KDE PIM/KItinerary/Koleje Mazowiekie

General Observation

• PDF contains a Code 128 1D code and a QR code
• The 1D code contains the ticket number (CP \d+), which is also printed under the QR code
• Both codes in the PDF are implemented as ungrouped individual rectangle paths, which currently failed to be recognized.
• The QR code contains a base64 encoded payload
• Content varies in size (87-89 after base64 decoding in the known samples)
• Content seems byte-aligned
• The content seems backwards!?

Payload structure

Offset	Size	Data Type	Meaning	Notes
0	3			0x03 0x01 0x20
3	2			"PC" (CP backwards, the prefix found in front of the ticket number)
5	4	uint32 LE	ticket number
9	2
10	1			0x00
11	1	uint8		the number printed after "OF:" in the upper right
12	1			0x00
13	1	uint8	number of passengers?	the number printed after "N:" in the upper right
14	1			0x00
15	12
27	2	uint16 LE	departure station code	same ids found in PKP tickets, but not matching any so far known id schema
29	2	uint16 LE	arrival station code
31	10	string	passenger name	given/family name separated by '.', given name truncated to fit, string in reverse order!?
41	varying	ASN.1	signature