KDE PIM/KItinerary/MAV Barcode
< KDE PIM | KItinerary
General Observation
- Uses PDF417 barcode format.
- Variable length.
- For domestic tickets only.
- No similarities with a known ERA format.
Outer Structure
- Two byte header, fixed 0x0403.
- Gzip-compressed payload using deflate compression, starting with the standard Gzip header 0x1f8b0800000000000000.
- 256 remaining bytes, high entropy and length suggest a cryptographic signature.
Payload Structure
Note: this is based on very few samples so far and thus isn't very reliable yet!
- Seems byte- rather than bit-aligned.
- String encoding is UTF-8.
- Number encoding seems big endian.
- Variable length, observed between 217 and 274 bytes.
- Content has a high amount of null bytes.
- Date/time values are encoded as seconds since Jan 1st 2017. Times are local but do not account for DST. (Exception: traveler birth date).
Layout
| Offset | Size | Data Type | Meaning | Notes |
|---|---|---|---|---|
| 0 | 17 | string | ticket number | printed as "CIV" on the PDF |
| 17 | 1 | null | ? | |
| 18 | 2 | uint16 | UIC company code | issuer or carrier, 0x0483 (1155) for MAV |
| 20 | 4 | time | issuing time | |
| 24 | 15 | ? | ? | |
| 39 | 45 | string | passenger name | null terminated |
| 84 | 4 | uint32 | passenger birth date | year * 10000 + month * 100 + day |
| 88 | 15 | null | ? | null in all samples |
| 103 | 4 | ? | ? | |
| 107 | 3 | uint24 | UIC departure station code | including the national prefix ('55' for HU) |
| 110 | 3 | uint24 | UIC arrival station code | |
| 113 | 90 | null | ? | null in all samples |
| 203 | 1 | text | class | "1" or "2" |
| 204 | 1 | ? | ? | 0x01 in all samples |
| 205 | 4 | time | time of validity/travel | |
| 209 | 8 | ? | ? | |
| 217 | 3 | uint24 | UIC departure station code | byte 217 and following are only present in tickets with seat reservations |
| 220 | 3 | uint24 | UIC arrival station code | |
| 223 | 4 | ? | ? | |
| 227 | 4 | time | time of validity/travel | same as byte 205 |
| 231 | 2 | ? | ? | |
| 233 | 5 | string | train number | null-terminated |
| 238 | 2 | ? | coach number? | numeric or string encoding, too few samples to be sure |
| 240 | 6 | numeric | seat number? | too few samples to be sure |
| 246 | 28 | null | ? | null bytes in all samples |
Missing/Suspected Information
Station names are not included, but station codes might be. UIC station numbers (possibly without the country prefix) would be the obvious suspect, given the MÁV website uses those as well.If the train number is included, one would expect at least the day of travel to be included as well.Class: several candidate locations exist, but given it's small footprint we need a lot more samples to confirm one of those.