Revision as of 11:50, 8 February 2020

General Observations

always exactly 114 byte
all binary, there are no recognizable ASCII strings in this
there's ~40 bytes towards the end with very high entropy, possibly some kind of signature
based on currently only 4 samples, so there's limited confidence in this
0:4 - 2:1 (14 bit) is "3018", which is the UIC operator code of Thalys. This matches Appendix C of ANNEX B.6 of TAP TSI, but unfortunately only for the first 18 bit it seems. Might still mean a similar encoding is used, but in a different layout.

Byte[:Bit] (MSB)	Content	Meaning	Notes
0:0 - 4:7	0x32 F2 84 20 40		fixed in all samples
5:0 - 5:7	0x01 or 0x02	class
6:0 - 8:7	null
9:0 - 35:7	TODO
36:0 - 42:7	null
43:0 - 49:7	0x9a 0c 28 82 c8 22 b2		fixed in all samples
50:0 - 54:7	TODO
55:0 - 58:7	0xc0 0a 80 30		fixed in all samples
59:0 - 105:7	TODO
106:0 - 113:7	null

@@ Line 4: / Line 4: @@
 * all binary, there are no recognizable ASCII strings in this
 * there's ~40 bytes towards the end with very high entropy, possibly some kind of signature
-* based on currently only 3 samples, so there's limited confidence in this
+* based on currently only 4 samples, so there's limited confidence in this
 * 0:4 - 2:1 (14 bit) is "3018", which is the UIC operator code of Thalys. This matches Appendix C of ANNEX B.6 of TAP TSI, but unfortunately only for the first 18 bit it seems. Might still mean a similar encoding is used, but in a different layout.