BUSIT - metrodroid/metrodroid GitHub Wiki

BUSIT is the public transit smart card used in Hamilton City and the greater Waikato Region, New Zealand. SmartRide is the public transit smart card used in Rotorua, NEw Zealand

Metrodroid v2.9.38 adds support for these cards.

Keying

The card technology is MIFARE Classic 1K (likely Fudan Microelectronics FM11RF08). All sectors use a default Key A and B (FF FF FF FF FF FF).

Because this is a factory-default key, one does not need additional encryption keys to be able to read this card.

Sector Layout

Sector Block Content
0 0 MIFARE UID and manufacturer information
0 1 Preamble: card magic
0 2 Empty (00)
1-4 0-2 Record group 1 (see below)
5-8 0-2 Record group 2 (see below)
9 0-2 Empty (00)
10 0 Empty (00)
10 1 Unknown
10 2 Empty (00)
11-15 0-2 Empty (00)

Records

All data on the card is little endian. Record lengths are shown in bytes, inclusive of the first and last bytes, unless otherwise specified.

Sector 0 Block 1

First Last Length Field description
0 4 5 Card magic: Panda (BUSIT) or Valid (Rotorua)
5 5 1 Record group indicator: 0x00 (group 1) or 0x10 (group 2)
6 12 7 ff-filled
13 14 2 Some kind of hash?
15 15 1 0xff

Sector 0 Block 2

Zero-filled

Record groups

There are two record groups on the card with the same structure.

Sector Block Content
1/5 0 Preamble / card number
1/5 1 Unknown
1/5 2 Empty (FF)
2/6 0 Empty (FF)
2/6 1 Balance
2/6 2 Empty (FF)
3/7 0 Last trip and refill
3/7 1 Empty (FF)
3/7 2 Mostly empty (FF)
4/8 0 Empty (FF)
4/8 1 Mostly empty (FF)
4/8 2 Empty (00)

Sector 1/5 Block 0

First Last Length Field description
0 1 2 Constant 0xffff
2 3 2 Card format variant: 0x4850 for BUSIT and Rotorua. 0x4321 for related Otago card.
4 7 4 Card number (binary-coded decimal)
8 15 8 ???

Sector 1/5 Block 1

Unknown. Seems to differ between activated and unactivated cards but otherwise constant. Maybe they indicate card/discount type

Sector 1/5 Block 2

Filled by ff

Sector 2/6 Block 1

First Last Length Field description
9 10 2 Balance (cents)

Other bytes seem to be constant, maybe they indicate card/discount type

Sector 2/6 Block 2

Filled by ff

Sector 3/7 Block 0

First Last Length Field description
0 0 1 Last trip transaction type?
1 3 3 Last trip timestamp
4 4 1 Some kind of terminal ID?
5 6 2 Cost of last trip
7 7 1 Last refill transaction type?
8 10 3 Last refill timestamp
11 11 1 Last refill some kind of terminal ID?
12 13 2 Always zero
14 15 2 Always 0xff

Sector 3/7 Block 1 and 2

Filled by ff

Sector 4/8 Block 0

Filled by ff

Sector 4/8 Block 1

Mostly ff-filled. Bytes 13-14 contain some kind of hash

Sector 4/8 Block 2

Zero-filled

References