I'm trying to reverse engineer a smart card that I use. I've successfully used a usb logic analyzer to dump the datastream and am trying to reverse engineer the password (CSC1 / Card Secret Code) password.
I know it generates the 4 byte password based on only the information here, all information is provided in the order it appears in the datastream.
The datasheet for the card can be found here, but I tried to note the area that the card is reading from below: https://jwamicha.files.wordpress.com/2010/09/gemclubmemo.pdf
Memory addresses are provided on the left, again this is ordered based on appearance in datastream
00: x20 x11 x11 xFF | MFR Area (static) 01: xC1 x92 xC4 x10 | issuer area (static from what I can tell) 02: x16 x20 x17 x00 | issuer area (static from what I can tell) 03: x00 x4C x53 x00 | issuer area (static from what I can tell) 04: x00 xCB x26 x80 | issuer area (static from what I can tell) 05: x00 x01 x01 x00 | access condition (static) 10: x45 xc3 x67 x00 | user area 1 (static) 11: x00 x00 x88 x13 | user area 1 (static) 12: x00 x11 x0A x26 | user area 1 (static) 15: x00 x00 x00 x00 | user area 1 (non-static non-changing) 16: x02 x00 x00 x00 | user area 1 (increments each write, rolls back to 0 post 2 increment) 08: x1B x00 x00 x00 | Write count 09: x1A x00 x00 x00 | write count (previous value) 0C: x1C x76 x3F x25 | balance area (checksum?) 0E: x96 x00 x00 x00 | balance area (actual balance, 150 aka $1.50) 39: x00 x00 x00 x00 | password ratification counter (should never change)
calculates xC9 x96 x09 x39
Does anyone recognize a pattern here? My hypothesis is that the value is calculated partially with the user area (varies by card) along with the write count, and the user area write count (iterates to x02 before looping back to x00).
Bonus pic of laundry card post surgery (initially tried to just use the tape, gave up and did a quick and dirty solder job): https://imgur.com/hNJ4V04