ERG MFC
Michael Farrell edited this page Jan 28, 2019
·
9 revisions
ERG was an Australian developer of automated fare collection systems. They renamed to Videlli in 2009. The assets of the business were sold to Vix in 2008.
There are a number of MIFARE Classic based ticketing systems built by ERG.
| Agency ID | Name | Quirks / notes |
|---|---|---|
0x0136 |
Metrocard (Christchurch) | Card number is printed in decimal. Agency uses INIT readers, which support both ERG MFC and a new DESFire media. |
0x0227 |
Manly Fast Ferry | Card number is printed in hexadecimal. |
| Metrodroid Version | Description |
|---|---|
| v2.9.22 | Added as Manly Fast Ferry |
| v2.9.33 | Adds Metrocard (Christchurch) and "generic" ERG support |
| (unreleased) | Adds index support, shows free trips/transfers on Metrocard (Christchurch) |
The card technology is MIFARE Classic.
- Sector 0 has a well known Key A (
FF FF FF FF FF FF). - All other sectors have a Key A and Key B which are unique to each individual card.
Some MIFARE Plus cards in Classic compatibility mode are in circulation, however all cards can be cracked with either the Nested or Hardnested attacks.
| Sector | Block | Content |
|---|---|---|
| 0 | 0 | MIFARE UID and manufacturer information |
| 0 | 1 | Preamble: card magic, sometimes contains serial number |
| 0 | 2 | Metadata: agency ID, card epoch, serial number |
| 1-2 | all | Index |
Remaining blocks are assigned according to the index.
All data on the card is big endian. Record lengths are shown in bytes, inclusive of the first and last bytes, unless otherwise specified.
| First | Last | Length | Field description |
|---|---|---|---|
| 0 | 6 | 7 | Magic: 32 32 00 00 00 01 01
|
| 7 | 9 | 3 | 00 |
| 10 | 13 | 4 | Card number; some older cards don't use this field, and have the first three bytes set to 0x00 instead. |
| 14 | 15 | 2 | 0F FF |
| First | Last | Length | Field description |
|---|---|---|---|
| 0 | 1 | 2 |
02 03 (unknown) |
| 2 | 3 | 2 | Agency ID |
| 4 | 4 | 1 |
01 (unknown) |
| 5 | 6 | 2 | Card epoch, expressed in days since 2000-01-01 |
| 7 | 10 | 4 | Card number |
| 11 | 12 | 2 | unknown, varies per card |
| 13 | 15 | 3 | 00 |
Index writes are alternated between sector 1 and 2.
| First | Last | Length | Field description |
|---|---|---|---|
| 0 | 0 | 1 | 00 |
| 1 | 2 | 2 | Sequence number |
| 3 | 3 | 1 | Sector 3 block 0 content |
| 4 | 4 | 1 | Sector 3 block 1 content |
| 5 | 5 | 1 | Sector 3 block 2 content |
| 6 | 6 | 1 | Sector 4 block 0 content |
| 7 | 7 | 1 | Sector 4 block 1 content |
| 8 | 8 | 1 | Sector 4 block 2 content |
| 9 | 9 | 1 | Sector 5 block 0 content |
| 10 | 10 | 1 | Sector 5 block 1 content |
| 11 | 11 | 1 | Sector 5 block 2 content |
| 12 | 12 | 1 | Sector 6 block 0 content |
| 13 | 13 | 1 | Sector 6 block 1 content |
| 14 | 14 | 1 | Sector 6 block 2 content |
| 15 | 15 | 1 | Sector 7 block 0 content |
| First | Last | Length | Field description |
|---|---|---|---|
| 0 | 0 | 1 | Sector 7 block 1 content |
| 1 | 1 | 1 | Sector 7 block 2 content |
| 2 | 2 | 1 | Sector 8 block 0 content |
| 3 | 3 | 1 | Sector 8 block 1 content |
| 4 | 4 | 1 | Sector 8 block 2 content |
| 5 | 5 | 1 | Sector 9 block 0 content |
| 6 | 6 | 1 | Sector 9 block 1 content |
| 7 | 7 | 1 | Sector 9 block 2 content |
| 8 | 8 | 1 | Sector 10 block 0 content |
| 9 | 9 | 1 | Sector 10 block 1 content |
| 10 | 10 | 1 | Sector 10 block 2 content |
| 11 | 11 | 1 | Sector 11 block 0 content |
| 12 | 12 | 1 | Sector 11 block 1 content |
| 13 | 13 | 1 | Sector 11 block 2 content |
| 14 | 14 | 1 | Sector 12 block 0 content |
| 15 | 15 | 1 | Sector 12 block 1 content |
| First | Last | Length | Field description |
|---|---|---|---|
| 0 | 0 | 1 | Sector 12 block 2 content |
| 1 | 1 | 1 | Sector 13 block 0 content |
| 2 | 2 | 1 | Sector 13 block 1 content |
| 3 | 3 | 1 | Sector 13 block 2 content |
| 4 | 4 | 1 | Sector 14 block 0 content |
| 5 | 5 | 1 | Sector 14 block 1 content |
| 6 | 6 | 1 | Sector 14 block 2 content |
| 7 | 7 | 1 | Sector 15 block 0 content |
| 8 | 8 | 1 | Sector 15 block 1 content |
| 9 | 9 | 1 | Sector 15 block 2 content |
| 10 | 10 | 1 | 00 |
| 11 | 12 | 2 | Sequence number |
| 13 | 14 | 2 | 00 |
| 15 | 15 | 1 | unknown |
| Type | Description |
|---|---|
0x00 |
Unallocated block |
0x03 |
Balance |
0x04 |
Alternating structure 1 |
0x05 |
Alternating structure 2 |
0x06 - 0x0a
|
Unknown, possibly travel passes? |
0x14 - 0x1d
|
Purse record |
| First | Last | Length | Field description |
|---|---|---|---|
| 1 | 2 | 2 | Transaction number (higher is more recent) |
| 5 | 6 | 2 | Agency ID (not present on Metrocard (Christchurch)) |
| 7 | 8 | 2 |
00 00 -- other values here indicate a different record type |
| 11 | 14 | 4 | Balance, in cents. |
| 15 | 15 | 1 | Number of trips in week counter |
Seems to alternate writes, gets writes on all transactions
| First | Last | Length | Field description |
|---|---|---|---|
| 6 | 8 | 3 | Timestamp of the last transaction (truncated) |
| 9 | 10.5 | 1.5 | unknown datestamp (Metrocard (Christchurch)) |
| 10.5 | 11 | 1.5 | unknown datestamp (Metrocard (Christchurch)) -- incremented to next day when daily travel cap hit |
| 12 | 15 | 4 | 00 |
Unknown, seems to get writes when there is a paid transaction
| First | Last | Length | Field description |
|---|---|---|---|
| 0 | 0 | 1 | Unknown (00: unused, used sectors have 01 or 02) |
| 1 | 2 | 2 | Agency ID (Metrocard (Christchurch) may use this to refer to operators) |
| 3 | 3 | 1 | Purse record type (see below) |
| 4 | 7 | 4 | Timestamp of transaction. |
| 8 | 11 | 4 | Value of the transaction, in cents (not used for record type = 0x02) |
| 12 | 15 | 4 | 00 |
| Type | Description |
|---|---|
0x02 |
Trip (Christchurch) |
0x08 |
Purse credit (Christchurch, Manly) |
0x09 |
Purse debit (Manly) |
0x0D |
Purse debit (Christchurch) |
Timestamps are 32 bits long. Values expressed in bits:
| First | Last | Length | Field description |
|---|---|---|---|
| 0 | 19 | 20 | Days since card epoch |
| 20 | 31 | 12 | Minutes since midnight |
Truncated timestamps are 24 bits long -- They remove the top 8 bits from "days since epoch".