A drop of solder - how to hack telephone cards.

__________________________________________

(C) Cardinal/PGC/BDA
__________________________________________


 Telephone cards.
What are they and what are they eaten with.


   Hello everyone who hasn't forgotten how
hold the soldering iron correctly! Well, finally
I got back to the IBM keyboard to
It is convenient to type this text into ZXWORD. How
I promised in the last issue in the article “From
authors", we will now talk about telephone
cards (payphone cards or simply
SMART CARDS).
   In some electronic journals already
there was information on this case, but what
it said it was suitable only for the PC, according to
because everything was downloaded from the Internet without
any conversion to Spectrum. Next you
you will understand why this is so. I will explain to you
material only as I understood it myself, and
say only those things that were personal
but checked by me.
   So...

   Another year in our glorious city of Kemerovo
back it was possible to post completely free of charge
stink from a telephone booth (payphone),
but then the half-sober men of Malice came
Nikitich and replaced all payphones with pay-
new And in the kiosks they begansell beautiful
they look like plastic cards, because the latter
didn't work without them. But honest people are not
wanted to buy expensive cards, and in places
on news broadcasts sometimes skipped
messages that there are payphones there and there
hopelessly spoiled by what's in the slits
the cards contained foreign bodies in
in the form of pins, hairpins, pieces of foil and
other ferrous and non-ferrous metals. Those who shoved in
payphones all kinds of foil and hairpins were
obvious suckers who didn't know a damn thing about
electronics.
   Max and I didn’t sit still either, but
acted in other ways. In short-
longer periods from different sources, but in large
in its majority through numerous
experiments, we found out the following information
information about the cards that are used in our
city.

 General theoretical information.

   In our city they sell cards following
blowing volumes:5,10,15,20,30,40,60,90and
120 minutes. Naturally, their prices vary
new These cards can not be used to make calls
only in the city, but also intercity and even
outside of Russia! Only minutes, naturally-
Surely they run faster.
   Externally, the card is a cu-
plastic juice with a microchip soldered into it.
The microchip, as it turned out later, corresponds
meets standards ISO7816-2.The chip contains -
ROM and RAM capacity of 64 bytes (512 bits).
Of this, RAM is only 8 bytes. Here
memory layout of the whole card into 120 mi-
no talk time:

 address value

 000 #00 %10000010 130 #82
 001 #01 %11001011 203 #CB
 002 #02 %00011001 025 #19
 003 #03 %00011101 029 #1D
 004 #04 %01010111 087 #57
 005 #05 %10101101 173 #AD
 006 #06 %11100101 229 #E5
 007 #07 %00101001 041 #29
 008 #08 %01111111 127 #7F
 009 #09 %01111111 127 #7F
 010 #0A %01111111 127 #7F
 011 #0B %01111111 127 #7F
012 #0C  %01111111 127 #7F
   013 #0D  %11111111 255 #FF
   014 #0E  %11111111 255 #FF
   015 #0F  %11111111 255 #FF
   016 #10  %10010101 149 #95
   017 #11  %00011111 031 #1F
   018 #12  %11101111 239 #EF
   019 #13  %00101011 043 #2B
   020 #14  %11011100 220 #DC
   021 #15  %00001111 015 #0F
   022 #16  %10111111 191 #BF
   023 #17  %11010010 210 #D2

   Байты  по адресам 24(#18) - 63(#3F) за-
биты всякой шнягой (0 и #FF) и, походу, не
используются. А  сейчас  подробнее о раск-
ладке памяти.
   Байты  0 - 3 all cards contain
values:  #82,#CB,#19,#1D, apparently
bridge, this is the card identification number,
It is different in different cities.
   Bytes 4 - 7 on all cards contain
different meanings. There is a suspicion that in
their number is somehow encoded
cards (it is written on the card itself) and the number
number of minutes
   Bytes 8 - 12 is the card's RAM, you can go there
record information, or rather, erase it
zeros. This is the most interesting place in the car-
those The remaining minutes of time are stored here.
dialect The format of these 5 bytes is as follows:
you see, each of them contains 7 inclusions
valuable bits. And if you count the quantities
bits in each byte, we get the number
77777  in octal number system
(32767  in decimal). Payphone calculates
number of minutes remaining in reverse
row. That is, the bytes are reduced to a certain
limit and no more reduction
is happening. From this it follows that
the maximum number of minutes can be
32767. If at address 12 you enter all incl.
bits marked with zeros, then you automatically7 minutes will disappear. And if you erase bit 0
byte at address 11, then another one will disappear
minute of conversation, and address byte 12 will receive
value %11111111.I.e. automatically re-
becomes, but for some reason the 7th one will also turn on
bit. But the payphone itself erases the 0th bit
address 12 to make the required number
Well, that's why there are no glitches. Moreover,
Moreover, only quantities of units are considered
literal bits in bytes, and it doesn’t matter how they are
located. So, a 120-minute card with
8 minutes spent will look like
like this:

 address value

 008 #08 %01111111 127 #7F
 009 #09 %01111111 127 #7F
 010 #0A %01111111 127 #7F
 011 #0B %01111110 126 #7E
 012 #0C %11111110 254 #FE

   And the empty 120-minute card looks like
like this:

 address value

 008 #08 %01111111 127 #7F
 009 #09 %01111111 127 #7F
 010 #0A %01111110 126 #7E
 011 #0B %00000000 000 #00
 012 #0C %11111110 254 #FE

   In truth, if you erase any
bit in a byte at address 11, then the byte at address
su 12 is automatically restored. Then
the same applies to the bytes at the addresses below,
if you kick them, they will automatically recover
bytes are poured into the addresses above.
   I’ll also say that writing units in these
addresses cannot be deleted, only erased.
   Algorithms on cards of other cities
minute subtractions usually differ, and,
very much.
   The byte at address 13 contains #FF and
For some reason you can’t cut it.
   Addresses 14 and 15 contain bytes,
which in my opinion are reserved
under seconds. They don't touch the payphone,
but you can erase them.
   At addresses 16 - 23 on all cards
contains different meanings. There is a suspicion
understanding that they may contain encoding
bathroom checksum, or quantity
minutes, or card number, or all together.
This question still remainsopen.

 Signal diagrams.

   A payphone with a card communicates through
vom of electrical impulses, determined
sequences. This is what the con-
tact pad of the card microchip.

┌──────────┬──────────┐
│  1  │  5  │ 1 : Vcc = +5V
├─────┐ │ ┌─────┤ 2 : RESET
│  2  ├────┘  │  6  │  3 : CLK
│ │        │     │   4 : ---
├─────┤         ├─────┤   5 : GND
│  3  │         │  7  │   6 : ---
│     ├────┬────┤     │   7 : DATA
├─────┘    │    └─────┤   8 : ---
│       4  │  8       │
└──────────┴──────────┘

   Contacts 4, 6 and 8 are not involved, because
this means your city cards may have
only 6 contacts instead of 8, but differently
measures and location must coincide with
our cards.
   The payphone reads the card bit by bit, i.e.
one bit at a time. Total on the map
512 bits when the last one is read,
0 is automatically read.  Diagram
signals is given below. To read
0th bit, it is necessary to set the card address
points at 0. This is done by the following signals
lami.

 Diagram of setting the address to 0.

 ┌──────────┐ log 1
 │ │
RESET ───┘ └────────── log 0

 ┌────┐ log 1
 │ │
CLK ──────┘ └───────────── log 0
<---->
 time

   Naturally, the card should have
power is given +5V and general. Time
momentum retention is not critical and can
be anything, but not too short, otherwise
the card will not have time to process the signal. By
time, the pulse length can be within a limit
lah from a few cycles of the Z80 to at least
how many days :)
   After you have reset the card address,
points at 0, then the DATA pin immediately shows
the value of the very beginning bit is displayed
crumple the cards. If bit = 0, then DATA is high
0 - 0.2 volts (log.0) is set if the bit
= 1, then DATA is set to high imp.
given state, i.e. torn off, not
log.1, as you can see.
   To increment the address by 1 and read
next bit, you just need to shorten
simultaneously set CLK to 1 and immediately
reset it.

 Diagram of card address offset by +1.

 log 1

RESET ───────────────────────── log 0

 ┌────┐ log 1
 │ │
CLK ──────┘ └───────────── log 0


   After such an operation on the DATA contact
the bit value is set at the address
adr0+1. If this action is repeated, then
the bit value is set at the address
adr0+2 and so on...

   How to erase any bit? There's a little
more difficult. As I already said, you can’t
then write bit=1, you can only write bit=0,
i.e.  erase the current bit. To erase
some bit, you need to install ad-
res cards to 0, then “click” so many times
"press" with the CLK signal so that the card address
settled right on the right bit. And only
then issue the required erase pulse.

 Erase pulse diagram.

 ┌─────┐ log 1
 │ │
RESET ───┘ └─────────────── log 0

 ┌────┐ log 1
 │ │
CLK ─────────────┘ └────── log 0

   After such a combination of bit pulses,
located at the current address will be reset to zero.
Then you can do it again"click" signal
CLK and go to the next address where
rum apply the erase pulse again and so on
continue until you get tired of spoiling the card.

 Practical information.

   Let's finish with theory for a while and
Let's move on to practice.  Now I'll teach you
read information from cards on the Spectrum.
To do this, it is necessary that your computer
There was a printer interface in the computer (Centronics
(LPT on PC) or any other). From the interface
For the printer we will need the following signals:
numbers: data_0, data_1, busy, gnd (general) and
+5v from the power supply.
   In order not to solder this whole thing to the car-
point, make a tablet in which you will
insert card. I have this tablet
made from pieces of plexiglass from under-
cassette players and bent stationery scrapers
pok as contacts.
   Signals data_0 and data_1 interface
Centronics (LPT on PC) output, and the signal
busy - input from the computer's point of view.

 Connection diagram.

      data_0 - CLK (3 pin cards)
 data_1 - RESET (2 pin cards)
 busy  - DATA (7 pin cards)
 GND  - GND (5 pin cards)
 +5V  - +5V (1 pin card)

   For those who don't know, GND is the general
or in other words land. In the passport from Scor-
pion's signals data_0 and data_1 are designated
like Centr_0 and Centr_1, on the Pentagon diagram
they are CTS0 and CTS1. In your computer they can-
may have a different designation, but the meaning is the same
same. It is necessary to solder a relay to the busy signal.
resistor for a couple of kOhms, one end of the re-
one resistor is set to busy, the other is set to +5V. Look,
perhaps it is already on the diagram of your computer
Yes, then there is no need to solder it. This
applies to owners of Scorpions and Pens
tagons.
   To control the data_0 and
data_1, must be output to port #FFDD
on Scorpio or #00FB on Pentagon byte with
on or off 0th and 1st
bits. On your computer, the printer port may
be different.

LD BC,#FFDD ;on the Pentagon #00FB
LD A,%00000001 ;
OUT (C),A ;CLK signal = log.1
...
LD BC,#FFDD ;at the Pentagon #00FB
LD A,%00000010 ;
OUT (C),A ;RESET signal = logic 1
...
LD BC,#FFDD ;at the Pentagon #00FB
LD A,%00000011 ;
OUT (C),A ;CLK and RESET signal = logic 1
...

   To analyze the DATA signal on
card that shows the value of those
current bit (0 or 1), required on Scor-
pion do this:

IN A,(#FE)
RLA
JR C,...

   Where the CF flag indicates the status of the signal
la DATA (busy in the printer interface). If
CF=1, then DATA=1 (bit=1), if CF=0, then
DATA=0 (bit=0). In other words, the 7th bit
port #FE on reading shows the status
DATA (busy) signal.
   At the Pentagon, judging by the diagram that
now lies in front of me (diagram courtesy
provided by the respectedCAV/AURYN/CPU), for
the busy signal (at the Pentagon CT_BUSY) responds
also the 7th bit, but it’s not clear what date
ta. Unfortunately, books from the Pentagon itself
I don't have one, so its the printer ports
I don’t know, but it’s hard to figure out the scheme.
   The most important thing is that you don't have to
puff on creating good software
support for this device, in the Application you
you will find the source in Alasm4.2 with detailed
comments who can read cards
points and display all the necessary
information. Whoever needs it will undoubtedly
is taken. The source will work without problems
thief on Scorpion, for another computer
you need to change the EQU with the port number
printer to the desired one.

                Cardinal/PGC/BDA