KDE PIM/KItinerary/MAV Barcode

General Observation

• Uses PDF417 barcode format.
• Variable length.
• For domestic tickets only.
• No similarities with a known ERA format.

Outer Structure

• Two byte header, fixed 0x0403.
• Gzip-compressed payload using deflate compression, starting with the standard Gzip header 0x1f8b0800000000000000.
• 256 remaining bytes, high entropy and length suggest a cryptographic signature.

Payload Structure

Note: this is based on very few samples so far and thus isn't very reliable yet!

• Seems byte- rather than bit-aligned.
• String encoding is UTF-8.
• Number encoding seems big endian.
• Variable length, observed between 217 and 274 bytes.
• Content has a high amount of null bytes.

Layout

Offset	Size	Data Type	Meaning	Notes
0	17	string	ticket number	printed as "CIV" on the PDF, numeric
17	22	?	?
39	45	string	passenger name	null terminated
84	4	uint32	passenger birth date	year * 10000 + month * 100 + day
88	128	?	?
216	17	?	?	bytes 216 and following are only present on tickets with seat reservations
233	5	string	train number	null-terminated
238	2	?	coach number?	numeric or string encoding, too few samples to be sure
240	6	numeric	seat number?	too few samples to be sure
246	28	null	?	null bytes in all samples