ERG MFC

ERG was an Australian developer of automated fare collection systems. They renamed to Videlli in 2009. The assets of the business were sold to Vix in 2008.

There are a number of MIFARE Classic based ticketing systems built by ERG.

Milestones

Metrodroid Version	Description
v2.9.22	Added as Manly Fast Ferry
v2.9.33	Adds Metrocard (Christchurch) and "generic" ERG support

Agency IDs / Deployments

Agency ID	Name	Quirks
0x0136	Metrocard (Christchurch)	Card number is printed in decimal
0x0227	Manly Fast Ferry	Card number is printed in hexadecimal

Keying

The card technology is MIFARE Classic.

• Sector 0 has a well known Key A (FF FF FF FF FF FF).
• All other sectors have a Key A and Key B which are unique to each individual card.

Some MIFARE Plus cards in Classic compatibility mode are in circulation, however all cards can be cracked with either the Nested or Hardnested attacks.

Sector Layout

Sector	Block	Content
0	0	MIFARE UID and manufacturer information
0	1	Preamble: card magic, sometimes contains serial number
0	2	Metadata: agency ID, card epoch, serial number
1-2	all	Unknown
3	all	Balance (contained in 2 of 3 blocks)
4	2	Purse record
5-7	all	Purse record
8	all	Empty
9-11	all	Purse record
12-15	all	Empty

Records

All data on the card is big endian. Record lengths are shown in bytes, inclusive of the first and last bytes, unless otherwise specified.

Preamble record

First	Last	Length	Field description
0	6	7	Magic: 32 32 00 00 00 01 01
7	9	3	00
10	13	4	Card number; some older cards don't use this field, and have the first three bytes set to 0x00 instead.
14	15	2	0F FF

Metadata record

First	Last	Length	Field description
0	1	2	02 03 (unknown)
2	3	2	Agency ID
4	4	1	01 (unknown)
5	6	2	Card epoch, expressed in days since 2000-01-01
7	10	4	Card number
11	12	2	unknown, varies per card
13	15	3	00

Balance records

First	Last	Length	Field description
1	2	2	Transaction number (higher is more recent)
5	6	2	Agency ID (not present on Metrocard (Christchurch))
7	8	2	00 00 -- other values here indicate a different record type
11	14	4	Balance, in cents.

Purse records

First	Last	Length	Field description
0	0	1	Unknown (00: unused, used sectors have 01 or 02)
1	2	2	Agency ID (Metrocard (Christchurch) may use this to refer to operators)
3	3	1	Purse record type (see below)
4	7	4	Timestamp of transaction.
8	11	4	Value of the transaction, in cents (not used for record type = 0x02)
12	15	4	00

Purse record types

Type	Description
0x02	Free transfer marker (Christchurch) ??
0x08	Purse credit (Christchurch, Manly)
0x09	Purse debit (Manly)
0x0D	Purse debit (Christchurch)

Timestamp format

Timestamps are 32 bits long. Values expressed in bits.

First	Last	Length	Field description
0	19	20	Days since card epoch
20	31	12	Minutes since midnight