Trying to understand fields in the Magna Carta mifare coffee card / 2011-02-05

Koos van den Hout

2011-02-05 Trying to understand fields in the Magna Carta mifare coffee card 9 years ago

For a while I dumped my work 'coffee card' Magna Carta mifare card every day and found where the 'last used' date is stored (record changes only once a day). But I can't think of the right encoding. So I'll post what I have at the moment, maybe someone else sees what I can't decode. ASCII versions of the dumps, the date as YYYY year MM month DD day. The 'cw-' prefix is for a different card.
   20110103: 3d00 ffff c270 7800 3e00 0000 0000 0000  =....px.>.......
   20110104: 3d00 ffff 7076 7800 3e00 0000 0000 0000  =...pvx.>.......
   20110105: 3d00 ffff 047c 7800 3e00 0000 0000 0000  =....|x.>.......
   20110106: 3d00 ffff a681 7800 3e00 0000 0000 0000  =.....x.>.......
   20110107: 3d00 ffff 4e87 7800 3e00 0000 0000 0000  =...N.x.>.......
   20110110: 3d00 ffff 2598 7800 3e00 0000 0000 0000  =...%.x.>.......
   20110111: 3d00 ffff dd9d 7800 3e00 0000 0000 0000  =.....x.>.......
   20110112: 3d00 ffff 7aa3 7800 3e00 0000 0000 0000  =...z.x.>.......
   20110113: 3d00 ffff f7a8 7800 3e00 0000 0000 0000  =.....x.>.......
   20110114: 3d00 ffff c7ae 7800 3e00 0000 0000 0000  =.....x.>.......
   20110117: 3d00 ffff 7fbf 7800 3e00 0000 0000 0000  =.....x.>.......
   20110118: 3d00 ffff 10c5 7800 3e00 0000 0000 0000  =.....x.>.......
   20110119: 3d00 ffff c2ca 7800 3e00 0000 0000 0000  =.....x.>.......
   20110121: 3d00 ffff fed5 7800 3e00 0000 0000 0000  =.....x.>.......
   20110124: 3d00 ffff d0e6 7800 3e00 0000 0000 0000  =.....x.>.......
cw-20110124: 3d00 ffff 03e7 7800 3e00 0000 0000 0000  =.....x.>.......
   20110125: 3d00 ffff 87ec 7800 3e00 0000 0000 0000  =.....x.>.......
   20110126: 3d00 ffff 29f2 7800 3e00 0000 0000 0000  =...).x.>.......
cw-20110126: 3d00 ffff abf2 7800 3e00 0000 0000 0000  =.....x.>.......
cw-20110127: 3d00 ffff 25f8 7800 3e00 0000 0000 0000  =...%.x.>.......
   20110128: 3d00 ffff 4ffd 7800 3e00 0000 0000 0000  =...O.x.>.......
   20110131: 3d00 ffff 430e 7900 3e00 0000 0000 0000  =...C.y.>.......
cw-20110131: 3d00 ffff 440e 7900 3e00 0000 0000 0000  =...D.y.>.......
   20110201: 3d00 ffff e113 7900 3e00 0000 0000 0000  =.....y.>.......
   20110202: 3d00 ffff 8319 7900 3e00 0000 0000 0000  =.....y.>.......
   20110204: 3d00 ffff bf24 7900 3e00 0000 0000 0000  =....$y.>.......
cw-20110204: 3d00 ffff b624 7900 3e00 0000 0000 0000  =....$y.>.......
   20110207: 3d00 ffff ac35 7900 3e00 0000 0000 0000  =....5y.>.......
I see clear progress in the values, but I can't find the right connection. Maybe someone else can.
Update 2011-02-07 : I received multiple suggestions that the time of the update might be included in the value. Taking the last 3 updates of my card:
20110131: 3d00 ffff 430e 7900 3e00 0000 0000 0000  =...C.y.>.......
20110201: 3d00 ffff e113 7900 3e00 0000 0000 0000  =.....y.>.......
20110202: 3d00 ffff 8319 7900 3e00 0000 0000 0000  =.....y.>.......
20110204: 3d00 ffff bf24 7900 3e00 0000 0000 0000  =....$y.>.......
20110207: 3d00 ffff ac35 7900 3e00 0000 0000 0000  =....5y.>.......
Assuming little-endian values:
hexval  decimal  diff  days
790e43  7933507
7913e1  7934945  1438     1
791983  7936387  1442     1
7924bf  7939263  2876     2
7935ac  7943596  4333     3
With 1440 minutes per day, I see a pattern emerging. The 7943596 would be 09:16 this morning, when I go back to what would be 'minute 0' I end up at Mon Jan 1 00:00:00 1996. Too much of a coincidence. The strange thing is the minute of the first consumption is encoded in the record with only one update per day.
Update 2011-02-07 : And changing the last-used date on a card to 7 February 2010 made the coffee machine reject the card. Whoopsie. Restored a backup.
Update 2011-02-07 : The significance of 1996 is probably the introduction of the Mifare classic in 1996. Sources: New hack trashes London's Oyster card RFID in Seoul: first impressions both mention 1996 as introduction year.
Update 2011-02-07 : A bit of perl..
Magna Carta coffee card dump
============================
Front number 1801069
Counter 568
Last used update at Mon, 03 Jan 2011 10:11:00
Fun.
Update 2011-02-07 : ~~And when I update a card to a more recent last-used date the coffee machine accepts it. Which suggests a check on 'not usable before'.~~ No, that trick didn't work either, I missed something or planned a write which didn't work out. I get errors writing anyway. Time to determine the access masks.
Update 2011-02-08 : I played with the ? button on the coffee machine this morning and it can tell me each day I used the card. Interesting, because I don't see that much change on the card each day. But that is only for coffee on the same machine, so this may be from the logs in the machine.
Update 2011-02-09 : The ? button indeed uses the logs in the machine. On a different coffee machine it has no idea.

Tags: english, rfid