📄 telecard.txt
字号:
===============================================================================
What you need to know about electronics telecards
===============================================================================
(C) 10-07-1993 / 03-1994
Version 1.06
Stephane BAUSSON
Email: sbausson@ensem.u-nancy.fr
Smail: 4, Rue de Grand; F-88630 CHERMISEY; France
Phone: (33)-29-06-09-89
-------------------------------------------------------------------------------
Any suggestions or comments about phonecards and smart-cards are welcome
-------------------------------------------------------------------------------
Content
---------
I ) The cards from Gemplus, Solaic, Schlumberger, Oberthur:
I-1) Introduction:
I-2) SCHEMATICS of the chip:
I-3) PINOUT of the connector:
I-4) Main features:
I-5) TIME DIAGRAMS:
I-6) Memory MAP of cards from France and Monaco:
I-5) Memory MAP of cards from other countries:
II ) The cards from ODS: (German cards)
II-1) Introduction:
II-2) Pinout:
II-3) Main features:
II-4) Time Diagrams:
II-5) Memory Map:
II-6) Electrical features:
III) The Reader Schematic:
IV) The program:
-------------------------------------------------------------------------------
I ) The cards from Gemplus, Solaic, Schlumberger, Oberthur: (French cards)
======================================================================
I-1) Introduction:
------------
You must not think that the electronics phone-cards are completly secret
things, and that you can not read the informations that are inside. It is quite
false, since in fact an electronic phonecard does not contain any secret
information like credit cards, and an electronic phonecard is nothing else that
an 256 bits EPROM, with serial output.
Besides do not think that you are going to refilled them when you will
have understood how they work, since for that you should reset the 256 bits of
the cards by erasing the whole card. But the chip is coated in UV opaqued resin
even if sometime you can see it as tranparent! Even if you were smart enough to
erase the 256 bits of the card you should program the manufactuer area, but
this is quite imposible since these first 96 bits are writing protected by a
lock-out fuse that is fused after the card programing in factory.
Neithertheless it can be very interesting to study how these cards work, to
see which kind of data are inside and how the data are maped inside or to see
how many units are left inside for exemple. Besides there are a great number of
applications of these cards when there are used (only for personal usage of
course) , since you can use them as key to open a door, or you can also use them as
key to secure a program, etc ....
These Telecards have been created in 1984 and at this time constructors
decided to build these cards in NMOS technology but now, they plan to change by
1994 all readers in the public to booths and use CMOS technology. Also they
plan to use EEPROM to secure the cards and to add many usefull infornations in,
and you will perhaps use phone cards to buy you bread or any thing else.
These cards are called Second Generation Telecards.
I-2) SCHEMATICS of the chip:
----------------------
.-------------------.
| |
--|> Clk |
| _ |
--| R/W |
| |
--| Reset |
| |
--| Fuse |
| |
--| Vpp |
| |
| |
'-. .-'
| |
.-------------------.
| Out |-- serial output
'-------------------'
I-3) PINOUT of the connector:
-------------------------
AFNOR CHIP ISO CHIP
---------- --------
-------------+------------- -------------+-------------
| 8 | 4 | | 1 | 5 |
| | | | | |
+-------\ | /-------+ +-------\ | /-------+
| 7 +----+----+ 3 | | 2 +----+ + 6 |
| | | | | | | |
+--------| |--------+ +--------| |--------+
| 6 | | 2 | | 3 | | 7 |
| + +----+ | | +----+----+ |
+-------/ | \-------+ +-------/ | \-------+
| 5 | 1 | | 4 | 8 |
| | | | | |
-------------+------------- -------------+-------------
NB: only the position of the chip is ISO
standardized and not the pinout
PINOUT: 1 : Vcc = 5V 5 : Gnd
------ 2 : R/W 6 : Vpp = 21V
3 : Clock 7 : I/O
4 : Reset 8 : Fuse
I-4) Main features:
---------------
- Synchronous protocol.
- N-MOS technology.
- 256x1 bit organisation.
- 96 written protected by a lock-out fuse.
- Low power 85mW in read mode.
- 21 V programming voltage.
- Access time: 500ns
- Operating range: -10癈 +70癈
- Ten year data rentention.
I-5) TIME DIAGRAMS:
---------------
+21V _____________
+5V ____________________________________| |_________________ Vpp
: :
+5V ___________________:_____________:_________________ Reset
0V ________________| : :
: : :
+5V ____ : ____ : ______:______
0V ___| |_______:_____| |________:______| : |__________ Clock
: : : : : : : : :
+5V : : : : : :______:______: : _
0V ___:____:_______:_____:____:________| : |______:__________ R/W
: : : : : : : : :
+5V : : :_____: :________: : : :__________
0V XXXXXXXXXXXXXXXXX_____XXXXXX________XXXXXXXXXXXXXXXXXXXXXX__________ Out
: : : : : :<-----><---->: :
: : : : : :10 to 10 to :
: : : : : :50 ms 50ms :
Reset Bit 1 Bit2 Bit 3
card reading reading Bit2 writing to 1 reading
I-6) MEMORY MAP of cards from France and Monaco:
--------------------------------------------
Bytes Bits Binary Hexa
+-----------+-----+
1 1 --> 8 | | | ---> Builder code.
+-----------+-----+
2 9 --> 16 | 0000 0011 | $03 | ---> a french telecard
+-----------+-----+
3 17 --> 24 | | |
+-----------+-----+
4 25 --> 32 | | |
+-----------+-----+
5 33 --> 40 | | |
+-----------+-----+
6 41 --> 48 | | |
+-----------+-----+
7 49 --> 56 | | |
+-----------+-----+
8 57 --> 64 | | |
+-----------+-----+
9 65 --> 72 | | |
+-----------+-----+
10 73 --> 80 | | |
+-----------+-----+
11 81 --> 88 | | |
+-----------+-----+
12 33 --> 40 | 0001 0011 | $13 | ---> 120 units card
| 0000 0110 | $06 | ---> 50 units card
| 0000 0101 | $05 | ---> 40 units card
+-----------+-----+
13-31 97 --> 248 | | | ---> The units area: each time a unit
| | | is used, then a bit is set to "1";
| | | Generaly the first ten units are
| | | fused in factory as test.
| | |
| | |
| | |
+-----------+-----+
32 249 --> 256 | 1111 1111 | $FF | ---> the card is empty
+-----------+-----+
I-7) MEMORY MAP of the other cards:
-------------------------------
Bytes Bits Binary Hexa
+-----------+-----+
1 1 --> 8 | | |
+-----------+-----+
2 9 --> 16 | 1000 0011 | $83 | ---> a telecard
+-----------+-----+-----------+-----+
3-4 17 --> 32 | 1000 0000 | $80 | 0001 0010 | $12 | ---> 10 units card
| | | 0010 0100 | $24 | ---> 22 units card
| | | 0010 0111 | $27 | ---> 25 units card
| | | 0011 0010 | $32 | ---> 30 units card
| | | 0101 0010 | $52 | ---> 50 units card
| | | 1000 0010 | $82 | ---> 80 units card
| 1000 0001 | $81 | 0000 0010 | $02 | ---> 100 untis card
| | | 0101 0010 | $52 | ---> 150 units card
+-----------+-----+-----------+-----+
5 33 --> 40 | | |
+-----------+-----+
6 41 --> 48 | | |
+-----------+-----+
7 49 --> 56 | | |
+-----------+-----+
8 57 --> 64 | | |
+-----------+-----+
9 65 --> 72 | | |
+-----------+-----+
10 73 --> 80 | | |
+-----------+-----+
11 81 --> 88 | | |
+-----------+-----+
12 89 --> 96 | 0001 1110 | $1E | ---> Sweden
| 0010 0010 | $22 | ---> Spain
| 0011 0000 | $30 | ---> Norway
| 0011 0011 | $33 | ---> Andorra
| 0011 1100 | $3C | ---> Ireland
| 0100 0111 | $47 | ---> Portugal
| 0101 0101 | $55 | ---> Czech Republic
| 0101 1111 | $5F | ---> Gabon
| 0110 0101 | $65 | ---> Finland
+-----------+-----+
13-31 97 --> 248 | | | ---> The units area: each time a unit
| | | is used, then a bit is set to "1";
| | |
| | | Generaly the first two units are
| | | fused in factory as test.
| | |
| | |
+-----------+-----+
32 249 --> 256 | 0000 0000 | $00 |
+-----------+-----+
II ) The cards from ODS, Giesecke & Devrient, ORGA Karten systeme,
=============================================================
Uniqua, Gemplus, Schlumberger and Oldenbourg Kartensysteme:
===========================================================
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -