Text file discussing electronic telecards and GSM.
665bcb4031c8307db3280b95ca54e64a7e4474faf5c0f240288d21a2e5763a73===============================================================================
What you need to know about electronics telecards
===============================================================================
Version 2.04 (Last revised: 06 March 1999)
(C) Laurent - (1998, 1999)
(C) Stephane - (1993, 1994, 1995, 1996, 1997, 1998)
-------------------------------------------------------------------------------
>>> Any suggestions or comments about phonecards and smartcards are welcome <<<
>> NO QUESTIONS REGARDING CLONING, RECHARGING... PHONECARDS WILL BE ANSWERED <<
I NEED YOUR HELP TO COMPLETE THIS FILE
You can contact me at mailto:telecard@wanadoo.fr
This file is archived at http://perso.wanadoo.fr/telecard/
-------------------------------------------------------------------------------
Document History:
~~~~~~~~~~~~~~~~
v2.04 : Modified (or added) Danmark, Mexico (Telnor), Veezuela (CANTV),
Russia (MRTC replaced by MCTN), Swiss (Swisscom), Romania (512 bits),
Bulgaria, Republic of Moldova (MoldTelecom), Venezuela (CANTV),
Croatia (128 bits), Malaysia (Citifon), Slovakia, Netherland,
Belgium (Belgacom), Malaysia (Malaysia Telecom), Netherland (PTT
Telecom), Greece (OTE), Germany (Telekom).
Corrected Slovenske Telekomunikanie belongs to Slovakia.
Added: definition of Authentification and Challenge in glossary.
v2.03 : Added Cuba (ETECSA - 512 bits), Madagascar (Telecom Malagasy S.A.),
Poland, Slovenia (Slovenske Telekomunikacie), Argentina (Telefonia
de Argentina), Guinea (Sotelgui), Guinean Equatorial Republic
(Getesa), Swaziland (Phutfumani), Israel (Bezeq), Belgium (Belgacom),
Estonia (Eesti Telefon - T2G).
Modified Bulgaria, Czech Republic / Yougoslavia (SPT Telecom,
Telecom Praha), Russia (Eurochip - CNM/MRTC), Croatia (Eurochip 512
bits), South Africa (Telkom), Malaysia (Malaysia Telecom).
News for french T2G (5 units cards and "Numero Unique" cards),
Canada (BELL).
Modified Pinouts. Modified reader 1. Modified explanation of the
octal counter.
v2.02 : Corrected Estonia.
Modified South Africa, Russia, England, Estonia.
Added Venezuela (CANTV), Swiss (Swisscom), Emirates (Etisalat),
Ivory Coast (Publicom S.A.), Morocco (Unknown operator),
Danmark (Hrvatska Posta Telekomunikacije),
Spain (500 pta), Canada (Gemplus 512 bits - Bell),
Lithuania (Lieutuvos Telekomas), Croatia (HPT - 128 and 512 bits),
Greece (OTE - 158 and 512 bits)
v2.01 : Modified french T1G, french T2G, Germany, Romania, Netherlands.
Added DisneyLand Paris, Estonia, Australia (Telstra).
v2.00 : ************************************************************
******* BITS AND BYTES RENUMBERED STARTING FROM ZERO *******
*** IN ORDER TO COMPLY WITH MANUFACTURER'S DOCUMENTATION ***
************************************************************
French 25u, Senegal, Central African Republic, Togo, Cuba.
News for french T2G.
Extended glossary of terms.
First version maintained by Laurent.
v1.24 : News for Agentina, Bulgaria, South-Africa, Lithuania, french 5u,
Botwana, Ukrainia, Lithuania, Comores, Djibouti, Chile.
Last version maintained by Stephane (version not released).
v1.23 : Completion for french T2G, Hungary, Germany, Greek, Bulgaria,
Portugal and UK.
V1.22 : New code for Schlumberger (swedish cards), Greek card correction.
V1.21 : Slovenian and Canadian cards added.
V1.20 : Malta Cards Added.
V1.19 : French T2G added.
V1.18 : New coutries: Argentina, Burkina Faso, Cameroon, Croatia,
Djibouti, Gambia, Hungary, Mali, Mexico (Telmex), Morocco,
French Polynesia, New Caledonia, St Maarten, Slovakia.
V1.17 : Greek Serial Number added.
V1.16 : German Telefonkarte Serial Number.
V1.15 : New readers (Telecards+ISO7816 cards).
V1.14 : New 512 bit Greek telecards + modification of Mexican cards.
V1.13 : Checksums for french cards + modification for 'G+D' spanish cards.
V1.12 : Chip builder code added.
V1.11 : Croatian cards added.
V1.10 : Romanian telecards added.
V1.09 : Spanish card reading.
V1.08 : Modification of the octal stage counter for greek cards.
V1.07 : Modification of the 5 stage octal counter for 128 bit cards.
V1.06 : Schematic of a new reader [DELETED].
V1.02 : Introduction of the German cards.
V1.00 : First version of the document.
Glossary of terms:
~~~~~~~~~~~~~~~~~~
[TBC] : to be confirmed
[TBD] : to be defined
S.N. : Serial Number
b(i) : bit i
b(i..j) : bits from i to j (if i>j then area is read in reverse)
B(I) : byte I
B(I..J) : bytes from I to J (if I>J then area is read in reverse)
x^y : x at the power y (in mathematical expresssions)
Serial Number: Unique number assigned to a chip, this number is programmed
in the chip by the manufacturer, you can not change it. A few
cards don't have a serial number. A copy of the serial number
is sometimes printed on the card itself.
Checksum : Checksums are used in order to verify if the header of a card
is not altered. One byte a the header is computed using a
simple formula (ie: for a bit set to '1' in bytes 1, 2, 3
substract 4 to the value 227, you must obtain the value set
in byte 0 of the card). You can use these checksums (and
other bits in the header area) to check if a card is of a
given type. This document is intended to help you doing so.
Certificate : Certificates are used in 2nd generation telecards to verify
if a card is not a fake one. Certificates are 16 or 32 bits
long and are calculated using a one way function (each
operator has his own), a secret key (operator dependent) and
the value of the bits contained in the header of the card.
Because the function and the key are kept secret you can't
compute a certificate by yourself, nor you can't use it to
check if the card is of a given type. In order to avoid
hackers doing crypto-analysis against certificates using a
big number of cards, it can be erased when the card is empty.
Writting to this area may invalidate the card.
Counter/Unit : This area contains the number of units remaining (or used) on
Area the card. It is designed so you can not increase the value of
the card. How this area works (decoding and writing) depends
on the card's type. This document will help you in determing
the remaining credit of a card.
Anti-tearing : Anti-tearing flags (also known as pull-out flags) are used in
order to ensure that the holder of the card does not loose
units (money) if he removes the card during an operation.
Anti-tearing flags are written when the counter area is
written to, they are erased when the operation is completed.
If the card is removed during the operation anti-tearing
are used to restore the counter area the next time you use
the card.
Authentification: Authentification is used in 2nd generation telecards, the
reader sends a random sequence called 'challenge' to the
card, this challenge is used by the card to compute an answer
wich is sent back to the reader. If the answer is correct
the the reader can assume that the card is a 'good' one.
-------------------------------------------------------------------------------
* Content *
~~~~~~~~~~~
I ) The 1st generation Telecards:
1.1 - Introduction:
1.2 - SCHEMATICS of the chip:
1.3 - PINOUT of the connector:
1.4 - Main features:
1.5 - TIME DIAGRAMS:
1.6 - Memory Map for cards from FRANCE and MONACO:
1.7 - Memory Map for cards from other countries:
1.8 - Memory Map for cards from SPAIN, CROATIA and MEXICO:
1.9 - Memory Map for Mexican cards from Telmex:
II ) The 2nd generations Telecards:
2.1 - Introduction:
2.2 - Pinout:
2.3 - Main features:
2.4 - Time Diagrams:
2.5 - Memory Map:
2.5.1 - Memory Map for 4 or 5 stage octal unit counter:
2.5.2 - 2nd Generation French Telecards (TG2) and derivates:
2.8 - Octal counter description
2.7 - Electrical features:
III) Schematics of Readers:
3.1 - Reader 1 (very simple one, only for telecards)
3.2 - Reader 2 (for telecards and ISO7816 cards too)
-------------------------------------------------------------------------------
I ) The 1st generation Telecards:
============================
1.1 - Introduction:
~~~~~~~~~~~~
Since the middle of 80's have appeared a new generation of cards ( the
smart-cards or chip cards ) that have replaced most of the magnetics cards
applications notably for telecom payement and also for credit cards. These
cards are far more secure than the magnetics cards, and there are several kind
of cards following the application. The simplier ones are the Simple Memory
cards like the one used as Telecard for the telecom payement in the public
phone-booths ( Generaly all the memory content is readable, and there is a
maker-area that is unwritable ) , then there are more sofisticated cards:
Memory Cards with some area read protected by a key, these cards can contain
some private informations in the read-protected area. At the end there are
microprocessor-cards (cards working following the ISO-7816 protocol), that are
the safiest ones since these cards have their own internal Operating System
that prevent I/O if the PIN (Personal Idenfication Number) has not been ent-
-ered in the cards before ( These cards are used when confidentiality is
needed, like in credit cards (bank), crypted TV access cards, health cards,
SIM cards for GSM, etc ... ).
About telecards, even if these cards are the less safe ones, don't think
that you are going to phone freely for that, in fact no. All the data are
readable since there are no confidential data inside, the cards are well done
enough to be very secure for the payement of telecom communications in public
booth.
So, what is a phonecard exactly ? In fact generaly it's a 256 bits EPROM
( French like cards ), or a 128 bits EEPROM (German like cards) with a serial
output and some other control pins.
Then why can it not be refilled ? Well, indeed to refill the card you
will have to erase the cards with UV, knowing that the cards is coated in UV
opaqued resin that prevent UV from reaching the silicium chip, and even if you
could to erase the chip you will have to program the manufactuer area that is
write-protected by a lock-out fuse that was fused after the card programming in
factory.
Remember that a public booth contains a specialized computer and have a
direct connexion to the public telephone network, and so to other computers. In
France public booths are connected to the telephone network using a "Unite de
raccordement de publiphone (URP)" which holds a "black list" of stolen, fake
cards... A public booth first reads the card, checks if it seems OK (checksums,
certificates...), it asks the URP to check if the card is reported stolen or is
known as fake and then it allows you to dial a number.
DO NOT FORGET: if you try to use a fake card, the public booth may let
you issue your call and the URP may alert the operator who may call the police.
Many people in France where jailed this way. SO NO QUESTIONS REGARDING CLONING,
RECHARGING... PHONECARDS WILL BE ANSWERED AS IT IS ILLEGAL AND MAY BE VERY BAD
FOR YOUR KARMA.
Neithertheless it can be very interesting to study how these cards work,
to see which kind of data are inside and how the data are maped inside or to
see how many units are left inside for exemple. Besides there are a great
number of applications of these cards when there are used (only for personal
use of course) , since you can use them as key to open a door, or you can also
use them as key to secure a program, etc ....
French Telecards have been created in 1984 and at this time constructors
decided to build these cards in NMOS technology but now, France Telecom has
changed all the readers in the public booths and use CMOS technology for 70 %
of the cards currently being issued (07/1997).
Also they plan to use EEPROM to secure the cards and to add many usefull
informations in, and you will perhaps use phone cards to buy you bread or
anything else. Cards used for advertising may be programmed so the public booth
automatically call a given number when the card is inserted (a remplacement for
toll free number where advertiser can choose who may call freely and where
user do not have to bother reminding a number).
These cards are called Second Generation Telecards (T2G).
1.2 - SCHEMATICS of the chip:
~~~~~~~~~~~~~~~~~~~~~~
.-----------------.
--|>_ Clk |
--| R/W |
--| Reset |
--| Fuse |
--| Vpp |
'-, ,-'
.-'-------------'-.
| Out |-- serial output
'-----------------'
1.3 - PINOUT of the connector (synchronous cards):
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Afnor Position ISO position
(in the left top corner) (in the middle left)
,------------+------------, ,------------+------------,
| 8 | 4 | | 1 | 5 |
+------\ | /------+ +------\ | /------+
| 7 +----+----+ 3 | | 2 +----+ + 6 |
+-------| |-------+ +-------| |-------+
| 6 + +----+ 2 | | 3 +----+----+ 7 |
+------/ | \------+ +------/ | \------+
| 5 | 1 | | 4 | 8 |
'------------+------------' '------------+------------'
6 contacts
ISO POSITION
(in the middle left)
,------------+------------,
| 1 | 5 |
+------\ | /------+
| 2 +----+ + 6 |
+-------| |-------+
| 3 +----,----+ 7 |
'------------'------------'
NB: only the position of the chip is ISO standardized and not the pinout.
PINOUT: 1 : Vcc = 5V 5 : Gnd
~~~~~~ 2 : RESET 6 : Vpp = 5V (*)
3 : Clock 7 : I/O
4 : RAS 8 : Fus (**)
(*) +21V for T1G (NMOS cards).
(**) Not used with the new G+D cards compatible with the 256 bit memory
Exemple: spannish G+D cards.
1.4 - Main features:
~~~~~~~~~~~~~
- Synchronous protocol.
- N-MOS technology or CMOS for the new ones.
- 256x1 bit organisation.
- 96 written protected by a lock-out fuse.
- Low power 85mW in read mode.
- 21 V programming voltage.
- Access time: 500ns
- Operating range: -10øC +70øC
- Ten year data rentention.
1.5 - Time diagrams:
~~~~~~~~~~~~~
a - Cards from Schlumberger, Solaic, Gemplus
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+21V _____________
+5V ____________________________________| |_________________ VPP
: :
+5V ___________________:_____________:_________________ ___
0V ________________| : : RST
: : :
+5V ____ : ____ : ______:______
0V ___| |_______:_____| |________:______| : |__________ CLK
: : : : : : : : :
+5V : : : : : :______:______: : _
0V ___:____:_______:_____:____:________| : |______:__________ R/W
: : : : : : : : :
+5V : : :_____: :________: : : :__________
0V XXXXXXXXXXXXXXXXX_____XXXXXX________XXXXXXXXXXXXXXXXXXXXXX__________ OUT
: : : : : :<-----><---->: :
: : : : : :10 to 10 to :
: : : : : :50 ms 50ms :
Reset Bit0 Bit1 Bit2
card reading reading Bit1 writing to 1 reading
NOTE: Vpp Idle state is 5V, thus Vpp will have to be connected to Vcc to read
the card.
b - Cards from G+D (Spanish cards labeled with the 5th byte = $30)
~~~~~~~~~~~~~~
+5V ___________________________________________________ ___
0V ________________| RST
+5V ____ ____ _____________
0V ___| |_____________| |_______________| |__________ CLK
: : : : : :
+5V : : : : ______:______ : _
0V ___:____:_____________:____:________| : |______:__________ R/W
: : : : : : :
+5V :____:_____________:____:_______________:______:______:__________
0V XXXX X_____________X X_______________X : X__________ OUT
: : : : :<---->: :
: : : : : 1 ms :
: : : : : :
Reset Bit0 Bit1 Bit1 Bit2
card reading reading writing to 1 reading
1.6 - Memory Map for cards from FRANCE, MONACO and St MAARTEN:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Byte (Bit) Hexa
+-----+
0 (0..7) | | --> Checksum for bytes 1, 2, 3 (*)
+-----+
1 (8..15) | $0s | --> French telecard
| | Serial Number (1st byte)
| $80 | --> St Maarten
+-----+
2 (16..23) | | --> Serial Number (2nd byte)
+-----+
3 (24..31) | | --> Serial Number (3rd byte)
+-----+
4 (32..39) | | --> checksum for bytes 5, 6, 7 (*)
+-----+
5 (40..47) | | --> Serial Number (4th byte)
+-----+
6 (48..55) | | --> Serial Number (5th byte)
+-----+
7 (56..63) | | --> ? [TBD]
| $FF | --> St Maarten
+-----+
8 (64..71) | | --> checksum for byte 9, 10, 11 (*)
+-----+
9 (72..79) | | --> ? [TBD]
| $FF | --> St Maarten
+-----+
10 (80..87) | $10 | --> France and Monaco
| $14 | --> St Maarten
+-----+
11 (88..95) | $13 | --> 120 units
| $07 | --> 60 units (St Maarten)
| $06 | --> 50 units
| $05 | --> 40 units
| $04 | --> 25 units
| $02 | --> 5 units
+-----+
12 (96..103) | | --> The units area: each time a unit is used
. | | then a bit is set to "1"; The 1st 10 units
. | | are fused in factory for test (15 units for
. | | 25u and 5u cards).
. | |
. | |
30 (240..247) | |
+-----+
31 (248..255) | $FF | --> $FF is set when all the units are used.
+-----+
(*) checksum is calculated by the following expresion:
max | min=32*(j-1)+8
$E3 - 4 * Sum b(i) where | max=32*j-1
i=min | and j is the checksum number (1, 2 or 3)
NOTE: The card number is the concatenation in a single string of the 5 bytes
written in hexadecimal.
1.7 - Memory Map for cards from other countries:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Byte (Bit) Hexa
+-----+ 95
0 (0..7) | | --> Check Sum Byte = $D8 - Sum b(i)
+-----+ i=8
1 (8..15) | $83 | --> Telecard
| $80 | --> Other Applications (See below)
| $9A | --> PIAF card [TBC]
| $C0 | --> AVANT card [TBC]
+-----+-----+
2-3 (16..31) | $1x | $xx | --> Units+2 (0x1152 : exemple for a 150u card).
+ - - - - - +
| $10 | $00 | --> In case of special Argentine telecard
| $3D | $13 | --> 80u (Morocco)
| $DB | $B5 | --> 40u (Morocco)
+-----+-----+
ARGENTINA
+-----+-----+-----+-----+
4..7 (32..63) | $Ta | $bc | $de | $fg | T = Manufacturer (4 Gemplus, 0 Schlumberger)
| | | | | S.N. = a*64 + b*32 + c*16 + d*8 + e*4 + f*2 + g
+-----+-----+-----+-----+
8..9 (64..79) | | | --> Don't Know
+-----+-----+
HUNGARY
+-----+-----+-----+-----+
4..7 (32..63) | $Ta | $B | $C | $D | T = Manufacturer (4 Gemplus, C ODS)
| | | | | S.N. = a*2^21 + B*2^17 + C*2^9 + D
+-----+-----+-----+-----+
8..9 (64..79) | | | --> Unit value : $0103 for 120u; $010A for 50u
+-----+-----+
PORTUGAL
+-----+-----+-----+-----+
4..7 (32..63) | $00 | $A | $B | $C | Portugal : S.N. = A*2^17 + B*2^9 + C
+-----+-----+-----+-----+
8..9 (64..79) | | | --> Certificate
+-----+-----+
OTHERS
+-----+
4 (32..39) | $Tx | --> T = Manufacturer 0 --> Schlumberger
| | --> 1 --> Solaic [TBC]
| | --> 3 --> Gemplus [TBC] (finnish cards)
| | --> 4 --> Gemplus
+-----+----+----+----+----+
5..9 (40..79) | | | | | | --> Serial Number
+-----+----+----+----+----+
+-----+-----+
10-11(80..95) | $10 | $16 | --> French Polynesia
| | $78 | --> DisneyLand Paris (see note #1)
| $11 | $15 | --> Djibouti
| | $1C | --> Senegal (Sonatel)
| | $1D | --> French Cinecarte [TBC]
| | $1E | --> Sweden
| | $28 | --> Argentina (Telefonica de Argentina)
| | $30 | --> Norway (Telenor).
| | $31 | --> New Caledonia
| | $32 | --> Cameroon
| | $33 | --> Andorra
| | $36 | --> Central African Republic (Socatel)
| | $39 | --> Luxembourg
| | $3C | --> Ireland
| | $3D | --> Gambia
| | $3F | --> Guinean Equatorial Republic (Getesa)
| | $47 | --> Portugal
| | $54 | --> Malta
| | $55 | --> Czech Republic / Yougoslavia
| | $58 | --> Comores
| | $5C | --> Argentina (Telecom Argentina)
| | $5D | --> Burkina Faso
| | $5E | --> Mali
| | $5F | --> Gabon
| | $65 | --> Finland
| | $6A | --> Madagascar (Telecom Malagasy S.A.)
| | $72 | --> Togo (OPT Togo)
| | $86 | --> Slovakia
| | $9E | --> Cuba (Etecsa)
| | $B7 | --> Morocco (Special Operator)
| | $BC | --> Israel (Bezeq)
| | $BE | --> Guinea (Sotelgui)
| | $C3 | --> Emirates (Etisalat)
| | $D5 | --> Poland
| | $E0 | --> Hungary
| | $E1 | --> Cameroon (CamTel)
| | $E2 | --> Morocco (Ave Phone)
| $1E | $5C | --> Argentina (Special Cards)
+-----+-----+
12 (96..103) | | --> The units area: each time a unit
. | | is used, then a bit is set to "1";
. | |
. | | The first two units are fused in
. | | factory as test.
. | |
. | | In some countries 5 extra units are burned when the
. | | card is empty (credit seems to be -5 units).
. | |
. | | Hungary: Each bit set to 1 in this area is a unit used.
. | | ~~~~~~~ 10u are used in factory when the cards is new.
31 (248..255) | |
+-----+
Note #1: For DisneyLand Paris Unit Area is b(128..239), B(30) is set to $FF to
mark an empty card.
ARGENTINA SPECIAL
+-----+
12 (96..103) | $C0 | --> The first two units are fused in factory as test.
. | |
. | |
20-21(160..175)|$XXXX| --> User number Eg. $2456
22-23(176..191)|$XXXX| $1252 --> 2456 1252 6578
24-25(192..207)|$XXXX| $6578
. | |
. | |
30 (240..247) | |
+-----+
1.8 - Memory Map for cards from Argentina, Spain, Croatia and Mexico (Telnor):
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The spanish telecards are made from different manufacturers, and these cards
should be read and written with a different protocol following byte 04
of the memory (see subclause 1.6-a for the cards with the byte 04=$90 and
see the subclause 1.6-b for the cards with the byte 04=$30).
Byte (Bit) Binary Hexa
+-----+ 95
0 (0..7) | | ---> Checksum byte = 216 - Sum b(i)
+-----+ i=8
1 (8..15) | $83 | ---> Telecard
+-----+-----+
2-3 (16..31) | $FF | $FF |
+-----+-----+
4 (32..39) | $30 | --> G+D
| $5A | --> Gemplus
| $90 | --> Oberthur (and F.N.M.T for Spain)
| $9E | --> Oberthur (Argentina)
| $A0 | --> Solaic
+-----+-----+-----+
5..7 (40..63) | ss | ss | ss | ---> Serial Number (*)
+-----+-----+-----+
8-9 (64..79) | $00 | $0A | --> 500 pesetas (Spain)
| $14 | $8A | --> 1000 pesetas (Spain)
| $25 | $04 | --> 2000 pesetas (Spain)
| $25 | $06 | --> 2100 pesetas (Spain)
| | |
| $14 | $CA | --> N$ 25.00 (Mexico)
| $15 | $4A | --> N$ 35.00 (Mexico)
| $31 | $02 | --> N$ 50.00 (Mexico)
| | |
| $00 | $03 | --> 25 (Argentina)
| | |
| $00 | $05 | --> 50u (Croatia)
| $00 | $0A | --> 100u (Croatia)
| $14 | $8A | --> 200u (Croatia)
| $2A | $85 | --> 1000u (Croatia)
+-----+-----+
10-11 (80..95)| $1E | $22 | --> Spain
| | $24 | --> Mexico (Telnor)
| | $26 | --> Croatia
| | $28 | --> Argentina
+-----+-----+-----+
12 (96..103) | 1111 1111 | $FF | ---> the first 10 units are fused
. | 11xx xxxx | $xx | in factory for testing.
. | xxxx xxxx | $xx |
. | xxxx xxxx | $xx | ---> Slow counter area
. | xxxx xxxx | $xx |
. +-----------+-----+
. | xxxx xxxx | $xx |
. | xxxx xxxx | $xx | ---> Fast counter area
31 (248..255) | xxxx xxxx | $xx |
+-----------+-----+
The slow counter area:
----------------------
o [b255 ... b156] for 500 Pta cards, Increment 5 Pta
o [b205 ... b106] for 1000 Pta cards, Increment 5 Pta
o [b165 ... b126] for 2000 Pta cards, Increment 5 Pta
o [b165 ... b106] for 2100 Pta cards, Increment 5 Pta
o [b205 ... b106] for 25.00 N$ cards, Increment 0.1 N$
o [b205 ... b106] for 35.00 N$ cards, Increment 0.1 N$
o [b135 ... b116] for 50.00 N$ cards, Increment 0.1 N$
The Fast counter area:
----------------------
o No fast counter for 500 Pta cards
o [b255 ... b206] for 1000 Pta cards, Increment 10 Pta
o [b255 ... b166] for 2000 Pta cards, Increment 20 Pta
o [b255 ... b166] for 2100 Pta cards, Increment 20 Pta
o [b255 ... b206] for 25.00 N$ cards, Increment 0.3 N$
o [b255 ... b206] for 35.00 N$ cards, Increment 0.5 N$
o [b255 ... b136] for 50.00 N$ cards, Increment 0.4 N$
Exemple of an fast units area: (1000 Pta cards)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
00 -,
0000 0000 |
0000 0000 |-> Unused units
0000 0000 |
0000 0000 -'
0011 1110 ---> 14*10 Pta are used (same as 0011 1111
1000 1110 1111 1111)
NB: Several units can be used, in this case only the last unit is set as
used, like in the previous exemple, where some units are set to 0 but
are nonetheless used.
(*) Serial Number for spanish telecards: The serial number for G+D,
Gemplus and Solaic telecards is directly obtained by the following formula:
Byte[5]*$10000 + Byte[6]*$100 + Byte[7]
1.9a - Memory Map for Mexican cards from Telmex (LadaTel):
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Byte (Bit) Hexa
+-----+ 95
0 (0..7) | | ---> Check Sum Byte = 216 - Sum b(i)
+-----+ i=8
1 (8..15) | $80 |
+-----+
2 (16..23) | |
3 (24..31) | | --> [TBD]
+-----+
4 (32..39) | $0s | --> Schlumberger
| $1s | --> Solaic [TBC]
| $4s | --> Gemplus
+-----+
5 (40..47) | ss |
6 (48..55) | ss | --> Serial Number (*)
7 (56..63) | ss |
+-----+-----+
8-9 (64..79) | $sv | vC | --> Card Value (*)
+-----+-----+
10 (80..87) | $32 |
| $64 | --> [TBD]
+-----+
11 (88..95) | $59 | --> Mexico
+-----+
12 (96..103) | | ---> The units area: each time a unit
. | | is used, then a bit is set to "1";
. | |
. | | The first 4 units are fused in
. | | factory as test.
. | |
30 (240..247) | |
+-----+
31 (248..255) | $FF | --> $FF is set when all the units are used.
+-----+
Serial Number = b(34..65) displayed in decimal
Card Value: Each unit has 0.5N$ worth. Units burned in factory are not counted
in the value (so a 40 units card has a 20N$ value and 44 units are
burned when card is empty).
1.9b - Memory Map for Ivory Coast cards from publicom S.A.:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Byte (Bit) Hexa
+-----+ 95
0 (0..7) | | ---> Check Sum Byte = 216 - Sum b(i)
+-----+ i=8
1 (8..15) | $80 |
+-----+
2 (16..23) | |
3 (24..31) | | --> [TBD]
+-----+
4 (32..39) | $0s | --> Schlumberger
| $1s | --> Solaic [TBC]
| $4s | --> Gemplus
+-----+
5 (40..47) | ss |
6 (48..55) | ss | --> Serial Number (*)
7 (56..63) | ss |
+-----+-----+
8-9 (64..79) | $sv | vC | --> Card Value (*)
+-----+-----+
10 (80..87) | $32 |
| $64 | --> [TBD]
+-----+
11 (88..95) | $59 | --> Mexico
+-----+
12 (96..103) | | ---> The units area: each time a unit
. | | is used, then a bit is set to "1";
. | |
. | | The first 4 units are fused in
. | | factory as test.
. | |
30 (240..247) | |
+-----+
31 (248..255) | $FF | --> $FF is set when all the units are used.
+-----+
Serial Number = b(34..65) displayed in decimal
Card Value: Units burned in factory are not counted in the value (so
a 40 units card has a 20N$ value and 44 units are burned
when card is empty).
1.10 - Memory Map for Slovenian Cards:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Byte (Bit) Hexa
+-----+
0 (0..7) | $5A |
+-----+
1 (8..15) | $vv | --> Unit Value
| | $81 -> 100u
| | $82 -> 20u
| | $83 -> 300u (2 units/bit)
| | $84 -> 100u (not used)
| | $85 -> 50u
| | $86 -> 25u
+-----+-----+-----+
2..4 (16..39) | $E9 | $B5 | $4B | --> Telekom cards
| | $B4 | | --> "Impulz" cards
+-----+-----+-----+
5 (40..47) | $00 |
| $01 | --> first digit of serial number
+-----+
6 (48..55) | $xx | --> Serial Number = (B(6) << 16) + (B(7) << 8) + B(8)
7 (56..63) | $xx |
8 (64..71) | $xx |
+-----+
9 (72..79) | $yy | --> Signature for the S.N.
10 (80..87) | $yy |
+-----+ 10
11 (88..95) | $zz | --> Checksum for B[0] .. B[10] = 0xFF & [( Sum B(i) )-1]
| | i=0
+-----+
12 (96..103) | | --> The units area: each time a unit
. | | is used, then a bit is set to "1";
. | |
. | |
. | |
31 (248..255) | |
+-----+
II ) The 2nd generation Telecards:
============================
2.1 - Introduction:
~~~~~~~~~~~~
These cards are in fact 128 bit memory in NMOS technology, and the map of
these cards are the following:
64 bit EPROM written protected (manufaturer area).
40 bit EEPROM (5x8 bits).
24 bits set to "1".
2.2 - Pinout:
~~~~~~
ISO 7816-2
,-------------+-------------,
| 1 | 5 | Pinout:
+-------\ | /-------+ ~~~~~~
| 2 +----+ + 6 | 1 : VCC=5V 5 : Gnd
+--------| |--------+ 2 : Reset 6 : n.c.
| 3 +----+----+ 7 | 3 : Clock 7 : I/O
+-------/ | \-------+ 4 : n.c. 8 : n.c.
| 4 | 8 |
'-------------+-------------' (n.c. : not connected)
2.3 - Main features:
~~~~~~~~~~~~~
- ISO 7816- 1/2 compatible.
- use a single 5V power supply.
- low power consuption.
- NMOS technology.
2.4 - Time Diagrams:
~~~~~~~~~~~~~
Reset:
------
The address counter is reset to 0 when the clock line CLK is raised while
the control line R is high {Note that the address counter can not be reset
when it is in the range 0 to 7}.
__________________
_____| |_____________________________________________ Reset
: :
: _____ : _____ _____ _____ _____
_____:_______| |____:_| |_____| |_____| |_____| |_ Clk
: : : : : : : : : : :
_____:_______:__________:_:_____:_____:_____:_____:_____:_____:_____:_
_____:___n___|_____0____:_|_____1_____|_____2_____|_____3_____|___4_:_(Address)
: : : : : :
_____: :_______:___________:___________:___________:_
_____XXXXXXXXXXXXXXXXXXXX_______|___________|___________|___________|_ Data
Bit n Bit 0 Bit 1 Bit2 Bit3
The address counter is incremented by 1 with each rising edge of the clock
signal Clk, for as long as the control line R remains low. The data held in
each addressed bit is output to I/O contact each time Clk falls. It is not
impossible to decrement the address counter, therefore to address an earlier
bit, the address counter must be reset then incremented to require value.
Write:
------
All unwritten or erased bits in the address 64-104 can be unwritten to.
When a memory cell is unwritten, it is set to 0. The addressed cell is
unwritten to by the following sequence.
1- R is raised while Clk is low, to disable address counter increment for one
clock pulse.
2- Clk is then raised for a minimum of 10ms to write to the address bit.
When to write operation ends, and Clk falls, the address counter is unlocked,
and the content of the written cell, which is now 0, is output to I/O contact
if the operation is correct.
The next Clk pulse will increment the address by one, then the write sequence
can be repeated to write the next bit.
_____ _____
_____________| |______________________________| |_______________ Reset
: :
___ : _____ ___ : _____
____| |____:__________| |_________| |_____:__________| |____ Clk
: : : : : : : : :
____:________:__________:_____:_________:___:_____:__________:_____:_____
n | n+1 | n+2 | : n+3 | : (Address)
----'--------:----------'-----:---------'---:-----:----------'-----:-----
: : : : : : :
_________ _: : : ____________: ___: : :
_________XXX_XXXXXXXXXXXXXXXXXXX____________ XX___XXXXXXXXXXXXXXXXXXXXXXX I/O
n n+1 : : n+1 n+2 : :
: : : :
write write
WriteCarry:
-----------
A counter is erased by performing the WRITECARRY sequence on the stage of
the next highest weighing to that to be erased.
The writecarry sequence is as follows:
1 - Set the address counter to an unwritten bit in the next highest counter
stage to that to be erased.
2 - Increment is disabled on the following rising edge of R where Clk remains
low.
3 - Clk is then raised for a minimum of 10ms, while R is low, to write to the
next address bit.
4 - R is the raised again while Clk remains low to disable increment a second
time.
5 - Clk is the raised for a minimum of 1ms, while R is low, to write to the
addressed bit a second time, erasing the counter level immediately below that
the addressed bit.
_____ _____
______| |____________________| |_________________________________ Rst
: :
: _______ : _______ ___
______:___________| |______:_____________| |______| |______ Clk
: : : : : : : :
: : : : : : : :
<------------------------- address n ------------------------>:<--- n+1 ------
: : : : : : :
: : : : : : :
______: : :______: : :__________: _____
______XXXXXXXXXXXXXXXXXXXXX______XXXXXXXXXXXXXXXXXXXXXXX__________XX_____ I/O
: : n : : n n+1
: : : :
Write Erase
2.5 - Memory Map:
~~~~~~~~~~
2.5.1 - Memory Map for 4 or 5 stage octal unit counter:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2.5.1.1 - Albania:
~~~~~~~
Byte (Bit) Hexa
+-----+-----+-----+-----+
0-3 (0..31) | $98 | $20 | $33 | $38 | --> Albania
+-----+-----+-----+-----+
4-7 (32..63) | $.. | $.. | $.. | $.. | --> Serial Number (see below)
+-----+-----+-----+-----+
8..11 (64..95) |c512 | c64 | c8 | c1 | --> 4 stage octal counter
+-----+-----+-----+-----+
12 (96..103) | $.. |
13 (104..111) | $.. |
14 (112..119) | $.. |
15 (120..127) | $.. |
+-----+
Serial Number = b(63..32) Read in reverse binary from bit 63 to 32
Displayed in 10 decimal digits.
2.5.1.2 - Australia:
~~~~~~~~~
Byte (Bit) Hexa
+-----+-----+-----+-----+
0-3 (0..31) | $E8 | $20 | $61 | $09 |
+-----+-----+-----+-----+
4 (32..39) | | --> Serial Number / Manufacturer area
5 (40..47) | |
6 (48..55) | |
7 (56..63) | |
+-----+-----+-----+-----+-----+
8..12 (64..103)|c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter
+-----+-----+-----+-----+-----+
13 (104..111) | $FF |
14 (112..119) | $F0 |
15 (120..127) | $FF |
+-----+
Note: Each unit is 0.01$ worth.
2.5.1.3 - Belgium (Belgacom):
~~~~~~~~~~~~~~~~~~
Byte (Bit) Hexa
+-----+-----+-----+
0..3 (0..31) | $E9 | $30 | $35 |
+-----+-----+-----+-----+-----+
4..7 (32..63) | $xx | xs | ss | ss | | --> xxxx : [TBD]
| | | | | | sssss: Serial Number
+-----+-----+-----+-----+-----+
7 (56..63) | | --> [TBD]
+-----+-----+-----+-----+-----+
8..12 (64..103) |c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter
+-----+-----+-----+-----+-----+
13 (104..111) | $FF |
14 (112..119) | $.. |
15 (120..127) | $.. |
+-----+--- -+--- -+-----+
16..63 (128..511) | $FF | . . + . . + $FF +
+-----+- ---+- ---+-----+
Serial Number = b(32..55) displayed in decimal.
Each unit is 0.10 BEF worth.
2.5.1.4 - Botswana:
~~~~~~~~
Byte (Bit) Hexa
+-----+-----+-----+
0-2 (0..23) | $98 | $20 | $FF | --> Botswana
| $92 | $3B | $FF |
+-----+-----+-----+
3 (24..31) | | --> Serial Number / Manufacturer area
4 (32..39) | |
5 (40..47) | |
6 (48..55) | |
7 (56..63) | |
+-----+-----+-----+-----+-----+
8..12 (64..103)| | | | | | --> octal counter
+-----+-----+-----+-----+-----+
13 (104..111) | $.. |
14 (112..119) | $.. |
15 (120..127) | $.. |
+-----+
The number of stages (4 or 5 stages) is not known for this card.
2.5.1.5 - Bulgaria:
~~~~~~~~
Byte (Bit) Hexa
+-----+-----+-----+-----+
0..3 (0..31) | $93 | $0B | $AF | $5v | --> Value : $0 = 100u
| $E8 | $2B | $07 | $5v | $4 = 50u
| | | | | $8 = 200u
| | | | | $C = 400u
+-----+-----+-----+-----+
4..7 (32..63) | ss | ss | ss | ss | --> Serial Number
+-----+-----+-----+-----+-----+
8..12 (64..103) | | | | | | --> octal counter
+-----+-----+-----+-----+-----+
13..15 (104..127) | $.. | $.. | $.. |
+-----+-----+-----+-----+
16..19 (128..159) | $FF | $FF | $FF | $FF |
" " " " | " | " | " | " |
28..31 (224..255) | $FF | $FF | $FF | $FF |
+-----+-----+-----+-----+
The number of stages (4 or 5 stages) is not known for this card.
Serial Number = b(63..32) displayed in decimal.
2.5.1.6a - Canada (128 bits):
~~~~~~~~~~~~~~~~~
Byte (Bit) Hexa
+-----+-----+-----+
0-2 (0..23) | $99 | $28 | $1C | --> Canada (G+D)
| $99 | $28 | $BF |
+-----+-----+-----+
3 (24..31) | VV | Card Value: $02 = $5
| | $03 = $10
| | $04 = $20
+-----+
4 (32..39) | | --> Serial Number / Manufacturer area
5 (40..47) | |
6 (48..55) | |
7 (56..63) | |
+-----+-----+-----+-----+
8..12 (64..95) |c512 | c64 | c8 | c1 | --> 4 stage octal counter
+-----+-----+-----+-----+
12 (96..103) | $.. |
13 (104..111) | $.. |
14 (112..119) | $.. |
15 (120..127) | $.. |
+-----+
2.5.1.6b - Canada (512 bits):
~~~~~~~~~~~~~~~~~
Byte (Bit) Hexa
+-----+-----+-----+
0..2 (0..23) | $93 | $AB | $1C | --> Canada (Gemplus)
| $93 | $AB | $BF | --> Canada (Gemplus)
+-----+-----+-----+
3 (24..31) | VV | --> Value : $02 = 5$
| | $03 = 10$
| | $04 = 20$
+-----+
4 (32..39) | | --> Serial Number / Manufacturer area
5 (40..47) | |
6 (48..55) | |
7 (56..63) | |
+-----+-----+-----+-----+-----+
8..12 (64..103) | | | | | | --> octal counter
+-----+-----+-----+-----+-----+
13..15 (104..127) | $FF | $FF | $FF |
+-----+-----+-----+-----+
16..19 (128..159) | $FF | $FF | $FF | $FF |
" " " " | " | " | " | " |
28..31 (224..255) | $FF | $FF | $FF | $FF |
+-----+-----+-----+-----+
32..35 (256..287) | $0A | $00 | $0A | $00 |
36..39 (288..319) | $0A | $00 | $0A | $00 |
+-----+-----+-----+-----+
40..43 (320..351) | $00 | $00 | $00 | $00 |
" " " " | " | " | " | " |
60..63 (480..511) | $00 | $00 | $00 | $00 |
+-----+- ---+- ---+-----+
2.5.1.7 - Chile:
~~~~~~
Byte (Bit) Hexa
+-----+-----+-----+-----+
0-3 (0..31) | $10 | $2B | $5F | $06 |
+-----+-----+-----+-----+
4 (32..39) | | --> Serial Number / Manufacturer area
5 (40..47) | |
6 (48..55) | |
7 (56..63) | |
+-----+-----+-----+-----+-----+
8..12 (64..103)| | | | | | --> octal counter
+-----+-----+-----+-----+-----+
13 (104..111) | $.. |
14 (112..119) | $.. |
15 (120..127) | $.. |
+-----+
The number of stages (4 or 5 stages) is not known for this card.
2.5.1.8a - Croatia (128 bits - HPT_B):
~~~~~~~~~~~~~~~~~~~~~~~~~~
Byte (Bit) Hexa
+-----+-----+-----+
0-2 (0..23) | $98 | $30 | $8F |
| $99 | $30 | $8F |
+-----+-----+-----+
3 (24..31) | .v | --> v: Unit identifier $2 = 25 Units
| | $6 = 50 Units
| | $7 = 100 Units
| | $3 = 200 Units
| | $8 = 200 Units
| | $5 = 500 Units
+-----|
4 (32..39) | | --> Serial Number / Manufacturer area
5 (40..47) | |
6 (48..55) | |
+-----+
7 (56..63) | | --> [TBD]
+-----+-----+-----+-----+-----+
8..12 (64..103)|c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter
+-----+-----+-----+-----+-----+
13 (104..111) | $FF |
14 (112..119) | $FF |
15 (120..127) | $FF |
+-----+
Serial Number = b(32..55) displayed in decimal.
2.5.1.8b - Croatia (512 bits - HPT_CF):
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Byte (Bit) Hexa
+-----+-----+-----+
0..2 (0..23) | $93 | $AB | $8F | --> Croatia (Gemplus)
+-----+-----+-----+
3 (24..31) | .V | --> Value : $2 = 25u
| | $6 = 50u
| | $7 = 100u
| | $3 = 200u
| | $5 = 500u
| | $8 = 1000u
+-----+-----+-----+
4..6 (32..55) | ss | ss | ss | --> Serial Number
+-----+-----+-----+
7 (56..63) | | --> Always $26 [TBC]
+-----+-----+-----+-----+-----+
8..12 (64..103) |c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter
+-----+-----+-----+-----+-----+
13..15 (104..127) | $FF | $FF | $FF |
+-----+-----+-----+-----+
16..19 (128..159) | $FF | $FF | $FF | $FF |
" " " " | " | " | " | " |
28..31 (224..255) | $FF | $FF | $FF | $FF |
+-----+-----+-----+-----+
32..35 (256..287) | $0A | $00 | $0A | $00 |
36..39 (288..319) | $0A | $00 | $0A | $00 |
+-----+-----+-----+-----+
40..43 (320..351) | $00 | $00 | $00 | $00 |
" " " " | " | " | " | " |
60..63 (480..511) | $00 | $00 | $00 | $00 |
+-----+- ---+- ---+-----+
Serial Number = b(32..55) displayed in decimal.
2.5.1.8c - Croatia (512 bits - HPT_D):
~~~~~~~~~~~~~~~~~~~~~~~~~~
Byte (Bit) Hexa
+-----+-----+-----+
0-2 (0..23) | $E9 | $30 | $8F |
+-----+-----+-----+
3 (24..31) | .v | --> v: Unit identifier $2 = 25 Units
| | $6 = 50 Units
| | $7 = 100 Units
| | $3 = 200 Units
| | $5 = 500 Units
+-----|
4 (32..39) | | --> Serial Number / Manufacturer area
5 (40..47) | |
6 (48..55) | |
+-----+
7 (56..63) | | --> [TBD]
+-----+-----+-----+-----+-----+
8..12 (64..103) |c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter
+-----+-----+-----+-----+-----+
13 (104..111) | $FF |
14 (112..119) | $FF |
15 (120..127) | $FF |
+-----+--- -+--- -+-----+
16..63 (128..511) | $FF | . . + . . + $FF +
+-----+- ---+- ---+-----+
Serial Number = b(32..55) displayed in decimal.
2.5.1.8d - Croatia (128 bits - HPT_E):
~~~~~~~~~~~~~~~~~~~~~~~~~~
Byte (Bit) Hexa
+-----+-----+-----+
0-2 (0..23) | $10 | $2B | $8F |
+-----+-----+-----+
3 (24..31) | .v | --> v: Unit identifier $2 = 25 Units
| | $6 = 50 Units
| | $7 = 100 Units
| | $3 = 200 Units
| | $5 = 500 Units
+-----|
4 (32..39) | | --> Serial Number / Manufacturer area
5 (40..47) | |
6 (48..55) | |
+-----+
7 (56..63) | | --> [TBD]
+-----+-----+-----+-----+-----+
8..12 (64..103)|c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter
+-----+-----+-----+-----+-----+
13 (104..111) | $FF |
14 (112..119) | $FF |
15 (120..127) | $FF |
+-----+
Serial Number = b(32..55) displayed in decimal.
2.5.1.9 - Cuba:
~~~~
Byte (Bit) Hexa
+-----+-----+-----+
0..2 (0..23) | $93 | $0B | $8F |
+-----+-----+-----+
3 (24..31) | VV | --> [TBD]
| |
+-----+-----+-----+
4..6 (32..55) | ss | ss | ss | --> Serial Number
+-----+-----+-----+
7 (56..63) | | --> [TBD]
+-----+-----+-----+-----+-----+
8..12 (64..103) | | | | | | --> octal counter
+-----+-----+-----+-----+-----+
13..15 (104..127) | $FF | $FF | $FF |
+-----+-----+-----+-----+
16..19 (128..159) | $FF | $FF | $FF | $FF |
" " " " | " | " | " | " |
28..31 (224..255) | $FF | $FF | $FF | $FF |
+-----+-----+-----+-----+
32..35 (256..287) | $0A | $00 | $0A | $00 |
36..39 (288..319) | $0A | $00 | $0A | $00 |
+-----+-----+-----+-----+
40..43 (320..351) | $00 | $00 | $00 | $00 |
" " " " | " | " | " | " |
60..63 (480..511) | $00 | $00 | $00 | $00 |
+-----+- ---+- ---+-----+
Serial Number = b(32..55) displayed in decimal.
The number of stages (4 or 5 stages) is not known for this card.
2.5.1.10 - Danmark:
~~~~~~~
Byte (Bit) Hexa
+-----+-----+-----+-----+
0..3 (0..31) | $E8 | $20 | $FF | $00 |
| $E8 | $39 | $FF | $00 |
+-----+-----+-----+-----+
4..6 (32..55) | ss | ss | ss | --> Serial Number
+-----+-----+-----+
7 (56..63) | | --> [TBD]
+-----+-----+-----+-----+-----+
8..12 (64..103) |c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter
+-----+-----+-----+-----+-----+
13 (104..111) | $FF |
14 (112..119) | $.. |
15 (120..127) | $.. |
+-----+--- -+--- -+-----+
16..63 (128..511) | $FF | . . + . . + $FF +
+-----+- ---+- ---+-----+
Serial Number = b(32..55) displayed in decimal.
Each unit is 0.01 Kr worth.
2.5.1.11 - England:
~~~~~~~
Byte (Bit) Hexa
+-----+-----+-----+
0..2 (0..23) | $A8 | $22 | $F7 |
+-----+-----+-----+
3 (24..31) | | -> Manufacturer [TDC]
+-----+-----+-----+-----+
4..7 (32..63) | .s | ss | ss | ss | --> Serial Number
+-----+-----+-----+-----+-----+
8..12 (64..103) |c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter
+-----+-----+-----+-----+-----+
13..15 (104..127) | $FE | $.. | $FF |
+-----+--- -+--- -+-----+
16..63 (128..511) | $FF | . . + . . + $FF +
+-----+- ---+- ---+-----+
Each unit is 0.01 £ worth.
Serial Number = "2x/x/" b(51..36) "/" b(63..54)
6 digits 4 digits
2.5.1.12 - Estonia:
~~~~~~~
Byte (Bit) Hexa
+-----+-----+-----+-----+
0-3 (0..31) | $E8 | $20 | $00 | $CE |
| $E8 | $20 | $FF | $CE |
| $E8 | $35 | $00 | $CE |
| $E9 | $30 | $00 | $CE |
| $E9 | $34 | $FF | $CE |
+-----+-----+-----+-----+
4 (32..39) | ss | --> sssssss = Serial Number
5 (40..47) | ss |
6 (48..55) | ss |
7 (56..63) | sv | --> v = Value (see notes)
+-----+-----+-----+-----+-----+
8..12 (64..103) |c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter
+-----+-----+-----+-----+-----+
13 (104..111) | $FF |
14 (112..119) | $.. |
+-----+--- -+--- -+-----+
16..63 (128..511) | $FF | . . + . . + $FF +
+-----+- ---+- ---+-----+
Serial Number = b(32..57) displayed in decimal.
Note 1: Each unit is 0.16kr worth.
Note 2: v=$0 Value = 188 Units (30 Kr)
v=$4 Value = 313 Units (50 Kr)
v=$8 Value = 625 Units (100 Kr)
2.5.1.13 - Germany (128 and 512 bits):
~~~~~~~~~~~~~~~~~~~~~~~~~~
Byte (Bit) Hexa
+-----+-----+-----+-----+
0-3 (0..31) | $80 | $6F | $FF | $mm | --> Germany ($mm : manufacturer)
| $A0 | $8F | $FC | | $mm : $1A : Orga [TBC]
| $C0 | $8F | $FF | | $2A : Solaic
| $D8 | $2F | $FC | | $4A : ODS
| $D8 | $2F | $FF | | $8A : G+D
| $F0 | $2F | $FF | | $AA : Orga
| $F2 | $2F | $FF | | $CA : Gemplus
| $F4 | $2F | $FF | |
+-----+-----+-----+-----+
4 (32..39) | | --> Serial Number
5 (40..47) | |
6 (48..55) | |
7 (56..63) | |
+-----+-----+-----+-----+-----+
8..12 (64..103)|c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter
+-----+-----+-----+-----+-----+
13 (104..111) | $.. |
14 (112..119) | $.. |
15 (120..127) | $.. |
+-----+
Serial Number:
-------------
+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+
| 1 | 2 | 3 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 |
+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+
Digit: 1 = b(27..24) - b(67..64)
2 = b(39..36)
3&4 = b(43..40)
5 = b(63..60)
6 = b(59..56)
7 = b(55..52)
8 = b(51..48)
9 = b(47..44)
Digits 10 & 11 are not coded in the memory [TBC].
2.5.1.14a - Greece (128 bits - OTE):
~~~~~~~~~~~~~~~~~~~~~~~
Byte (Bit) Hexa
+-----+-----+-----+-----+
0-3 (0..31) | $10 | $2B | $FF | $7B | --> Greece (Gemplus)
| $92 | $3B | $FF | $7B | --> Greece (G+D)
| $94 | $3B | $FF | $7B | --> Greece (G+D)
| $98 | $35 | $1D | $7B | --> Greece (Solaic)
| $E8 | $2B | $FF | $7B | --> Greece (Gemplus - 512 bits ???)
+-----+-----+-----+-----+
4-7 (32..63) | $.. | $.. | $.. | $.. | --> Serial Number (see below)
+-----+-----+-----+-----+
8..11 (64..95) |c512 | c64 | c8 | c1 | --> 4 stage octal counter
+-----+-----+-----+-----+
12 (96..103) | $.. |
13 (104..111) | $.. |
14 (112..119) | $.. |
15 (120..127) | $.. |
+-----+
NOTE: For Greece the counter is twice the unit value of the card (200 bits
for a 100u card).
Serial Number = b(63..32) displayed in decimal.
Serial numbers for Solaic seems to begin by '11', Gemplus by '21', and
Schlumberger by '31'. A new manufacturer appears with serial numbers beginning
by '41'.
2.5.1.14b - Greece (512 bits - OTE):
~~~~~~~~~~~~~~~~~~~~~~~
Byte (Bit) Hexa
+-----+-----+-----+-----+
0..2 (0..23) | $93 | $AB | $FF | $7B | --> Greece (Gemplus)
| $E8 | $20 | $FF | $7B | --> Greece (Schlumberger)
| $E9 | $22 | $80 | $7B | --> Greece (Unknown manufacturer)
| $E9 | $30 | $FF | $7B | --> Greece (Schlumberger)
+-----+-----+-----+-----+
4..7 (32..63) | ss | ss | ss | ss | --> Serial Number
+-----+-----+-----+-----+
8..11 (64..95) |c512 | c64 | c8 | c1 | --> 4 stage octal counter
+-----+-----+-----+-----+
12..15 (96..127) | $FF | $FF | $FF | $FF |
+-----+--- -+--- -+--- -+-----+
16..63 (128..511) | $FF | . . + . . + . . + $FF +
+-----+- ---+- ---+- ---+-----+
Serial Number = b(63..32) displayed in decimal.
Serial numbers for Solaic seems to begin by '11', Gemplus by '21', and
Schlumberger by '31'. A new manufacturer appears with serial numbers beginning
by '41'.
2.5.1.15 - Lithuania:
~~~~~~~~~
Byte (Bit) Hexa
+-----+-----+-----+-----+
0..3 (0..31) | $E8 | $39 | $13 | $41 |
+-----+-----+-----+-----+
4 (32..39) | $vv | $07 -> 50u
| | $08 -> 50u
| | $17 -> 75u
+-----+-----+-----+
5..7 (40..63) | xs | ss | ss | --> sssss Serial Number
| | | | x [TBD]
+-----+-----+-----+-----+-----+
8..12 (64..103) |c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter
+-----+-----+-----+-----+-----+
13 (104..111) | $FF |
14 (112..119) | $F0 |
15 (120..127) | $FF |
+-----+--- -+--- -+-----+
16..63 (128..511) | $FF | . . + . . + $FF +
+-----+- ---+- ---+-----+
NOTE: The counter represents 1/10u
Serial Number = b(44..63) displayed in hexadecimal.
2.5.1.16a - Malaysia (Malaysia Telecom - 128 bits):
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Byte (Bit) Hexa
+-----+-----+-----+
0..2 (0..23) | $10 | $2B | $88 |
| $98 | $39 | $88 |
+-----+-----+-----+
3 (24..31) | $.v | --> v: Value ($1=5 RM, $2=10 RM, $4=50 RM)
+-----+
4 (32..39) | | --> Serial Number / Manufacturer area
5 (40..47) | |
6 (48..55) | |
7 (56..63) | |
+-----+-----+-----+-----+-----+
8..12 (64..103)|c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter
+-----+-----+-----+-----+-----+
13 (104..111) | $FF |
14 (112..119) | $FF |
15 (120..127) | $FF |
+-----+
Serial Number = b(32..55) displayed in decimal.
Each unit is 0.1 RM worth.
2.5.1.16b - Malaysia (Malaysia Telecom - 512 bits):
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+-----+-----+-----+
0..2 (0..23) | $93 | $AB | $88 |
+-----+-----+-----+
3 (24..31) | $.v | --> v: Value ($1 = 5 RM, $2, 10 RM, $4 = 50 RM)
+-----+
4 (32..39) | | --> Serial Number / Manufacturer area
5 (40..47) | |
6 (48..55) | |
7 (56..63) | |
+-----+-----+-----+-----+-----+
8..12 (64..103) |c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter
+-----+-----+-----+-----+-----+
13 (104..111) | $FF |
14 (112..119) | $FF |
15 (120..127) | $FF |
+-----+-----+-----+-----+
16..19 (128..159) | $FF | $FF | $FF | $FF |
" " " " | " | " | " | " |
28..31 (224..255) | $FF | $FF | $FF | $FF |
+-----+-----+-----+-----+
32..35 (256..287) | $0A | $00 | $0A | $00 |
36..39 (288..319) | $0A | $00 | $0A | $00 |
+-----+-----+-----+-----+
40..43 (320..351) | $00 | $00 | $00 | $00 |
" " " " | " | " | " | " |
60..63 (480..511) | $00 | $00 | $00 | $00 |
+-----+- ---+- ---+-----+
Serial Number = b(32..55) displayed in decimal.
Each unit is 0.1 RM worth.
2.5.1.16c - Malaysia (Citifon - 128 bits):
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Byte (Bit) Hexa
+-----+-----+-----+
0..2 (0..23) | $10 | $2B | $16 |
+-----+-----+-----+
3 (24..31) | $.. |
+-----+
4 (32..39) | | --> Serial Number / Manufacturer area
5 (40..47) | |
6 (48..55) | |
7 (56..63) | |
+-----+-----+-----+-----+-----+
8..12 (64..103)|c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter
+-----+-----+-----+-----+-----+
13 (104..111) | $FF |
14 (112..119) | $FF |
15 (120..127) | $FF |
+-----+
2.5.1.17 - Republic of Moldova (MoldTelecom):
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Byte (Bit) Hexa
+-----+-----+-----+-----+
0..3 (0..31) | $E8 | $20 | $FF | $Bv | --> Value : $4, $B = 100u
| $E8 | $2B | $07 | $Bv | $8 = 75u
| $E9 | $30 | $B1 | $Bv | $C = 200u
+-----+-----+-----+-----+
4..7 (32..63) | ss | ss | ss | ss | --> Serial Number
+-----+-----+-----+-----+-----+
8..12 (64..103) |c4096|c512 | c64 | c8 | c1 | --> octal counter
+-----+-----+-----+-----+-----+
13..15 (104..127) | $.. | $.. | $.. |
+-----+-----+-----+-----+
16..19 (128..159) | $FF | $FF | $FF | $FF |
" " " " | " | " | " | " |
28..31 (224..255) | $FF | $FF | $FF | $FF |
+-----+-----+-----+-----+
Serial Number = b(63..32) displayed in decimal.
Serial Number is 10 digits long, it begins by '075' for 75 units cards,
'100' for 100 units cards and '200' for 200 units cards.
2.5.1.18 - Netherlands (PTT Telekom):
~~~~~~~~~~~~~~~~~~~~~~~~~
Byte (Bit) Hexa
+-----+-----+-----+-----+
0-3 (0..31) | $80 | $37 | $FF | $mm | --> Netherlands ($mm : manufacturer)
| $80 | $77 | $FF | | $mm : $1A : Orga [TBC]
| $D8 | $37 | $FF | | $2A : Solaic
| $F0 | $37 | $FF | | $4A : ODS
| | | | | $8A : G+D
| | | | | $AA : Orga
| | | | | $CA : Gemplus
+-----+-----+-----+-----+
4 (32..39) | | --> $4x : 5G
| | $2x : 10G
| | $6x : 25G
+-----+
5 (40..47) | | --> Serial Number
6 (48..55) | |
7 (56..63) | |
+-----+-----+-----+-----+-----+
8..12 (64..103)|c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter
+-----+-----+-----+-----+-----+
13 (104..111) | $FF |
14 (112..119) | $.. | --> $00 for empty cards ($80, $C0, E0, ...... )
15 (120..127) | $.. | --> $00 for empty cards
+-----+
Serial Number:
-------------
+-----+-----+-----+-----+-----+-----+-----+-----+-----+
| 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 |
+-----+-----+-----+-----+-----+-----+-----+-----+-----+
Digit: 1 = b(27..24)
2 = b(63..60)
3 = b(59..56)
4 = b(55..52)
5 = b(51..48)
6 = b(47..44)
Digits 7,8&9 are not coded in the memory [TBC].
2.5.1.19a - Romania (128 bits):
~~~~~~~~~~~~~~~~~~
Byte (Bit) Hexa
+-----+-----+-----+
0-2 (0..23) | $10 | $2B | $2F |
| $10 | $2B | $17 |
| $93 | $AB | $2F |
| $98 | $20 | $2F |
| $99 | $3C | $2F |
+-----+-----+-----+
3 (24..31 | | --> Serial Number / Manufacturer area
4 (32..39) | |
5 (40..47) | |
6 (48..55) | |
7 (56..63) | |
+-----+-----+-----+-----+-----+
8..12 (64..103) |c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter
+-----+-----+-----+-----+-----+
13 (104..111) | $FF |
14 (112..119) | $FF |
15 (120..127) | $FF |
+-----+
2.5.1.19b - Romania (512 bits):
~~~~~~~~~~~~~~~~~~
Byte (Bit) Hexa
+-----+-----+-----+
0..2 (0..23) | $E8 | $2B | $17 |
+-----+-----+-----+
3 (24..31 | | --> Serial Number / Manufacturer area
4 (32..39) | |
5 (40..47) | |
6 (48..55) | |
7 (56..63) | |
+-----+-----+-----+-----+-----+
8..12 (64..103) |c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter
+-----+-----+-----+-----+-----+
13 (104..111) | $FF |
14 (112..119) | $.. |
15 (120..127) | $.. |
+-----+--- -+--- -+-----+
16..63 (128..511) | $FF | . . + . . + $FF +
+-----+- ---+- ---+-----+
2.5.1.20a - Russia (CNM):
~~~~~~~~~~~~~
Byte (Bit) Hexa
+-----+-----+-----+-----+
0..3 (0..31) | $E8 | $2B | $FF | $01 | --> Russia - CNM (???)
| $E9 | $30 | $FF | $01 | --> Russia - CNM (Schlumberger)
+-----+-----+-----+-----+
4..7 (32..63) | ss | ss | ss | ss | --> Serial Number
+-----+-----+-----+-----+-----+
8..12 (64..103) |c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter
+-----+-----+-----+-----+-----+
13 (104..111) | $FF |
14 (112..119) | $.. |
15 (120..127) | $.. |
+-----+--- -+--- -+-----+
16..63 (128..511) | $FF | . . + . . + $FF +
+-----+- ---+- ---+-----+
Serial Number = b(63..32) displayed in decimal.
2.5.1.20b - Russia (MCTN - Moscow City Telephone Network):
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Byte (Bit) Hexa
+-----+-----+-----+
0..2 (0..23) | $E8 | $30 | $CF |
| $E9 | $30 | $07 |
+-----+-----+-----+
3 (24..31) | mm | --> Manufacturer: $01 = Schlumberger
| | $03 = Schlumberger
| | $04 = ???
| | $05 = ???
+-----+-----+-----+-----+
4..7 (32..63) | ss | ss | ss | sv | --> sssss: Serial Number
| | | | | v: Value (see note)
+-----+-----+-----+-----+-----+
8..12 (64..103) |c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter
+-----+-----+-----+-----+-----+
13 (104..111) | $FF |
14 (112..119) | $.. |
15 (120..127) | $.. |
+-----+--- -+--- -+-----+
16..63 (128..511) | $FF | . . + . . + $FF +
+-----+- ---+- ---+-----+
Serial Number = b(38..57) displayed in decimal.
Value: The value is stored b(63..60) multiplied by 10, that is to say you read the
area in reverse and you multiply by 10 ($A=50 Units, $C=30, $6=60).
2.5.1.21 - Slovakia (Slovenske Telekomunikanie):
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Byte (Bit) Hexa
+-----+-----+-----+
0-2 (0..23) | $10 | $2B | $12 |
| $92 | $3B | $FF |
| $98 | $25 | $FF |
| $98 | $35 | $0C |
+-----+-----+-----+
3 (24..31 | | --> Serial Number / Manufacturer area
4 (32..39) | |
5 (40..47) | |
6 (48..55) | |
7 (56..63) | |
+-----+-----+-----+-----+-----+
8..12 (64..103)|c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter
+-----+-----+-----+-----+-----+
13 (104..111) | $FF |
14 (112..119) | $FF |
15 (120..127) | $FF |
+-----+
Serial Number = b(40..63) displayed in decimal.
2.5.1.22 - South Africa:
~~~~~~~~~~~~
Byte (Bit) Hexa
+-----+-----+-----+-----+
0-3 (0..31) | $92 | $3B | $FF | $06 | --> South Africa (G+D)
| | | | $09 | --> South Africa (G+D)
| $98 | $28 | $FF | $x4 | --> South Africa (???)
| | $3E | | | --> South Africa (G+D)
+-----+-----+-----+-----+
4 (32..39) | | --> [TBD]
5 (40..47) | ss | --> Serial Number
6 (48..55) | ss |
7 (56..63) | ss |
+-----+-----+-----+-----+-----+
8..12 (64..103)|c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter
+-----+-----+-----+-----+-----+
13 (104..111) | $FF |
14 (112..119) | $FF |
15 (120..127) | $FF |
+-----+
2.5.1.23 - Swaziland:
~~~~~~~~~
Byte (Bit) Hexa
+-----+-----+-----+-----+
0..3 (0..31) | $E8 | $35 | $3B | $A3 |
+-----+-----+-----+-----+
4..7 (32..63) | ss | ss | ss | ss | --> Serial Number
+-----+-----+-----+-----+-----+
8..12 (64..103) |c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter
+-----+-----+-----+-----+-----+
13 (104..111) | $FE |
14 (112..119) | $FF |
15 (120..127) | $FF |
+-----+--- -+--- -+-----+
16..63 (128..511) | $FF | . . + . . + $FF +
+-----+- ---+- ---+-----+
Serial Number = "SGAB" b(56..63) b(32..55)
3 digits 8 digits
2.5.1.24 - Swiss:
~~~~~
Byte (Bit) Hexa
+-----+-----+-----+-----+
0-3 (0..31) | $D8 | $2A | $FF | $mm | --> Swiss ($mm : manufacturer)
| $DD | $2A | $0F | | $mm : $1A : Orga [TBC]
| $DD | $2A | $2F | | $2A : Solaic [TBC]
| $DD | $2A | $4F | | $4A : ODS [TBC]
| | | | | $8A : G+D [TBC]
| | | | | $9A : ???
| | | | | $AA : Orga [TBC]
| | | | | $CA : Gemplus
+-----+-----+-----+-----+
4 (32..39) | vx | --> v: Value ($2=10 CHF, $4= 5 CHF, $6=20 CHF)
5 (40..47) | xs | --> x: [TBD]
6 (48..55) | ss | --> s:Serial Number
7 (56..63) | ss |
+-----+-----+-----+-----+-----+
8..12 (64..103) |c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter
+-----+-----+-----+-----+-----+
13 (104..111) | $FF |
14 (112..119) | $FF |
15 (120..127) | $FF |
+-----+--- -+--- -+-----+
16..39 (128..319) | $FF | . . + . . + $FF +
+-----+-----+-----+-----+
40..43 (320..351) | $00 | $00 + $00 + $00 +
+-----+-----+-----+-----+
44..47 (352..383) | $.. | $.. + $.. + $.. + --> See note.
+-----+-----+-----+-----+
48..63 (384..511) | $FF | . . + . . + $FF +
+-----+--- -+--- -+-----+
Each unit is 0.01 CHF worth.
Serial Number = b(63..44) displayed in hexadecimal.
Cards beginning by $D82A have $F8884AA8 in b(352..383)
Cards beginning by $DD2A have 'Eurochip' printed above the chip.
2.5.1.25 - Thailand:
~~~~~~~~
Byte (Bit) Hexa
+-----+-----+-----+-----+
0-3 (0..31) | $92 | $3B | $FF | $07 |
+-----+-----+-----+-----+
4 (32..39) | ss | --> Serial Number
5 (40..47) | ss |
6 (48..55) | ss |
+-----+
7 (56..63) | |
+-----+-----+-----+-----+-----+
8..12 (64..103)| | | | | | --> octal counter
+-----+-----+-----+-----+-----+
13 (104..111) | $FF |
14 (112..119) | $FF |
15 (120..127) | $FF |
+-----+
The number of stages (4 or 5 stages) is not known for this card.
2.5.1.26a - Venezuela (CANTV - 128 bits):
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Byte (Bit) Hexa
+-----+-----+-----+
0-2 (0..23) | $10 | $2B | $1F | --> Venezuela (CANTV)
| $98 | $35 | $1F |
+-----+-----+-----+
3 (24..31) | $.v | --> v: Value ($0 = 250, $2=1000 Bs, $4=2000 Bs)
+-----+
4 (32..39) | ss | --> Serial Number
5 (40..47) | ss |
6 (48..55) | ss |
+-----+
7 (56..63) | |
+-----+-----+-----+-----+-----+
8..12 (64..103) |c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter
+-----+-----+-----+-----+-----+
13 (104..111) | $FF |
14 (112..119) | $FF |
15 (120..127) | $FF |
+-----+
2.5.1.26b - Venezuela (CANTV - 512 bits):
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Byte (Bit) Hexa
+-----+-----+-----+
0-2 (0..23) | $93 | $0B | $1F | --> Venezuela (CANTV)
| $93 | $AB | $1F |
| $93 | $AC | $1F |
+-----+-----+-----+
3 (24..31) | $.v | --> v: Value ($0 = 250 Bs, $2=1000 Bs, $4=2000 Bs)
+-----+
4 (32..39) | ss | --> Serial Number
5 (40..47) | ss |
6 (48..55) | ss |
+-----+
7 (56..63) | |
+-----+-----+-----+-----+-----+
8..12 (64..103) |c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter
+-----+-----+-----+-----+-----+
13 (104..111) | $FF |
14 (112..119) | $FF |
15 (120..127) | $FF |
+-----+-----+-----+-----+
16..19 (128..159) | $FF | $FF | $FF | $FF |
" " " " | " | " | " | " |
28..31 (224..255) | $FF | $FF | $FF | $FF |
+-----+-----+-----+-----+
32..35 (256..287) | $0A | $00 | $0A | $00 |
36..39 (288..319) | $0A | $00 | $0A | $00 |
+-----+-----+-----+-----+
40..43 (320..351) | $00 | $00 | $00 | $00 |
" " " " | " | " | " | " |
60..63 (480..511) | $00 | $00 | $00 | $00 |
+-----+- ---+- ---+-----+
Each unit is 0.25 Bs worth.
Serial Number = b(32..57) displayed in decimal.
2.5.2 - 2nd Generation French Telecards (T2G) and derivates:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2.5.2.1 - French T2G:
~~~~~~~~~~
Byte (Bit) Memory Map
+-----+-----+
0-1 (0..15) | $81 | $40 | --> French T2G
+-----+-----+
2..7 (16..63) | $NN |
| $NN | --> N: Serial Number
| $NN | $001: 5u
| $NN | $003: 25u
| $NV | --> V: Unit Value --> $005: 50u
| $VV | $00C: 120u
+-----+
8 (64..71) | $xx | --> c(512) 4 stage octal Incremental-counter
9 (72..79) | $xx | c(64) (see note for units set in factory)
10 (80..87) | $xx | c(8)
11 (88..95) | $xx | c(1)
+-----+
12 (96..103) | $xx | --> $7F when not empty; $FF when empty
+-----+
13 (104..111) | $FF | --> Unused (Zone set to 1)
+-----+-----+
14..15 (112..127) | $.. | $.. | --> Certificate ($0000 when card is empty)
+-----+-----+-----+-----+
16..23 (128..191) | $.. | $.. | $.. | $.. | --> Authentification Secret Key
| $.. | $.. | $.. | $.. | All $FF when memory dumped.
+-----+-----+-----+-----+
24..31 (192..255) | $00 | $00 | $00 | $00 | --> Unused
| $00 | $00 | $00 | $00 |
+-----+-----+-----+-----+
32.(256..263) | $* | --> 4 next = signature / First 4 bits = fuses
+-----+-----+-----+
33..35 (264..287) | $.. | $.. | $.. | --> Unused
+-----+-----+-----+-----+
36..39 (288..319) | $.. | $.. | $.. | $.. | --> Anti Tearing Flags
+-----+-----+-----+-----+-----+-----+-----+
40..46 (320..375) | $.. | $.. | $.. | $.. | $.. | $.. | $.. | --> User Defined
+-----+-----+-----+-----+-----+-----+-----+ Area
NOTES: When memory is dumped, the address counter restarts at 000 when you
reach address 511. Value for bits from 376 to 511 depends on the chip's
version. At that date, 3 chip versions seem to exist.
On the first version of the chip the certificate b(112..127) cannot be
erased when the card is empty. Some payphones do not erase certificate
and do not set B(12) to $FF when card is empty.
For 50u and 120u cards 9 units are set in factory, 14 units are set in
factory for 5u and 25u cards.
The User Defined Area b(320..375) can be defined as "not erasable".
2.5.2.2 - French T2G ("Numero Unique"):
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
French T2G "Numero Unique" are some special cards: a defined number is
automatically dialed when the card is inserted in a payphone. At this
time only 5u cards are known to exist (but may be 25u will come?).
Byte (Bit) Memory Map
+-----+-----+
0-1 (0..15) | $81 | $40 | --> French T2G
+-----+-----+
2..7 (16..63) | $NN |
| $NN | --> N: Serial Number
| $NN |
| $NN |
| $NV | --> V: Unit Value --> $101: 5u "Numero Unique"
| $VV |
+-----+
8 (64..71) | $xx | --> c(512) 4 stage octal Incremental-counter
9 (72..79) | $xx | c(64) (see note for units set in factory)
10 (80..87) | $xx | c(8)
11 (88..95) | $xx | c(1)
+-----+-----+-----+-----+
12..15 (96..127) | $nn | $nn | $nn | $nn | --> Dialed Number
+-----+-----+-----+-----+
16..23 (128..191) | $.. | $.. | $.. | $.. | --> Authentification Secret Key
| $.. | $.. | $.. | $.. | All $FF when memory dumped.
+-----+-----+-----+-----+
24..31 (192..255) | $00 | $00 | $00 | $00 | --> Unused
| $00 | $00 | $00 | $00 |
+-----+-----+-----+-----+
32.(256..263) | $* | --> 4 next = signature / First 4 bits = fuses
+-----+-----+-----+
33..35 (264..287) | $.. | $.. | $.. | --> Unused
+-----+-----+-----+-----+
36..39 (288..319) | $.. | $.. | $.. | $.. | --> Anti Tearing Flags
+-----+-----+-----+-----+-----+-----+-----+
40..46 (320..375) | $.. | $.. | $.. | $.. | $.. | $.. | $.. | --> User Defined
+-----+-----+-----+-----+-----+-----+-----+ Area
The automatically dialed number is stored b(96..127), it is stored in binary
and as a french national number (as dialed from France). The number must be
french number, because there is no room for the international prefix.
Example: $08E3248D represents the number "01 49 10 37 57".
Theses cards are special, because the dialed number is partially stored on the
certificate, so certificate is not used (does not matter because you may only
dial one number).
2.5.2.3 - Estonia:
~~~~~~~
Byte (Bit) Hexa
+-----+-----+-----+-----+
0..3 (0..31) | $83 | $AD | $00 | $CE | --> Estonia (Schlumberger)
+-----+-----+-----+-----+
4..6 (32..55) | ss | ss | ss | --> ssssss = Serial Number
+-----+-----+-----+
7 (56..63) | $sv | --> v = Value (see note)
+-----+-----+-----+-----+-----+
8..12 (64..103) |c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter
+-----+-----+-----+-----+-----+
13 (104..111) | $00 |
+-----+-----+
14..15 (112..127) | $.. | $.. | --> Certificate ($0000 when card is empty)
+-----+-----+-----+-----+
16..19 (128..159) | $00 | $00 | $00 | $00 |
" " " " | | | | |
28..31 (224..255) | $00 | $00 | $00 | $00 |
+-----+-----+-----+-----+
32..35 (256..287) | $F5 | $F5 | $F5 | $F5 |
+-----+-----+-----+-----+
36..39 (288..319) | $00 | $00 | $00 | $00 |
" " " " | " | " | " | " |
44..47 (352..383) | $00 | $00 | $00 | $00 |
+-----+-----+-----+-----+
48..51 (384..415) | $F5 | $F5 | $F5 | $F5 |
+-----+-----+-----+-----+
52..55 (416..448) | $FF | $FF | $FF | $FF |
" " " " | " | " | " | " |
60..63 (480..511) | $FF | $FF | $FF | $FF |
+-----+- ---+- ---+-----+
Serial Number = b(34..57) displayed in decimal.
Each unit is 0.16 Kr worth.
b(60..63) indicates the value of the card:
$0 = 188 Units (30 Kr)
$4 = 313 Units (50 Kr)
$8 = 625 Units (100 kr)
2.5.2.4 - Russia:
~~~~~~
Byte (Bit) Hexa
+-----+-----+-----+-----+
0..3 (0..31) | $83 | $AB | $01 | $06 | --> Russia - MRTC (Gemplus)
+-----+-----+-----+-----+
4..6 (32..55) | ss | ss | ss | --> Serial Number
+-----+-----+-----+
7 (56..63) | $.. | --> Value $02 = 20 [TBC]
+-----+-----+-----+-----+
8..11 (64..96) | $00 | $00 | $00 | $00 |
" " " " | | | | |
28..31 (224..255) | $00 | $00 | $00 | $00 |
+-----+-----+-----+-----+
32..35 (256..287) | $F5 | $F5 | $F5 | $F5 |
+-----+-----+-----+-----+
36..39 (288..319) | $00 | $00 | $00 | $00 |
" " " " | " | " | " | " |
44..47 (352..383) | $00 | $00 | $00 | $00 |
+-----+-----+-----+-----+
48..51 (384..415) | $F5 | $F5 | $F5 | $F5 |
+-----+-----+-----+-----+
52..55 (416..448) | $FF | $FF | $FF | $FF |
" " " " | " | " | " | " |
60..63 (480..511) | $FF | $FF | $FF | $FF |
+-----+- ---+- ---+-----+
2.7 - The Octal Counter:
------------------
The counter area stores the card's units. Its initial value is specified by
the card issuer and is set during manufacturing.
The counter area is divided into a 5 stage abacus counter, or 4 stage abacus
counter. Depending on the chip you may:
- Write a bit set to '1' to change its value to '0' (Eurochip family).
- Write a bit set to '0' to change its value to '1' (T2G family).
The octal value of each stage is defined by the number of bits set to
'1' (Eurochip and French T2G from France Telecom) or '0' (French T2G derivates)
this stage value must be weighted by the coeficient 8^n (where n is among
[4..0] or [3..0]).
Exemple (Eurochip or french T2G from France Telecom):
-----------------------------------------------------
5 stage octal unit counter with 15818 units.
Byte8 Byte9 Byte10 Byte11 Byte12
(c4096) (c512) (c64) (c8) (c1)
--------------------------------------------------------------
00000111 - 00111111 - 01111111 - 00000001 - 00000011
--------------------------------------------------------------
(3)octal (6)octal (7)octal (1)octal (2)octal
--------------------------------------------------------------
Value = 3*8^4 + 6*8^3 + 7*8^2 + 1*8^1 + 2*8^0
= 3*4096 + 6*512 + 7*64 + 1*8 + 2*1
--------------------------------------------------------------
TOTAL = 15818 Units
Exemple (french T2G derivate):
------------------------------
5 stage octal unit counter with 15818 units.
Byte8 Byte9 Byte10 Byte11 Byte12
(c4096) (c512) (c64) (c8) (c1)
--------------------------------------------------------------
11111000 - 11000000 - 10000000 - 11111110 - 11111100
--------------------------------------------------------------
(3)octal (6)octal (7)octal (1)octal (2)octal
--------------------------------------------------------------
Value = 3*8^4 + 6*8^3 + 7*8^2 + 1*8^1 + 2*8^0
= 3*4096 + 6*512 + 7*64 + 1*8 + 2*1
--------------------------------------------------------------
TOTAL = 15818 Units
Two types of cards exist:
- Cards who counts the remaining units (mainly eurochips and french
T2G derivates)
- Cards who counts the used units (mainly french T2G from France
Telecom).
For cards who count the used units you need to know the value of card
(to compute the remaining value of the card). You must be aware that a
given number of units are burned in factory (in order to test the card).
Exemple: For a 120 units French Telecard from France Telecom
9 units are burned in factory, so a fully used card counts 129 Units.
Exemple of the WRITE and WRITECARRY sequences (Eurochip):
--------------------------------------------------------
b64 ........................................... b103
----------------------------------------------------
00000111 - 00111111 - 01111111 - 00000000 - 00000011
-1 ^ WRITE(b102)
00000111 - 00111111 - 01111111 - 00000000 - 00000001
-1 ^ WRITE(b103)
00000111 - 00111111 - 01111111 - 00000000 - 00000000
-1 ^ ^ ^
00000111 - 00111111 - 00111111 - 11111111 - 00000000 + WRITECARRY(b81)
00000111 - 00111111 - 00111111 - 01111111 - 11111111 + WRITECARRY(b88)
00000111 - 00111111 - 00111111 - 01111111 - 01111111 + WRITE(b96)
-1
00000111 - 00111111 - 00111111 - 01111111 - 00111111 + WRITE(b97)
-1
00000111 - 00111111 - 00111111 - 01111111 - 00011111 + WRITE(b98)
Etc ....
Note that you can only decrease the counter and it is not authorised to write
in the counter a value greater than the old value.
NB: In fact, most of the card units do not represent telecom units, but money
units, for exemple in german cards each telecom unit represent 30 pfennigs.
2.7 - Electrical features:
Maximum ratings:
----------------
| Symbol Min Max Unit
---------------------+---------------------------
Supply voltage | Vcc -0.3 6 V
---------------------+---------------------------
Input voltage | Vss -0.3 6 V
---------------------+---------------------------
Storage temperature | Tstg -20 +55 øC
---------------------+---------------------------
Power dissipassion | Pd - 50 mW
-------------------------------------------------
DC caracteristics:
------------------
| Symbol Min. Typ. Max. Unit
---------------------------+-----------------------------
Suplly current | Icc - - 5 mA
---------------------------+-----------------------------
Input Voltage (low) | Vl 0 - 0.8 V
---------------------------+-----------------------------
Input voltage (high) | Vh 3.5 - Vcc V
---------------------------+-----------------------------
Input current R | Ih - - 100 uA
---------------------------+-----------------------------
Input current Clk | Il - - 100 uA
---------------------------+-----------------------------
Output current (Vol=0.5V) | Iol - - 10 uA
---------------------------+-----------------------------
Output current (Voh=5V) | Ioh - - 0.5 mA
---------------------------------------------------------
AC caracteristics:
------------------
| Symbol | Min. | Max. | Unit |
+----------------------+--------+------+------+------+
| Pulse duration | tr | 50 | - | us |
| R address reset | | | | |
+----------------------+--------+------+------+------+
| Pulse duration | ts | 10 | - | us |
| R write | | | | |
+----------------------+--------+------+------+------+
| High level Clk | th | 8 | - | us |
+----------------------+--------+------+------+------+
| Low level Clk | tl | 12 | - | us |
+----------------------+--------+------+------+------+
| Write window | Twrite | 10 | - | ms |
+----------------------+--------+------+------+------+
| Erase window | Terase | 10 | - | ms |
+----------------------+--------+------+------+------+
| | tv1 | 5 | - | us |
+----------------------+--------+------+------+------+
| | tv2 | 3.5 | - | us |
+----------------------+--------+------+------+------+
| | tv3 | 3.5 | - | us |
+----------------------+--------+------+------+------+
| | tv4 | 3.5 | - | us |
+----------------------+--------+------+------+------+
| | tv5 | 3.5 | - | us |
+----------------------+--------+------+------+------+
| | tv6 | 5 | - | us |
+----------------------+--------+------+------+------+
| | tv7 | 5 | - | us |
+----------------------+--------+------+------+------+
| | tv8 | 10 | - | us |
------------------------------------------------------
III) Schematics of Readers:
=======================
3.1 - Reader 1 (THIS ONE WORKS FOR CHIPY):
~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~
The following schematics is a very simple one, which will enable you to
read all kind of telecards with a chip, and also other memory cards.
A 4.7K pull-up resistor has been added for new generation telecards.
| +5V
| C=200uF; R=2.2k (or less)
Centronic / ____
Port ,/ ,--|____|--,
Presence of *----------*----||----*---------------,
the card | ,-------------+-------------, |
Pin10 (Ack) --<--------*-----| 1 | 5 |---*--,
R/W | RST +-------\ | /-------+ |
Pin4 (d2) -->--------------| 2 +----+ + 6 |------|--*-- Vcc
Clock +--------| |--------+ | |
Pin3 (d1) -->--------------| 3 +----+----+ 7 |---, | -
RAZ | RFU +-------/ | \-------+ | | | | 4.7K
Pin2 (d0) -->--------------| 4 | 8 |---|--* | |
'-------------+-------------' | | -
I/O | | |
Pin 11 (Busy) --<----------------------------------------------'--|--'
Gnd |
Pin 25 ----------------------------------------------------'
3.2 - Reader 2 (DON'T KNOW WHICH SOFTWARE WORKS WITH THIS ONE):
~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This Reader which is indeed a reader/writter will enable you to read/write
most of the more current memory cards (and notably telecards), and also smart
cards working under ISO7816 protocol (Credit cards, SIM cards, Health cards,
Videocrypt TV cards, etc ...).
+5V o
|
*-----------------,
| |
,-------------, |
+ | Vcc | + |
SUBD25 ,--|C1+ C2+|--, | K
RS 232 1æF === | | === 1æF | / Smartcard
'--|C1- M C2-|--' | / Connector
RX | A | '-----o' o----*---------------o 1
3 o---------------|TX1 X In1|----------------*---------|---------------o 7
TX | | | ,-------|---------------o 4
2 o----------, -|TX2 2 In2|- 1/3 7406 | | ,-----|---------------o 2
Gnd | | 3 | ,---, ,---, | | | ,---|---------------o 8
7 o-, '----|RX1 2 Out1|--| 1 |o-| 1 |o-* | | | ,-|---------------o 3
| | | '---' '---' | | | | | *---|>|-*-------o 6
""" -|RX2 Out2|- | | | | | | ,-|>|-' ,---o 5
| | | | | | | | | 2xD |
+5V + | | + | | | | | *-|----||---*
o-||--|CV+ Gnd CV-|--||-, | | | | | | | 100nF |
1æF '-------------' 1æF | | | | | | | | """
| | | | | | | | |
SUBD 25 """ """ | | | | | | |c
PRINTER Port | | | | | | \ | PNP
| | | | | | >|---,
D0 - (4) RFU (RAZ) | | | | | | / | ,-,
2 o----------------------------------------------|-' | | | | |e | | 10k
D1 - (3) CLK ,---, ,---, 1/3 7406 | | | | | | | |
3 o-------------------| 1 |o--| 1 |o-------------|---|-|-* | | '-'
D2 - (2) RST (W) '---' '---' | | | | | | |
4 o----------------------------------------------|---' | | | | c \ | NPN
D3 - (8) RFU (FUS) | | | | | >|----,
5 o----------------------------------------------|-----' | | | e / | ,-,
D4 - (7) I/O ,---, 1/6 7406 | | | | | | |
6 o----------------------------| 1 |o--*---------' | | | """ | |
D5 (Desativate Oscillator) '---' | 2xD ,---, | | | 10k '-'
7 o------------------------------------|----|<|-*-| 1 |o-' | | |
D6 (Vpp Command) | ,-|<|-' '---' | | |
8 o------------------------------------|--|----------------|-|--------------'
D7 | | *-|--------,
9 o------x | | | | ,-----'------,
ACK (Presence of the card) | '----------------|-|--|Oscillator F|
10o------------------------------------|-------------------' | '------------'
BUSY (Synchronous Data Output) | | |
11o------------------------------------' | """
GND | F=3.6864MHz
25o-----, |
| 100uH 1N4935 |
""" ,-@@@@@--*-----------|>|--------*----*---------* +21V
| | | | |
| '---|| BUZ11 or | | |
| ,->-|| IRF14 | | |
| |---|'--, ,-, | 1nF |
| | | 330k| | === |
| """ | | | | |
| |6 '-' | |
| ,------------------, | | +| 220æF
| 5| Vcut Ext Vfb |7 | | ===
+12V >--------*-------| MAX 643 |----*----' |
| | LB1 GND COMP | | |
| '------------------' ,-, |
| + |1 |3 |8 | |22k |
*----||----*-----*-----' '-' |
| 10æF | | |
| """ """ """
|
| ,---------,
'----*--| 7805 |--*----> +5V
| '---------' |
100nF === | === 100nF
'-------*-------'
|
"""
Component List
~~~~~~~~~~~~~~
Integratyed Circuits
--------------------
1xMAX232 (RS232<-->TTL Adapter)
1xMAX643 (12-->21V Converter Controler)
1x74LS06 (6 inverters)
1x7805 (5V regulator)
Transistors Diodes
----------- ------
1xBUZ11 or IRF14 4x1N4148 or other
1xBC107 or antoher NPN 1x1N4935 or another fast commutation diode
1xBC177 or another PNP
Condensators Resistors Misc
------------ --------- ----
3x100nF 2x10k 100uH self
1x1nF 1x330k 1xSmartcard connector
1x10æF 1x22k 1xSUBD25 Female
1x220æF 1xSUBD25 Male
4x1æF
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed