How to Inspect SIM Subscriber Identity and Device Identifiers on Android Using ADB dumpsys iphonesubinfo

In mobile cellular development, automated enterprise provisioning, and telecommunications testing, validating hardware subscriber identities across physical SIM cards and embedded eSIM profiles is foundational. When testing multi-SIM devices, verifying carrier provisioning, or diagnosing network registration rejections, engineers need direct visibility into cellular subscriber parameters without relying on third-party diagnostics apps. Within the Android framework, the iphonesubinfo service (implementing the IPhoneSubInfo telephony interface) acts as the central custodian for subscriber identity records. Using the Android Debug Bridge (ADB), engineers can query this service via dumpsys iphonesubinfo to retrieve subscriber identities, SIM serial numbers, and line numbers.

Understanding Android Telephony Subscriber Architecture

The subscriber identification stack on Android coordinates hardware baseband states, UICC (Universal Integrated Circuit Card) secure chips, and framework APIs:

• UICC / SIM Secure Element: Stores the physical subscriber profile, cryptographic authentication keys (Ki), and network operator identifiers.
• IPhoneSubInfo Daemon: The internal AIDL service (traditionally named in AOSP during early telephony architecture design) that bridges between the Radio Interface Layer (RIL) and the Android framework.
• SubscriptionManager: Manages active logical SIM profiles, assigning dynamic Subscription IDs (subId) to each active cellular profile (e.g., SIM 1, SIM 2, eSIM).
• Telephony Permissions: In modern Android releases (Android 10+), access to non-resettable subscriber identifiers (such as IMSI and ICCID) is strictly restricted to system-privileged apps and device owner profiles via READ_PRIVILEGED_PHONE_STATE permissions.

Querying Subscriber Diagnostics via ADB

To inspect the active state of subscriber identities, connect your Android device with USB debugging enabled and execute:

adb shell dumpsys iphonesubinfo

The command outputs subscriber identity metadata for all detected SIM slots. A representative output structure appears as follows:

Phone Subscriber Info:
  Default Subscription ID: 1
  SubId 1 (Slot 0):
    Device ID (IMEI): 865421041234567
    Subscriber ID (IMSI): 234151234567890
    SIM Serial Number (ICCID): 89441100652134567890
    Line 1 Number: +447911123456
    Voice Mail Number: +447911100000
    Voice Mail Alpha Tag: Voicemail
  SubId 2 (Slot 1):
    Device ID (IMEI): 865421047654321
    Subscriber ID (IMSI): 208101234567890
    SIM Serial Number (ICCID): 89331000781234567890
    Line 1 Number: +33612345678
    Voice Mail Number: +33612340000
    Voice Mail Alpha Tag: Messagerie

Key operational fields include:

• Subscriber ID (IMSI): The International Mobile Subscriber Identity (15-digit number) consisting of the Mobile Country Code (MCC), Mobile Network Code (MNC), and Mobile Station Identification Number (MSIN).
• SIM Serial Number (ICCID): The 19- or 20-digit globally unique hardware identifier embedded on the physical SIM card or eSIM chip.
• Line 1 Number (MSISDN): The subscriber’s public mobile telephone number written into the SIM card’s EF_MSISDN elementary file by the carrier.
• Voice Mail Number and Alpha Tag: The carrier-provisioned destination number used for automated voicemail retrieval.

Decoding Multi-SIM and eSIM Profiles

On Dual SIM Dual Standby (DSDS) or Dual SIM Dual Active (DSDA) devices, dumpsys iphonesubinfo enumerates each physical SIM slot and embedded eSIM profile separately under its associated SubId. This allows engineers to verify:

• Which subscription is currently selected as the default data and voice bearer.
• Whether a roaming SIM correctly exposes its home network IMSI while operating on a foreign network.
• Whether private APN provisioning matches the expected carrier ICCID range.

Auditing Telephony Identifier Privacy Restrictions

Starting with Android 10, Google deprecated access to device identifiers for standard third-party applications to prevent user tracking across factory resets. When an unprivileged app attempts to query getSubscriberId() or getSimSerialNumber() through the public TelephonyManager API, the framework either throws a SecurityException or returns a dummy null string.

To verify which applications have been granted special carrier privileges or carrier app exemptions via ADB:

# Check carrier app privileges
adb shell dumpsys carrier_config | grep "carrier_app"

Tracing Live SIM State and Radio Events in Logcat

To monitor real-time SIM card insertion events, PIN/PUK verification handshakes, and UICC state transitions, filter logcat for RIL and SIM tags:

adb logcat -b radio -s RILC:V UiccController:V GsmCdmaPhone:V

When a SIM is initialized, the radio log outputs the raw APDU exchanges between the baseband modem and the UICC secure chip:

UiccController: Received SIM state update: CARDSTATE_PRESENT
RILC: [0042]> RIL_REQUEST_GET_SIM_STATUS
RILC: [0042]< RIL_REQUEST_GET_SIM_STATUS response {app_state: APPSTATE_READY}

By leveraging dumpsys iphonesubinfo alongside radio subsystem monitoring, cellular engineers and Android developers can audit SIM identity provisioning, verify multi-SIM parameters, and troubleshoot carrier roaming registrations with definitive accuracy.