Bilhete Único

Bilhete Único is the public transit smartcard system in use in São Paulo, Brazil. It is a MIFARE Classic based card system, with encryption keys required.

This card is supported in all versions of Metrodroid.

Publicly available notes / dumps (português): https://github.com/vpereira/bilhete

Layout

Card layout (excluding trailers)

Sector	Block	Contents
0	0	Manufacturer block
0	1-2	Zero-filled
1	0-2	Zero-filled
2	0-2	Card identity. Blocks 1 and 2 are identical
3-4	0-2	Last trip sectors. Sectors 3 and 4 are normally identical
5	0	Const per card
5	1-2	Value blocks with addr 0x15, value = 0
6	0-2	Copy of sector 5
7	0	Const per card
7	1-2	Value blocks with addr 0x19, value = ??
8	0	Last refill block
8	1	Value block with current money and addr 0x1d
8	2	Value block with previous money and addr 0x1d
9	0-1	Zero-filled
9	2	??
10-end	*	Zero-filled

Card identity

Block 0. In bits. All is BE.

Start	End	Length	Meaning
0	1	2	Zero
2	15	14	Day. Meaning unknown In days since 2001-1-1
16	59	44	Serial number
60	63	4	Zero
64	127	64	Hash

Trip sectors

Block 0. In bits. All is BE.

Start	End	Length	Meaning
0	7	8	Transport. b4 = bus, 78 = TRAM
8	27	20	Location. For bus: line
20	47	20	Line. For bus: const
48	61	14	Transaction counter
62	63	2	Zero
64	127	64	Hash

Block 1. In bits. All is BE.

Start	End	Length	Meaning
0	35	36	???. Most bits are zero
36	51	16	Fare
52	75	24	Zero
76	89	14	Day. In days since 2001-1-1
90	100	11	Time. In minutes since local midnight
101	103	2	???. 0 or 2
104	111	8	Zero
112	127	16	???

Block 2. In bits. All is BE.

Start	End	Length	Meaning
0	1	2	Zero
2	15	14	First tap day. In days since 2001-1-1
16	26	11	First tap time. In minutes since local midnight
27	35	9	??. Maybe first tap line
36	111	76	Zero
112	127	16	CRC-16

Refill block (Sector 8, block 0)

Start	End	Length	Meaning
0	1	2	Zero
2	15	14	Day. In days since 2001-1-1
16	27	12	Zero
28	28	1	??
29	39	11	Refill amount
44	57	14	Transaction counter
58	63	6	Zero
64	127	64	Hash

Sector 9

Blocks 0 and 1 are zero-filled Block 2. In bits. All is BE.

Start	End	Length	Meaning
0	19	20	????
20	111	92	Zero
112	127	16	CRC-16

** Between Metrodroid 2.9.30 and 2.9.38, this reader was disabled by default.** It must be explicitly enabled in the MIFARE Classic Fallback Reader setting or update to newest Metrodroid.