D1104073005880388370A300E0603551D0F0101FF04040302078030170603551D200101FF040D300B300906076781120102010430610603551D1F045A3058302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D412E63726C302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D422E63726C300A06082A8648CE3D040302034700304402200823EE7DFA5E3DD07838E930F81BC34AE99F06CBA35927FE9E502C464DC1FEE302200D2D4087DB01A5382D21690AC0488B15067FB2460D336332446CA99F08A8A4EF", "308201E0A00302010202020100300A06082A8648CE3D04030230443110300E06035504030C07546573742043493111300F060355040B0C0854455354434552543110300E060355040A0C0752535054455354310B3009060355040613024954301E170D3230303430313038333133305A170D3330303333303038333133305A3025310D300B060355040A0C0441434D453114301206035504030C0B5445535420534D2D44502B305A301406072A8648CE3D020106092B240303020801010703420004255D7DAF00EF841D76FA7A63D63EB3FE6C9F70492D381923F8F8BD7B24F3C5AD168EBE3B09DD80F29E7FFD24A4D1BE747F8323E472928396DDE9E0151CEABA18A381DF3081DC301F0603551D23041830168014C0BC70BA36929D43B467FF57570530E57AB8FCD8301D0603551D0E0416041479A4BD4D78FF4734BC6045CF9196244A1FB84BEB300E0603551D1104073005880388370A300E0603551D0F0101FF04040302078030170603551D200101FF040D300B300906076781120102010430610603551D1F045A3058302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D412E63726C302AA028A0268624687474703A2F2F63692E746573742E6578616D706C652E636F6D2F43524C2D422E63726C300A06082A8648CE3D0403020347003044022003078BD459045184BC50C1397141F8B90398E6B81737EC703403D5CB0DC0DFC302201A38E7FC84D3DB1179FBB17199231F2D635ED7A8AB4049774057B0ACDF726063"];
+ var pd9Sks = ["DCD694B778957E8E9ADDBDD94433E9EF8F73D11E491C48D425A38A9491BD3BED", "75FF322F416616DAE1A484EF71D4874FB0DF3295FD35C2CBA489FBB2BB9C7BF6"];
+ var pd9Tid = "";
+ for (var pd9Ri = 0; pd9Ri < 16; pd9Ri++) {
+ pd9Tid += bind.engine.Hex(Math.round(255 * Math.random()), 2);
+ }
+ var pd9Sel = 0;
+ var pd9Sig1 = "";
+ var pd9Dps = [["FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF", "FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFC", "5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B", "046B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C2964FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5", "FFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551"], ["A9FB57DBA1EEA9BC3E660A909D838D726E3BF623D52620282013481D1F6E5377", "7D5A0975FC2C3057EEF67530417AFFE7FB8055C126DC5C6CE94A4B44F330B5D9", "26DC5C6CE94A4B44F330B5D9BBD77CBF958416295CF7E1CE6BCCDC18FF8C07B6", "048BD2AEB9CB7E57CB2C4B482FFC81B7AFB9DE27E1E3BD23C23A4453BD9ACE3262547EF835C3DAC4FD97F8461A14611DC9C27745132DED8E545C1D54C72F046997", "A9FB57DBA1EEA9BC3E660A909D838D718C397AA3B561A6F7901E0E82974856A7"]];
+ if (pd9Sel < 0 || pd9Sig1 === "") {
+ // fail-closed 诚实面：CMA 运行时操作数缺席（CMA 失败/未执行）→ BF21 不发送（前序 CMA 步断言面已计错，本步不伪造通过）。
+ bind.checkData("S9-C1 SW", "9000", "pd9_not_executed:cma_operands_absent");
+ bind.checkData("S9-C2 R_PREP_DOWNLOAD response structure", "1", "pd9_not_executed:cma_operands_absent");
+ } else {
+ bind.engine.InitEccDomainParams(pd9Dps[pd9Sel][0], pd9Dps[pd9Sel][1], pd9Dps[pd9Sel][2], pd9Dps[pd9Sel][3], pd9Dps[pd9Sel][4], 1);
+ var pd9S2 = BindEs10xSingleRequest.buildTlv("30",
+ BindEs10xSingleRequest.buildTlv("80", pd9Tid)
+ + BindEs10xSingleRequest.buildTlv("01", "00"));
+ var pd9Sgn = "";
+ while (pd9Sgn.length != 2 * pd9Sks[pd9Sel].length) {
+ bind.engine.SleepTime(2000);
+ pd9Sgn = bind.engine.EccSignData(pd9Sks[pd9Sel], pd9S2 + BindEs10xSingleRequest.buildTlv("5F37", pd9Sig1), 33);
+ }
+ var pd9Req = BindEs10xSingleRequest.buildTlv("BF21",
+ pd9S2
+ + BindEs10xSingleRequest.buildTlv("5F37", pd9Sgn)
+ + BindEs10xSingleRequest.buildTlv("30", pd9Certs[pd9Sel]));
+ var pd9Run = BindEs10xSingleRequest.runTransport(bind.sendApdu,
+ {cla: "", ins: "E2", p1: "91", p2: "00", data: pd9Req,
+ le: "00", blockSize: 255, blockSw: "9000", final_sw: "9000"});
+ var pd9Sw = (pd9Run.final && pd9Run.final.sw) ? pd9Run.final.sw : "transport_error";
+ bind.checkData("S9-C1 SW", "9000", pd9Sw);
+ // euiccOtpk（5F49）运行时提取面登记：响应 ok 分支 euiccSigned2 成员（BF21 A0 30 5F49 路径），供后续步（RETRY 形 bppEuiccOtpk/BPP 装配）消费。
+ var pd9Otpk = "";
+ if (pd9Run.final && pd9Run.final.resp) {
+ var pd9L1 = BindEs10xSingleRequest.parseBerTlv(pd9Run.final.resp);
+ for (var pd9I1 = 0; pd9I1 < pd9L1.length && pd9Otpk === ""; pd9I1++) {
+ if (pd9L1[pd9I1].tag !== "BF21") continue;
+ var pd9L2 = BindEs10xSingleRequest.parseBerTlv(pd9L1[pd9I1].value);
+ for (var pd9I2 = 0; pd9I2 < pd9L2.length && pd9Otpk === ""; pd9I2++) {
+ if (pd9L2[pd9I2].tag !== "A0") continue;
+ var pd9L3 = BindEs10xSingleRequest.parseBerTlv(pd9L2[pd9I2].value);
+ for (var pd9I3 = 0; pd9I3 < pd9L3.length && pd9Otpk === ""; pd9I3++) {
+ if (pd9L3[pd9I3].tag !== "30") continue;
+ var pd9L4 = BindEs10xSingleRequest.parseBerTlv(pd9L3[pd9I3].value);
+ for (var pd9I4 = 0; pd9I4 < pd9L4.length; pd9I4++) {
+ if (pd9L4[pd9I4].tag === "5F49") pd9Otpk = pd9L4[pd9I4].value;
+ }
+ }
+ }
+ }
+ }
+ }
+ // R_PREP_DOWNLOAD 响应结构（S22_prep_dl §5.7.5 行 77-111：外层 BF21 CHOICE；downloadResponseError A1{transactionId 80, downloadErrorCode 02}）：运行时域，仅结构与在场性断言。
+ var pd9RSR = (pd9Run.final && pd9Run.final.resp) ? BindEs10xSingleRequest.parseBerTlv(pd9Run.final.resp) : [];
+ var pd9RSOuter = pd9RSR.length === 1 ? pd9RSR[0].tag : "absent";
+ var pd9RSBr = pd9RSR.length === 1 ? BindEs10xSingleRequest.parseBerTlv(pd9RSR[0].value) : [];
+ var pd9RSA0 = false, pd9RSA1 = false, pd9RSCk = [];
+ for (var pd9RSi = 0; pd9RSi < pd9RSBr.length; pd9RSi++) {
+ if (pd9RSBr[pd9RSi].tag === "A0") { pd9RSA0 = true; pd9RSCk = BindEs10xSingleRequest.parseBerTlv(pd9RSBr[pd9RSi].value); }
+ if (pd9RSBr[pd9RSi].tag === "A1") { pd9RSA1 = true; pd9RSCk = BindEs10xSingleRequest.parseBerTlv(pd9RSBr[pd9RSi].value); }
+ }
+ var pd9RS30 = false, pd9RS5F37 = false, pd9RS80 = false, pd9RS02 = false;
+ for (var pd9RSj = 0; pd9RSj < pd9RSCk.length; pd9RSj++) {
+ if (pd9RSCk[pd9RSj].tag === "30") pd9RS30 = true;
+ if (pd9RSCk[pd9RSj].tag === "5F37") pd9RS5F37 = true;
+ if (pd9RSCk[pd9RSj].tag === "80") pd9RS80 = true;
+ if (pd9RSCk[pd9RSj].tag === "02") pd9RS02 = true;
+ }
+ var pd9RS5F49 = false;
+ if (pd9RS30) {
+ for (var pd9RSk = 0; pd9RSk < pd9RSCk.length; pd9RSk++) {
+ if (pd9RSCk[pd9RSk].tag !== "30") continue;
+ var pd9RSU = BindEs10xSingleRequest.parseBerTlv(pd9RSCk[pd9RSk].value);
+ for (var pd9RSm = 0; pd9RSm < pd9RSU.length; pd9RSm++) {
+ if (pd9RSU[pd9RSm].tag === "5F49") pd9RS5F49 = true;
+ if (pd9RSU[pd9RSm].tag === "80") pd9RS80 = true;
+ }
+ }
+ }
+ bind.checkData("S9-C2 R_PREP_DOWNLOAD response structure" + " (downloadResponseError or no data)", "1", (pd9RSOuter === "absent" || (pd9RSA1 && pd9RS80 && pd9RS02)) ? "1" : "0");
+ // S9-C3: binding:prep_download_response_tid_echo(request-S_TRANSACTION_ID;S22_prep_dl) (check_attestation)
}