Decoding Dual-Track MetroCards - Track 1-2
This is a single track that is twice the width of a normal track, as per ISO 7811. It holds variable data that is read and written to by turnstiles and other fare collection devices.
|
Field # |
Track 1-2 Content |
Offset |
Length |
Extracting information |
|
1 |
Start Sentinel |
0 |
10 |
0011010111 |
|
2 |
Time Last Used (1) |
10 |
2 |
See Time Decoding below |
|
3 |
Card Sub-Type |
12 |
6 |
See CardTypes |
|
4 |
Time Last Used (2) |
18 |
6 |
See Time Decoding below |
|
5 |
Date Last Used |
24 |
10 |
See Date Decoding below |
|
6 |
Times Used |
34 |
6 |
Simple binary -> decimal, this is incremented with each use, except xfers |
|
7 |
Expiration Date |
40 |
10 |
See Date Decoding below, this is the date when unlimited cards expire |
|
8 |
Transfer Bit |
50 |
1 |
1 if last use is valid for a transfer, 0 otherwise |
|
9 |
Last Used ID |
51 |
15 |
See LastUsed |
|
10 |
Card Value |
66 |
16 |
Simple binary -> decimal gives you the card value in cents |
|
11 |
Purchase ID |
82 |
16 |
See VendingMachines |
|
12 |
Unknown |
98 |
20 |
Anyone know? |
Decoding Dual-Track MetroCards - Track 3
This track contains static data that is written only when the card is manufactured.
|
Field # |
Track 3 Content |
Offset |
Length |
Extracting information |
|
1 |
Start Sentinel |
0 |
15 |
000000011000111 |
|
2 |
Card Type |
15 |
4 |
See CardTypes |
|
3 |
Unknown |
19 |
4 |
?? |
|
4 |
Expiration Date |
23 |
12 |
See Time Decoding below, this is the hard expiration date found on the back of the card |
|
5 |
Unknown |
35 |
4 |
?? |
|
6 |
Constant |
39 |
8 |
00001101 |
|
7 |
Unknown |
47 |
8 |
?? |
|
8 |
Serial Number |
55 |
80 |
Simple binary -> decimal |
|
9 |
Unused |
135 |
16 |
-- |
|
10 |
Unknown |
151 |
16 |
?? |
|
11 |
End Sentinel |
167 |
93 |
00100101001100100110100101100101010011001010010 1001100110101010011010010101001101001010110101 |
Decoding
Time Decoding
Concatenate track 1-2 fields #2 and #4, convert binary -> decimal, multiply by 6, result is number of minutes since 01:00 (1 AM) that the card was last used.
Date Decoding
Dates can be determined by converting the field from binary to decimal (call this x), and performing the following calculations:
Year: (x/2 round up)/12 + offset (Since this field is only 10 bits, the offset must be changed every 1024 days. Find the offset by extracting it from a card with a last use date that is known)
Month: (x/2 round up)%12 (this means the remainder when the number is divided by 12. 0=January 1=February etc.)
Day: The actual expiration date is the last day of the previous month. A February expiration month means an exp. date of January 31.
Other links
See Decoder for Redbird's perl script to parse card data.
See the
![[WWW]](/wiki/modern/img/moin-www.png)
2600 article in 22:1 Spring 2005 for detailed instructions on decoding binary data read from cards into useful information, which will proabably be documented here in more detail as time goes on. - Listen to Red Balaclava's talk during Beyond HOPE Sunday, August 10 1997 12:00 noon - "The mystery transit employee who appeared at the original Hackers On Planet Earth conference in 1994 returns (via ISDN) to talk about the easily hackable but ingeniously self-correcting payment method of New York City's subways and buses. We will also discuss the subtle - and possibly increasing - dangers of the Transit Authority's ability to trace YOUR travels via Metrocard." - He explains some of the system, what is known about the data on the card (which is not nearly as extensive as 2600's current knowledge), and essentially promotes the idea that the Metrocard is "unhackable".