For a while I dumped my work 'coffee card' Magna Carta mifare card every
day and found where the 'last used' date is stored (record changes only
once a day). But I can't think of the right encoding. So I'll post what
I have at the moment, maybe someone else sees what I can't decode.
ASCII versions of the dumps, the date as YYYY year MM month DD day. The
'cw-' prefix is for a different card.
20110103: 3d00 ffff c270 7800 3e00 0000 0000 0000 =....px.>.......
20110104: 3d00 ffff 7076 7800 3e00 0000 0000 0000 =...pvx.>.......
20110105: 3d00 ffff 047c 7800 3e00 0000 0000 0000 =....|x.>.......
20110106: 3d00 ffff a681 7800 3e00 0000 0000 0000 =.....x.>.......
20110107: 3d00 ffff 4e87 7800 3e00 0000 0000 0000 =...N.x.>.......
20110110: 3d00 ffff 2598 7800 3e00 0000 0000 0000 =...%.x.>.......
20110111: 3d00 ffff dd9d 7800 3e00 0000 0000 0000 =.....x.>.......
20110112: 3d00 ffff 7aa3 7800 3e00 0000 0000 0000 =...z.x.>.......
20110113: 3d00 ffff f7a8 7800 3e00 0000 0000 0000 =.....x.>.......
20110114: 3d00 ffff c7ae 7800 3e00 0000 0000 0000 =.....x.>.......
20110117: 3d00 ffff 7fbf 7800 3e00 0000 0000 0000 =.....x.>.......
20110118: 3d00 ffff 10c5 7800 3e00 0000 0000 0000 =.....x.>.......
20110119: 3d00 ffff c2ca 7800 3e00 0000 0000 0000 =.....x.>.......
20110121: 3d00 ffff fed5 7800 3e00 0000 0000 0000 =.....x.>.......
20110124: 3d00 ffff d0e6 7800 3e00 0000 0000 0000 =.....x.>.......
cw-20110124: 3d00 ffff 03e7 7800 3e00 0000 0000 0000 =.....x.>.......
20110125: 3d00 ffff 87ec 7800 3e00 0000 0000 0000 =.....x.>.......
20110126: 3d00 ffff 29f2 7800 3e00 0000 0000 0000 =...).x.>.......
cw-20110126: 3d00 ffff abf2 7800 3e00 0000 0000 0000 =.....x.>.......
cw-20110127: 3d00 ffff 25f8 7800 3e00 0000 0000 0000 =...%.x.>.......
20110128: 3d00 ffff 4ffd 7800 3e00 0000 0000 0000 =...O.x.>.......
20110131: 3d00 ffff 430e 7900 3e00 0000 0000 0000 =...C.y.>.......
cw-20110131: 3d00 ffff 440e 7900 3e00 0000 0000 0000 =...D.y.>.......
20110201: 3d00 ffff e113 7900 3e00 0000 0000 0000 =.....y.>.......
20110202: 3d00 ffff 8319 7900 3e00 0000 0000 0000 =.....y.>.......
20110204: 3d00 ffff bf24 7900 3e00 0000 0000 0000 =....$y.>.......
cw-20110204: 3d00 ffff b624 7900 3e00 0000 0000 0000 =....$y.>.......
20110207: 3d00 ffff ac35 7900 3e00 0000 0000 0000 =....5y.>.......
I see clear progress in the values, but I can't find the right connection.
Maybe someone else can.
Update 2011-02-07 : I received multiple suggestions
that the time of the update might be included in the value.
Taking the last 3 updates of my card:
20110131: 3d00 ffff 430e 7900 3e00 0000 0000 0000 =...C.y.>.......
20110201: 3d00 ffff e113 7900 3e00 0000 0000 0000 =.....y.>.......
20110202: 3d00 ffff 8319 7900 3e00 0000 0000 0000 =.....y.>.......
20110204: 3d00 ffff bf24 7900 3e00 0000 0000 0000 =....$y.>.......
20110207: 3d00 ffff ac35 7900 3e00 0000 0000 0000 =....5y.>.......
Assuming little-endian values:
hexval decimal diff days
790e43 7933507
7913e1 7934945 1438 1
791983 7936387 1442 1
7924bf 7939263 2876 2
7935ac 7943596 4333 3
With 1440 minutes per day, I see a pattern emerging. The 7943596 would be
09:16 this morning, when I go back to what would be 'minute 0' I end up at
Mon Jan 1 00:00:00 1996. Too much of a coincidence.
The strange thing is the minute of the first consumption is encoded in the
record with only one update per day.
Update 2011-02-07 :
And changing the last-used date on a card to 7 February 2010 made the coffee
machine reject the card. Whoopsie. Restored a backup.
Update 2011-02-07 :
The significance of 1996 is probably the introduction of the Mifare classic
in 1996. Sources:
New hack trashes London's Oyster card
RFID in Seoul: first impressions both mention 1996 as introduction year.
Update 2011-02-07 :
A bit of perl..
Magna Carta coffee card dump
============================
Front number 1801069
Counter 568
Last used update at Mon, 03 Jan 2011 10:11:00
Fun.
Update 2011-02-07 :
And when I update a card to a more recent last-used date the coffee machine
accepts it. Which suggests a check on 'not usable before'.
No, that trick didn't work either, I missed something or planned a write which
didn't work out. I get errors writing anyway. Time to determine the access
masks.
Update 2011-02-08 :
I played with the
? button on the coffee machine this morning
and it can tell me each day I used the card. Interesting, because I don't see
that much change on the card each day. But that is only for coffee on the
same machine, so this may be from the logs in the machine.
Update 2011-02-09 :
The
? button indeed uses the logs in the machine. On
a different coffee machine it has no idea.