How to Inspect eSIM Profiles and eUICC Controller States on Android Using ADB dumpsys euicc_card_controller

Modern Android smartphones, cellular tablets, and wearable devices increasingly replace physical plastic SIM cards with embedded SIMs (eSIM). The underlying hardware component — known as the embedded Universal Integrated Circuit Card (eUICC) — is a tamper-resistant security chip soldered directly onto the device motherboard. An eUICC can store multiple cellular operator profiles concurrently, allowing users to switch between networks or provision roaming carriers digitally over the air.

Managing and debugging eSIM operations involves communication between the Android telephony framework, the Local Profile Assistant (LPA), carrier Remote SIM Provisioning (RSP) servers, and the physical eUICC chip. When eSIM activation fails, profiles fail to switch, or carrier entitlement permissions conflict, standard Android UI settings provide minimal insight. System engineers, mobile developers, and enterprise administrators can use Android Debug Bridge (ADB) and the diagnostic service dumpsys euicc_card_controller to inspect eUICC hardware states, profile metadata, and carrier privilege rules in real time.

Understanding Android eUICC Architecture and Card Controller

The Android operating system coordinates eSIM profiles through a dedicated set of system services operating inside the Telephony framework:

• EuiccCardController: The core hardware abstraction controller responsible for routing commands directly to the eUICC chip via the Radio Interface Layer (RIL) and Open Mobile API (OMAPI).
• EuiccController / EuiccManager: High-level API exposed to privileged carrier apps and the system LPA (such as Google SIM Manager) to initiate profile downloads, deletions, and nickname updates.
• EID (eUICC Identifier): A globally unique 32-digit serial number assigned to the physical eUICC chip, used by cellular operators to register and target eSIM profile activation codes (LPA:1$… strings).
• Profile States: Profiles stored on the eUICC exist in one of two primary operational states: Enabled (active, providing radio connectivity) or Disabled (dormant in secure non-volatile memory).

Connecting via ADB and Executing dumpsys euicc_card_controller

Ensure Developer Options and USB Debugging are enabled on your Android device. Connect the device to your computer via USB, and verify that ADB identifies the hardware:

adb devices -l

Execute the diagnostic dump for the eUICC card controller service:

adb shell dumpsys euicc_card_controller

A typical diagnostic output provides comprehensive hardware and profile information:

EuiccCardController:
  Card ID: 1
  EID: 89049032000000000000000012345678
  Card State: READY
  Default SM-DP+ Address: rsp.truphone.com
  Number of Profiles: 2
    Profile 0:
      ICCID: 89014103211118510720
      Nickname: Work eSIM
      Service Provider Name: Vodafone UK
      State: ENABLED
      Class: OPERATIONAL
      Carrier Privilege Rules: [SHA-256: A1B2C3D4...]
    Profile 1:
      ICCID: 89882110234456789012
      Nickname: Travel Data
      Service Provider Name: Airalo
      State: DISABLED
      Class: OPERATIONAL

Analysing Key eUICC Diagnostic Metrics

The output of dumpsys euicc_card_controller reveals essential security and operational variables:

1. eUICC Identifier (EID) and Card State

The EID is the permanent hardware serial number required when submitting activation requests to cellular network carriers. The Card State indicates whether the secure element is accessible: READY signifies normal operation, while LOCKED or ERROR indicates physical hardware communication faults with the baseband modem.

2. Subscription Identification (ICCID) and Operator Metadata

Each profile block contains its 20-digit ICCID (Integrated Circuit Card Identifier), user-defined Nickname, and Service Provider Name. Verifying the ICCID through ADB confirms whether a downloaded profile was successfully written into secure memory even if the Android status bar displays “No Service”.

3. Carrier Privilege Rules

The Carrier Privilege Rules field contains cryptographic SHA-1 or SHA-256 certificate hashes. Modern Android architectures allow carrier apps to manage cellular subscriptions only if the app’s signing certificate matches the certificate hash embedded within the eSIM profile itself. If a carrier application cannot detect its own eSIM, inspecting this hash verifies whether the carrier provided mismatched signing credentials.

Querying High-Level eSIM Service States

In addition to the card controller, you can inspect the high-level EuiccController to view overall LPA provisioning status and system feature flags:

adb shell dumpsys euicc_controller

To inspect active cellular subscriptions and verify whether an enabled eSIM profile is recognized by Android Telephony:

adb shell dumpsys isms | grep -i "subscription"
adb shell dumpsys telephony.registry | grep -i "mActiveDataSubId"

You can also check whether the device supports Multiple Enabled Profiles (MEP — allowing two eSIM profiles to operate simultaneously without a physical SIM card):

adb shell getprop | grep -i "esim"

Simulating and Debugging eSIM Provisioning Failures

When troubleshooting profile activation errors (such as HTTP errors communicating with the operator’s Subscription Manager Data Preparation / SM-DP+ server), filter system logs during profile activation:

adb logcat -v time -s EuiccCardController:* EuiccController:* EuiccManager:* LPA:* GmsEuicc:*

Common provisioning error patterns identified in logcat include:

• SUBJECT_CODE_8 / REASON_CODE_1: Activation code already redeemed or expired on the carrier server.
• SUBJECT_CODE_5 / REASON_CODE_2: The device EID is not registered in the operator’s SM-DP+ database.
• CERTIFICATE_VERIFICATION_FAILED: Root Certificate Authority (CA) mismatch between the operator server and the eUICC’s trusted certificates.

Troubleshooting Common eSIM Anomalies

If eSIM profiles behave erratically or disappear after operating system updates, perform the following troubleshooting steps:

• Modem Radio Out of Sync: If dumpsys euicc_card_controller shows the profile as ENABLED but cellular signal is missing, toggle the radio interface via ADB:

  adb shell cmd phone set-radio-power false
  sleep 2
  adb shell cmd phone set-radio-power true

• Privilege Cache Desynchronization: If an enterprise management app loses carrier privileges after an app update, clear the carrier privilege cache by restarting the telephony registry:

  adb shell kill $(adb shell pidof com.android.phone)

• Stuck LPA Download Sessions: If an eSIM download is interrupted midway due to a Wi-Fi drop, inspect pending download operations and reboot into recovery or restart the LPA service:

  adb shell am force-stop com.google.android.euicc