Iron - hacking calling cards for endless calls.

   
   
        
        
        
        
        
     

music:Midisoft/Energy Minds               
(C) 1998 Ьу Alien AKA Dimik               
---------------------------------FUNeral--
                                          
           ОТ АВТОРА            
                                      
 риведенная в этом  документе информа-
ция не может являться  конфиденциальной, и
ее публикация неis a violation of someone's
or  is right, because this is just a translation
Russian languageand a squeeze from open inter-
national standards,  as well as description
specific operating principles taken separately
that payphone card.  I did not use
no internal official documents
company "SPT". This is the result of my research
dovaniya.  If desired, anyone can
do all this work and come to an analogous
gical outputs.I just want saving
spend timepeople interested in modern
new card technologies. Author not non-
set of responsibility for the use of data
document by anyone in illegal
purposes, and for losses incurred when using
the nameof the information presented. This information
mation can be used in anylegal
purposes without restrictions.  If you have,what to add or clarify, please message
shield me.  For any questions you can write
to me at dimik@infopro.spb.su         
                                          
 INTRODUCTION             
                                          
 Not so long ago at the Russian consumer
a whole stream of new payments collapsed
means: payphone cards, magnetic cards
metro, bank cards, etc. Let's touch on
so far only  payphone cards. Probably
everyone wondered how it works
and how a payphone card works, and you can
whether to deceive her. The answer to the second question is
Let's keep silent, but let's try first on
branch  in an accessible and popular form. B
This document provides onlyalgorithm
reading cardsbut nothing is said about
their recording,that is, about the process itself, reducing
changing the number of remaining units. Pos-
Since  experiments  with a decrease in the
real money to me for obvious reasons
I don’t want to carry out, information on this
about myscantyand not verified. Pos-
since, if desired, the most general information
tion can be found on the Internet, then the conversation
will go specifically about  payphone cards
company  "St. Petersburg payphones".
For other cards the information provided may be
may  not correspond to reality.
If you want to understand the workso-
sophone cards in your city, then you want
It is important to first read the document on
ftp://nic.funet.fi/pub/doc/telecom/phonecard/chips,       
where the most common ones are described
world cards.                            
                                          
 Payphone cardcorresponds    
ISO 7816 Parts 1 and 2.         
                                          
ISO 8716-1:1987                           
Identification cards.     
          Integrated circuit cards 
          with contacts.                   
          Part 1. Physical characteristics 
          tics.                           
CTK 1 code B 4 s.         ed.1 
                                          
ISO 8716-2:1988                           
Identification cards.     
          Integrated circuit cards 
  with contacts.                   
  Part 2. Dimensions and location 
  contacts.                      
CTK 1 code D 7 s.         ed.1 
                                          
 The crystal on the map represents
electrically programmable ROM  with after-
consistent beatenoutput of information,
manufactured using NMOS technology. In this
ROM  is used 128 bits. To reprogram
frame the card,you need to erase the information
tion  from  ROM,  but the chip is protected from
ultraviolet irradiation special
resin. Even if you manage to erase the chip,
then you will need toreprogramspecial
cial area of the manufacturer - first 64
bit,and it is write-protected by a fusible
fuse, which is blown on
factory during  production of  chip. Main
way  of deceiving payphones - manufacturing
emulators,  i.e.  devices emulating
work of a real card. It's pretty easy
make on modern single-chip mi-krocomputer.  The main way to protect payphones
from such emulators - measurement of inter-
electrode resistances,capacitances and comparison
combining them with  nominal ones,  which allows
payphone to distinguish the emulator from the real one
cards.                                    
                                          
 LOCATION AND PURPOSE   
       CONTACTS ON THE MAP.      
                                          
 ,-------------+-------------,                    
               │ 1 │ 5 │                    
               +------- │ /-------+                    
               │ 2 +----+ + b │                    
               +--------│ │--------+                    
               │ 3 +----+----+ 7 │                    
               +-------/ │ -------+                    
               │ 4 │ 8 │                    
               '-------------+------------'                    
                                          
1 : VCC = 5V - Power                    
2 : Reset (input) - Initialization signal
cards.                                    
3 : Clk (input) - Clock pulses     
4 : Not used                       
5 : GND (ground)                           
6 : Not used                       
7 : I/O - (input and output) - Bit input
and withdrawal from the card.                          
8 : Not used                       
                                          
 All signals  correspond to TTL levels.
Please note that the central
Teena is connected to the earth.                 
                                          
 READING INFORMATION FROM THE CARD    
                                          
 Inside the  card there is a address counter
bit size  9 bits. That is, after reading
every  512 bits  everything starts over.
The counter can only be increased. If
You want to read the bit with address less than those
Tabernacle, then  the counter needs reset to 0,a
then increase to the required value.
The reset operation looks like this: You need to set
turn high signal level Reset (2 con-
card clock) and then set and reset
signal  Clk.After resetting the signal Reset to
output (7 pin card) will be available
bit with address 0.                          
                                          
 __________________│             │_______________________________ Reset    
        :             :                                         
        :      ____   :  ____      ____      ____               
   _____:_____│    │__:_│    │____│    │____│    │____ Clk      
        :     :       : :    :    :    :    :    :              
   _____:_____:_______:_:____:____:____:____:____:_____         
   _____:__n__│___0___:_│____1____│____2____│____3_____ Address 
        :             :      :         :         :              
   _____:             :______:_________:_________:_____         
   _____ХХХХХХХХХХХХХХХ______│_________│_________│_____ Data    
   Bit n                Bit 0   Bit 1     Bit 2    Bit 3        
                                          
 Теперь нужно  подавать  тактовые импульсы
на  вход  Clk (3 контакт карты). По фронту
импульса  происходит увеличение на единицу
внутреннего счетчика адреса. По спаду так-
тового импульса следующий бит данных появ-
ляетсяon output. It is usually more convenient to represent
send information in the form of bytes. For this
every 8 read bits are grouped into a byte,
considering that the least is read first
significant bit.  Thus,sequential
exactly reading  1,0,0,1,0,1,1,1, we get
byte OxE9.                                
                                          
 READING THROUGH PARALLEL   
         COMPUTER PORT        
                                          
 Since all signals correspond
level TTL,  then it is logical to use for
information reading ordinary printer
port  I don’t think it’s necessary to include it here
full technical description of the operation of the para-
link port, pin assignments and
description of I/O ports   - that's all
can be found in a special technical
literature                                 
                                          
 HARDWARE       
The hardware is
reciprocal part of the connector parallel port
that a piece of mounting wire and a reading
device that can represent co-
fightan ordinary piece of textolitewith a hole
parts into which the pins are inserted. Right
yes, in this casea card will need to be
press  with your hands.  Let's connect the contacts parallel
line port with card contacts in
according tothe table below:      
                                          
 parallel port ╎ card    
        --------------------╎---------   
 2 : D0 (output)  ╎ 2 : Reset   
 3 : D1 (output)  ╎ 3 : Clk     
 11 : Busy (input) ╎ 7:I/O     
 25 : Gnd  ╎ 5 : Gnd     
                                          
 Here is not specifiedpin 1 cards - pi-
voltage +5V. It can be taken from the connector
Viaturas or simply from a battery.          
                                          
   SOFTWARE      
                                          
 We use  LPT1 port. Write to printer-
This port is provided via port 0x378.
The written byte  appears  on the weekend
contacts. Weuse bit 0for the signal
Reset and bit 1 for signal Clk. Reading you
is filled via port 0x379. In the oldest
In this bit the inverted value will appear
from input pin 11 (Busy). In short,
The actual program is in the filereadcard.c. 
                                          
 WHAT EXACTLY IS WRITTEN ON THE CARD  
                                          
 Now wecome tothe most interesting part
place - the purpose of each bit recorded -
nogo on the map. Naturally, on the cards
other  cities this assignment will be different
gim, but we, as promised, are talking about St. Petersburg
sky cards.  On the card are used
only  16 bytes. All others are equal to OxFF.
In the process of research about
300 cards.                             
                                          
 EXAMPLES OF MEMORY CARDS       
                                          
 This 50 unit card is over. Number
0050415503.                               
 Valid until 09.30.98                      
 E9, 30, FF, 01, F1, E2, 80, C0         
   00, 00, 00, 00, 00, FF, 18, EA         
                                          
 This 400 unit card is also empty. But- 
measures 0400155921.                           
 Valid until 09.30.98                      
 E9, 30, FF, 01, 88, A7, 9B, E8         
   00, 00, 00, 00, 00, FF, D9, 79         
                                          
 Here is a map for 1000 units. 998 left.  
Number 1000013039.                         
 Expiration date: 12/31/99                      
 E9, 30, FF, 01, F7, 3F, 59, DC         
   00, 01, 7F, 0F, 3F, FF, 68, 6B         
                                          
 Then I called using this card. Remaining 
6 units.                                 
 E9, 30, FF, 01, F7, 3F, 59, DC         
   00, 00, 00, 00, 3F, FF, 68, 6B         
                                          
 Finally, it ended.                
 E9, 30, FF, 01, F7, 3F, 59, DC         
   00, 00, 00, 00, 00, FF, 68, 6B         
                                          
 FIELDS ASSIGNMENT          
                                          
1.  First  4 bytes - some kind of identification-
torus On all cards E9, 30, FF, 01.       
                                          
2. Next 4 bytes - serial number of the card
you.  Arranging the bits in bytes in reverse
order, and then the bytes themselves, we get 32
unsigned bit integer. For example, buy
you F7, 3F, 59, DC inverted bit order
look like EF, FC, 9A, 3B. Get the number
mapsOxЗB9AFCEF or 1000013039 in decimal
nom form.  It is easy to see that number,
printed on the card, always consists of
10 digits, and the first 4 digits - card capacity
points.                                    
                                          
3. Next 5 bytes - number of units,
remaining on the card.  Storage format
very interesting: quantity is used
unit bits in a byte, starting with the least significant
th.   Accordingly, the value  of byte 07
corresponds to 3 units, value 1F -
five, and 7F - seven units.Maximum
number of  units  stored in a byte -
seven.  Accordingly, eight-
ary number system. Thus,bytes 00, 01, 7F, 0F, 3F correspond
01746 in the octal system or998unit
prostrate in the decimal system.Maximum co-
The number of units  can be expressed as a number
77777 in octal or32767 in decimal
noy system.                              
                                          
4. The next byte is always equal to FF. It looks like
it is not used.                       
                                          
5. The last two bytes appear to be
press  CRC or other control code for
the first  8 constant bytes, since at consumption
units they do not change, but for each
they are yours. For now their purpose
not clear.                                  
 It was discovered that the expiration date was not recorded
san on the map. Apparently he somehow
associated with the card number. Perhaps everyone
expiration date corresponds to a certain
number range.                         
                                          
 As already mentioned, from  10 digits of the number
the first 4 express the card capacity. Remaining
6 do not uniquely identify the card
but, because More than million cards have already been released.
expiration date corresponds to a certain
number range.                         
                                          
 As already mentioned, from  10 digits of the number
the first 4 express the card capacity. Remaining
6 do not uniquely identify the card
but, because More than million cards have already been released.
In total, with such a numbering system, it can
exist 6 million cards:            
                                          
For 25 units with numbers from 0025000000 to
0025999999.                               
For 50 units with numbers from 0050000000 to
0050999999.                               
For 100 units with numbers from 0100000000 to
0100999999.                               
For 200 units with numbers from 0200000000 to
0200999999.                               
For 400 units with numbers from 0400000000 to
0400999999.                               
For 1000 units with numbers from 1000000000 to
1000999999.