Revision as of 16:18, 14 February 2020

General Observations

always exactly 114 byte
all binary, there are no recognizable ASCII strings in this
there's two 14-15 byte variable lengths blocks towards the end with very high entropy, possibly some kind of signature
based on currently only 4 samples, so there's limited confidence in this
0:4 - 2:1 (14 bit) is "3018", which is the UIC operator code of Thalys. This matches Appendix C of ANNEX B.6 of TAP TSI, but unfortunately only for the first 18 bit it seems. Might still mean a similar encoding is used, but in a different layout.

Byte[:Bit] (MSB)	Content	Meaning	Notes
0:0 - 4:7	0x32 F2 84 20 40		fixed in all samples
5:0 - 5:7	0x01 or 0x02	class
6:0 - 9:5	null
9:6 - 16:3	9 x 6bit string	ticket number
16:4 - 18:3	TODO
18:4 - 22:1	5 x 6bit string	departure station	see below
22:2 - 25:7	5 x 6bit string	arrival station	see below
26:1 - 35:7	TODO
36:0 - 42:7	null
43:0 - 49:7	0x9a 0c 28 82 c8 22 b2		fixed in all samples
50:0 - 55:7	TODO
56:0 - 58:7	0x0a 80 30		fixed in all samples
59:0 - 59:7	0x2C or 0x2E

After this there follow two blocks with the following variable length layout:

Byte[:Bit] (MSB)	Content	Meaning	Notes
0:0 - 0:7	0x02		fixed
1:0 - 1:7	8bit uint	length
N bytes			high entropy content

Remaining bytes are filled by null until reaching 114 bytes.

Strings:

Station identifiers:

using Benerail identifiers, which consists of 5 upper-case letters, the first two being the ISO 3166-1 alpha 2 code
very similar to SNCF identifiers, but there are slight differences e.g. for Amsterdam Central (NLASC vs NLAMA).

@@ Line 16: / Line 16: @@
 | 5:0 - 5:7 || 0x01 or 0x02 || class ||
 |-
-| 6:0 - 8:7 || null || ||
+| 6:0 - 9:5 || null || ||
 |-
-| 9:0 - 9:7 || 0x01 || || ticket/traveler count, or traveler type?
+| 9:6 - 16:3 || 9 x 6bit string || ticket number ||
 |-
-| 10:0 - 18:3 || TODO || ||
+| 16:4 - 18:3 || TODO || ||
 |-
-| 18:4 - 22:1 || 5 x 6bit || departure station || see below
+| 18:4 - 22:1 || 5 x 6bit string || departure station || see below
 |-
-| 22:2 - 25:7 || 5 x 6bit || arrival station || see below
+| 22:2 - 25:7 || 5 x 6bit string || arrival station || see below
 |-
 | 26:1 - 35:7 || TODO || ||
@@ Line 54: / Line 54: @@
 Remaining bytes are filled by null until reaching 114 bytes.
+Strings:
+* encoded as 6bit per character
+* a character can be converted to the corresponding ASCII value by adding 32
 Station identifiers:
 * using Benerail identifiers, which consists of 5 upper-case letters, the first two being the ISO 3166-1 alpha 2 code
-* each letter is encoded as a 5 bit value that can be converted to the corresponding ASCII value by adding 32.
+* very similar to SNCF identifiers, but there are slight differences e.g. for Amsterdam Central (NLASC vs NLAMA).