KDE PIM/KItinerary/Thalys Barcode

General Observations

• always exactly 114 byte
• all binary, there are no recognizable ASCII strings in this
• there's two 14-15 byte variable lengths blocks towards the end with very high entropy, possibly some kind of signature
• based on currently only 4 samples, so there's limited confidence in this
• 0:4 - 2:1 (14 bit) is "3018", which is the UIC operator code of Thalys. This matches Appendix C of ANNEX B.6 of TAP TSI, but unfortunately only for the first 18 bit it seems. Might still mean a similar encoding is used, but in a different layout.
• correlation between samples suggests 20-26 contain departure and arrival stations in an so far unknown encoding

Bit Layout

Byte[:Bit] (MSB)	Content	Meaning	Notes
0:0 - 4:7	0x32 F2 84 20 40		fixed in all samples
5:0 - 5:7	0x01 or 0x02	class
6:0 - 8:7	null
9:0 - 9:7	0x01		ticket/traveler count, or traveler type?
10:0 - 18:3	TODO
18:4 - 22:1	5 x 6bit	departure station	see below
22:2 - 25:7	5 x 6bit	arrival station	see below
26:1 - 35:7	TODO
36:0 - 42:7	null
43:0 - 49:7	0x9a 0c 28 82 c8 22 b2		fixed in all samples
50:0 - 55:7	TODO
56:0 - 58:7	0x0a 80 30		fixed in all samples
59:0 - 59:7	0x2C or 0x2E

After this there follow two blocks with the following variable length layout:

Byte[:Bit] (MSB)	Content	Meaning	Notes
0:0 - 0:7	0x02		fixed
1:0 - 1:7	8bit uint	length
N bytes			high entropy content

Remaining bytes are filled by null until reaching 114 bytes.

Station identifiers:

• using Benerail identifiers, which consists of 5 upper-case letters, the first two being the ISO 3166-1 alpha 2 code
• each letter is encoded as a 5 bit value that can be converted to the corresponding ASCII value by adding 32.