(General Observations)
Line 3: Line 3:
 
* always exactly 114 byte
 
* always exactly 114 byte
 
* all binary, there are no recognizable ASCII strings in this
 
* all binary, there are no recognizable ASCII strings in this
* there's ~40 bytes towards the end with very high entropy, possibly some kind of signature
+
* there's two 14-15 byte variable lengths blocks towards the end with very high entropy, possibly some kind of signature
 
* based on currently only 4 samples, so there's limited confidence in this
 
* based on currently only 4 samples, so there's limited confidence in this
 
* 0:4 - 2:1 (14 bit) is "3018", which is the UIC operator code of Thalys. This matches Appendix C of ANNEX B.6 of TAP TSI, but unfortunately only for the first 18 bit it seems. Might still mean a similar encoding is used, but in a different layout.
 
* 0:4 - 2:1 (14 bit) is "3018", which is the UIC operator code of Thalys. This matches Appendix C of ANNEX B.6 of TAP TSI, but unfortunately only for the first 18 bit it seems. Might still mean a similar encoding is used, but in a different layout.
* correlation between samples suggests 20-26 contain departure and arrival stations in an so farunknown encoding
+
* correlation between samples suggests 20-26 contain departure and arrival stations in an so far unknown encoding
  
 
= Bit Layout =
 
= Bit Layout =
Line 29: Line 29:
 
| 55:0 - 58:7 || 0xc0 0a 80 30 || || fixed in all samples
 
| 55:0 - 58:7 || 0xc0 0a 80 30 || || fixed in all samples
 
|-
 
|-
| 59:0 - 105:7 || TODO || ||
+
| 59:0 - 59:7 || 0x2C or 0x2E || ||
 
|-
 
|-
| 106:0 - 113:7 || null || ||
+
|}
 +
 
 +
After this there follow two blocks with the following variable length layout:
 +
 
 +
{| class="wikitable"
 +
! Byte[:Bit] (MSB) !! Content !! Meaning !! Notes
 +
|-
 +
| 0:0 - 0:7 || 0x02 || || fixed
 +
|-
 +
| 1:0 - 1:7 || 8bit uint || length ||
 +
|-
 +
| N bytes ||  || || high entropy content
 
|-
 
|-
 
|}
 
|}
 +
 +
Remaining bytes are filled by null until reaching 114 bytes.

Revision as of 18:51, 8 February 2020

General Observations

  • always exactly 114 byte
  • all binary, there are no recognizable ASCII strings in this
  • there's two 14-15 byte variable lengths blocks towards the end with very high entropy, possibly some kind of signature
  • based on currently only 4 samples, so there's limited confidence in this
  • 0:4 - 2:1 (14 bit) is "3018", which is the UIC operator code of Thalys. This matches Appendix C of ANNEX B.6 of TAP TSI, but unfortunately only for the first 18 bit it seems. Might still mean a similar encoding is used, but in a different layout.
  • correlation between samples suggests 20-26 contain departure and arrival stations in an so far unknown encoding

Bit Layout

Byte[:Bit] (MSB) Content Meaning Notes
0:0 - 4:7 0x32 F2 84 20 40 fixed in all samples
5:0 - 5:7 0x01 or 0x02 class
6:0 - 8:7 null
9:0 - 35:7 TODO
36:0 - 42:7 null
43:0 - 49:7 0x9a 0c 28 82 c8 22 b2 fixed in all samples
50:0 - 54:7 TODO
55:0 - 58:7 0xc0 0a 80 30 fixed in all samples
59:0 - 59:7 0x2C or 0x2E

After this there follow two blocks with the following variable length layout:

Byte[:Bit] (MSB) Content Meaning Notes
0:0 - 0:7 0x02 fixed
1:0 - 1:7 8bit uint length
N bytes high entropy content

Remaining bytes are filled by null until reaching 114 bytes.


Content is available under Creative Commons License SA 4.0 unless otherwise noted.