KDE PIM/KItinerary/MAV Barcode
< KDE PIM | KItinerary
General Observation
- Uses PDF417 barcode format.
- Variable length.
- For domestic tickets only.
- No similarities with a known ERA format.
Outer Structure
- Two byte header, fixed 0x0403.
- Gzip-compressed payload using deflate compression, starting with the standard Gzip header 0x1f8b0800000000000000.
- 256 remaining bytes, high entropy and length suggest a cryptographic signature.
Payload Structure
Note: this is based on very few samples so far and thus isn't very reliable yet!
- Seems byte- rather than bit-aligned.
- String encoding is UTF-8.
- Number encoding seems big endian.
- Variable length, observed between 217 and 274 bytes.
- Content has a high amount of null bytes.
Layout
| Offset | Size | Data Type | Meaning | Notes |
|---|---|---|---|---|
| 0 | 17 | string | ticket number | printed as "CIV" on the PDF, numeric |
| 17 | 22 | ? | ? | |
| 39 | 45 | string | passenger name | null terminated |
| 84 | 4 | uint32 | passenger birth date | year * 10000 + month * 100 + day |
| 88 | 128 | ? | ? | |
| 216 | 17 | ? | ? | bytes 216 and following are only present on tickets with seat reservations |
| 233 | 5 | string | train number | null-terminated |
| 238 | 2 | ? | coach number? | numeric or string encoding, too few samples to be sure |
| 240 | 6 | numeric | seat number? | too few samples to be sure |
| 246 | 28 | null | ? | null bytes in all samples |