metroflip_scene_charliecard.c 55 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287
  1. /*
  2. * Parser for MBTA CharlieCard (Boston, MA, USA).
  3. *
  4. * Copyright 2024 Zachary Weiss <me@zachary.ws>
  5. *
  6. * Public security research on the MBTA's fare system stretches back to 2008,
  7. * starting with Russel Ryan, Zack Anderson, and Alessandro Chiesa's
  8. * "Anatomy of a Subway Hack", for which they were famously issued a gag order.
  9. * A thorough history of research & researchers deserving of credit is
  10. * detailed by @bobbyrsec in his 2022 blog post (& presentation):
  11. * "Operation Charlie: Hacking the MBTA CharlieCard from 2008 to Present"
  12. * https://medium.com/@bobbyrsec/operation-charlie-hacking-the-mbta-charliecard-from-2008-to-present-24ea9f0aaa38
  13. *
  14. * Fare gate IDs, card types, and general assistance courtesy of the
  15. * minds behind DEFCON 31's "Boston Infinite Money Glitch" presentation:
  16. * — Matthew Harris; mattyharris.net <matty@mattyharris.net>
  17. * — Zachary Bertocchi; zackbertocchi.com <zach@zachbertocci.com>
  18. * — Scott Campbell; josephscottcampbell.com <scott@josephscottcampbell.com>
  19. * — Noah Gibson; <noahgibson06@proton.me>
  20. * Talk available at: https://www.youtube.com/watch?v=1JT_lTfK69Q
  21. *
  22. * TODOs:
  23. * — Reverse engineer passes (sectors 4 & 5?), impl.
  24. * — Infer transaction flag meanings
  25. * — Infer remaining unknown bytes in the balance sectors (2 & 3)
  26. * — Improve string output formatting, esp. of transaction log
  27. * — Mapping of buses to garages, and subsequently, route subsets via
  28. * http://roster.transithistory.org/ data
  29. * — Mapping of stations to lines
  30. * — Add'l data fields for side of station fare gates are on? Some stations
  31. * separate inbound & outbound sides, so direction could be inferred
  32. * from gates used.
  33. * — Continually gather data on fare gate ID mappings, update as collected;
  34. * check locations this might be scrapable / inferrable from:
  35. * [X] MBTA GTFS spec (https://www.mbta.com/developers/gtfs) features & IDs
  36. * seem too-coarse-grained & uncorrelated
  37. * [X] MBTA ArcGIS (https://mbta-massdot.opendata.arcgis.com/) & Tableau
  38. * (https://public.tableau.com/app/profile/mbta.office.of.performance.management.and.innovation/vizzes)
  39. * files don't seem to have anything of that resolution (only down to ridership by station)
  40. * [X] (skim of) MBTA public GitHub (https://github.com/mbta) repos make no reference to fare-gate-level data
  41. * [X] (skim of) MBTA public engineering docs (https://www.mbta.com/engineering) unfruitful;
  42. * Closest mention spotted is 2014 "Ridership and Service Statistics"
  43. * (https://cdn.mbta.com/sites/default/files/fmcb-meeting-docs/reports-policies/2014-07-mbta-bluebook-ed14.pdf)
  44. * where on pg.40, "Equipment at Stations" is enumerated, and fare gates counts are given,
  45. * listed as "AFC Gates" (presumably standing for "Automated Fare Collection")
  46. * [X] Josiah Zachery criminal trial public evidence — convicted partially on
  47. * data on his CharlieCard, appeals partially on basis of legality of this search.
  48. * Prev. court case (gag order mentioned in preamble) leaked some data in the files
  49. * entered into evidence. Seemingly did not happen here; fare gate IDs unmentioned,
  50. * only ever the nature of stored/saved data and methods of retrieval.
  51. * Appelate case dockets 2019-P-0401, SJC-12952, SJ-2017-0390
  52. * (https://www.ma-appellatecourts.org/party)
  53. * Trial court indictment 04/02/2015, Case# 1584CR10265 @Suffolk County Criminal Superior Court
  54. * (https://www.masscourts.org/eservices/home.page.16)
  55. * [ ] FOIA / public records request?
  56. * (https://massachusettsdot.mycusthelp.com/WEBAPP/_rs/(S(tbcygdlm0oojy35p1wv0y2y5))/supporthome.aspx)
  57. * [X] MBTA data blog? (https://www.massdottracker.com/datablog/)
  58. * [ ] MassDOT developers Google group? (https://groups.google.com/g/massdotdevelopers)
  59. * [X] preexisting posts
  60. * [ ] ask directly?
  61. * [ ] Other?
  62. *
  63. * This program is free software: you can redistribute it and/or modify it
  64. * under the terms of the GNU General Public License as published by
  65. * the Free Software Foundation, either version 3 of the License, or
  66. * (at your option) any later version.
  67. *
  68. * This program is distributed in the hope that it will be useful, but
  69. * WITHOUT ANY WARRANTY; without even the implied warranty of
  70. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  71. * General Public License for more details.
  72. *
  73. * You should have received a copy of the GNU General Public License
  74. * along with this program. If not, see <http://www.gnu.org/licenses/>.
  75. */
  76. #include <flipper_application.h>
  77. #include "../metroflip_i.h"
  78. #include <nfc/protocols/mf_classic/mf_classic_poller_sync.h>
  79. #include <nfc/protocols/mf_classic/mf_classic.h>
  80. #include <nfc/protocols/mf_classic/mf_classic_poller.h>
  81. #include <dolphin/dolphin.h>
  82. #include <bit_lib.h>
  83. #include <datetime.h>
  84. #include <furi_hal.h>
  85. #include <locale/locale.h>
  86. #include <nfc/nfc.h>
  87. #include <nfc/nfc_device.h>
  88. #include <nfc/nfc_listener.h>
  89. #define TAG "Metroflip:Scene:CharlieCard"
  90. // starts Wednesday 2003/1/1 @ midnight
  91. #define CHARLIE_EPOCH \
  92. (DateTime) { \
  93. 0, 0, 0, 1, 1, 2003, 4 \
  94. }
  95. // timestep is one minute
  96. #define CHARLIE_TIME_DELTA_SECS 60
  97. #define CHARLIE_END_VALID_DELTA_SECS 60 * 8
  98. #define CHARLIE_N_TRANSACTION_HISTORY 10
  99. #define CHARLIE_N_PASSES 4
  100. // always from the same set of keys (cf. default keys dict for list w/o multiplicity)
  101. // we only care about the data in the first half of the sectors
  102. // second half sectors keys seemingly change position sometimes across cards?
  103. // no data stored there, but might want to impl some custom read function
  104. // accounting for this such that reading is faster (else it seems to fall back on dict
  105. // approach for remaining keys)...
  106. typedef struct {
  107. uint16_t dollars;
  108. uint8_t cents;
  109. } Money;
  110. #define FARE_BUS \
  111. (Money) { \
  112. 1, 70 \
  113. }
  114. #define FARE_SUB \
  115. (Money) { \
  116. 2, 40 \
  117. }
  118. typedef struct {
  119. DateTime date;
  120. uint16_t gate;
  121. uint8_t g_flag;
  122. Money fare;
  123. uint16_t f_flag;
  124. } Transaction;
  125. typedef struct {
  126. bool valid;
  127. uint16_t pre;
  128. uint16_t post;
  129. DateTime date;
  130. } Pass;
  131. typedef struct {
  132. uint16_t n_uses;
  133. uint8_t active_balance_sector;
  134. } CounterSector;
  135. typedef struct {
  136. Money balance;
  137. uint16_t type;
  138. DateTime issued;
  139. DateTime end_validity;
  140. } BalanceSector;
  141. // IdMapping approach borrowed from Jeremy Cooper's 'clipper.c'
  142. typedef struct {
  143. uint16_t id;
  144. const char* name;
  145. } IdMapping;
  146. // this should be a complete accounting of types, (1 and 7 day pass types maybe missing?)
  147. static const IdMapping charliecard_types[] = {
  148. // Regular card types
  149. {.id = 367, .name = "Adult"},
  150. {.id = 366, .name = "SV Adult"},
  151. {.id = 418, .name = "Student"},
  152. {.id = 419, .name = "Senior"},
  153. {.id = 420, .name = "TAP"},
  154. {.id = 417, .name = "Blind"},
  155. {.id = 426, .name = "Child"},
  156. {.id = 410, .name = "Employee ID Without Passback"},
  157. {.id = 414, .name = "Employee ID With Passback"},
  158. {.id = 415, .name = "Retiree"},
  159. {.id = 416, .name = "Police/Fire"},
  160. // Passes
  161. {.id = 135, .name = "30 Day Local Bus Pass"},
  162. {.id = 136, .name = "30 Day Inner Express Bus Pass"},
  163. {.id = 137, .name = "30 Day Outer Express Bus Pass"},
  164. {.id = 138, .name = "30 Day LinkPass"},
  165. {.id = 139, .name = "30 Day Senior LinkPass"},
  166. {.id = 148, .name = "30 Day TAP LinkPass"},
  167. {.id = 150, .name = "Monthly Student LinkPass"},
  168. {.id = 424, .name = "Monthly TAP LinkPass"},
  169. {.id = 425, .name = "Monthly Senior LinkPass"},
  170. {.id = 421, .name = "Senior TAP/Permit"},
  171. {.id = 422, .name = "Senior TAP/Permit 30 Days"},
  172. // Commuter rail passes
  173. {.id = 166, .name = "30 Day Commuter Rail Zone 1A Pass"},
  174. {.id = 167, .name = "30 Day Commuter Rail Zone 1 Pass"},
  175. {.id = 168, .name = "30 Day Commuter Rail Zone 2 Pass"},
  176. {.id = 169, .name = "30 Day Commuter Rail Zone 3 Pass"},
  177. {.id = 170, .name = "30 Day Commuter Rail Zone 4 Pass"},
  178. {.id = 171, .name = "30 Day Commuter Rail Zone 5 Pass"},
  179. {.id = 172, .name = "30 Day Commuter Rail Zone 6 Pass"},
  180. {.id = 173, .name = "30 Day Commuter Rail Zone 7 Pass"},
  181. {.id = 174, .name = "30 Day Commuter Rail Zone 8 Pass"},
  182. {.id = 175, .name = "30 Day Interzone 1 Pass"},
  183. {.id = 176, .name = "30 Day Interzone 2 Pass"},
  184. {.id = 177, .name = "30 Day Interzone 3 Pass"},
  185. {.id = 178, .name = "30 Day Interzone 4 Pass"},
  186. {.id = 179, .name = "30 Day Interzone 5 Pass"},
  187. {.id = 180, .name = "30 Day Interzone 6 Pass"},
  188. {.id = 181, .name = "30 Day Interzone 7 Pass"},
  189. {.id = 182, .name = "30 Day Interzone 8 Pass"},
  190. {.id = 140, .name = "One Way Interzone Adult 1 Zone"},
  191. {.id = 141, .name = "One Way Interzone Adult 2 Zones"},
  192. {.id = 142, .name = "One Way Interzone Adult 3 Zones"},
  193. {.id = 143, .name = "One Way Interzone Adult 4 Zones"},
  194. {.id = 144, .name = "One Way Interzone Adult 5 Zones"},
  195. {.id = 145, .name = "One Way Interzone Adult 6 Zones"},
  196. {.id = 146, .name = "One Way Interzone Adult 7 Zones"},
  197. {.id = 147, .name = "One Way Interzone Adult 8 Zones"},
  198. {.id = 428, .name = "One Way Half Fare Zone 1"},
  199. {.id = 429, .name = "One Way Half Fare Zone 2"},
  200. {.id = 430, .name = "One Way Half Fare Zone 3"},
  201. {.id = 431, .name = "One Way Half Fare Zone 4"},
  202. {.id = 432, .name = "One Way Half Fare Zone 5"},
  203. {.id = 433, .name = "One Way Half Fare Zone 6"},
  204. {.id = 434, .name = "One Way Half Fare Zone 7"},
  205. {.id = 435, .name = "One Way Half Fare Zone 8"},
  206. {.id = 436, .name = "One Way Interzone Half Fare 1 Zone"},
  207. {.id = 437, .name = "One Way Interzone Half Fare 2 Zones"},
  208. {.id = 438, .name = "One Way Interzone Half Fare 3 Zones"},
  209. {.id = 439, .name = "One Way Interzone Half Fare 4 Zones"},
  210. {.id = 440, .name = "One Way Interzone Half Fare 5 Zones"},
  211. {.id = 441, .name = "One Way Interzone Half Fare 6 Zones"},
  212. {.id = 442, .name = "One Way Interzone Half Fare 7 Zones"},
  213. {.id = 443, .name = "One Way Interzone Half Fare 8 Zones"},
  214. {.id = 509, .name = "Group Interzone 1 Zones"},
  215. {.id = 510, .name = "Group Interzone 2 Zones"},
  216. {.id = 511, .name = "Group Interzone 3 Zones"},
  217. {.id = 512, .name = "Group Interzone 4 Zones"},
  218. {.id = 513, .name = "Group Interzone 5 Zones"},
  219. {.id = 514, .name = "Group Interzone 6 Zones"},
  220. {.id = 515, .name = "Group Interzone 7 Zones"},
  221. {.id = 516, .name = "Group Interzone 8 Zones"},
  222. {.id = 952, .name = "Zone 1 Student Monthly Pass"},
  223. {.id = 953, .name = "Zone 2 Student Monthly Pass"},
  224. {.id = 954, .name = "Zone 3 Student Monthly Pass"},
  225. {.id = 955, .name = "Zone 4 Student Monthly Pass"},
  226. {.id = 956, .name = "Zone 5 Student Monthly Pass"},
  227. {.id = 957, .name = "Zone 6 Student Monthly Pass"},
  228. {.id = 958, .name = "Zone 7 Student Monthly Pass"},
  229. {.id = 959, .name = "Zone 8 Student Monthly Pass"},
  230. {.id = 960, .name = "Zone 9 Student Monthly Pass"},
  231. {.id = 961, .name = "Zone 10 Student Monthly Pass"},
  232. {.id = 963, .name = "Interzone 1 Zone Student Monthly Pass"},
  233. {.id = 964, .name = "Interzone 2 Zone Student Monthly Pass"},
  234. {.id = 965, .name = "Interzone 3 Zone Student Monthly Pass"},
  235. {.id = 966, .name = "Interzone 4 Zone Student Monthly Pass"},
  236. {.id = 967, .name = "Interzone 5 Zone Student Monthly Pass"},
  237. {.id = 968, .name = "Interzone 6 Zone Student Monthly Pass"},
  238. {.id = 969, .name = "Interzone 7 Zone Student Monthly Pass"},
  239. {.id = 970, .name = "Interzone 8 Zone Student Monthly Pass"},
  240. {.id = 971, .name = "Interzone 9 Zone Student Monthly Pass"},
  241. {.id = 972, .name = "Interzone 10 Zone Student Monthly Pass"},
  242. };
  243. static const size_t kNumTypes = COUNT_OF(charliecard_types);
  244. // Incomplete, and subject to change
  245. // Only covers Orange & Blue line stations
  246. // Gathered manually, and provided courtesy of, DEFCON31 researchers
  247. // as cited above.
  248. static const IdMapping charliecard_fare_gate_ids[] = {
  249. // Davis
  250. {.id = 6766, .name = "Davis"},
  251. {.id = 6767, .name = "Davis"},
  252. {.id = 6768, .name = "Davis"},
  253. {.id = 6769, .name = "Davis"},
  254. {.id = 6770, .name = "Davis"},
  255. {.id = 6771, .name = "Davis"},
  256. {.id = 6772, .name = "Davis"},
  257. {.id = 2167, .name = "Davis"},
  258. {.id = 7020, .name = "Davis"},
  259. // Porter
  260. {.id = 6781, .name = "Porter"},
  261. {.id = 6780, .name = "Porter"},
  262. {.id = 6779, .name = "Porter"},
  263. {.id = 6778, .name = "Porter"},
  264. {.id = 6777, .name = "Porter"},
  265. {.id = 6776, .name = "Porter"},
  266. {.id = 6775, .name = "Porter"},
  267. {.id = 2168, .name = "Porter"},
  268. {.id = 7021, .name = "Porter"},
  269. {.id = 6782, .name = "Porter"},
  270. // Oak Grove
  271. {.id = 6640, .name = "Oak Grove"},
  272. {.id = 6641, .name = "Oak Grove"},
  273. {.id = 6639, .name = "Oak Grove"},
  274. {.id = 2036, .name = "Oak Grove"},
  275. {.id = 6642, .name = "Oak Grove"},
  276. {.id = 6979, .name = "Oak Grove"},
  277. // Downtown Crossing
  278. {.id = 2091, .name = "Downtown Crossing"},
  279. {.id = 6995, .name = "Downtown Crossing"},
  280. {.id = 6699, .name = "Downtown Crossing"},
  281. {.id = 6700, .name = "Downtown Crossing"},
  282. {.id = 1926, .name = "Downtown Crossing"},
  283. {.id = 2084, .name = "Downtown Crossing"},
  284. {.id = 6994, .name = "Downtown Crossing"},
  285. {.id = 6695, .name = "Downtown Crossing"},
  286. {.id = 6694, .name = "Downtown Crossing"},
  287. {.id = 6696, .name = "Downtown Crossing"},
  288. {.id = 2336, .name = "Downtown Crossing"},
  289. {.id = 1056, .name = "Downtown Crossing"},
  290. {.id = 6814, .name = "Downtown Crossing"},
  291. {.id = 6813, .name = "Downtown Crossing"},
  292. {.id = 2212, .name = "Downtown Crossing"},
  293. {.id = 7038, .name = "Downtown Crossing"},
  294. // State
  295. {.id = 7092, .name = "State"},
  296. {.id = 1844, .name = "State"},
  297. {.id = 6689, .name = "State"},
  298. {.id = 6988, .name = "State"},
  299. {.id = 6991, .name = "State"},
  300. {.id = 2083, .name = "State"},
  301. {.id = 6688, .name = "State"},
  302. {.id = 6687, .name = "State"},
  303. {.id = 6686, .name = "State"},
  304. {.id = 2078, .name = "State"},
  305. {.id = 6987, .name = "State"},
  306. {.id = 7090, .name = "State"},
  307. {.id = 1842, .name = "State"},
  308. // Haymarket
  309. {.id = 6684, .name = "Haymarket"},
  310. {.id = 6683, .name = "Haymarket"},
  311. {.id = 6682, .name = "Haymarket"},
  312. {.id = 6681, .name = "Haymarket"},
  313. {.id = 2073, .name = "Haymarket"},
  314. {.id = 7074, .name = "Haymarket"},
  315. {.id = 6883, .name = "Haymarket"},
  316. {.id = 6884, .name = "Haymarket"},
  317. {.id = 6885, .name = "Haymarket"},
  318. {.id = 6886, .name = "Haymarket"},
  319. {.id = 2303, .name = "Haymarket"},
  320. {.id = 6986, .name = "Haymarket"},
  321. // North Station
  322. {.id = 6985, .name = "North Station"},
  323. {.id = 2063, .name = "North Station"},
  324. {.id = 6671, .name = "North Station"},
  325. {.id = 6672, .name = "North Station"},
  326. {.id = 6673, .name = "North Station"},
  327. {.id = 6674, .name = "North Station"},
  328. {.id = 6675, .name = "North Station"},
  329. {.id = 6676, .name = "North Station"},
  330. {.id = 6677, .name = "North Station"},
  331. {.id = 6678, .name = "North Station"},
  332. {.id = 6984, .name = "North Station"},
  333. {.id = 2062, .name = "North Station"},
  334. {.id = 6668, .name = "North Station"},
  335. {.id = 6667, .name = "North Station"},
  336. {.id = 6666, .name = "North Station"},
  337. {.id = 6665, .name = "North Station"},
  338. {.id = 6664, .name = "North Station"},
  339. // Sullivan Square
  340. {.id = 6654, .name = "Sullivan Square"},
  341. {.id = 6655, .name = "Sullivan Square"},
  342. {.id = 6656, .name = "Sullivan Square"},
  343. {.id = 6657, .name = "Sullivan Square"},
  344. {.id = 6658, .name = "Sullivan Square"},
  345. {.id = 6659, .name = "Sullivan Square"},
  346. {.id = 2053, .name = "Sullivan Square"},
  347. {.id = 6982, .name = "Sullivan Square"},
  348. // Community College
  349. {.id = 6661, .name = "Community College"},
  350. {.id = 6662, .name = "Community College"},
  351. {.id = 2056, .name = "Community College"},
  352. {.id = 6983, .name = "Community College"},
  353. // Assembly
  354. {.id = 3876, .name = "Assembly"},
  355. {.id = 3875, .name = "Assembly"},
  356. {.id = 6957, .name = "Assembly"},
  357. {.id = 6956, .name = "Assembly"},
  358. {.id = 6955, .name = "Assembly"},
  359. {.id = 6954, .name = "Assembly"},
  360. {.id = 6953, .name = "Assembly"},
  361. {.id = 7101, .name = "Assembly"},
  362. {.id = 3873, .name = "Assembly"},
  363. {.id = 3872, .name = "Assembly"},
  364. // Wellington
  365. {.id = 6981, .name = "Wellington"},
  366. {.id = 2042, .name = "Wellington"},
  367. {.id = 6650, .name = "Wellington"},
  368. {.id = 6651, .name = "Wellington"},
  369. {.id = 6652, .name = "Wellington"},
  370. {.id = 6653, .name = "Wellington"},
  371. // Malden
  372. {.id = 6980, .name = "Malden Center"},
  373. {.id = 2037, .name = "Malden Center"},
  374. {.id = 6645, .name = "Malden Center"},
  375. {.id = 6646, .name = "Malden Center"},
  376. {.id = 6647, .name = "Malden Center"},
  377. {.id = 6648, .name = "Malden Center"},
  378. // Chinatown
  379. {.id = 6704, .name = "Chinatown"},
  380. {.id = 6705, .name = "Chinatown"},
  381. {.id = 2099, .name = "Chinatown"},
  382. {.id = 7003, .name = "Chinatown"},
  383. {.id = 7002, .name = "Chinatown"},
  384. {.id = 2096, .name = "Chinatown"},
  385. {.id = 6702, .name = "Chinatown"},
  386. {.id = 6701, .name = "Chinatown"},
  387. // Tufts Medical Center
  388. {.id = 6707, .name = "Tufts Medical Center"},
  389. {.id = 6708, .name = "Tufts Medical Center"},
  390. {.id = 6709, .name = "Tufts Medical Center"},
  391. {.id = 6710, .name = "Tufts Medical Center"},
  392. {.id = 6711, .name = "Tufts Medical Center"},
  393. {.id = 2105, .name = "Tufts Medical Center"},
  394. {.id = 7004, .name = "Tufts Medical Center"},
  395. {.id = 1941, .name = "Tufts Medical Center"},
  396. {.id = 7006, .name = "Tufts Medical Center"},
  397. // Back Bay
  398. {.id = 7007, .name = "Back Bay"},
  399. {.id = 1480, .name = "Back Bay"},
  400. {.id = 6714, .name = "Back Bay"},
  401. {.id = 6715, .name = "Back Bay"},
  402. {.id = 6716, .name = "Back Bay"},
  403. {.id = 6717, .name = "Back Bay"},
  404. {.id = 6718, .name = "Back Bay"},
  405. {.id = 6719, .name = "Back Bay"},
  406. {.id = 6720, .name = "Back Bay"},
  407. {.id = 1801, .name = "Back Bay"},
  408. {.id = 7009, .name = "Back Bay"},
  409. // Massachusetts Avenue
  410. {.id = 7010, .name = "Massachusetts Avenue"},
  411. {.id = 2118, .name = "Massachusetts Avenue"},
  412. {.id = 6724, .name = "Massachusetts Avenue"},
  413. {.id = 6723, .name = "Massachusetts Avenue"},
  414. {.id = 6722, .name = "Massachusetts Avenue"},
  415. {.id = 6721, .name = "Massachusetts Avenue"},
  416. // Ruggles
  417. {.id = 6726, .name = "Ruggles"},
  418. {.id = 6727, .name = "Ruggles"},
  419. {.id = 6728, .name = "Ruggles"},
  420. {.id = 2122, .name = "Ruggles"},
  421. {.id = 2123, .name = "Ruggles"},
  422. {.id = 2124, .name = "Ruggles"},
  423. {.id = 1804, .name = "Ruggles"},
  424. // Roxbury Crossing
  425. {.id = 6737, .name = "Roxbury Crossing"},
  426. {.id = 6736, .name = "Roxbury Crossing"},
  427. {.id = 6735, .name = "Roxbury Crossing"},
  428. {.id = 6734, .name = "Roxbury Crossing"},
  429. {.id = 6733, .name = "Roxbury Crossing"},
  430. {.id = 2125, .name = "Roxbury Crossing"},
  431. {.id = 7012, .name = "Roxbury Crossing"},
  432. // Jackson Square
  433. {.id = 6741, .name = "Jackson Square"},
  434. {.id = 6740, .name = "Jackson Square"},
  435. {.id = 6739, .name = "Jackson Square"},
  436. {.id = 2131, .name = "Jackson Square"},
  437. {.id = 7013, .name = "Jackson Square"},
  438. {.id = 7014, .name = "Jackson Square"},
  439. {.id = 2135, .name = "Jackson Square"},
  440. {.id = 6743, .name = "Jackson Square"},
  441. {.id = 6744, .name = "Jackson Square"},
  442. {.id = 6745, .name = "Jackson Square"},
  443. // Green Street
  444. {.id = 6746, .name = "Green Street"},
  445. {.id = 6747, .name = "Green Street"},
  446. {.id = 6748, .name = "Green Street"},
  447. {.id = 2142, .name = "Green Street"},
  448. {.id = 7015, .name = "Green Street"},
  449. // Forest Hills
  450. {.id = 6750, .name = "Forest Hills"},
  451. {.id = 6751, .name = "Forest Hills"},
  452. {.id = 6752, .name = "Forest Hills"},
  453. {.id = 6753, .name = "Forest Hills"},
  454. {.id = 6754, .name = "Forest Hills"},
  455. {.id = 6755, .name = "Forest Hills"},
  456. {.id = 2150, .name = "Forest Hills"},
  457. {.id = 7016, .name = "Forest Hills"},
  458. {.id = 6950, .name = "Forest Hills"},
  459. {.id = 6951, .name = "Forest Hills"},
  460. {.id = 604, .name = "Forest Hills"},
  461. {.id = 7096, .name = "Forest Hills"},
  462. // South Station
  463. {.id = 7039, .name = "South Station"},
  464. {.id = 2215, .name = "South Station"},
  465. {.id = 6816, .name = "South Station"},
  466. {.id = 6817, .name = "South Station"},
  467. {.id = 6818, .name = "South Station"},
  468. {.id = 6819, .name = "South Station"},
  469. {.id = 6820, .name = "South Station"},
  470. {.id = 6821, .name = "South Station"},
  471. {.id = 6822, .name = "South Station"},
  472. {.id = 6823, .name = "South Station"},
  473. {.id = 7040, .name = "South Station"},
  474. {.id = 2228, .name = "South Station"},
  475. {.id = 6827, .name = "South Station"},
  476. {.id = 6826, .name = "South Station"},
  477. {.id = 6825, .name = "South Station"},
  478. {.id = 6824, .name = "South Station"},
  479. // Courthouse
  480. {.id = 6929, .name = "Courthouse"},
  481. {.id = 2357, .name = "Courthouse"},
  482. {.id = 7079, .name = "Courthouse"},
  483. {.id = 6933, .name = "Courthouse"},
  484. {.id = 6932, .name = "Courthouse"},
  485. {.id = 2358, .name = "Courthouse"},
  486. {.id = 6792, .name = "Courthouse"},
  487. // Bowdoin
  488. {.id = 6937, .name = "Bowdoin"},
  489. {.id = 2367, .name = "Bowdoin"},
  490. {.id = 7085, .name = "Bowdoin"},
  491. // Government Center
  492. {.id = 6963, .name = "Government Center"},
  493. {.id = 6962, .name = "Government Center"},
  494. {.id = 6961, .name = "Government Center"},
  495. {.id = 6960, .name = "Government Center"},
  496. {.id = 6959, .name = "Government Center"},
  497. {.id = 6958, .name = "Government Center"},
  498. {.id = 5298, .name = "Government Center"},
  499. // Aquarium
  500. {.id = 6609, .name = "Aquarium"},
  501. {.id = 6608, .name = "Aquarium"},
  502. {.id = 1877, .name = "Aquarium"},
  503. {.id = 6965, .name = "Aquarium"},
  504. {.id = 6610, .name = "Aquarium"},
  505. {.id = 1880, .name = "Aquarium"},
  506. {.id = 1871, .name = "Aquarium"},
  507. {.id = 6966, .name = "Aquarium"},
  508. // Maverick
  509. {.id = 7088, .name = "Maverick"},
  510. {.id = 6944, .name = "Maverick"},
  511. {.id = 4384, .name = "Maverick"},
  512. {.id = 6946, .name = "Maverick"},
  513. {.id = 6947, .name = "Maverick"},
  514. {.id = 6948, .name = "Maverick"},
  515. {.id = 6949, .name = "Maverick"},
  516. {.id = 1840, .name = "Maverick"},
  517. {.id = 7083, .name = "Maverick"},
  518. // Airport
  519. {.id = 6613, .name = "Airport"},
  520. {.id = 6612, .name = "Airport"},
  521. {.id = 6611, .name = "Airport"},
  522. {.id = 6968, .name = "Airport"},
  523. {.id = 2009, .name = "Airport"},
  524. {.id = 6616, .name = "Airport"},
  525. {.id = 6615, .name = "Airport"},
  526. {.id = 6614, .name = "Airport"},
  527. {.id = 6970, .name = "Airport"},
  528. {.id = 1847, .name = "Airport"},
  529. // Wood Island
  530. {.id = 6618, .name = "Wood Island"},
  531. {.id = 6619, .name = "Wood Island"},
  532. {.id = 2010, .name = "Wood Island"},
  533. {.id = 6971, .name = "Wood Island"},
  534. // Orient Heights
  535. {.id = 6621, .name = "Orient Heights"},
  536. {.id = 6622, .name = "Orient Heights"},
  537. {.id = 6623, .name = "Orient Heights"},
  538. {.id = 2014, .name = "Orient Heights"},
  539. {.id = 6972, .name = "Orient Heights"},
  540. {.id = 6974, .name = "Orient Heights"},
  541. {.id = 1868, .name = "Orient Heights"},
  542. // Suffolk Downs
  543. {.id = 6625, .name = "Suffolk Downs"},
  544. {.id = 6626, .name = "Suffolk Downs"},
  545. {.id = 2017, .name = "Suffolk Downs"},
  546. {.id = 6975, .name = "Suffolk Downs"},
  547. // Beachmont
  548. {.id = 6628, .name = "Beachmont"},
  549. {.id = 6629, .name = "Beachmont"},
  550. {.id = 6630, .name = "Beachmont"},
  551. {.id = 2021, .name = "Beachmont"},
  552. {.id = 6976, .name = "Beachmont"},
  553. // Revere Beach
  554. {.id = 6632, .name = "Revere Beach"},
  555. {.id = 6633, .name = "Revere Beach"},
  556. {.id = 2024, .name = "Revere Beach"},
  557. {.id = 6977, .name = "Revere Beach"},
  558. // Wonderland
  559. {.id = 6638, .name = "Wonderland"},
  560. {.id = 6637, .name = "Wonderland"},
  561. {.id = 6636, .name = "Wonderland"},
  562. {.id = 2025, .name = "Wonderland"},
  563. {.id = 6978, .name = "Wonderland"},
  564. };
  565. static const size_t kNumFareGateIds = COUNT_OF(charliecard_fare_gate_ids);
  566. // **********************************************************
  567. // ********************* MISC HELPERS ***********************
  568. // **********************************************************
  569. static const uint8_t*
  570. pos_to_ptr(const MfClassicData* data, uint8_t sector_num, uint8_t block_num, uint8_t byte_num) {
  571. // returns pointer to specified sector/block/byte of MFClassic card data
  572. uint8_t block_offset = mf_classic_get_first_block_num_of_sector(sector_num);
  573. return &data->block[block_offset + block_num].data[byte_num];
  574. }
  575. static uint64_t pos_to_num(
  576. const MfClassicData* data,
  577. uint8_t sector_num,
  578. uint8_t block_num,
  579. uint8_t byte_num,
  580. uint8_t byte_len) {
  581. // returns numeric values at specified card location, for given byte length.
  582. // assumes big endian.
  583. return bit_lib_bytes_to_num_be(pos_to_ptr(data, sector_num, block_num, byte_num), byte_len);
  584. }
  585. static DateTime dt_delta(DateTime dt, uint64_t delta_secs) {
  586. // returns shifted DateTime, from initial DateTime and time offset in seconds
  587. DateTime dt_shifted = {0};
  588. datetime_timestamp_to_datetime(datetime_datetime_to_timestamp(&dt) + delta_secs, &dt_shifted);
  589. return dt_shifted;
  590. }
  591. static bool dt_ge(DateTime dt1, DateTime dt2) {
  592. // compares two DateTimes
  593. return datetime_datetime_to_timestamp(&dt1) >= datetime_datetime_to_timestamp(&dt2);
  594. }
  595. static bool dt_eq(DateTime dt1, DateTime dt2) {
  596. // compares two DateTimes
  597. return datetime_datetime_to_timestamp(&dt1) == datetime_datetime_to_timestamp(&dt2);
  598. }
  599. static bool get_map_item(uint16_t id, const IdMapping* map, size_t sz, const char** out) {
  600. // code borrowed from Jeremy Cooper's 'clipper.c'. Used as follows:
  601. // const char* s; if(!get_map_item(_,_,_,&s)) {s="Default str";}
  602. // TODO: change to furistring out?
  603. for(size_t i = 0; i < sz; i++) {
  604. if(map[i].id == id) {
  605. *out = map[i].name;
  606. return true;
  607. }
  608. }
  609. return false;
  610. }
  611. uint32_t time_now() {
  612. return furi_hal_rtc_get_timestamp();
  613. }
  614. static bool is_debug() {
  615. return furi_hal_rtc_is_flag_set(FuriHalRtcFlagDebug);
  616. }
  617. // **********************************************************
  618. // ******************** FIELD PARSING ***********************
  619. // **********************************************************
  620. static Money money_parse(
  621. const MfClassicData* data,
  622. uint8_t sector_num,
  623. uint8_t block_num,
  624. uint8_t byte_num) {
  625. // CharlieCards store all money values in two bytes as half-cents
  626. // bitmask removes sign/flag, bitshift converts half-cents to cents, div & mod yield dollars & cents
  627. uint16_t amt = (pos_to_num(data, sector_num, block_num, byte_num, 2) & 0x7FFF) >> 1;
  628. return (Money){amt / 100, amt % 100};
  629. }
  630. static DateTime
  631. date_parse(const MfClassicData* data, uint8_t sector_num, uint8_t block_num, uint8_t byte_num) {
  632. // Dates are 3 bytes, in minutes since 2003/1/1 ("CHARLIE_EPOCH")
  633. uint32_t ts_charlie = pos_to_num(data, sector_num, block_num, byte_num, 3);
  634. return dt_delta(CHARLIE_EPOCH, ts_charlie * CHARLIE_TIME_DELTA_SECS);
  635. }
  636. static DateTime end_validity_parse(
  637. const MfClassicData* data,
  638. uint8_t sector_num,
  639. uint8_t block_num,
  640. uint8_t byte_num) {
  641. // End validity field is weird; shares first byte with another variable (the card type field),
  642. // occupying the last 5 bits (and subsequent two bytes), hence bitmask
  643. uint32_t ts_charlie_ev = pos_to_num(data, sector_num, block_num, byte_num, 3) & 0x1FFFFF;
  644. // additionally, instead of minute deltas, is in 8 minute increments
  645. // relative to CHARLIE_EPOCH (2003/1/1), per DEFCON31 researcher's work
  646. return dt_delta(CHARLIE_EPOCH, ts_charlie_ev * CHARLIE_END_VALID_DELTA_SECS);
  647. }
  648. static Pass
  649. pass_parse(const MfClassicData* data, uint8_t sector_num, uint8_t block_num, uint8_t byte_num) {
  650. // WIP; testing only. Speculating it may be structured as follows
  651. // Sub-byte field divisions not drawn to scale, see code for exact bit offsets
  652. //
  653. // 0 1 2 3 4 5
  654. // +----.----.----.----+----.----+
  655. // | uk1 | date | uk2 |
  656. // +----.----.----.----+----.----+
  657. //
  658. // "Blank" entries are as follows:
  659. // 0 1 2 3 4 5
  660. // +----.----.----.----.----.----+
  661. // | 00 20 00 00 00 00 |
  662. // +----.----.----.----.----.----+
  663. //
  664. // even when not blank, uk1 LSB seems to always be set to 1...
  665. // the sole bit set to 1 on the blank entry seems to divide
  666. // the uk1 and date fields, and is always set to 1 regardless
  667. // same is true of type & end-validity split found in balance sector
  668. //
  669. // likely fields incl
  670. // — type #,
  671. // — a secondary date field (eg start/end, end validity or normal format)
  672. // — ID of FVM from which the pass was loaded
  673. // check for empty, if so, return struct filled w/ 0s
  674. // (incl "valid" field: hence, "valid" is false-y)
  675. if(pos_to_num(data, sector_num, block_num, byte_num, 6) == 0x002000000000) {
  676. return (Pass){0};
  677. }
  678. // const DateTime start = date_parse(data, sector_num, block_num, byte_num + 1);
  679. const uint16_t pre = pos_to_num(data, sector_num, block_num, byte_num, 2) >> 6;
  680. const uint16_t post = (pos_to_num(data, sector_num, block_num, byte_num + 4, 2) >> 2) & 0x3ff;
  681. // these values make sense for a date, but implied position of type
  682. // before end validity, as seen in balance sector, doesn't seem
  683. // to produce sensible values
  684. const DateTime date = end_validity_parse(data, sector_num, block_num, byte_num + 1);
  685. // DateTime start = date_parse(data, sector_num, block_num, byte_num);
  686. // uint16_t type = 0; // pos_to_num(data, sector_num, block_num, byte_num + 3, 2) >> 6;
  687. return (Pass){true, pre, post, date};
  688. }
  689. static Transaction
  690. transaction_parse(const MfClassicData* data, uint8_t sector, uint8_t block, uint8_t byte) {
  691. // This function parses individual transactions. Each transaction packs 7 bytes, stored as follows:
  692. //
  693. // 0 1 2 3 4 5 6
  694. // +----.----.----+----.--+-+----.----+
  695. // | date | loc |f| amt |
  696. // +----.----.----+----.--+-+----.----+
  697. //
  698. // Where date is in the typical format, loc represents the fare gate tapped, and amt is the fare amount.
  699. // Amount appears to contain some flag bits, however, it is unclear what precisely their function is.
  700. //
  701. // Gate ID ("loc") is only the first 13 bits of 0x3:0x5, the final three bits appear to be flags ("f").
  702. // Least significant flag bit seems to indicate:
  703. // — When f & 1 == 1, fare (the amount by which balance is decremented)
  704. // — When f & 1 == 0, refill (the amount by which balance is incremented)
  705. // MSB (sign bit) of amt seems to serve the same role, just inverted, ie
  706. // — When amt & 0x8000 == 0, fare
  707. // — When amt & 0x8000 == 0x8000, refill
  708. // Only contradiction between the two observed is on cards w/ passes;
  709. // MSB of amt seems to be set for every transaction when (remaining bits of) amt is 0 on a card w/ a pass
  710. // Hence, using f's LSB as method for inferring fare v. refill
  711. //
  712. // Remaining unknown bits:
  713. // — f & 0b100; seems to be set on fares where the card has a pass, and amt is 0
  714. // — f & 0b010
  715. // — amt & 1; does not seem to correspond with card type, last transaction, first transaction, refill v. fare, etc
  716. const DateTime date = date_parse(data, sector, block, byte);
  717. const uint16_t gate = pos_to_num(data, sector, block, byte + 3, 2) >> 3;
  718. const uint8_t g_flag = pos_to_num(data, sector, block, byte + 3, 2) & 0b111;
  719. const Money fare = money_parse(data, sector, block, byte + 5);
  720. const uint16_t f_flag = pos_to_num(data, sector, block, byte + 5, 2) & 0x8001;
  721. return (Transaction){date, gate, g_flag, fare, f_flag};
  722. }
  723. // **********************************************************
  724. // ******************* SECTOR PARSING ***********************
  725. // **********************************************************
  726. static uint32_t mfg_sector_parse(const MfClassicData* data) {
  727. // Manufacturer data (Sector 0)
  728. //
  729. // 0 1 2 3 4 5 6 7 8 9 A B C D E F
  730. // +----.----.----.----+----+----.----.----.----+----+----.----.----.----.----+----+
  731. // 0x000 | UID | rc | 88 04 00 C8 | uk | 00 20 00 00 00 | uk |
  732. // +----.----.----.----+----+----.----.----.----+----+----.----.----.----.----+----+
  733. // 0x010 | 4E 0F 04 10 04 10 04 10 04 10 04 10 04 10 04 10 |
  734. // +----.----.----.----.----.----.----.----.----.----.----.----.----.----.----.----+
  735. // 0x020 | ... 00 00 ... |
  736. // +----.----.----.----.----.----.----.----.----.----.----.----.----.----.----.----+
  737. //
  738. // rc := "redundancy check" (lrc / bcc)
  739. // uk := "unknown"
  740. size_t uid_len = 0;
  741. const uint8_t* uid = mf_classic_get_uid(data, &uid_len);
  742. const uint32_t card_number = bit_lib_bytes_to_num_be(uid, 4);
  743. return card_number;
  744. }
  745. static CounterSector counter_sector_parse(const MfClassicData* data) {
  746. // Trip/transaction counters (Sector 1)
  747. //
  748. // 0 1 2 3 4 5 6 7 8 9 A B C D E F
  749. // +----.----.----.----.----.----.----.----.----.----.----.----.----.----.----.----+
  750. // 0x040 | 04 10 23 45 66 77 ... 00 00 ... |
  751. // +----.----+----+----.----.----.----.----.----.----.----.----.----.----.----.----+
  752. // 0x050 | uses1 | uk | ... 00 00 ... |
  753. // +----.----+----+----.----.----.----.----.----.----.----.----.----.----.----.----+
  754. // 0x060 | uses2 | uk | ... 00 00 ... |
  755. // +----.----+----+----.----.----.----.----.----.----.----.----.----.----.----.----+
  756. //
  757. // uk := "unknown"; if nonzero, seems to only occupy the first 4 bits (ie, uk & 0xF0 == uk),
  758. // with the remaining 4 zero
  759. // Card has two sectors (2 & 3) containing balance data, with two
  760. // corresponding trip counters in 0x50:0x51 & 0x60:0x61 (sector 1, byte 0:1 of blocks 1 & 2).
  761. // The *lower* of the two values *minus one* is the true use count,
  762. // and corresponds to the active balance sector,
  763. // (0x50 counter lower -> sector 2 active, 0x60 counter lower -> 3 active)
  764. // per DEFCON31 researcher's findings
  765. const uint16_t n_uses1 = pos_to_num(data, 1, 1, 0, 2);
  766. const uint16_t n_uses2 = pos_to_num(data, 1, 2, 0, 2);
  767. const bool is_sec2_active = n_uses1 <= n_uses2;
  768. const uint8_t active_sector = is_sec2_active ? 2 : 3;
  769. const uint16_t n_uses = (is_sec2_active ? n_uses1 : n_uses2) - 1;
  770. return (CounterSector){n_uses, active_sector};
  771. }
  772. static BalanceSector balance_sector_parse(const MfClassicData* data, uint8_t active_sector) {
  773. // Balance & misc card info (Sector 2 or 3)
  774. //
  775. // 0 1 2 3 4 5 6 7 8 9 A B C D E F
  776. // +----+----.----.----+----.----+----.----.----+----.----+----.----+----+----.----+
  777. // 0x080 | 11 | date last | loc last| date issued | 65 00 | unknown | 00 | crc | 0x0C0
  778. // +----+----.----.----+----+----+----+----+----+----.----+----.----+----+----.----+
  779. // 0x090 | type |end validity| uk | balance | 00 | unknown | crc | 0x0D0
  780. // +----.----.----.----+----+----.----+----+----.----.----.----.----.----+----.----+
  781. // 0x0A0 | 20 ... 00 00 ... 04 | crc | 0x0E0
  782. // +----.----.----.----.----.----.----.----.----.----.----.----.----.----+----.----+
  783. //
  784. // "Active" balance sector alternates between 2 and 3
  785. // Last trip/transaction info in balance sector ("date last" & "loc last")
  786. // is also included in transaction log, hence don't bother to read here
  787. //
  788. // Inactive balance sector represent the transaction N-1 version
  789. // (where active sector represents data from transaction N).
  790. const DateTime issued = date_parse(data, active_sector, 0, 6);
  791. const DateTime end_validity = end_validity_parse(data, active_sector, 1, 1);
  792. // Card type data stored in the first 10bits of block 1
  793. // (0x90 or 0xD0 depending on active sector)
  794. // bitshift (2bytes = 16 bits) by 6bits for just first 10bits
  795. const uint16_t type = pos_to_num(data, active_sector, 1, 0, 2) >> 6;
  796. const Money bal = money_parse(data, active_sector, 1, 5);
  797. return (BalanceSector){bal, type, issued, end_validity};
  798. }
  799. static Pass* passes_parse(const MfClassicData* data) {
  800. // Passes, speculative (Sectors 4 &/or 5)
  801. //
  802. // 0 1 2 3 4 5 6 7 8 9 A B C D E F
  803. // +----.----.----.----.----.----+----+----.----.----.----.----.----+----+----.----+
  804. // 0x100 | pass0/2? | 00 | pass1/3? | 00 | crc | 0x140
  805. // +----.----.----.----.----.----+----+----.----.----.----.----.----+----+----.----+
  806. // 0x110 | ... 00 00 ... | crc | 0x150
  807. // +----.----.----.----.----.----.----.----.----.----.----.----.----.----+----.----+
  808. // 0x120 | ... 00 ... 05 | crc | 0x160
  809. // +----.----.----.----.----.----.----.----.----.----.----.----.----.----+----.----+
  810. //
  811. // WIP. Read in all speculative passes into array
  812. // 4 separate fields? active vs inactive sector for 2 passes?
  813. // something else entirely?
  814. Pass* passes = malloc(sizeof(Pass) * CHARLIE_N_PASSES);
  815. for(size_t i = 0; i < CHARLIE_N_PASSES; i++) {
  816. passes[i] = pass_parse(data, 4 + (i / 2), 0, (i % 2) * 7);
  817. }
  818. return passes;
  819. }
  820. static Transaction* transactions_parse(const MfClassicData* data) {
  821. // Transaction history (Sectors 6–7)
  822. //
  823. // 0 1 2 3 4 5 6 7 8 9 A B C D E F
  824. // +----.----.----.----.----.----.----+----.----.----.----.----.----.----+----.----+
  825. // 0x180 | transaction0 | transaction1 | crc |
  826. // +----.----.----.----.----.----.----+----.----.----.----.----.----.----+----.----+
  827. // ... ... ... ...
  828. // +----.----.----.----.----.----.----+----.----.----.----.----.----.----+----.----+
  829. // 0x1D0 | transaction8 | transaction9 | crc |
  830. // +----.----.----.----.----.----.----+----.----.----.----.----.----.----+----.----+
  831. // 0x1E0 | ... 00 00 ... | crc |
  832. // +----.----.----.----.----.----.----.----.----.----.----.----.----.----+----.----+
  833. //
  834. // Transactions are not sorted, rather, appear to get overwritten
  835. // sequentially. (eg, sorted modulo array rotation)
  836. Transaction* transactions = malloc(sizeof(Transaction) * CHARLIE_N_TRANSACTION_HISTORY);
  837. // Parse each transaction field using some modular math magic to get the offsets:
  838. // move from sector 6 -> 7 after the first 6 transactions
  839. // move a block within a given sector every 2 transactions, reset every 3 blocks (as sector has changed)
  840. // alternate between a start byte of 0 and 7 with every iteration
  841. for(size_t i = 0; i < CHARLIE_N_TRANSACTION_HISTORY; i++) {
  842. transactions[i] = transaction_parse(data, 6 + (i / 6), (i / 2) % 3, (i % 2) * 7);
  843. }
  844. // Iterate through the array to find the maximum (newest) date value
  845. int max_idx = 0;
  846. for(int i = 1; i < CHARLIE_N_TRANSACTION_HISTORY; i++) {
  847. if(dt_ge(transactions[i].date, transactions[max_idx].date)) {
  848. max_idx = i;
  849. }
  850. }
  851. // Sort by rotating
  852. for(int r = 0; r < (max_idx + 1); r++) {
  853. // Store the first element
  854. Transaction temp = transactions[0];
  855. // Shift elements to the left
  856. for(int i = 0; i < CHARLIE_N_TRANSACTION_HISTORY - 1; i++) {
  857. transactions[i] = transactions[i + 1];
  858. }
  859. // Move the first element to the last
  860. transactions[CHARLIE_N_TRANSACTION_HISTORY - 1] = temp;
  861. }
  862. // Reverse order, such that newest is first, oldest last
  863. for(int i = 0; i < CHARLIE_N_TRANSACTION_HISTORY / 2; i++) {
  864. // Swap elements at index i and size - i - 1
  865. Transaction temp = transactions[i];
  866. transactions[i] = transactions[CHARLIE_N_TRANSACTION_HISTORY - i - 1];
  867. transactions[CHARLIE_N_TRANSACTION_HISTORY - i - 1] = temp;
  868. }
  869. return transactions;
  870. }
  871. /*
  872. static DateTime expiry(DateTime iss) {
  873. // Per Metrodroid CharlieCard parser (https://github.com/metrodroid/metrodroid/blob/master/src/commonMain/kotlin/au/id/micolous/metrodroid/transit/charlie/CharlieCardTransitData.kt)
  874. // Expiry not explicitly stored in card data; rather, calculated from date of issue
  875. // Cards were first issued in 2006, expired in 5 years, w/ no printed expiry date
  876. // Cards issued after 2011 expire in 10 years
  877. //
  878. // Per DEFCON31 researcher's work (cited above):
  879. // Student cards last one school year and expire at the end of August the following year
  880. // Pre-2011 issued cards expire in 7 years, not 5 as claimed by Metrodroid
  881. // Post-2011 expire in 10 years, less one day
  882. // Redundant function given the existance of the end validity field?
  883. // Any important distinctions between the two?
  884. // perhaps additionally clipping to 2030-12-__ in anticipation of upcoming system migration?
  885. // need to get a new card to confirm.
  886. // TODO add card type logic for student card expiry
  887. DateTime exp;
  888. if(iss.year < 2011) {
  889. // add 7 years; assumes average year of 8766 hrs (to account for leap years)
  890. // may be off by a few hours as a result
  891. exp = dt_delta(iss, 7 * 8766 * 60 * 60);
  892. } else {
  893. // add 10 years, subtract a day. Same assumption as above
  894. exp = dt_delta(iss, ((10 * 8766) - 24) * 60 * 60);
  895. }
  896. return exp;
  897. }
  898. static bool expired(DateTime expiry, DateTime last_transaction) {
  899. // if a card has sat unused for >2 years, expired (verify this claim?)
  900. // else expired if current date > expiry date
  901. uint32_t ts_exp = datetime_datetime_to_timestamp(&expiry);
  902. uint32_t ts_last = datetime_datetime_to_timestamp(&last_transaction);
  903. uint32_t ts_now = time_now();
  904. return (ts_exp <= ts_now) | ((ts_now - ts_last) >= (2 * 365 * 24 * 60 * 60));
  905. }
  906. */
  907. // **********************************************************
  908. // ****************** STRING FORMATTING *********************
  909. // **********************************************************
  910. void locale_format_dt_cat(FuriString* out, const DateTime* dt) {
  911. // helper to print datetimes
  912. FuriString* s = furi_string_alloc();
  913. LocaleDateFormat date_format = locale_get_date_format();
  914. const char* separator = (date_format == LocaleDateFormatDMY) ? "." : "/";
  915. locale_format_date(s, dt, date_format, separator);
  916. furi_string_cat(out, s);
  917. locale_format_time(s, dt, locale_get_time_format(), false);
  918. furi_string_cat_printf(out, " ");
  919. furi_string_cat(out, s);
  920. furi_string_free(s);
  921. }
  922. void type_format_cat(FuriString* out, uint16_t type) {
  923. const char* s;
  924. if(!get_map_item(type, charliecard_types, kNumTypes, &s)) {
  925. s = "";
  926. furi_string_cat_printf(out, "Unknown-%u", type);
  927. }
  928. furi_string_cat_str(out, s);
  929. }
  930. void pass_format_cat(FuriString* out, Pass pass) {
  931. furi_string_cat_printf(out, "\n-Pre: %b", pass.pre);
  932. // type_format_cat(out, pass.type);
  933. furi_string_cat_printf(out, "\n-Post: ");
  934. type_format_cat(out, pass.post);
  935. // locale_format_dt_cat(out, &pass.start);
  936. furi_string_cat_printf(out, "\n-Date: ");
  937. locale_format_dt_cat(out, &pass.date);
  938. }
  939. void passes_format_cat(FuriString* out, Pass* passes) {
  940. // only print passes if DEBUG on
  941. if(!is_debug()) {
  942. return;
  943. }
  944. // only print if there is at least 1 valid pass to print
  945. bool any_valid = false;
  946. for(size_t i = 0; i < CHARLIE_N_PASSES; i++) {
  947. any_valid |= passes[i].valid;
  948. }
  949. if(!any_valid) {
  950. return;
  951. }
  952. furi_string_cat_printf(out, "\nPasses (DEBUG / WIP):");
  953. for(size_t i = 0; i < CHARLIE_N_PASSES; i++) {
  954. if(passes[i].valid) {
  955. furi_string_cat_printf(out, "\nPass %u", i + 1);
  956. pass_format_cat(out, passes[i]);
  957. furi_string_cat_printf(out, "\n");
  958. }
  959. }
  960. }
  961. void money_format_cat(FuriString* out, Money money) {
  962. furi_string_cat_printf(out, "$%u.%02u", money.dollars, money.cents);
  963. }
  964. void transaction_format_cat(FuriString* out, Transaction transaction) {
  965. const char* sep = " ";
  966. const char* sta;
  967. locale_format_dt_cat(out, &transaction.date);
  968. furi_string_cat_printf(out, "\n%s", !!(transaction.g_flag & 0x1) ? "-" : "+");
  969. money_format_cat(out, transaction.fare);
  970. if(!!(transaction.g_flag & 0x1) && (transaction.fare.dollars == FARE_BUS.dollars) &&
  971. (transaction.fare.cents == FARE_BUS.cents)) {
  972. // if not a refill, and the fare amount is equal to bus fare (any better approach? flag bits for modality?)
  973. // format for bus — supposedly some correlation between gate ID & bus #, haven't investigated
  974. furi_string_cat_printf(out, "%s#%u", sep, transaction.gate);
  975. } else if(get_map_item(transaction.gate, charliecard_fare_gate_ids, kNumFareGateIds, &sta)) {
  976. // station found in fare gate ID map, append station name
  977. furi_string_cat_str(out, sep);
  978. furi_string_cat_str(out, sta);
  979. } else {
  980. // no found station in fare gate ID map & not a bus, just print ID w/o add'l info
  981. furi_string_cat_printf(out, "%s#%u", sep, transaction.gate);
  982. }
  983. // print flags for debugging purposes
  984. if(is_debug()) {
  985. furi_string_cat_printf(out, "%s%x%s%x", sep, transaction.g_flag, sep, transaction.f_flag);
  986. }
  987. }
  988. void transactions_format_cat(FuriString* out, Transaction* transactions) {
  989. furi_string_cat_printf(out, "\nTransactions:");
  990. for(size_t i = 0; i < CHARLIE_N_TRANSACTION_HISTORY; i++) {
  991. furi_string_cat_printf(out, "\n");
  992. transaction_format_cat(out, transactions[i]);
  993. furi_string_cat_printf(out, "\n");
  994. }
  995. }
  996. // **********************************************************
  997. // **************** NFC PLUGIN BOILERPLATE ******************
  998. // **********************************************************
  999. static bool charliecard_parse(FuriString* parsed_data, const MfClassicData* data) {
  1000. bool parsed = false;
  1001. do {
  1002. // Verify key
  1003. // arbitrary sector in the main data portion
  1004. const uint8_t verify_sector = 3;
  1005. const MfClassicSectorTrailer* sec_tr =
  1006. mf_classic_get_sector_trailer_by_sector(data, verify_sector);
  1007. const uint64_t key_a =
  1008. bit_lib_bytes_to_num_be(sec_tr->key_a.data, COUNT_OF(sec_tr->key_a.data));
  1009. if(key_a != charliecard_1k_keys[verify_sector].a) break;
  1010. // parse card data
  1011. const uint32_t card_number = mfg_sector_parse(data);
  1012. const CounterSector counter_sector = counter_sector_parse(data);
  1013. const BalanceSector balance_sector =
  1014. balance_sector_parse(data, counter_sector.active_balance_sector);
  1015. Pass* passes = passes_parse(data);
  1016. Transaction* transactions = transactions_parse(data);
  1017. // print/append card data
  1018. furi_string_cat_printf(parsed_data, "\e#CharlieCard");
  1019. furi_string_cat_printf(parsed_data, "\nSerial: 5-%lu", card_number);
  1020. // Type and balance 0 on some (Perq) cards
  1021. // (ie no "main" type / balance / end validity,
  1022. // essentially only pass & trip info)
  1023. // skip/change formatting for that case?
  1024. furi_string_cat_printf(parsed_data, "\nBal: ");
  1025. money_format_cat(parsed_data, balance_sector.balance);
  1026. furi_string_cat_printf(parsed_data, "\nType: ");
  1027. type_format_cat(parsed_data, balance_sector.type);
  1028. furi_string_cat_printf(parsed_data, "\nTrip Count: %u", counter_sector.n_uses);
  1029. furi_string_cat_printf(parsed_data, "\nIssued: ");
  1030. locale_format_dt_cat(parsed_data, &balance_sector.issued);
  1031. if(!dt_eq(balance_sector.end_validity, CHARLIE_EPOCH) &
  1032. dt_ge(balance_sector.end_validity, balance_sector.issued)) {
  1033. // sometimes (seen on Perq cards) end validity field is all 0
  1034. // When this is the case, calc'd end validity is equal to CHARLIE_EPOCH).
  1035. // Only print if not 0, & end validity after issuance date
  1036. furi_string_cat_printf(parsed_data, "\nExpiry: ");
  1037. locale_format_dt_cat(parsed_data, &balance_sector.end_validity);
  1038. }
  1039. // const DateTime last = date_parse(data, active_sector, 0, 1);
  1040. // furi_string_cat_printf(parsed_data, "\nExpired: %s", expired(e_v, last) ? "Yes" : "No");
  1041. transactions_format_cat(parsed_data, transactions);
  1042. free(transactions);
  1043. passes_format_cat(parsed_data, passes);
  1044. free(passes);
  1045. parsed = true;
  1046. } while(false);
  1047. return parsed;
  1048. }
  1049. static NfcCommand
  1050. metroflip_scene_charlicard_poller_callback(NfcGenericEvent event, void* context) {
  1051. furi_assert(context);
  1052. furi_assert(event.event_data);
  1053. furi_assert(event.protocol == NfcProtocolMfClassic);
  1054. NfcCommand command = NfcCommandContinue;
  1055. const MfClassicPollerEvent* mfc_event = event.event_data;
  1056. Metroflip* app = context;
  1057. if(mfc_event->type == MfClassicPollerEventTypeCardDetected) {
  1058. view_dispatcher_send_custom_event(app->view_dispatcher, MetroflipCustomEventCardDetected);
  1059. command = NfcCommandContinue;
  1060. } else if(mfc_event->type == MfClassicPollerEventTypeCardLost) {
  1061. view_dispatcher_send_custom_event(app->view_dispatcher, MetroflipCustomEventCardLost);
  1062. app->sec_num = 0;
  1063. command = NfcCommandStop;
  1064. } else if(mfc_event->type == MfClassicPollerEventTypeRequestMode) {
  1065. mfc_event->data->poller_mode.mode = MfClassicPollerModeRead;
  1066. } else if(mfc_event->type == MfClassicPollerEventTypeRequestReadSector) {
  1067. MfClassicKey key = {0};
  1068. bit_lib_num_to_bytes_be(charliecard_1k_keys[app->sec_num].a, COUNT_OF(key.data), key.data);
  1069. MfClassicKeyType key_type = MfClassicKeyTypeA;
  1070. mfc_event->data->read_sector_request_data.sector_num = app->sec_num;
  1071. mfc_event->data->read_sector_request_data.key = key;
  1072. mfc_event->data->read_sector_request_data.key_type = key_type;
  1073. mfc_event->data->read_sector_request_data.key_provided = true;
  1074. if(app->sec_num == 16) {
  1075. mfc_event->data->read_sector_request_data.key_provided = false;
  1076. app->sec_num = 0;
  1077. }
  1078. app->sec_num++;
  1079. } else if(mfc_event->type == MfClassicPollerEventTypeSuccess) {
  1080. nfc_device_set_data(
  1081. app->nfc_device, NfcProtocolMfClassic, nfc_poller_get_data(app->poller));
  1082. const MfClassicData* mfc_data = nfc_device_get_data(app->nfc_device, NfcProtocolMfClassic);
  1083. FuriString* parsed_data = furi_string_alloc();
  1084. Widget* widget = app->widget;
  1085. dolphin_deed(DolphinDeedNfcReadSuccess);
  1086. furi_string_reset(app->text_box_store);
  1087. if(!charliecard_parse(parsed_data, mfc_data)) {
  1088. furi_string_reset(app->text_box_store);
  1089. FURI_LOG_I(TAG, "Unknown card type");
  1090. furi_string_printf(parsed_data, "\e#Unknown card\n");
  1091. }
  1092. widget_add_text_scroll_element(widget, 0, 0, 128, 64, furi_string_get_cstr(parsed_data));
  1093. widget_add_button_element(
  1094. widget, GuiButtonTypeRight, "Exit", metroflip_exit_widget_callback, app);
  1095. furi_string_free(parsed_data);
  1096. view_dispatcher_switch_to_view(app->view_dispatcher, MetroflipViewWidget);
  1097. command = NfcCommandStop;
  1098. metroflip_app_blink_stop(app);
  1099. } else if(mfc_event->type == MfClassicPollerEventTypeFail) {
  1100. FURI_LOG_I(TAG, "fail");
  1101. command = NfcCommandContinue;
  1102. }
  1103. return command;
  1104. }
  1105. void metroflip_scene_charliecard_on_enter(void* context) {
  1106. Metroflip* app = context;
  1107. dolphin_deed(DolphinDeedNfcRead);
  1108. app->sec_num = 0;
  1109. // Setup view
  1110. Popup* popup = app->popup;
  1111. popup_set_header(popup, "Apply\n card to\nthe back", 68, 30, AlignLeft, AlignTop);
  1112. popup_set_icon(popup, 0, 3, &I_RFIDDolphinReceive_97x61);
  1113. // Start worker
  1114. view_dispatcher_switch_to_view(app->view_dispatcher, MetroflipViewPopup);
  1115. app->poller = nfc_poller_alloc(app->nfc, NfcProtocolMfClassic);
  1116. nfc_poller_start(app->poller, metroflip_scene_charlicard_poller_callback, app);
  1117. metroflip_app_blink_start(app);
  1118. }
  1119. bool metroflip_scene_charliecard_on_event(void* context, SceneManagerEvent event) {
  1120. Metroflip* app = context;
  1121. bool consumed = false;
  1122. if(event.type == SceneManagerEventTypeCustom) {
  1123. if(event.event == MetroflipCustomEventCardDetected) {
  1124. Popup* popup = app->popup;
  1125. popup_set_header(popup, "DON'T\nMOVE", 68, 30, AlignLeft, AlignTop);
  1126. consumed = true;
  1127. } else if(event.event == MetroflipCustomEventCardLost) {
  1128. Popup* popup = app->popup;
  1129. popup_set_header(popup, "Card \n lost", 68, 30, AlignLeft, AlignTop);
  1130. consumed = true;
  1131. } else if(event.event == MetroflipCustomEventWrongCard) {
  1132. Popup* popup = app->popup;
  1133. popup_set_header(popup, "WRONG \n CARD", 68, 30, AlignLeft, AlignTop);
  1134. consumed = true;
  1135. } else if(event.event == MetroflipCustomEventPollerFail) {
  1136. Popup* popup = app->popup;
  1137. popup_set_header(popup, "Failed", 68, 30, AlignLeft, AlignTop);
  1138. consumed = true;
  1139. }
  1140. } else if(event.type == SceneManagerEventTypeBack) {
  1141. scene_manager_search_and_switch_to_previous_scene(app->scene_manager, MetroflipSceneStart);
  1142. consumed = true;
  1143. }
  1144. return consumed;
  1145. }
  1146. void metroflip_scene_charliecard_on_exit(void* context) {
  1147. Metroflip* app = context;
  1148. widget_reset(app->widget);
  1149. if(app->poller) {
  1150. nfc_poller_stop(app->poller);
  1151. nfc_poller_free(app->poller);
  1152. }
  1153. // Clear view
  1154. popup_reset(app->popup);
  1155. metroflip_app_blink_stop(app);
  1156. }