Shenzhen Tong

Shenzhen Tong is a system used in Shenzhen. From examining source code of other projects it seems that it's similar to some other Chinese cities, however without a sample card it's impossible to implement other cities.

Older Shenzhen Tong used same technology as Octopus. New ones are ISO7816-based cards. The application is called "PAY.SZT" with ISO7816 files and few own commands

Balance command

Class: 80 Command: 5c P1: purse number (only 0 is valid) P2: 2

Returns 4 bytes representing balance in big-endian with most-significant bit having unknown function (looks like it's always set).

All date/times are BCD-encoded YYYYMMDD[HHMMSS]. Files :8, :9 and :19 don;t appear to provide any additional info compared to file :18

Note: "always" means that no available dump has different value. We understand that most likely it has some unknown purpose

App FCI (AppData)

It has following BER-TLV:

6f32
   8407 "PAY.SZT"
   a527
     9f 08 01
        02
     9f 0c 20
        info 32 bytes. Following layout:
          16 bytes unknown
          4 bytes serial
          4 bytes validity start
          4 bytes expiry
          4 bytes unknown

File :8

Entry 1

Start byte	End byte	Length	Meaning
0	0	1	Entry number (2 or 3)
1	1	1	Entry size without header (0x1e)
2	3	2	Always zero
4	15	12	?????
16	31	16	Always zero

Entry 2 and 3

Start byte	End byte	Length	Meaning
0	0	1	Entry number (2 or 3)
1	1	1	Entry size without header (0x1e)
2	31	30	Always zero

File :9

Start byte	End byte	Length	Meaning
0	0	1	Entry number
1	1	1	Entry size without header (0x1e)
2	31	30	Always zero

File :18

This is record-file with trip data. Every entry has following layout:

Start byte	End byte	Length	Meaning
0	1	2	Transaction counter
2	4	3	Always zero
5	8	4	Fare
9	9	1	Agency (3 = BUS, 6 = METRO)
10	11	2	Always zero
12	15	4	Station
16	22	7	Timestamp

File :19

Entry 1

Start byte	End byte	Length	Meaning
0	0	1	Entry number (1)
1	1	1	Entry size without header (0x1e)
2	4	3	Looks const
5	8	4	Date of last trip
9	15	7	ASCII number. Looks const
16	19	4	Looks const
20	26	7	Last trip timestamp
27	31	5	Always zero

Entry 2

Start byte	End byte	Length	Meaning
0	0	1	Entry number (2)
1	1	1	Entry size without header (0x1e)
2	31	30	Always zero

Entry 3

Start byte	End byte	Length	Meaning
0	0	1	Entry number (3)
1	1	1	Entry size without header (0x3e)
2	63	62	Always zero

entries 2 and 3 share first 2 bytes but are otherwise zero-filled