-
Notifications
You must be signed in to change notification settings - Fork 71
ERG MFC
ERG was an Australian developer of automated fare collection systems. They renamed to Videlli in 2009. The assets of the business were sold to Vix in 2008.
There are a number of MIFARE Classic based ticketing systems built by ERG.
Metrodroid implements support for Manly Fast Ferry in v2.9.22. There is a "generic" reader in v2.9.33, which also supports Metrocard (Christchurch).
The card technology is MIFARE Classic.
- Sector 0 has a well known Key A (
FF FF FF FF FF FF). - All other sectors have a Key A and Key B which are unique to each individual card.
Some MIFARE Plus cards in Classic compatibility mode are in circulation, however all cards can be cracked with either the Nested or Hardnested attacks.
| Sector | Block | Content |
|---|---|---|
| 0 | 0 | MIFARE UID and manufacturer information |
| 0 | 1 | Preamble: card magic, sometimes contains serial number |
| 0 | 2 | Metadata: agency ID, card epoch, serial number |
| 1-2 | all | Unknown |
| 3 | all | Balance (contained in 2 of 3 blocks) |
| 4 | 2 | Purse record |
| 5-7 | all | Purse record |
| 8 | all | Empty |
| 9 | all | Purse record |
| 10 | all | Unknown |
| 11-15 | all | Empty |
| Agency ID | Name | Quirks |
|---|---|---|
| 0x0136 | Metrocard (Christchurch) | Card number is printed in decimal |
| 0x0227 | Manly Fast Ferry | Card number is printed in hexadecimal |
All data on the card is big endian. Record lengths are shown in bytes, inclusive of the first and last bytes, unless otherwise specified.
| First | Last | Length | Field description |
|---|---|---|---|
| 0 | 6 | 7 | Magic: 32 32 00 00 00 01 01
|
| 10 | 13 | 4 | Card number; some older cards don't use this field, and have the first three bytes set to 0x00 instead. |
| 14 | 15 | 2 | 0F FF |
| First | Last | Length | Field description |
|---|---|---|---|
| 2 | 3 | 2 | Agency ID |
| 5 | 6 | 2 | Card epoch, expressed in days since 2000-01-01 |
| 7 | 10 | 4 | Card number |
| First | Last | Length | Field description |
|---|---|---|---|
| 1 | 2 | 2 | Transaction number (higher is more recent) |
| 5 | 6 | 2 | Agency ID (not present on Metrocard (Christchurch)) |
| 7 | 8 | 2 |
00 00 -- other values here indicate a different record type |
| 11 | 14 | 4 | Balance, in cents. |
| First | Last | Length | Field description |
|---|---|---|---|
| 1 | 2 | 2 | Agency ID (might not be present on Metrocard (Christchurch)) |
| 3 | 3 | 1 |
0x08 purse credit, 0x09 purse debit |
| 4 | 7 | 4 | Timestamp of transaction. |
| 8 | 11 | 4 | Value of the transaction, in cents. |
Timestamps are 32 bits long. Values expressed in bits.
| First | Last | Length | Field description |
|---|---|---|---|
| 0 | 19 | 20 | Days since card epoch |
| 20 | 31 | 12 | Minutes since midnight |