BUSIT - metrodroid/metrodroid GitHub Wiki
BUSIT is the public transit smart card used in Hamilton City and the greater Waikato Region, New Zealand. SmartRide is the public transit smart card used in Rotorua, NEw Zealand
Metrodroid v2.9.38 adds support for these cards.
Keying
The card technology is MIFARE Classic 1K (likely Fudan Microelectronics FM11RF08). All sectors use a default Key A and B (FF FF FF FF FF FF).
Because this is a factory-default key, one does not need additional encryption keys to be able to read this card.
Sector Layout
| Sector | Block | Content | 
|---|---|---|
| 0 | 0 | MIFARE UID and manufacturer information | 
| 0 | 1 | Preamble: card magic | 
| 0 | 2 | Empty (00) | 
| 1-4 | 0-2 | Record group 1 (see below) | 
| 5-8 | 0-2 | Record group 2 (see below) | 
| 9 | 0-2 | Empty (00) | 
| 10 | 0 | Empty (00) | 
| 10 | 1 | Unknown | 
| 10 | 2 | Empty (00) | 
| 11-15 | 0-2 | Empty (00) | 
Records
All data on the card is little endian. Record lengths are shown in bytes, inclusive of the first and last bytes, unless otherwise specified.
Sector 0 Block 1
| First | Last | Length | Field description | 
|---|---|---|---|
| 0 | 4 | 5 | Card magic: Panda (BUSIT) or Valid (Rotorua) | 
| 5 | 5 | 1 | Record group indicator: 0x00 (group 1) or 0x10 (group 2) | 
| 6 | 12 | 7 | ff-filled | 
| 13 | 14 | 2 | Some kind of hash? | 
| 15 | 15 | 1 | 0xff | 
Sector 0 Block 2
Zero-filled
Record groups
There are two record groups on the card with the same structure.
| Sector | Block | Content | 
|---|---|---|
| 1/5 | 0 | Preamble / card number | 
| 1/5 | 1 | Unknown | 
| 1/5 | 2 | Empty (FF) | 
| 2/6 | 0 | Empty (FF) | 
| 2/6 | 1 | Balance | 
| 2/6 | 2 | Empty (FF) | 
| 3/7 | 0 | Last trip and refill | 
| 3/7 | 1 | Empty (FF) | 
| 3/7 | 2 | Mostly empty (FF) | 
| 4/8 | 0 | Empty (FF) | 
| 4/8 | 1 | Mostly empty (FF) | 
| 4/8 | 2 | Empty (00) | 
Sector 1/5 Block 0
| First | Last | Length | Field description | 
|---|---|---|---|
| 0 | 1 | 2 | Constant 0xffff | 
| 2 | 3 | 2 | Card format variant: 0x4850 for BUSIT and Rotorua. 0x4321 for related Otago card. | 
| 4 | 7 | 4 | Card number (binary-coded decimal) | 
| 8 | 15 | 8 | ??? | 
Sector 1/5 Block 1
Unknown. Seems to differ between activated and unactivated cards but otherwise constant. Maybe they indicate card/discount type
Sector 1/5 Block 2
Filled by ff
Sector 2/6 Block 1
| First | Last | Length | Field description | 
|---|---|---|---|
| 9 | 10 | 2 | Balance (cents) | 
Other bytes seem to be constant, maybe they indicate card/discount type
Sector 2/6 Block 2
Filled by ff
Sector 3/7 Block 0
| First | Last | Length | Field description | 
|---|---|---|---|
| 0 | 0 | 1 | Last trip transaction type? | 
| 1 | 3 | 3 | Last trip timestamp | 
| 4 | 4 | 1 | Some kind of terminal ID? | 
| 5 | 6 | 2 | Cost of last trip | 
| 7 | 7 | 1 | Last refill transaction type? | 
| 8 | 10 | 3 | Last refill timestamp | 
| 11 | 11 | 1 | Last refill some kind of terminal ID? | 
| 12 | 13 | 2 | Always zero | 
| 14 | 15 | 2 | Always 0xff | 
Sector 3/7 Block 1 and 2
Filled by ff
Sector 4/8 Block 0
Filled by ff
Sector 4/8 Block 1
Mostly ff-filled. Bytes 13-14 contain some kind of hash
Sector 4/8 Block 2
Zero-filled
References
- Stephen Shkardoon: Cracking the Waikato bus card system
 - BalanceIT (stand-alone Android application for reading the balance of a BUSIT card)