Tampereen matkakortti

Tampere uses Mifare desfire card

It has 3 applications:

• 0x30302 contains 1 file: 2 which contains card number as ASCII
• 0x30202 contains no files
• 0x121ef is the main application with 7 files

Main application files:

• File 1. This is a value file with value being balance in cents. No longer used
• File 2. This file contains tickets and value
• File 3. This is a record file with records being the transaction log
• File 4. This file contains personal data
• File 5
• File 6
• File 7. This contains the card serial number

Unless specified all values are little-endian

• New format value (file 2)

The file contains 2 blocks of 48 bytes each. Probably each block contains up to 3 tickets but so far only one samples with one ticket have been acquired. According to the official website it's possible to have a card with both value and period ticket but so far the author doesn't have one.

Start (byte)	Length (bytes)	Meaning
0	1	Sequence number
1	3	???
4	36	Tickets. 12-byte structures
40	2	??? So far only zeros were observed
42	4	???
46	2	Probably checksum or hash

Tickets have the following header:

Start (byte)	Length (bytes)	Meaning
0	2	???
2	1	Ticket type

Then the contents depends on type.

Type 0x3. Seen encoding 30-day ticket:

Start (byte)	Length (bytes)	Meaning
3	3	???
6	2	Expiry date
8	4	???

Type 0x7:

Start (byte)	Length (bytes)	Meaning
3	4	???
7	2	Balance in cents
9	3	???

Type 0xf. Seen encoding 360-day ticket:

Start (byte)	Length (bytes)	Meaning
3	3	???
6	2	Start date
8	2	End date
10	2	???

• Transaction log (file 3)

Start (byte)	Length (bytes)	Meaning
0	2	Date in days since 1.1.1900
2	1	Minutes since first validation
3	3	???
6	2	High 11 bits: time as number of minutes since local midnight. Low 5 bits: event code
8	2	Fare
10	2	High 14 bits: route number, low 2 bits: ???
12	1	???
13	1	High nibble: number of passengers. Low nibble:??
14	1	??
15	1	CRC-8-maxim of the record

Route numbers:

• last 2 decimal digits are route variant (A/B/C/...) including direction. Exact coding unknown
• Rest is human-readable route number

Event codes:

• 3 = topup

• 5 = first tap

• 11 = transfer

• File 4 (personal data)

Start (byte)	Length (bytes)	Meaning
0	6	???
6	24	Holder name
30	4	???
34	2	Holder birth date
36	6	???
42	2	Issue date
44	51	???

• File 7 (serial number)

Start (byte)	Length (bytes)	Meaning
0	1	Zero
1	10	Serial number as BCD
11	1	???
12	18	Zero-filled
30	2	??? Some kind of checksum