💾 Archived View for spam.works › mirrors › textfiles › phreak › smartcar.txt captured on 2023-06-16 at 19:49:24.

View Raw

More Information

-=-=-=-=-=-=-

                 
  ._______..___.._______.._______.                                
  |?     ?||? ?||? . . ?||?  .  ?|            Sir SnOoze   (TiTins)
  |       ||_ _||  ? ?  ||   |   |            LAzzER       (TiTins)
  |       ||   ||  | |  ||   |   |            Cyanide      (TiTins)
  |__   __||   ||  | |  ||   |___|            Numark       (TiTins)
    |   |  |   ||  | |  ||   ._>_.    
    |   |  |   ||  | |  ||   |   |            Node 1 16.8 Daul    
    |   |  |   ||  | |  ||   |   |            Node 2 14.4 Bis   
    |   |  |   ||  | |  ||   !   |  Over 540 Mb Online COOl 5:1 Ratios  
    |___|  |___||__|_|__||_______|   [AMiGA]=*=[iBM-PC]=*=[CONSLE ALL]     
                                                                  
                  sMeG uTiLiTiEs WHQ / TiTANS UK HQ  

 Node 1 0181 You Know 16.8 Daul          Node 2 0181 You Know 14.4 Bis
.@BEGIN_FILE_ID.DIZ
 Telecard/Smartcard technical
       specs. and nfo
================================
 What you need to know about 
electronics telecards/smartcards
================================
Sourced from SpArC
@END_FILE_ID.DIZ

(C) Stephane BAUSSON - (1993-1995)
Version 1.07 (Last revised: 15-01-1995)

Email: sbausson@ensem.u-nancy.fr

Smail: 4, Rue de Grand
       F-88630 Chermisey
       France

Phone: +33 29.06.09.89
-------------------------------------------------------------------------------
    Any suggestions or comments about phonecards and smart-cards are welcome
-------------------------------------------------------------------------------

                              Content
                             ---------

 I ) The cards from Gemplus, Solaic, Schlumberger, Oberthur:

    I-1) Introduction:
    I-2) SCHEMATICS of the chip:
    I-3) PINOUT of the connector:
    I-4) Main features:
    I-5) TIME DIAGRAMS:
    I-6) Memory MAP of cards from France and Monaco:
    I-5) Memory MAP of cards from other countries:

II ) The cards from ODS: (German cards)

    II-1) Introduction:
    II-2) Pinout:
    II-3) Main features:
    II-4) Time Diagrams:
    II-5) Memory Map:
    II-6) Electrical features:


III) Schematics of Readers:

    III-1) Reader 1:
    III-2) Reader 2:

IV) The program:

-------------------------------------------------------------------------------

I ) The cards from Gemplus, Solaic, Schlumberger, Oberthur: (French cards)
    ======================================================================

    I-1) Introduction:
         ------------

       Since the middle of 80's have appeared a new generation of cards  ( the
smart-cards  or  chip cards )  that have  replaced most of the magnetics cards
applications  notably  for  telecom payement and  also for credit cards. These
cards are far more secure than the magnetics cards, and there are several kind
of  cards following  the application.  The simplier ones are the Simple Memory
cards  like the  one used as  Telecard  for the telecom payement in the public
phone-booths  ( Generaly all the memory content is  readable,  and there  is a
maker-area that is unwritable ) , then there are  more sofisticated  cards:
Memeory Cards with some area read protected by a key, these cards can  contain
some  private informations in  the read-protected area.   At the end there are
microprocessor-cards (cards working following the ISO-7816 protocol), that are
the safiest ones  since these cards  have their own internal  Operating System
that prevent  I/O  if the Pin code  has not been entered  in the cards  before
( These cards are used  when confidentiality  is needed,  like in  bank cards,
crypted TV access cards, health cards, etc ... ).


       About telecards, even if these cards are the less safe ones, don't think
that  you  are  going  to  phone freely for that, in fact no.  All the data are
readable since  there are  no confidential data inside,  the the cards are well
done  enough to be  very secure for  the payement of  telecom communications in
public booth.

       So, what is a phonecard exactly ? In fact generaly it's a 256 bits EPROM
( French likde cards ),  or a 128 bits EEPROM (German like cards) with a serial
output and some other control pins.

       Then why can it not be refilled ?   Well,  indeed to refill the card you
will  have to erase the cards with UV,  knowing that the cards is coated in  UV
opaqued resin that prevent  UV from reaching the silicium chip, and even if you
could  to erase the chip  you will have to program the manufactuer area that is
write-protected by a lock-out fuse that was fused after the card programming in
factory.

       Neithertheless it can be very interesting to study how these cards work,
to see  which kind of data are inside and  how the data are maped  inside or to
see  how many units are left  inside for exemple.  Besides  there  are a  great
number of  applications of  these cards when there  are used (only for personal
use of course) , since  you can use them as key to open a door, or you can also
use them as key to secure a program, etc ....

       French Telecards have been created in 1984 and at this time constructors
decided to build these cards in NMOS technology but now, they plan to change by
1994 all readers  in the public booths  and use CMOS technology. Also they plan
to use  EEPROM to secure the cards and to add many usefull infornations in, and
you will perhaps use phone cards to buy you bread or any thing else.

These cards are called Second Generation Telecards.


    I-2) SCHEMATICS of the chip:
         ----------------------

                    .-------------------.
                    |                   |
                  --|> Clk              |
                    | _                 |
                  --| R/W               |
                    |                   |
                  --| Reset             |
                    |                   |
                  --| Fuse              |
                    |                   |
                  --| Vpp               |
                    |                   |
                    |                   |
                    '-.               .-'
                      |               |
                    .-------------------.
                    |               Out |-- serial output
                    '-------------------'


    I-3) PINOUT of the connector:
        -------------------------


          AFNOR CHIP                                   ISO CHIP
          ----------                                   --------

 -------------+-------------                 -------------+-------------
|   8         |         4   |               |   1         |         5   |
|             |             |               |             |             |
+-------\     |     /-------+               +-------\     |     /-------+
|   7    +----+----+    3   |               |   2    +----+    +    6   |
|        |         |        |               |        |         |        |
+--------|         |--------+               +--------|         |--------+
|   6    |         |    2   |               |   3    |         |    7   |
|        +    +----+        |               |        +----+----+        |
+-------/     |     \-------+               +-------/     |     \-------+
|   5         |         1   |               |   4         |         8   |
|             |             |               |             |             |
 -------------+-------------                 -------------+-------------

                                     NB: only the position of the chip is ISO
                                         standardized and not the pinout

PINOUT:    1 : Vcc = 5V        5 : Gnd
------     2 : R/W             6 : Vpp = 21V
           3 : Clock           7 : I/O
           4 : Reset           8 : Fuse

    I-4) Main features:
        ---------------

        - Synchronous protocol.
        - N-MOS technology.
        - 256x1 bit organisation.
        - 96 written protected by a lock-out fuse.
        - Low power 85mW in read mode.
        - 21 V programming voltage.
        - Access time: 500ns
        - Operating range: -100C +700C
        - Ten year data rentention.


    I-5) TIME DIAGRAMS:
        ---------------

+21V                                     _____________
+5V ____________________________________|             |_________________ Vpp
                                        :             :
+5V                  ___________________:_____________:_________________ Reset
0V  ________________|                   :             :
                    :                   :             :
+5V     ____        :      ____         :       ______:______
0V  ___|    |_______:_____|    |________:______|      :      |__________ Clock
       :    :       :     :    :        :      :      :      :
+5V    :    :       :     :    :        :______:______:      :           _
0V  ___:____:_______:_____:____:________|      :      |______:__________ R/W
       :    :       :     :    :        :      :      :      :
+5V    :    :       :_____:    :________:      :      :      :__________
0V  XXXXXXXXXXXXXXXXX_____XXXXXX________XXXXXXXXXXXXXXXXXXXXXX__________ Out
       :    :       :     :    :        :<-----><---->:      :
       :    :       :     :    :        :10 to   10 to       :
       :    :       :     :    :        :50 ms   50ms        :
        Reset        Bit 1        Bit2                           Bit 3
        card        reading      reading  Bit2 writing to 1     reading



    I-6) MEMORY MAP of cards from France and Monaco:
        --------------------------------------------

Bytes       Bits      Binary     Hexa

                    +-----------+-----+
  1        1 --> 8  |           |     | ---> Builder code.
                    +-----------+-----+
  2       9 --> 16  | 0000 0011 | $03 | ---> a french telecard
                    +-----------+-----+
  3      17 --> 24  |           |     |
                    +-----------+-----+
  4      25 --> 32  |           |     |
                    +-----------+-----+
  5      33 --> 40  |           |     |
                    +-----------+-----+
  6      41 --> 48  |           |     |
                    +-----------+-----+
  7      49 --> 56  |           |     |
                    +-----------+-----+
  8      57 --> 64  |           |     |
                    +-----------+-----+
  9      65 --> 72  |           |     |
                    +-----------+-----+
 10      73 --> 80  |           |     |
                    +-----------+-----+
 11      81 --> 88  |           |     |
                    +-----------+-----+
 12      33 --> 40  | 0001 0011 | $13 | ---> 120 units card
                    | 0000 0110 | $06 | --->  50 units card
                    | 0000 0101 | $05 | --->  40 units card
                    +-----------+-----+
 13-31  97 --> 248  |           |     | ---> The units area: each time a unit
                    |           |     |      is used, then a bit is set to "1";
                    |           |     |        Generaly the first ten units are
                    |           |     |      fused in factory as test.
                    |           |     |
                    |           |     |
                    |           |     |
                    +-----------+-----+
 32    249 --> 256  | 1111 1111 | $FF | ---> the card is empty
                    +-----------+-----+



    I-7) MEMORY MAP of the other cards:
        -------------------------------

Bytes       Bits      Binary     Hexa

                    +-----------+-----+
  1        1 --> 8  |           |     |
                    +-----------+-----+
  2       9 --> 16  | 1000 0011 | $83 | ---> a telecard
                    +-----------+-----+-----------+-----+
3-4      17 --> 32  | 1000 0000 | $80 | 0001 0010 | $12 | ---> 10 units card
                    |           |     | 0010 0100 | $24 | ---> 22 units card
                    |           |     | 0010 0111 | $27 | ---> 25 units card
                    |           |     | 0011 0010 | $32 | ---> 30 units card
                    |           |     | 0101 0010 | $52 | ---> 50 units card
                    |           |     | 0110 0010 | $62 | ---> 60 units card
                    |           |     | 1000 0010 | $82 | ---> 80 units card
                    | 1000 0001 | $81 | 0000 0010 | $02 | ---> 100 untis card
                    |           |     | 0010 0010 | $22 | ---> 120 units card
                    |           |     | 0101 0010 | $52 | ---> 150 units card
                    +-----------+-----+-----------+-----+
  5      33 --> 40  |           |     | ---> $00 for sweden.
                    +-----------+-----+
  6      41 --> 48  |           |     |
                    +-----------+-----+
  7      49 --> 56  |           |     |
                    +-----------+-----+
  8      57 --> 64  |           |     |
                    +-----------+-----+
  9      65 --> 72  |           |     |
                    +-----------+-----+
 10      73 --> 80  |           |     |
                    +-----------+-----+
 11      81 --> 88  |           |     | ---> $11 for sweden
                    +-----------+-----+
 12      89 --> 96  | 0001 1110 | $1E | ---> Sweden
                    | 0010 0010 | $22 | ---> Spain
                    | 0011 0000 | $30 | ---> Norway
                    | 0011 0011 | $33 | ---> Andorra
                    | 0011 1100 | $3C | ---> Ireland
                    | 0100 0111 | $47 | ---> Portugal
                    | 0101 0101 | $55 | ---> Czech Republic
                    | 0101 1111 | $5F | ---> Gabon
                    | 0110 0101 | $65 | ---> Finland
                    +-----------+-----+
 13-31  97 --> 248  |           |     | ---> The units area: each time a unit
                    |           |     |      is used, then a bit is set to "1";
                    |           |     |
                    |           |     |      Generaly the first two units are
                    |           |     |      fused in factory as test.
                    |           |     |
                    |           |     |
                    +-----------+-----+
 32    249 --> 256  | 0000 0000 | $00 |
                    +-----------+-----+



II ) The cards from ODS, Giesecke & Devrient, ORGA Karten systeme,
     =============================================================
     Uniqua, Gemplus, Schlumberger and Oldenbourg Kartensysteme:
     ===========================================================

    II-1) Introduction:
          ------------

        These cards are in fact 128 bit memory in NMOS technology, and the
map of these cards are the following:

               64 bit EPROM written protected (manufaturer area).
               40 bit EEPROM (5x8 bits).
               24 bits set to "1".


    II-2) Pinout:
         --------

           ISO 7816-2

  -------------+-------------
 |   1         |         5   |        Pinout:
 |             |             |        -------
 +-------\     |     /-------+
 |   2    +----+    +    6   |          1 : Vcc = 5V    5 : Gnd
 |        |         |        |          2 : Reset       6 : n.c.
 +--------|         |--------+          3 : Clock       7 : I/O
 |   3    |         |    7   |          4 : n.c.        8 : n.c.
 |        +----+----+        |
 +-------/     |     \-------+      n.c. : not connected
 |   4         |         8   |
 |             |             |
  -------------+-------------


    II-3) Main features:
         ---------------

        - ISO 7816- 1/2 compatible.
        - use a single 5V power supply.
        - low power consuption.
        - NMOS technology.

    II-4) Time Diagrams:
        ----------------

Reset:
------
  The address counter is reset to 0 when the clock line CLK is raised while
the control line R is high. Note that the address counter can not be reset
when it is in the range 0 to 7.

      __________________
_____|                  |_____________________________________________ Reset
     :                  :
     :        _____     :  _____       _____       _____       _____
_____:_______|     |____:_|     |_____|     |_____|     |_____|     |_ Clk
     :       :          : :     :     :     :     :     :     :     :
_____:_______:__________:_:_____:_____:_____:_____:_____:_____:_____:_
_____:___n___|_____0____:_|_____1_____|_____2_____|_____3_____|___4_:_ (Address)
     :                  :       :           :           :           :
_____:                  :_______:___________:___________:___________:_
_____XXXXXXXXXXXXXXXXXXXX_______|___________|___________|___________|_ Data
Bit n                      Bit 0    Bit 1        Bit2       Bit3

   The address counter is incremented by 1 with each rising edge of the clock
signal Clk, for as long as the control line R remains low. The data held in
each addressed bit is output to I/O contact each time Clk falls. It is not
impossible to decrement the address counter, therefore to address an earlier
bit, the address counter must be reset then incremented to require value.


Write:
------
   All unwritten or erased bits in the address 64-104 may be unwritten to.
When a memory cell is unwritten to, it is set to 0. The addressed cell is
unwritten to by the following sequence.

1- R is raised while Clk is low, to disable address counter increment for one
clock pulse.

2- Clk is then raised for a minimum of 10ms to write to the address bit.

When to write operation ends, and Clk falls, the address counter is unlocked,
and the content of the written cell, which is now 0, is output to I/O contact
if the operation is correct.
The next Clk pulse will increment the address by one, then the write sequence
can be repeated to write the next bit.

              _____                                _____
_____________|     |______________________________|     |_______________  Reset
             :                                    :
     ___     :           _____           ___      :           _____
____|   |____:__________|     |_________|   |_____:__________|     |____  Clk
    :        :          :     :         :   :     :          :     :
____:________:__________:_____:_________:___:_____:__________:_____:_____
 n  |      n+1          |     n+2       |   :    n+3         |     :       (Address)
----'--------:----------'-----:---------'---:-----:----------'-----:-----
             :          :     :             :     :          :     :
_________   _:          :     : ____________:  ___:          :     :
_________XXX_XXXXXXXXXXXXXXXXXXX____________ XX___XXXXXXXXXXXXXXXXXXXXXXX  I/O
   n      n+1           :     :     n+1        n+2           :     :
                        :     :                              :     :
                         write                                write


WriteCarry:
-----------

   A counter is erased by performing the WRITECARRY sequence on the stage of
the next highest weighing to that to be erased.

The writecarry sequence is as follows:

1 - Set the address counter to an unwritten bit in the next highest counter
stage to that to be erased.

2 - Increment is disabled on the following rising edge of R where Clk remains
low.

3 - Clk is then raised for a minimum of 10ms, while R is low, to write to the
next address bit.

4 - R is the raised again while Clk remains low to disable increment a second
time.

5 - Clk is the raised for a minimum of 1ms, while R is low, to write to the
addressed bit a second time, erasing the counter level immediately below that
the addressed bit.

       _____                      _____
______|     |____________________|     |_________________________________  Rst
      :                          :
      :            _______       :              _______        ___
______:___________|       |______:_____________|       |______|   |______  Clk
      :           :       :      :             :       :      :   :
      :           :       :      :             :       :      :   :
<------------------------- address n ------------------------>:<--- n+1 ------
      :           :       :      :             :       :          :
      :           :       :      :             :       :          :
______:           :       :______:             :       :__________: _____
______XXXXXXXXXXXXXXXXXXXXX______XXXXXXXXXXXXXXXXXXXXXXX__________XX_____  I/O
                  :       :  n                 :       :     n        n+1
                  :       :                    :       :
                    Write                        Erase

     II-5) Memory Map:
         -------------

Bytes       Bits      Binary     Hexa

                    +-----------+-----+
  1       1 -->   8 |           |     |
                    +-----------+-----+
  2       9 -->  16 | 0010 1111 | $2F | ---> Germany
                    | 0011 0111 | $37 | ---> Netherland
                    | 0011 1011 | $3B | ---> Greece
                    +-----------+-----+
  3      17 -->  24 |           |     |
  4      25 -->  32 |           |     | ---> Issuer area (written protected)
  5      33 -->  40 |           |     |
  6      41 -->  48 |           |     |
  7      49 -->  56 |           |     |
  8      57 -->  64 |           |     |
                    +-----------+-----+
  9      65 -->  72 |           |     | ---> c4096  )
 10      73 -->  80 |           |     | --->  c512  )
 11      81 -->  88 |           |     | --->   c64  ) 5 stage octal counter
 12      89 -->  96 |           |     | --->    c8  )
 13      97 --> 104 |           |     | --->    c0  )
                    +-----------+-----+
 14     105 --> 112 | 1111 1111 | $FF |
 15     113 --> 120 | 1111 1111 | $FF | ---> area of bits set to "1"
 16     120 --> 128 | 1111 1111 | $FF |
                    +-----------+-----+

The Issuer area:
----------------

    This issuer consists of 40 bits. The contents of the issuer area are
specified by the card issuer, and are fixed during the manufacturing process.
The contents of the issuer area will include data such as serial numbers,
dates, and distribution centers.

This area may only be read.

The Counter area:
-----------------

   The counter area stores the card's units. Its initial value is specified
by the card issuer and set during manufacturing.

The counter area is divided into a 5 stage abacus. The octal value of each
stage is defined by the number of bits set to '1' and this stage value must
be weighted by the coeficient 8^n ( where n is among [4..0] ).

      Exemple: For a card with 15818 units (or money units) left.
      --------

             Byte9      Byte10     Byte11     Byte12     Byte13
    --------------------------------------------------------------
            00000111 - 00111111 - 01111111 - 00000001 - 00000011
    --------------------------------------------------------------
            (3)octal   (6)octal   (7)octal   (1)octal   (2)octal
    --------------------------------------------------------------
     Value = 3*8^4   +  6*8^3   +  7*8^2   +  1*8^1   +  2*8^
    --------------------------------------------------------------
     TOTAL = 15818 Units



Note that you can only decrease the counter and it is not authorised to write
in the counter a value greater than the old value.


    I-6) Electrical features:
        --------------------

Maximum ratings:
----------------

                       +--------+------+------+------+
                       | Symbol | Min  |  Max | Unit |
+----------------------+--------+------+------+------+
| Supply voltage       |   Vcc  | -0.3 |    6 |   V  |
+----------------------+--------+------+------+------+
| Input voltage        |   Vss  | -0.3 |    6 |   V  |
+----------------------+--------+------+------+------+
| Storage temperature  |  Tstg  |  -20 |  +55 |  0C  |
+----------------------+--------+------+------+------+
| Power dissipassion   |    Pd  |   -  |   50 |  mW  |
+----------------------+--------+------+------+------+


DC caracteristics:
------------------
                            +--------+-----+-----+-----+------+
                            | Symbol | Min.| Typ.| Max.| Unit |
+---------------------------+--------+-----+-----+-----+------+
| Suplly current            |   Icc  |  -  |  -  |   5 |   mA |
+---------------------------+--------+-----+-----+-----+------+
| Input Voltage (low)       |    Vl  |   0 |  -  | 0.8 |    V |
+---------------------------+--------+-----+-----+-----+------+
| Input voltage (high)      |    Vh  | 3.5 |  -  | Vcc |    V |
+---------------------------+--------+-----+-----+-----+------+
| Input current R           |    Ih  |  -  |  -  | 100 |   uA |
+---------------------------+--------+-----+-----+-----+------+
| Input current Clk         |    Il  |  -  |  -  | 100 |   uA |
+---------------------------+--------+-----+-----+-----+------+
| Output current (Vol=0.5V) |   Iol  |  -  |  -  |  10 |   uA |
+---------------------------+--------+-----+-----+-----+------+
| Output current (Voh=5V)   |   Ioh  |  -  |  -  | 0.5 |   mA |
+---------------------------+--------+-----+-----+-----+------+

AC caracteristics:
------------------     +--------+------+------+------+
                       | Symbol | Min. | Max. | Unit |
+----------------------+--------+------+------+------+
| Pulse duration       |    tr  |   50 |   -  |  us  |
| R address reset      |        |      |      |      |
+----------------------+--------+------+------+------+
| Pulse duration       |    ts  |   10 |   -  |  us  |
| R write              |        |      |      |      |
+----------------------+--------+------+------+------+
| High level Clk       |    th  |    8 |   -  |  us  |
+----------------------+--------+------+------+------+
| Low level Clk        |    tl  |   12 |   -  |  us  |
+----------------------+--------+------+------+------+
| Write window         | Twrite |   10 |   -  |  ms  |
+----------------------+--------+------+------+------+
| Erase window         | Terase |   10 |   -  |  ms  |
+----------------------+--------+------+------+------+
|                      |   tv1  |    5 |   -  |  us  |
+----------------------+--------+------+------+------+
|                      |   tv2  |  3.5 |   -  |  us  |
+----------------------+--------+------+------+------+
|                      |   tv3  |  3.5 |   -  |  us  |
+----------------------+--------+------+------+------+
|                      |   tv4  |  3.5 |   -  |  us  |
+----------------------+--------+------+------+------+
|                      |   tv5  |  3.5 |   -  |  us  |
+----------------------+--------+------+------+------+
|                      |   tv6  |    5 |   -  |  us  |
+----------------------+--------+------+------+------+
|                      |   tv7  |    5 |   -  |  us  |
+----------------------+--------+------+------+------+
|                      |   tv8  |   10 |   -  |  us  |
+----------------------+--------+------+------+------+



III) Schematics of Readers:
    =======================

     III-1) Reader 1:
           ----------

   External 5V (Optional)

5V o------,
          |                 /             T2  PNP      d13  r7 10
0V o--,   |                /               BC 177     |\ |  _____
      |   |      ,-------o/   o--*------. E      C .--| >+-[_____]--------,
    __+__ |      |               |       \        /   |/ |                |
    \\\\\ |    __|__ Batery      |         \    /                         |
          |      -   22.5V       |       ---------                        |
.......   |      |               |   _____   |   _____                    |
       :  |    __+__             +--[_____]--*--[_____]--,                |
   D2  :  |    \\\\\                r6 150k     r5 15k   |                |
4 o-------|---------------------------*------------------|-------------,  |
       :  |                           |   r3 220k       / C            |  |
   Ack :  |                           |   _____      |/    T1 - NPN    |  |
10 o------|--------.                  '--[_____]-*---|      BC107      |  |
       :  |        |                      _____  |   |\                |  |
       : ,-,      ,-,                 +--[_____]-'      \ E            |  |
       : | |r2    | |r1               |  r4 390k         |             |  |
       : | |220   | |22k            __+__              __+__           |  |
       : |_|      |_|               \\\\\              \\\\\           |  |
       :  |  |\ |  |                                                   |  |
       :  *--| >+--|----------------*----------------------------------|--*
       :  |  |/ |  |          ,-----|-----------------------------,    |  |
       :  |  d1    |          |     |   ,----------,----------,   |    |  |
       :  |        |          |     *---|--*  Fuse | Reset *--|---'    |  |
       :  |        |          |     |   |----------|----------|        |  |
   D0  :  |        |          |   ,-|---|--*   I/O | Clk   *--|---,    |  |
2 o-------|--------|----------'   | |   |----------|----------|   |    |  |
       :  |        |              | '---|--*   Vpp | R/W   *--|---|----'  |
  Busy :  |        |              |     |----------|----------|   |       |
11 o------|--------|--------------' ,---|--*   Gnd | 5V    *  |   |       |
       :  |        |                |   '----------'-------|--'   |       |
   D1  :  |        |              __+__    Chip connector  |      |       |
3 o-------|--------|--------,     \\\\\                    |      |       |
       :  |        |        '------------------------------|------'       |
  Str  :  |  |\ |  |                                       |              |
1 o-------*--| >+--*----*----*----*----*-------------------'              |
       :   d2|/ |  |d3  |d4  |d5  |d6  |d7                                |
       :          -+-  -+-  -+-  -+-  -+-                                 |
       :          /_\  /_\  /_\  /_\  /_\                                 |
   D3  :           |    |    |    |    |   |\ | d8                        |
5 o----------------*----|----|----|----|---| >+-------*-------------------'
       :                |    |    |    |   |/ |       |
       :                |    |    |    |              |
   D4  :                |    |    |    |   |\ | d9    |
6 o---------------------*----|----|----|---| >+-------*
       :                     |    |    |   |/ |       |
       :                     |    |    |              |
   D5  :                     |    |    |   |\ | d10   |
7 o--------------------------*----|----|---| >+-------*
       :                          |    |   |/ |       |
       :                          |    |              |
   D6  :                          |    |   |\ | d11   |
8 o-------------------------------*----|---| >+-------*
       :                               |   |/ |       |
       :                               |              |
   D7  :                               |   |\ | d12   |
9 o------------------------------------*---| >+-------'
       :                                   |/ |
       :
       :
25 o------.
       :  |
.......:  |                                 d1 to d13: 1N4148
        __+__
        \\\\\

Centronic port


     III-2) Reader 2:
            ---------

                                                           Zener 3.3V
              2x1N4001         ________                150
           |\ |     |\ |      |        |              _____  | /|        (6)
o----,  ,--+ >+--*--+ >+--*---+  7824  +----*--o   o-|_____|-+< +-*----o Vpp
     |  |  |/ |  |  |/ |  |   |________|    |                | \| |
     )||(  220F |  220F |        |      ===== 0.22F           _+_
220V )||(    25V | +  40V | +      |        |                    / \  1N4148
     )||(      =====    =====    __+__    __+__                 '-+-'
 ~   )||(        | -      | -    \\\\\    \\\\\                  ,+,
     |  |   ___  |        |                                      | | 12
o----'  '--o   o-*      __+__                                    | |
           card  |      \\\\\  ________                          '+'   12
         present |  |\ |      |        |                          |   _____    (1)
                 '--+ >+------+  7805  +------*-------------------*--|_____|-o Vcc
                    |/ |      |________|      |                   |
                   1N4001          |         _+_                  |
                                   |         \ / --->            ,+,
                                 __+__       -+-  --->           | |
                                 \\\\\        |                  | | 4.7k
                                             ,+,                 '+'
                                             | |                  |            (7)
                                             | | 680             *----------o I/O
                                             '+'                  |
                                              |         Busy (11) o
                                              |                                (4)
                                            __+__         D0 (2)  o-----*----o Raz
                                            \\\\\                       |
                                                              4.7nF   =====
                                                                        |
                                                                      __+__
                                                                      \\\\\    (3)
                                                          D1 (3)  o----------o Clk

                                                                               (2)
                                                          D2 (4)  o----------o  W


                                                         Gnd (25) o
                                                                  |   fuse     (8)
                                                                  *--~~~~~---o Fus
                                                                __+__
                                                                \\\\\


IV) The program:
    ===========

    The following program will enable you to read telecards on you PC if you
build the precedent reader.

--------------- cut here (begin)
(*****************************************************************************)
(*                            T E L E C A R D . PAS                          *)
(*****************************************************************************)
(*  This program enable you to dumb the memory of electronics phonecards     *)
(*  from all over the world, so that you will be able to see which country   *)
(*  the card is from how many units are left and so on ....                  *)
(*****************************************************************************)
(*                                                                           *)
(*                       Written by Stephane BAUSSON (1993, 1994)            *)
(*                                                                           *)
(*                        Email: sbausson@ensem.u-nancy.fr                   *)
(*                                                                           *)
(*                       Snail Mail Address: 4, Rue de Grand                 *)
(*                                           F-88630 CHERMISEY               *)
(*                                           France                          *)
(*---------------------------------------------------------------------------*)
(* Last revised: 07.05.1994                                                  *)
(*****************************************************************************)
(* Thanks to: Tomi Engdahl (Tomi.Engdahl@hut.fi)                             *)
(*            Martin Schutlte (schulte@thp.Uni-Koeln.DE)                     *)
(*                                                                           *)
(*****************************************************************************)

USES crt,dos;

CONST port_address=$378;     (* Select Printer PORT 1 *)

TYPE string8=string[8];
     string2=string[2];

VAR reg         : registers;
    i,j         : integer;
    Data        : array[1..32] of byte;
    car         : char;
    byte_number : integer;
    displaying  : char;

{-----------------------------------------------------------------------------}
{ PROCEDURE Send(b:byte);                                                     }
{                                                                             }
{       - Send a byte on the selected printer port.                           }
{-----------------------------------------------------------------------------}

PROCEDURE Send(b:byte);

  BEGIN port[port_address]:=b;
  END;

{-----------------------------------------------------------------------------}
{ FUNCTION Get:byte;                                                          }
{                                                                             }
{       - Get a byte from the status register of the selected printer port.   }
{-----------------------------------------------------------------------------}

FUNCTION Get:byte;

  BEGIN get:=port[port_address+1];
  END;

{-----------------------------------------------------------------------------}
{ FUNCTION dec2hexa_one(decimal_value):hexa_character_representation;         }
{                                                                             }
{       - convert a 4 bit long decimal number to hexadecimal.                 }
{-----------------------------------------------------------------------------}

FUNCTION dec2hexa(value:byte):char;

  BEGIN case value of
          0..9   : dec2hexa:=chr(value+$30);
          10..15 : dec2hexa:=chr(value+$37);
        END;
  END;

{-----------------------------------------------------------------------------}
{ FUNCTION d2h(decimal_byte):string2;                                         }
{                                                                             }
{       - convert a decimal byte to its hexadecimal representation.           }
{-----------------------------------------------------------------------------}

FUNCTION d2h(value:byte):string2;

  BEGIN d2h:=dec2hexa(value div $10) + dec2hexa(value and $0F);
  END;

{-----------------------------------------------------------------------------}
{ FUNCTION Binary(byte):string8;                                              }
{                                                                             }
{       - Convert a byte to its binary representation.                        }
{-----------------------------------------------------------------------------}

FUNCTION Binary( b : byte):string8;

  VAR weigth : byte;
      s      : string8;

  BEGIN weigth:=$80;
        s:='';
        while (weigth > 0) do
        BEGIN if ((b and weigth) = weigth) then s:=s+'1'
              else s:=s+'0';
              weigth:=weigth div $02;
        END;
        Binary:=s;
  END;

{-----------------------------------------------------------------------------}

FUNCTION Units:byte;

  VAR  u, i : integer;
       s    : string8;

  BEGIN u:=0;
        i:=13;
        while (Data[i] = $FF) do
        BEGIN u:=u+8;
              i:=i+1;
        END;
        s:=Binary(Data[i]);
        while(s[1]='1') do
              BEGIN inc(u);
              s:=copy(s,2,length(s));
        END;
        units:=u;
  END;

{-----------------------------------------------------------------------------}

FUNCTION Octal_Unit_Count:LongInt;

  FUNCTION BitCount( Data : integer ):integer;

    VAR    i : integer;

    BEGIN i:=0;
          while ((Data and $01)=$01) do
          BEGIN Data:=Data div 2;
                inc(i);
          END;
          BitCount:=i;
    END;

  BEGIN Octal_Unit_Count:= 4096*BitCount(Data[9])+512*BitCount(Data[10])
                           +64*BitCount(Data[11])+8*BitCount(Data[12])
                           +BitCount(Data[13]);
  END;

{-----------------------------------------------------------------------------}

PROCEDURE Card_Type;

  BEGIN case Data[2] of
         $03: BEGIN write('Telecard - France - ');
                    case Data[12] of
                     $13: write('120 Units - ',units-130,' Units left');
                     $06: write('50 Units - ',units-60,' Units left');
                     $15: write('40 Units - ',units-40,' Units left');
                    END;
              END;
         $2F:write('Telecard - Germany - ', Octal_Unit_Count, ' Pfennigs left');
         $37:write('Telecard - Neitherland - ',Octal_Unit_Count,' Units left');
         $3B:write('Telecard - Greece - ', Octal_Unit_Count, ' Units left');
         $83:BEGIN write('Telecard');
                   case Data[12] of
                     $1E: write(' - Sweden');
                     $30: write(' - Norway');
                     $33: write(' - Andorra');
                     $3C: write(' - Ireland');
                     $47: write(' - Portugal');
                     $55: write(' - Czech Republic');
                     $5F: write(' - Gabon');
                     $65: write(' - Finland');
                   END;
                   if (Data[12] in [$30,$33,$3C,$47,$55,$65]) then
                   BEGIN case ((Data[3] and $0F)*$100+Data[4]) of
                          $012: write (' - 10 Units - ',units-12,' Units left');
                          $024: write (' - 22 Units - ',units-24,' Units left');
                          $027: write (' - 25 Units - ',units-27,' Units left');
                          $032: write (' - 30 Units - ',units-32,' Units left');
                          $052: write (' - 50 Units - ',units-52,' Units left');
                          $067: write (' - 65 Units - ',units-62,' Units left');
                          $070: write (' - 70 Units - ',units-70,' Units left');
                          $102: write (' - 100 Units - ',units-102,' Units left');
                          $152: write (' - 150 Units -  ',units-152,' Units left');
                         END;
                    END;
{                    write(' - N0 ',Data[5]*$100+Data[6]);}
              END;
        END;
  END;

{-----------------------------------------------------------------------------}

PROCEDURE waiting;

  BEGIN send($00);
        write('Enter a card in the reader and press a key ...');
        repeat until keypressed;
        gotoxy(1, wherey);
        clreol;
  END;

{-----------------------------------------------------------------------------}

PROCEDURE Full_Displaying;

  BEGIN writeln('Memory dump:');
        for i:=1 to 80 do write('-');
        for i:=1 to (byte_number div 6 + 1) do
        BEGIN for j:=1 to 6 do
                if j+6*(i-1) <= byte_number then write(binary(Data[j+6*(i-1)]):9)
                else write('         ');
              write('    ');
              for j:=1 to 6 do
              if j+6*(i-1) <= byte_number then write(d2h(Data[j+6*(i-1)]),' ');
              writeln;
        END;
        for i:=1 to 80 do write('-');
        Card_Type;
        writeln;
  END;

{-----------------------------------------------------------------------------}

PROCEDURE Short_Displaying;

  VAR j : integer;

  BEGIN for j:=1 to byte_number do
        BEGIN write(d2h(Data[j]),' ');
        END;
        writeln;
  END;

{-----------------------------------------------------------------------------}

PROCEDURE Reading;

  VAR i, j  : integer;
      Value : byte;

  BEGIN send($FE);
        send($F8);
        for i:=1 to 32 do
        BEGIN Value:=0;
              for j:=1 to 8 do
              BEGIN Value:=Value*$02 + ((get and $08) div $08);
                    send($FB);
                    delay(1);
                    send($F8);
              END;
              Data[i]:=Value;
        END;
        case displaying of
          'F':full_displaying;
          'S':short_displaying;
        END;
  END;

{-----------------------------------------------------------------------------}

PROCEDURE writting;

  VAR i,n:integer;
      car:char;

  BEGIN write('Which bit do you want to set to "1" : ');
        readln(n);

        waiting;
        car:=readkey;

        send($FA);
        send($F8);
        for i:=1 to n do
        BEGIN send($F9);
              if i=n then
              BEGIN send($FD);
                    delay(20);
                    send($FF);
                    delay(20);
              END;
              send($FB);
        END;
        reading;
  END;

{-----------------------------------------------------------------------------}

PROCEDURE Saving;

  VAR filename : string;
      f        : text;
      i        : word;

  BEGIN write('Enter the filename: ');
        readln(filename);
        assign(f, filename);
        rewrite(f);

        writeln(f,'Memory dump:');
        for i:=1 to 80 do write(f,'-');
        for i:=1 to (byte_number div 6 + 1) do
        BEGIN for j:=1 to 6 do
                if j+6*(i-1) <= byte_number then write(f,binary(Data[j+6*(i-1)]):9)
                else write(f,'         ');
              write(f,'    ');
              for j:=1 to 6 do
              if j+6*(i-1) <= byte_number then write(f,d2h(Data[j+6*(i-1)]),' ');
              writeln(f);
        END;
        for i:=1 to 80 do write(f,'-');
        close(f);
  END;

{-----------------------------------------------------------------------------}

PROCEDURE initialize;

  VAR i : integer;

  BEGIN byte_number:=32;
        displaying:='F';
        clrscr;
        writeln(' 1 - to dump a 256 bits card');
        writeln(' 2 - to dump a 128 bits card');
        writeln(' F - to display in full format');
        window(41,1,80,25);
        writeln(' S  - to display in short format');
        writeln(' F2 - to save in a file');
        writeln(' Q  - to exit the program');
        window(1,4,80,25);
        for i:=1 to 80 do write('=');
        window(1,5,80,25);
  END;

{=============================================================================}

BEGIN initialize;
      repeat waiting;
             car:=upcase(readkey);
             case car of
              'W':writting;
              'Q':;
              '1':byte_number:=32;
              '2':byte_number:=16;
              'F','S':displaying:=car;
              #00: BEGIN car:=readkey;
                         if car=#60 then saving;
                   END;
              else reading;
             END;
      until car='Q';
END.
</PRE>
<ADDRESS>pannier@cs.tu-berlin.de</ADDRESS>
</BODY>
                 
  ._______..___.._______.._______.                                
  |?     ?||? ?||? . . ?||?  .  ?|            Sir SnOoze   (TiTins)
  |       ||_ _||  ? ?  ||   |   |            LAzzER       (TiTins)
  |       ||   ||  | |  ||   |   |            Cyanide      (TiTins)
  |__   __||   ||  | |  ||   |___|            Numark       (TiTins)
    |   |  |   ||  | |  ||   ._>_.    
    |   |  |   ||  | |  ||   |   |            Node 1 16.8 Daul    
    |   |  |   ||  | |  ||   |   |            Node 2 14.4 Bis   
    |   |  |   ||  | |  ||   !   |  Over 540 Mb Online COOl 5:1 Ratios  
    |___|  |___||__|_|__||_______|   [AMiGA]=*=[iBM-PC]=*=[CONSLE ALL]     
                                                                  
                  sMeG uTiLiTiEs WHQ / TiTANS UK HQ  

 Node 1 0181 You Know 16.8 Daul          Node 2 0181 You Know 14.4 Bis