How is this data from a magnetic card encoded? - hex

I have some information about magnetic cards that control the building access, and need to reverse engineer the way the software stores data on the cards to make something with more features. (We have lost contact with the original programmer.)
I have no idea how writing the order is done; I'm no magnetic card expert.
I know a few things:
Data is on the third track.
all readers are standalone and have batteries.
There is a master card that can add or remove some cards for a reader(currently, you need to go through all the doors to add or remove a card from the system).
Each card is different, and must have a unique identifier.
There is a expiration date, but I have no idea if it's a date format or just a number incrementing in the door readers.
There is a "flag" which gives access to special places (parking) and it isn't affected by the expiration date... weird.
I've got a reader and some software to read it. It gives me hexadecimal numbers.
As example here is a few cards I've got.
BAC716863B8CB32832BABAB40E1739BAB677563B3AF8BA3ABABABEBABABABABABAC0 (card with parking)
BDC011813CB9B4CBB53DBDB21FD2BCBDBEEA3EBDBDFFBD3DBDBDB1BDBDBDBDBDBDC0 (card with parking)
9DE031A11CA9912E951D9D9225369D1D9FCE6C9D1DDF9D1D9D9D9D9D9D9D9D9D9DC0 (normal card, no special access)
I just hope it's not secured by anything that could make this impossible to reverse-engineer.

This question comes up high on google, i experienced a similar issue and solved it.
Data on magnetic card encoded in ANSI/ISO ALPHA Data Format (on Track 1) and ANSI/ISO BCD Data Format (on Track 2 and 3). Most magnetic card readers decode this data before returning so you don't have to but some reader don't and here we are.
You can find encoding table and more information here: http://www.abacus21.com/Magnetic-Strip-Encoding-1586.html

Related

Can't get temperature reading out of ble beacon .. at my wits end now. This needs a super-hero I guess

I have a task where I need to read 2 parameters from a BLE Beacon. The documentation was seriously lacking and after a fair amount of effort, I managed to get some basic information about reading the data from the BLE Beacon.
The parameters to read are
1) Battery Voltage of the sensor
2) Temperature the beacon has a built in temperature sensor.
I think I have tried almost every popular Python BLE library out there but I just can't seem to get the temperature reading out of the beacon. "I think" I am able to read the voltage. The reason why I said "I think" is because the value seems to match what was provided in the minimal document. And also when I put the beacon into the charger, I can see the value go up - an indication that it is the voltage reading. As I could not read the temperature ( because the UUIDs that are mentioned in the document, the value doesn't seem to change ). I have tried enabling the sensor in every possible way and method described - by writing 01:00 etc. I spent a fair amount of time to reverse engineer the thing. I ran a packet sniffer and managed to capture the data that was being transferred between the beacon and the mobile app ( They have a mobile app ). But then again I am not able to figure out how the temperature readings are being communicated between the beacon and the app. Let me break the whole stuff in smaller blocks.
Hardware: BLE beacon from which voltage and temperature can be read. The temperature sensor is built into the beacon. And the beacon itself is from Texas Instruments but the temperature, voltage sensing part is done by a third party. They provided us with some minimal information and it was difficult to make sense of some of the sentences as they have trouble communicating in English.
The sequence to get the data goes like this
Scan for beacons
When the beacon is found then connect to it
Enable notification
Set notification interval
Get the voltage and temperature reading.
I have been able to do the first 4 real fast, and "half" of No. 5, i.e getting the voltage part. When I say real fast I mean I got that stuff with nearly no documentation available at that time.
As per the info that I have the data resides in these characteristics/UUIDs. Also please note that the UUID are not standard 128 bit and this caused me issues when using certain libraries. But after some tries I got to read/write to them using handles etc. The handles and other stuff I printed are ones that I read using PYGATT (A Python wrapper for gatttool).
The UUIDs are marked as 1st, 2nd, 3rd and 4th parameters and it has the following to say about the parameters
- A: 1 byte (2nd Param)
- B: Maj + Min values, 4 bytes (4th Param)
- C: 4 bytes (3rd Param)
- D: Enable/disable notification ( I have been able to turn this on )
- E: Set notification interval ( I have been able to set this and can notice the change in notification interval )
This is minimal so as to not have a large file. All it does is this - the mobile app connects to the beacon, then the notifications start and the temperate readings are retrieved by the mobile app. Like I had mentioned, I don't seem to have problem reading the voltage, it's only the temperature that I am getting stuck at. I have been at it for a week now. I think I have tried nearly everything that I could think of. I even enumerated all the writable characteristics and tried writing numbers like 1 ( enables the sensor? ). I could have offered a bounty for this straight away if it were possible. I rarely get stuck for so long with a problem. This is driving me a little crazy. I am getting close to my wits end - I guess it's time for a super hero - anyone out there? :) I can provide for every bit of information needed if someone could indicate what is wrong. I even wrote a cordova app ... and tried a bunch of stuff from my Android phone. I can connect ... write to characteristics, read stuff etc but temperature ready, nah!!! It just won't budge. All I get is the same set of values ( I used a JSON.stringify to display A, B and C). I can bother about the byte order later. I guess that is a smaller problem.
The communication between the beacon and a third party mobile app is fine, it is able to read the temperature info just fine.
I have been looking at wireshark data and I am fairly sure that the temperature data is being communicated at this stage. But then when I decode the "value", it looks like it's the voltage. It mentions l2cap but I am not sure how that is being used here to send the temperature readings ( if it is using that in the first place ).
Update: Wrote to every writable characteristics. Wrote values like 1, 0100, 2, 7 on every writable characteristics. At the same time I was reading every readable characteristic ( in a loop ) and doing a comparison (just true/false) with the previous set of values. This seemed like a quick and easier way to know if something changed. Didn't want to take chances with converting the hex to a float. I can figure out the byte order later.
From the sniffed data (wireshark) I can only see 3 writes happening on the beacon.
I am not fully sure, even after a long discussion, but it seems that the four bytes of the notification are used for the voltage as well as the temperature, since the temperature can most probably be derived from the voltage.
From the values it seems that those four bytes represent the voltage in float (if you ignore the absurd factor of 10^-38 that comes in because only 4 bytes instead of 8 bytes are used).
Since typically the temperature T is derived from a resistivity measurement, where the resistivity R is proportional to the voltage U (if the current is constant), you can in principle calculate the temperature T from the voltage U.
The problem is that T(R) is relatively linear, but not perfectly (in contrast to U(R) which is assumed to be U=RI). So you may need to plot the values for T(U) to find out the curve that they are using.
To add to the confusion, I got the best results when only using the first five bits of the third byte and the eight bits of the fourth byte. I am not aware why this is the case, and it might point to some trouble still.
The best option is to ask for their function T(U) that they are using. If they can and will provide it for you...

RFID Chess: One reader + many antennae

I'd like to read a playfield of RFID token equipped chess pieces. For cost and simplicity, I'd like to use ONE reader and many antennae.
I'm planning to purchase the following:
ArduinoMega; large enough to just let me program and debug without
optimizing for space or speed
standard 8x8 chess board; size may be determined by coil diameter (see below)
standard 16 pc chess set
16 RFID tokens of a given frequency; each with a different "value" or serial number that when glued to the bottom of the chess pieces would uniquely identify each piece to the system
64 RFID coils (initially) designed for correct frequency of RFID tokens; mounted to bottom side of playfield
1 RFID reader compatible with RFID frequency selected
some sort of multiplexor (or set of multiplexors) for the Arduino to step thru connecting all 64 of the coils for the playfield
My overall system design would be to connect the reader to each coil in turn via the multiplexor(s) and read the token found at each location of the playfield, if any. The Arduino would read the output of the RFID reader and step thru the various field positions, monitoring which chess piece was at which location.
Before I just buy all the parts and go for it, I'm wondering if anyone here has any initial advice or criteria to consider.
My specific questions are:
Would one RFID freq set be better than another?
How long should the Arduino have to "wait" at (row x col) position to read a token - if a token is even there - before trying to read the next one?
Is it better to use one big multiplexor vs many small ones tied
together? Why?
Part of this question was originally asked here: https://electronics.stackexchange.com/questions/9255/rfid-antenna-array
Moderators requested that the author start a new question instead of asking a new question in the replies of an existing question. But I can't find that they ever did. So, here we are.. :^)
Your design is completely valid. Sometime ago, i play with RFID using arduino and found that RDM xxxx, using Wiegan standard, is very hard to code. The simple and working one is MFRC-522, mifare family. For easiest use on maintenance, you should uses writeable RFID card, so if one of chess your pieces is lost, you can easily replace it.

Long Range RFiD Reading

I'm trying to set up a practical DIY method of unlocking a garage or front door by coming into the range of a reader; even if that means standing in a specific line of sight. Essentially once I reach the garage, the ID is read and raises
I'd prefer to have passive ID's, but the reader itself would be able to have a fixed power source that doesn't need to be changed.
I've done a lot of searching on google and there are RFiD scanners that read cars to open tolls booths, but those are commercial grade products and much more expensive than anything I'm trying to make. Should I continue looking into RFiD's, or is there a more efficient method of approaching this?
Also, if my tags are active, and powerful enough, would that compensate for a low frequency reader?
You'll easily achieve to read passive tags from a distance of a few meters (up to 10m) by using any industrial UHF RFID reader (Impinj, ThingMagic, Stid, ...).
Some tags are similar to labels that can be directly stuck on the windscreen of the cars. Tags are rather inexpensive.
But in that case you will need to spend a few hundreds of dollars to buy a single reader with its antenna.
That is what makes me think that any RFID based system is an option only when the number of users of the system is quite important (i.e: check the access to a company park or to a residence).
In that case, the investment of the reader is dispatched on all the users, whereas the global investment for the tags stay low.

Decode IR (RC5) steps

I have captured the IR signal ( I believe RC5) of a HVAC remote control, like this one....
(using Saleae)
This gave me a sequence of pulses of different width that I can make the Arduino reproduce and the HVAC recognize the request. An example is:
unsigned int power_ON[180] = {2888,3918,1911,1049,907,1992,903,989,1936,1023,907,1049,903,989,903,1049,903,1049,907,1992,1851,1992,1915,1049,928,963,928,1023,903,1049,907,1049,928,963,928,1023,903,1053,928,1023,928,963,928,1023,928,1027,928,1023,928,963,928,1023,907,1049,928,1023,928,1906,1941,959,2940,3866,1962,997,932,1967,929,963,1962,997,933,1019,959,933,933,1023,954,997,928,1971,1902,1941,1941,1019,958,933,958,997,954,997,933,1019,959,933,959,997,954,997,928,1023,958,933,958,997,954,997,933,1019,958,933,958,997,954,997,933,1019,958,1881,1962,937,2940,3862,1966,993,958,1941,933,959,1966,993,958,997,954,937,954,997,933,1023,954,1941,1880,1966,1962,997,954,937,928,1023,933,1023,954,997,928,963,928,1023,933,1023,929,1023,928,963,929,1023,928,1027,928,1023,928,963,928,1023,928,1027,928,1023,928,1910,1911,989,3832};
Could anyone guide me on the steps to decode the message? or understand the different pulse width?
I guess there must be certain defined pulse widths? Each meaning something different?
My initial though is that I need to:
1) Decode raw data by converting pulses to digital 1,0
2) Identify from digital data each section of the code, I think all the configuration is send on every key press, so identify the section of the code where it states the temperature, fan speed, hvac mode, clock, etc
3) Be able to put together a full IR code based on wanted setup, instead of just saving the whole code and reproducing it.
Any hint or guideline on how to do this?
Am I on the right track?
edit:
I have tried analysing one same mode and try to figure out which pulses change, but I cant figure it out as the number of pulses varies. Here you can see Cooling mode and maximum fan speed with changing temperature setting.
here is the excel file for anyone really into helping:
http://www.filedropper.com/analysiscoolingmodefanspeedmaximum
and the end of the message
So I put your pulse widths (?) into a diagram: http://i.imgur.com/C9k64qB.jpg
Without knowing more about what this actually represents, this does not really help i guess..
What buttons did you press while recording this? How did you record this?
I would try to visualize all the data you can get. Record all buttons and put what you get in diagrams. Then stare at them and maybe you will find some logic hidden in there.
Also, open the remote, look what IC's are inside and look up their datasheets. Maybe there you will find the protocol and you won't have to do any reverse engineering at all.
Keep us updated!

cheapest method to send small (24 bytes) data over long distances (600 miles)

I have a friend who is working on a project where they need to deploy a large number of devices over the midwest. For simplicity let's say these are temperature gauges - they read the current temperature and transmit that information to a server. The server would just need to know what device is reporting what temperature (412X|10c).
These devices will be in forests, near highways, in cities and swamps. All other technology is prototyped and working (ability to read the temperature, the hardware for the device) the open question they have right now is 'what is the cheapest way we can send this information to the primary server'?
I think they'll need to go with a wireless carrier (verizon/sprint/at&t) and use something similar to mobile broadband. Is there really any other option?
You could do it with ham radio and something like APRS, assuming they don't care about encryption and don't have a pecuniary interest in the project.
You wouldn't need full mobile broadband, as your data would fit in a text message. You can get cellular shields for arduino that would probably fit your needs.

Resources