KDE PIM/KItinerary/MAV Barcode

Current Version (>= 2020?)

General Observation

• Uses PDF417 barcode format, same content on PDF and in the official app.
• Variable length.
• For domestic tickets only.
• No similarities with a known ERA format.

Outer Structure

• Two byte header, fixed 0x0403.
• Gzip-compressed payload using deflate compression, starting with the standard Gzip header 0x1f8b0800000000000000.
• 256 remaining bytes, high entropy and length suggest a cryptographic signature.

Payload Structure

Note: this is based on very few samples so far and thus isn't very reliable yet!

• Seems byte- rather than bit-aligned.
• String encoding is UTF-8.
• Number encoding seems big endian.
• Content has a high amount of null bytes.
• Date/time values are encoded as seconds since Jan 1st 2017. Times are local but do not account for DST. (Exception: traveler birth date).
• At least three observed variants, so maybe some kind of (fixed-length?) block structure (but no signs of TLV):
  • 217 bytes, personalized train ticket without seat reservation
  • 274 bytes, personalized train ticket with seat reservation
  • 153 bytes, bike addon ticket

Layout

Offset	Size	Data Type	Meaning	Notes
0	17	string	ticket number	printed as "CIV" on the PDF
17	1	null	?
18	2	uint16	UIC company code	issuer or carrier, 0x0483 (1155) for MAV
20	4	time	issuing time
24	15	?	?
39	45	string	passenger name	null terminated
84	4	uint32	passenger birth date	year * 10000 + month * 100 + day
88	15	null	?	null in all samples
103	4	?	?
107	3	uint24	UIC departure station code	including the national prefix ('55' for HU)
110	3	uint24	UIC arrival station code
113	90	null	?	null in all samples
203	1	text	class	"1" or "2"
204	1	?	?	0x01 in all samples
205	4	time	time of validity/travel
209	8	?	?
217	3	uint24	UIC departure station code	byte 217 and following are only present in tickets with seat reservations
220	3	uint24	UIC arrival station code
223	4	?	?
227	4	time	time of validity/travel	same as byte 205
231	2	?	?
233	5	string	train number	null-terminated
238	2	?	coach number?	numeric or string encoding, too few samples to be sure
240	6	numeric	seat number?	too few samples to be sure
246	28	null	?	null bytes in all samples

Missing/Suspected Information

• Station names are not included, but station codes might be. UIC station numbers (possibly without the country prefix) would be the obvious suspect, given the MÁV website uses those as well.
• If the train number is included, one would expect at least the day of travel to be included as well.
• Class: several candidate locations exist, but given it's small footprint we need a lot more samples to confirm one of those.

Old Format (<2020?)

General Structure

• QR code containing a hex string
• content of the hex string is zlib-compressed, no header bytes
• result of decompression is a UTF-8 encoded string
  • the first 512 bytes appear to be a hex string again, length and entropy suggest a cryptographic signature
  • the second part looks like a '!' delimited list

Content

Index	Format	Meaning	Notes
0	~<number>	ticket number	printed as "CIV" in the PDF
1		passenger name
2	yyyy.MM.dd	passenger birth date
3		total price	in HUF
4	?	?	"P05"
5	yyyy.MM.dd hh:mm	begin of validity
6	yyyy.MM.dd hh:mm~v	end of validity	no idea what the literal '~v' means there
7	MÁV <number>	?	found in the "Km" column in the PDF
8	'-' separated string	vias
9		departure station name
10		arrival station name
11			empty?
12			empty?
13			empty?
14			empty?
15		train number	number only, not product/category prefix
16		class
17	yyyy.MM.dd~m	day of travel?
18	string	tariff?	e.g. "Teljesárú" (full price)
19	<number>~h	ticket price	in HUF
20		departure station name	possibly for the seat reservation
21		arrival station name	possibly for the seat reservation
22	yyyy.DD.mm	day of travel?
23	hh:mm	time of departure
24			empty?
25			empty?
26		train number	incl. product/category prefix
27		coach number
28		seat number
29	number	price of reservation	in HUF
30		reservation type?	"Helyjegy", "Pót- és helyjegy"
31	MÁV <number>	?	same as entry 7, not always present