KDE PIM/KItinerary/Thalys Barcode
Appearance
< KDE PIM | KItinerary
General Observations
- always exactly 114 byte
- all binary, there are no recognizable ASCII strings in this
- there's two 14-15 byte variable lengths blocks towards the end with very high entropy, possibly some kind of signature
- based on currently only 4 samples, so there's limited confidence in this
- 0:4 - 2:1 (14 bit) is "3018", which is the UIC operator code of Thalys. This matches Appendix C of ANNEX B.6 of TAP TSI, but unfortunately only for the first 18 bit it seems. Might still mean a similar encoding is used, but in a different layout.
- correlation between samples suggests 20-26 contain departure and arrival stations in an so far unknown encoding
Bit Layout
Byte[:Bit] (MSB) | Content | Meaning | Notes |
---|---|---|---|
0:0 - 4:7 | 0x32 F2 84 20 40 | fixed in all samples | |
5:0 - 5:7 | 0x01 or 0x02 | class | |
6:0 - 8:7 | null | ||
9:0 - 35:7 | TODO | ||
36:0 - 42:7 | null | ||
43:0 - 49:7 | 0x9a 0c 28 82 c8 22 b2 | fixed in all samples | |
50:0 - 54:7 | TODO | ||
55:0 - 58:7 | 0xc0 0a 80 30 | fixed in all samples | |
59:0 - 59:7 | 0x2C or 0x2E |
After this there follow two blocks with the following variable length layout:
Byte[:Bit] (MSB) | Content | Meaning | Notes |
---|---|---|---|
0:0 - 0:7 | 0x02 | fixed | |
1:0 - 1:7 | 8bit uint | length | |
N bytes | high entropy content |
Remaining bytes are filled by null until reaching 114 bytes.