Phone Cards

8/13/2019 Phone Cards

http://slidepdf.com/reader/full/phone-cards 1/42

=============================================================================== What you need to know about electronics telecards=============================================================================== Version 2.04 (Last revised: 06 March 1999)

(C) Laurent - (1998, 1999) (C) Stephane - (1993, 1994, 1995, 1996, 1997, 1998)

------------------------------------------------------------------------------->>> Any suggestions or comments about phonecards and smartcards are welcome <<<>> NO QUESTIONS REGARDING CLONING, RECHARGING... PHONECARDS WILL BE ANSWERED <<

I NEED YOUR HELP TO COMPLETE THIS FILE

You can contact me at mailto:[email protected]

This file is archived at http://perso.wanadoo.fr/telecard/-------------------------------------------------------------------------------

Document History:

~~~~~~~~~~~~~~~~ v2.04 : Modified (or added) Danmark, Mexico (Telnor), Veezuela (CANTV),Russia (MRTC replaced by MCTN), Swiss (Swisscom), Romania (512 bits),

Bulgaria, Republic of Moldova (MoldTelecom), Venezuela (CANTV), Croatia (128 bits), Malaysia (Citifon), Slovakia, Netherland, Belgium (Belgacom), Malaysia (Malaysia Telecom), Netherland (PTT Telecom), Greece (OTE), Germany (Telekom). Corrected Slovenske Telekomunikanie belongs to Slovakia. Added: definition of Authentification and Challenge in glossary. v2.03 : Added Cuba (ETECSA - 512 bits), Madagascar (Telecom Malagasy S.A.), Poland, Slovenia (Slovenske Telekomunikacie), Argentina (Telefonia de Argentina), Guinea (Sotelgui), Guinean Equatorial Republic (Getesa), Swaziland (Phutfumani), Israel (Bezeq), Belgium (Belgacom),

Estonia (Eesti Telefon - T2G). Modified Bulgaria, Czech Republic / Yougoslavia (SPT Telecom,Telecom Praha), Russia (Eurochip - CNM/MRTC), Croatia (Eurochip 512

bits), South Africa (Telkom), Malaysia (Malaysia Telecom). News for french T2G (5 units cards and "Numero Unique" cards), Canada (BELL). Modified Pinouts. Modified reader 1. Modified explanation of the octal counter. v2.02 : Corrected Estonia. Modified South Africa, Russia, England, Estonia. Added Venezuela (CANTV), Swiss (Swisscom), Emirates (Etisalat), Ivory Coast (Publicom S.A.), Morocco (Unknown operator), Danmark (Hrvatska Posta Telekomunikacije),

Spain (500 pta), Canada (Gemplus 512 bits - Bell), Lithuania (Lieutuvos Telekomas), Croatia (HPT - 128 and 512 bits), Greece (OTE - 158 and 512 bits) v2.01 : Modified french T1G, french T2G, Germany, Romania, Netherlands. Added DisneyLand Paris, Estonia, Australia (Telstra). v2.00 : ************************************************************ ******* BITS AND BYTES RENUMBERED STARTING FROM ZERO ******* *** IN ORDER TO COMPLY WITH MANUFACTURER'S DOCUMENTATION *** ************************************************************

French 25u, Senegal, Central African Republic, Togo, Cuba.



News for french T2G. Extended glossary of terms. First version maintained by Laurent. v1.24 : News for Agentina, Bulgaria, South-Africa, Lithuania, french 5u, Botwana, Ukrainia, Lithuania, Comores, Djibouti, Chile. Last version maintained by Stephane (version not released). v1.23 : Completion for french T2G, Hungary, Germany, Greek, Bulgaria, Portugal and UK. V1.22 : New code for Schlumberger (swedish cards), Greek card correction. V1.21 : Slovenian and Canadian cards added. V1.20 : Malta Cards Added. V1.19 : French T2G added. V1.18 : New coutries: Argentina, Burkina Faso, Cameroon, Croatia, Djibouti, Gambia, Hungary, Mali, Mexico (Telmex), Morocco, French Polynesia, New Caledonia, St Maarten, Slovakia. V1.17 : Greek Serial Number added. V1.16 : German Telefonkarte Serial Number. V1.15 : New readers (Telecards+ISO7816 cards). V1.14 : New 512 bit Greek telecards + modification of Mexican cards. V1.13 : Checksums for french cards + modification for 'G+D' spanish cards. V1.12 : Chip builder code added. V1.11 : Croatian cards added. V1.10 : Romanian telecards added. V1.09 : Spanish card reading.

V1.08 : Modification of the octal stage counter for greek cards. V1.07 : Modification of the 5 stage octal counter for 128 bit cards. V1.06 : Schematic of a new reader [DELETED]. V1.02 : Introduction of the German cards. V1.00 : First version of the document.

Glossary of terms:~~~~~~~~~~~~~~~~~~ [TBC] : to be confirmed [TBD] : to be defined S.N. : Serial Number

b(i) : bit i

b(i..j) : bits from i to j (if i>j then area is read in reverse) B(I) : byte I B(I..J) : bytes from I to J (if I>J then area is read in reverse) x^y : x at the power y (in mathematical expresssions)

Serial Number: Unique number assigned to a chip, this number is programmed in the chip by the manufacturer, you can not change it. A few cards don't have a serial number. A copy of the serial number is sometimes printed on the card itself.

Checksum : Checksums are used in order to verify if the header of a card is not altered. One byte a the header is computed using a simple formula (ie: for a bit set to '1' in bytes 1, 2, 3

substract 4 to the value 227, you must obtain the value set in byte 0 of the card). You can use these checksums (and other bits in the header area) to check if a card is of a given type. This document is intended to help you doing so.

Certificate : Certificates are used in 2nd generation telecards to verify if a card is not a fake one. Certificates are 16 or 32 bits

long and are calculated using a one way function (each operator has his own), a secret key (operator dependent) and the value of the bits contained in the header of the card.



Because the function and the key are kept secret you can't compute a certificate by yourself, nor you can't use it to check if the card is of a given type. In order to avoid hackers doing crypto-analysis against certificates using a big number of cards, it can be erased when the card is empty. Writting to this area may invalidate the card.

Counter/Unit : This area contains the number of units remaining (or used) on Area the card. It is designed so you can not increase the value of the card. How this area works (decoding and writing) depends on the card's type. This document will help you in determing the remaining credit of a card.

Anti-tearing : Anti-tearing flags (also known as pull-out flags) are used in order to ensure that the holder of the card does not loose units (money) if he removes the card during an operation. Anti-tearing flags are written when the counter area is written to, they are erased when the operation is completed. If the card is removed during the operation anti-tearing are used to restore the counter area the next time you use the card.

Authentification: Authentification is used in 2nd generation telecards, the

reader sends a random sequence called 'challenge' to the card, this challenge is used by the card to compute an answer wich is sent back to the reader. If the answer is correct the the reader can assume that the card is a 'good' one.

-------------------------------------------------------------------------------

* Content * ~~~~~~~~~~~

I ) The 1st generation Telecards:

1.1 - Introduction:

1.2 - SCHEMATICS of the chip: 1.3 - PINOUT of the connector: 1.4 - Main features: 1.5 - TIME DIAGRAMS: 1.6 - Memory Map for cards from FRANCE and MONACO: 1.7 - Memory Map for cards from other countries: 1.8 - Memory Map for cards from SPAIN, CROATIA and MEXICO: 1.9 - Memory Map for Mexican cards from Telmex:

II ) The 2nd generations Telecards:

2.1 - Introduction:

2.2 - Pinout: 2.3 - Main features: 2.4 - Time Diagrams: 2.5 - Memory Map:

2.5.1 - Memory Map for 4 or 5 stage octal unit counter: 2.5.2 - 2nd Generation French Telecards (TG2) and derivates:

2.8 - Octal counter description 2.7 - Electrical features:



III) Schematics of Readers:

3.1 - Reader 1 (very simple one, only for telecards) 3.2 - Reader 2 (for telecards and ISO7816 cards too)

-------------------------------------------------------------------------------

I ) The 1st generation Telecards: ============================

1.1 - Introduction: ~~~~~~~~~~~~

Since the middle of 80's have appeared a new generation of cards ( thesmart-cards or chip cards ) that have replaced most of the magnetics cardsapplications notably for telecom payement and also for credit cards. Thesecards are far more secure than the magnetics cards, and there are several kindof cards following the application. The simplier ones are the Simple Memorycards like the one used as Telecard for the telecom payement in the publicphone-booths ( Generaly all the memory content is readable, and there is amaker-area that is unwritable ) , then there are more sofisticated cards:

Memory Cards with some area read protected by a key, these cards can containsome private informations in the read-protected area. At the end there aremicroprocessor-cards (cards working following the ISO-7816 protocol), that arethe safiest ones since these cards have their own internal Operating Systemthat prevent I/O if the PIN (Personal Idenfication Number) has not been ent--ered in the cards before ( These cards are used when confidentiality isneeded, like in credit cards (bank), crypted TV access cards, health cards,SIM cards for GSM, etc ... ).

About telecards, even if these cards are the less safe ones, don't thinkthat you are going to phone freely for that, in fact no. All the data arereadable since there are no confidential data inside, the cards are well done

enough to be very secure for the payement of telecom communications in publicbooth.

So, what is a phonecard exactly ? In fact generaly it's a 256 bits EPROM( French like cards ), or a 128 bits EEPROM (German like cards) with a serialoutput and some other control pins.

Then why can it not be refilled ? Well, indeed to refill the card youwill have to erase the cards with UV, knowing that the cards is coated in UVopaqued resin that prevent UV from reaching the silicium chip, and even if youcould to erase the chip you will have to program the manufactuer area that iswrite-protected by a lock-out fuse that was fused after the card programming infactory.

Remember that a public booth contains a specialized computer and have adirect connexion to the public telephone network, and so to other computers. InFrance public booths are connected to the telephone network using a "Unite deraccordement de publiphone (URP)" which holds a "black list" of stolen, fakecards... A public booth first reads the card, checks if it seems OK (checksums,certificates...), it asks the URP to check if the card is reported stolen or isknown as fake and then it allows you to dial a number.

DO NOT FORGET: if you try to use a fake card, the public booth may let



you issue your call and the URP may alert the operator who may call the police.Many people in France where jailed this way. SO NO QUESTIONS REGARDING CLONING,RECHARGING... PHONECARDS WILL BE ANSWERED AS IT IS ILLEGAL AND MAY BE VERY BADFOR YOUR KARMA.

Neithertheless it can be very interesting to study how these cards work,to see which kind of data are inside and how the data are maped inside or tosee how many units are left inside for exemple. Besides there are a greatnumber of applications of these cards when there are used (only for personaluse of course) , since you can use them as key to open a door, or you can alsouse them as key to secure a program, etc ....

French Telecards have been created in 1984 and at this time constructorsdecided to build these cards in NMOS technology but now, France Telecom haschanged all the readers in the public booths and use CMOS technology for 70 %of the cards currently being issued (07/1997).

Also they plan to use EEPROM to secure the cards and to add many usefullinformations in, and you will perhaps use phone cards to buy you bread oranything else. Cards used for advertising may be programmed so the public boothautomatically call a given number when the card is inserted (a remplacement fortoll free number where advertiser can choose who may call freely and whereuser do not have to bother reminding a number).

These cards are called Second Generation Telecards (T2G).

1.2 - SCHEMATICS of the chip: ~~~~~~~~~~~~~~~~~~~~~~

.-----------------. --|>_ Clk | --| R/W | --| Reset | --| Fuse | --| Vpp | '-, ,-'

.-'-------------'-. | Out |-- serial output '-----------------'

1.3 - PINOUT of the connector (synchronous cards): ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Afnor Position ISO position (in the left top corner) (in the middle left)

,------------+------------, ,------------+------------,| 8 | 4 | | 1 | 5 |

+------\ | /------+ +------\ | /------+| 7 +----+----+ 3 | | 2 +----+ + 6 |+-------| |-------+ +-------| |-------+| 6 + +----+ 2 | | 3 +----+----+ 7 |+------/ | \------+ +------/ | \------+| 5 | 1 | | 4 | 8 |'------------+------------' '------------+------------'

6 contacts ISO POSITION



(in the middle left)

,------------+------------, | 1 | 5 | +------\ | /------+ | 2 +----+ + 6 | +-------| |-------+ | 3 +----,----+ 7 | '------------'------------'

NB: only the position of the chip is ISO standardized and not the pinout.

PINOUT: 1 : Vcc = 5V 5 : Gnd~~~~~~ 2 : RESET 6 : Vpp = 5V (*) 3 : Clock 7 : I/O 4 : RAS 8 : Fus (**)

(*) +21V for T1G (NMOS cards). (**) Not used with the new G+D cards compatible with the 256 bit memory Exemple: spannish G+D cards.

1.4 - Main features: ~~~~~~~~~~~~~

- Synchronous protocol. - N-MOS technology or CMOS for the new ones. - 256x1 bit organisation. - 96 written protected by a lock-out fuse. - Low power 85mW in read mode. - 21 V programming voltage. - Access time: 500ns - Operating range: -10øC +70øC - Ten year data rentention.

1.5 - Time diagrams:

~~~~~~~~~~~~~ a - Cards from Schlumberger, Solaic, Gemplus ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

+21V _____________ +5V ____________________________________| |_________________ VPP : :+5V ___________________:_____________:_________________ ___ 0V ________________| : : RST : : :+5V ____ : ____ : ______:______ 0V ___| |_______:_____| |________:______| : |__________ CLK : : : : : : : : :

+5V : : : : : :______:______: : _ 0V ___:____:_______:_____:____:________| : |______:__________ R/W : : : : : : : : :+5V : : :_____: :________: : : :__________ 0V XXXXXXXXXXXXXXXXX_____XXXXXX________XXXXXXXXXXXXXXXXXXXXXX__________ OUT : : : : : :<-----><---->: : : : : : : :10 to 10 to : : : : : : :50 ms 50ms : Reset Bit0 Bit1 Bit2 card reading reading Bit1 writing to 1 reading



NOTE: Vpp Idle state is 5V, thus Vpp will have to be connected to Vcc to read the card.

b - Cards from G+D (Spanish cards labeled with the 5th byte = $30) ~~~~~~~~~~~~~~

+5V ___________________________________________________ ___ 0V ________________| RST

+5V ____ ____ _____________ 0V ___| |_____________| |_______________| |__________ CLK : : : : : :+5V : : : : ______:______ : _ 0V ___:____:_____________:____:________| : |______:__________ R/W : : : : : : :+5V :____:_____________:____:_______________:______:______:__________ 0V XXXX X_____________X X_______________X : X__________ OUT : : : : :<---->: : : : : : : 1 ms : : : : : : : Reset Bit0 Bit1 Bit1 Bit2

card reading reading writing to 1 reading

1.6 - Memory Map for cards from FRANCE, MONACO and St MAARTEN: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Byte (Bit) Hexa

+-----+0 (0..7) | | --> Checksum for bytes 1, 2, 3 (*) +-----+1 (8..15) | $0s | --> French telecard | | Serial Number (1st byte)

| $80 | --> St Maarten +-----+2 (16..23) | | --> Serial Number (2nd byte) +-----+3 (24..31) | | --> Serial Number (3rd byte) +-----+4 (32..39) | | --> checksum for bytes 5, 6, 7 (*) +-----+5 (40..47) | | --> Serial Number (4th byte) +-----+6 (48..55) | | --> Serial Number (5th byte) +-----+7 (56..63) | | --> ? [TBD]

| $FF | --> St Maarten +-----+8 (64..71) | | --> checksum for byte 9, 10, 11 (*) +-----+9 (72..79) | | --> ? [TBD] | $FF | --> St Maarten +-----+10 (80..87) | $10 | --> France and Monaco | $14 | --> St Maarten +-----+



11 (88..95) | $13 | --> 120 units | $07 | --> 60 units (St Maarten) | $06 | --> 50 units | $05 | --> 40 units | $04 | --> 25 units | $02 | --> 5 units +-----+12 (96..103) | | --> The units area: each time a unit is used . | | then a bit is set to "1"; The 1st 10 units . | | are fused in factory for test (15 units for . | | 25u and 5u cards). . | | . | |30 (240..247) | | +-----+31 (248..255) | $FF | --> $FF is set when all the units are used. +-----+

(*) checksum is calculated by the following expresion:

max | min=32*(j-1)+8 $E3 - 4 * Sum b(i) where | max=32*j-1 i=min | and j is the checksum number (1, 2 or 3)

NOTE: The card number is the concatenation in a single string of the 5 bytes written in hexadecimal.

1.7 - Memory Map for cards from other countries: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Byte (Bit) Hexa

+-----+ 950 (0..7) | | --> Check Sum Byte = $D8 - Sum b(i)

+-----+ i=81 (8..15) | $83 | --> Telecard | $80 | --> Other Applications (See below) | $9A | --> PIAF card [TBC] | $C0 | --> AVANT card [TBC] +-----+-----+2-3 (16..31) | $1x | $xx | --> Units+2 (0x1152 : exemple for a 150u card). + - - - - - + | $10 | $00 | --> In case of special Argentine telecard | $3D | $13 | --> 80u (Morocco) | $DB | $B5 | --> 40u (Morocco) +-----+-----+

ARGENTINA +-----+-----+-----+-----+4..7 (32..63) | $Ta | $bc | $de | $fg | T = Manufacturer (4 Gemplus, 0 Schlumberger) | | | | | S.N. = a*64 + b*32 + c*16 + d*8 + e*4 + f*2 + g

+-----+-----+-----+-----+8..9 (64..79) | | | --> Don't Know +-----+-----+



HUNGARY +-----+-----+-----+-----+4..7 (32..63) | $Ta | $B | $C | $D | T = Manufacturer (4 Gemplus, C ODS) | | | | | S.N. = a*2^21 + B*2^17 + C*2^9 + D +-----+-----+-----+-----+8..9 (64..79) | | | --> Unit value : $0103 for 120u; $010A for 50u +-----+-----+

PORTUGAL +-----+-----+-----+-----+4..7 (32..63) | $00 | $A | $B | $C | Portugal : S.N. = A*2^17 + B*2^9 + C +-----+-----+-----+-----+8..9 (64..79) | | | --> Certificate +-----+-----+

OTHERS +-----+4 (32..39) | $Tx | --> T = Manufacturer 0 --> Schlumberger | | --> 1 --> Solaic [TBC] | | --> 3 --> Gemplus [TBC] (finnish cards) | | --> 4 --> Gemplus +-----+----+----+----+----+5..9 (40..79) | | | | | | --> Serial Number +-----+----+----+----+----+

+-----+-----+10-11(80..95) | $10 | $16 | --> French Polynesia | | $78 | --> DisneyLand Paris (see note #1) | $11 | $15 | --> Djibouti | | $1C | --> Senegal (Sonatel) | | $1D | --> French Cinecarte [TBC] | | $1E | --> Sweden | | $28 | --> Argentina (Telefonica de Argentina) | | $30 | --> Norway (Telenor). | | $31 | --> New Caledonia | | $32 | --> Cameroon | | $33 | --> Andorra

| | $36 | --> Central African Republic (Socatel) | | $39 | --> Luxembourg | | $3C | --> Ireland | | $3D | --> Gambia | | $3F | --> Guinean Equatorial Republic (Getesa) | | $47 | --> Portugal | | $54 | --> Malta | | $55 | --> Czech Republic / Yougoslavia | | $58 | --> Comores | | $5C | --> Argentina (Telecom Argentina) | | $5D | --> Burkina Faso | | $5E | --> Mali | | $5F | --> Gabon

| | $65 | --> Finland | | $6A | --> Madagascar (Telecom Malagasy S.A.) | | $72 | --> Togo (OPT Togo) | | $86 | --> Slovakia | | $9E | --> Cuba (Etecsa) | | $B7 | --> Morocco (Special Operator) | | $BC | --> Israel (Bezeq) | | $BE | --> Guinea (Sotelgui) | | $C3 | --> Emirates (Etisalat) | | $D5 | --> Poland



| | $E0 | --> Hungary | | $E1 | --> Cameroon (CamTel) | | $E2 | --> Morocco (Ave Phone) | $1E | $5C | --> Argentina (Special Cards) +-----+-----+12 (96..103) | | --> The units area: each time a unit . | | is used, then a bit is set to "1"; . | | . | | The first two units are fused in . | | factory as test. . | | . | | In some countries 5 extra units are burned when the . | | card is empty (credit seems to be -5 units). . | | . | | Hungary: Each bit set to 1 in this area is a unit used. . | | ~~~~~~~ 10u are used in factory when the cards is new.31 (248..255) | |

+-----+

Note #1: For DisneyLand Paris Unit Area is b(128..239), B(30) is set to $FF to mark an empty card.

ARGENTINA SPECIAL +-----+12 (96..103) | $C0 | --> The first two units are fused in factory as test. . | | . | |20-21(160..175)|$XXXX| --> User number Eg. $245622-23(176..191)|$XXXX| $1252 --> 2456 1252 657824-25(192..207)|$XXXX| $6578

. | | . | |30 (240..247) | | +-----+

1.8 - Memory Map for cards from Argentina, Spain, Croatia and Mexico (Telnor): ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The spanish telecards are made from different manufacturers, and these cards should be read and written with a different protocol following byte 04 of the memory (see subclause 1.6-a for the cards with the byte 04=$90 and see the subclause 1.6-b for the cards with the byte 04=$30).

Byte (Bit) Binary Hexa

+-----+ 95

0 (0..7) | | ---> Checksum byte = 216 - Sum b(i) +-----+ i=81 (8..15) | $83 | ---> Telecard +-----+-----+2-3 (16..31) | $FF | $FF | +-----+-----+4 (32..39) | $30 | --> G+D | $5A | --> Gemplus | $90 | --> Oberthur (and F.N.M.T for Spain) | $9E | --> Oberthur (Argentina)



| $A0 | --> Solaic +-----+-----+-----+5..7 (40..63) | ss | ss | ss | ---> Serial Number (*) +-----+-----+-----+8-9 (64..79) | $00 | $0A | --> 500 pesetas (Spain) | $14 | $8A | --> 1000 pesetas (Spain) | $25 | $04 | --> 2000 pesetas (Spain) | $25 | $06 | --> 2100 pesetas (Spain) | | | | $14 | $CA | --> N$ 25.00 (Mexico) | $15 | $4A | --> N$ 35.00 (Mexico) | $31 | $02 | --> N$ 50.00 (Mexico) | | | | $00 | $03 | --> 25 (Argentina) | | | | $00 | $05 | --> 50u (Croatia) | $00 | $0A | --> 100u (Croatia) | $14 | $8A | --> 200u (Croatia) | $2A | $85 | --> 1000u (Croatia) +-----+-----+10-11 (80..95)| $1E | $22 | --> Spain | | $24 | --> Mexico (Telnor) | | $26 | --> Croatia | | $28 | --> Argentina

+-----+-----+-----+12 (96..103) | 1111 1111 | $FF | ---> the first 10 units are fused . | 11xx xxxx | $xx | in factory for testing. . | xxxx xxxx | $xx | . | xxxx xxxx | $xx | ---> Slow counter area . | xxxx xxxx | $xx | . +-----------+-----+ . | xxxx xxxx | $xx | . | xxxx xxxx | $xx | ---> Fast counter area31 (248..255) | xxxx xxxx | $xx | +-----------+-----+

The slow counter area:

---------------------- o [b255 ... b156] for 500 Pta cards, Increment 5 Pta o [b205 ... b106] for 1000 Pta cards, Increment 5 Pta o [b165 ... b126] for 2000 Pta cards, Increment 5 Pta o [b165 ... b106] for 2100 Pta cards, Increment 5 Pta o [b205 ... b106] for 25.00 N$ cards, Increment 0.1 N$ o [b205 ... b106] for 35.00 N$ cards, Increment 0.1 N$ o [b135 ... b116] for 50.00 N$ cards, Increment 0.1 N$

The Fast counter area: ---------------------- o No fast counter for 500 Pta cards o [b255 ... b206] for 1000 Pta cards, Increment 10 Pta

o [b255 ... b166] for 2000 Pta cards, Increment 20 Pta o [b255 ... b166] for 2100 Pta cards, Increment 20 Pta o [b255 ... b206] for 25.00 N$ cards, Increment 0.3 N$ o [b255 ... b206] for 35.00 N$ cards, Increment 0.5 N$ o [b255 ... b136] for 50.00 N$ cards, Increment 0.4 N$

Exemple of an fast units area: (1000 Pta cards) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 00 -, 0000 0000 |



0000 0000 |-> Unused units 0000 0000 | 0000 0000 -' 0011 1110 ---> 14*10 Pta are used (same as 0011 1111 1000 1110 1111 1111)

NB: Several units can be used, in this case only the last unit is set as used, like in the previous exemple, where some units are set to 0 but are nonetheless used.

(*) Serial Number for spanish telecards: The serial number for G+D, Gemplus and Solaic telecards is directly obtained by the following formula:

Byte[5]*$10000 + Byte[6]*$100 + Byte[7]

1.9a - Memory Map for Mexican cards from Telmex (LadaTel): ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Byte (Bit) Hexa

+-----+ 950 (0..7) | | ---> Check Sum Byte = 216 - Sum b(i) +-----+ i=8

1 (8..15) | $80 | +-----+2 (16..23) | |3 (24..31) | | --> [TBD] +-----+4 (32..39) | $0s | --> Schlumberger | $1s | --> Solaic [TBC] | $4s | --> Gemplus +-----+5 (40..47) | ss |6 (48..55) | ss | --> Serial Number (*)7 (56..63) | ss | +-----+-----+

8-9 (64..79) | $sv | vC | --> Card Value (*) +-----+-----+10 (80..87) | $32 | | $64 | --> [TBD]

+-----+11 (88..95) | $59 | --> Mexico +-----+12 (96..103) | | ---> The units area: each time a unit . | | is used, then a bit is set to "1"; . | | . | | The first 4 units are fused in . | | factory as test. . | |

30 (240..247) | | +-----+31 (248..255) | $FF | --> $FF is set when all the units are used. +-----+

Serial Number = b(34..65) displayed in decimal

Card Value: Each unit has 0.5N$ worth. Units burned in factory are not counted in the value (so a 40 units card has a 20N$ value and 44 units are



burned when card is empty).

1.9b - Memory Map for Ivory Coast cards from publicom S.A.: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Byte (Bit) Hexa

+-----+ 950 (0..7) | | ---> Check Sum Byte = 216 - Sum b(i) +-----+ i=81 (8..15) | $80 | +-----+2 (16..23) | |3 (24..31) | | --> [TBD] +-----+4 (32..39) | $0s | --> Schlumberger | $1s | --> Solaic [TBC] | $4s | --> Gemplus +-----+5 (40..47) | ss |6 (48..55) | ss | --> Serial Number (*)7 (56..63) | ss | +-----+-----+8-9 (64..79) | $sv | vC | --> Card Value (*)

+-----+-----+10 (80..87) | $32 | | $64 | --> [TBD]

+-----+11 (88..95) | $59 | --> Mexico +-----+12 (96..103) | | ---> The units area: each time a unit . | | is used, then a bit is set to "1"; . | | . | | The first 4 units are fused in . | | factory as test. . | |30 (240..247) | |

+-----+31 (248..255) | $FF | --> $FF is set when all the units are used. +-----+

Serial Number = b(34..65) displayed in decimal

Card Value: Units burned in factory are not counted in the value (soa 40 units card has a 20N$ value and 44 units are burnedwhen card is empty).

1.10 - Memory Map for Slovenian Cards: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Byte (Bit) Hexa

+-----+0 (0..7) | $5A |

+-----+1 (8..15) | $vv | --> Unit Value | | $81 -> 100u | | $82 -> 20u | | $83 -> 300u (2 units/bit)



| | $84 -> 100u (not used) | | $85 -> 50u

| | $86 -> 25u+-----+-----+-----+

2..4 (16..39) | $E9 | $B5 | $4B | --> Telekom cards | | $B4 | | --> "Impulz" cards +-----+-----+-----+5 (40..47) | $00 | | $01 | --> first digit of serial number +-----+6 (48..55) | $xx | --> Serial Number = (B(6) << 16) + (B(7) << 8) + B(8)7 (56..63) | $xx |8 (64..71) | $xx | +-----+9 (72..79) | $yy | --> Signature for the S.N.10 (80..87) | $yy |

+-----+ 1011 (88..95) | $zz | --> Checksum for B[0] .. B[10] = 0xFF & [( Sum B(i) )-1] | | i=0 +-----+12 (96..103) | | --> The units area: each time a unit . | | is used, then a bit is set to "1"; . | | . | |

. | |31 (248..255) | | +-----+

II ) The 2nd generation Telecards: ============================

2.1 - Introduction: ~~~~~~~~~~~~

These cards are in fact 128 bit memory in NMOS technology, and the map of these cards are the following:

64 bit EPROM written protected (manufaturer area). 40 bit EEPROM (5x8 bits). 24 bits set to "1".

2.2 - Pinout: ~~~~~~

ISO 7816-2

,-------------+-------------, | 1 | 5 | Pinout:

+-------\ | /-------+ ~~~~~~ | 2 +----+ + 6 | 1 : VCC=5V 5 : Gnd +--------| |--------+ 2 : Reset 6 : n.c. | 3 +----+----+ 7 | 3 : Clock 7 : I/O +-------/ | \-------+ 4 : n.c. 8 : n.c. | 4 | 8 | '-------------+-------------' (n.c. : not connected)

2.3 - Main features:



~~~~~~~~~~~~~

- ISO 7816- 1/2 compatible. - use a single 5V power supply. - low power consuption. - NMOS technology.

2.4 - Time Diagrams: ~~~~~~~~~~~~~

Reset:------ The address counter is reset to 0 when the clock line CLK is raised whilethe control line R is high {Note that the address counter can not be resetwhen it is in the range 0 to 7}.

__________________ _____| |_____________________________________________ Reset : : : _____ : _____ _____ _____ _____

_____:_______| |____:_| |_____| |_____| |_____| |_ Clk : : : : : : : : : : :

_____:_______:__________:_:_____:_____:_____:_____:_____:_____:_____:_ _____:___n___|_____0____:_|_____1_____|_____2_____|_____3_____|___4_:_(Address)

: : : : : : _____: :_______:___________:___________:___________:_ _____XXXXXXXXXXXXXXXXXXXX_______|___________|___________|___________|_ DataBit n Bit 0 Bit 1 Bit2 Bit3

The address counter is incremented by 1 with each rising edge of the clocksignal Clk, for as long as the control line R remains low. The data held ineach addressed bit is output to I/O contact each time Clk falls. It is notimpossible to decrement the address counter, therefore to address an earlierbit, the address counter must be reset then incremented to require value.

Write:

------ All unwritten or erased bits in the address 64-104 can be unwritten to.When a memory cell is unwritten, it is set to 0. The addressed cell isunwritten to by the following sequence.

1- R is raised while Clk is low, to disable address counter increment for oneclock pulse.

2- Clk is then raised for a minimum of 10ms to write to the address bit.

When to write operation ends, and Clk falls, the address counter is unlocked,and the content of the written cell, which is now 0, is output to I/O contactif the operation is correct.

The next Clk pulse will increment the address by one, then the write sequencecan be repeated to write the next bit.

_____ _____ _____________| |______________________________| |_______________ Reset : : ___ : _____ ___ : _____

____| |____:__________| |_________| |_____:__________| |____ Clk : : : : : : : : :

____:________:__________:_____:_________:___:_____:__________:_____:_____



n | n+1 | n+2 | : n+3 | : (Address)----'--------:----------'-----:---------'---:-----:----------'-----:----- : : : : : : :

_________ _: : : ____________: ___: : : _________XXX_XXXXXXXXXXXXXXXXXXX____________ XX___XXXXXXXXXXXXXXXXXXXXXXX I/O n n+1 : : n+1 n+2 : : : : : : write write

WriteCarry:-----------

A counter is erased by performing the WRITECARRY sequence on the stage ofthe next highest weighing to that to be erased.

The writecarry sequence is as follows:

1 - Set the address counter to an unwritten bit in the next highest counterstage to that to be erased.

2 - Increment is disabled on the following rising edge of R where Clk remainslow.

3 - Clk is then raised for a minimum of 10ms, while R is low, to write to thenext address bit.

4 - R is the raised again while Clk remains low to disable increment a secondtime.

5 - Clk is the raised for a minimum of 1ms, while R is low, to write to theaddressed bit a second time, erasing the counter level immediately below thatthe addressed bit.

_____ _____ ______| |____________________| |_________________________________ Rst : :

: _______ : _______ ___ ______:___________| |______:_____________| |______| |______ Clk : : : : : : : : : : : : : : : :<------------------------- address n ------------------------>:<--- n+1 ------ : : : : : : : : : : : : : :

______: : :______: : :__________: _____ ______XXXXXXXXXXXXXXXXXXXXX______XXXXXXXXXXXXXXXXXXXXXXX__________XX_____ I/O : : n : : n n+1 : : : : Write Erase

2.5 - Memory Map: ~~~~~~~~~~

2.5.1 - Memory Map for 4 or 5 stage octal unit counter: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2.5.1.1 - Albania: ~~~~~~~

Byte (Bit) Hexa



+-----+-----+-----+-----+0-3 (0..31) | $98 | $20 | $33 | $38 | --> Albania +-----+-----+-----+-----+4-7 (32..63) | $.. | $.. | $.. | $.. | --> Serial Number (see below) +-----+-----+-----+-----+8..11 (64..95) |c512 | c64 | c8 | c1 | --> 4 stage octal counter +-----+-----+-----+-----+12 (96..103) | $.. |13 (104..111) | $.. |14 (112..119) | $.. |15 (120..127) | $.. | +-----+

Serial Number = b(63..32) Read in reverse binary from bit 63 to 32 Displayed in 10 decimal digits.

2.5.1.2 - Australia: ~~~~~~~~~

Byte (Bit) Hexa

+-----+-----+-----+-----+

0-3 (0..31) | $E8 | $20 | $61 | $09 | +-----+-----+-----+-----+4 (32..39) | | --> Serial Number / Manufacturer area5 (40..47) | |6 (48..55) | |7 (56..63) | | +-----+-----+-----+-----+-----+8..12 (64..103)|c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter +-----+-----+-----+-----+-----+13 (104..111) | $FF |14 (112..119) | $F0 |15 (120..127) | $FF | +-----+

Note: Each unit is 0.01$ worth.

2.5.1.3 - Belgium (Belgacom): ~~~~~~~~~~~~~~~~~~

Byte (Bit) Hexa +-----+-----+-----+0..3 (0..31) | $E9 | $30 | $35 | +-----+-----+-----+-----+-----+4..7 (32..63) | $xx | xs | ss | ss | | --> xxxx : [TBD] | | | | | | sssss: Serial Number

+-----+-----+-----+-----+-----+7 (56..63) | | --> [TBD] +-----+-----+-----+-----+-----+8..12 (64..103) |c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter +-----+-----+-----+-----+-----+13 (104..111) | $FF |14 (112..119) | $.. |15 (120..127) | $.. | +-----+--- -+--- -+-----+16..63 (128..511) | $FF | . . + . . + $FF +



+-----+- ---+- ---+-----+

Serial Number = b(32..55) displayed in decimal.Each unit is 0.10 BEF worth.

2.5.1.4 - Botswana: ~~~~~~~~

Byte (Bit) Hexa

+-----+-----+-----+0-2 (0..23) | $98 | $20 | $FF | --> Botswana | $92 | $3B | $FF | +-----+-----+-----+3 (24..31) | | --> Serial Number / Manufacturer area4 (32..39) | |5 (40..47) | |6 (48..55) | |7 (56..63) | | +-----+-----+-----+-----+-----+8..12 (64..103)| | | | | | --> octal counter +-----+-----+-----+-----+-----+13 (104..111) | $.. |

14 (112..119) | $.. |15 (120..127) | $.. | +-----+

The number of stages (4 or 5 stages) is not known for this card.

2.5.1.5 - Bulgaria: ~~~~~~~~

Byte (Bit) Hexa +-----+-----+-----+-----+0..3 (0..31) | $93 | $0B | $AF | $5v | --> Value : $0 = 100u

| $E8 | $2B | $07 | $5v | $4 = 50u | | | | | $8 = 200u | | | | | $C = 400u +-----+-----+-----+-----+4..7 (32..63) | ss | ss | ss | ss | --> Serial Number +-----+-----+-----+-----+-----+8..12 (64..103) | | | | | | --> octal counter +-----+-----+-----+-----+-----+13..15 (104..127) | $.. | $.. | $.. | +-----+-----+-----+-----+16..19 (128..159) | $FF | $FF | $FF | $FF | " " " " | " | " | " | " |28..31 (224..255) | $FF | $FF | $FF | $FF |

+-----+-----+-----+-----+


Serial Number = b(63..32) displayed in decimal.

2.5.1.6a - Canada (128 bits): ~~~~~~~~~~~~~~~~~





Byte (Bit) Hexa

+-----+-----+-----+-----+0-3 (0..31) | $10 | $2B | $5F | $06 | +-----+-----+-----+-----+4 (32..39) | | --> Serial Number / Manufacturer area5 (40..47) | |6 (48..55) | |7 (56..63) | | +-----+-----+-----+-----+-----+8..12 (64..103)| | | | | | --> octal counter +-----+-----+-----+-----+-----+13 (104..111) | $.. |14 (112..119) | $.. |15 (120..127) | $.. | +-----+


2.5.1.8a - Croatia (128 bits - HPT_B): ~~~~~~~~~~~~~~~~~~~~~~~~~~

Byte (Bit) Hexa

+-----+-----+-----+0-2 (0..23) | $98 | $30 | $8F | | $99 | $30 | $8F | +-----+-----+-----+3 (24..31) | .v | --> v: Unit identifier $2 = 25 Units | | $6 = 50 Units | | $7 = 100 Units | | $3 = 200 Units | | $8 = 200 Units | | $5 = 500 Units +-----|

4 (32..39) | | --> Serial Number / Manufacturer area5 (40..47) | |6 (48..55) | | +-----+7 (56..63) | | --> [TBD] +-----+-----+-----+-----+-----+8..12 (64..103)|c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter +-----+-----+-----+-----+-----+13 (104..111) | $FF |14 (112..119) | $FF |15 (120..127) | $FF | +-----+


2.5.1.8b - Croatia (512 bits - HPT_CF): ~~~~~~~~~~~~~~~~~~~~~~~~~~~

Byte (Bit) Hexa +-----+-----+-----+0..2 (0..23) | $93 | $AB | $8F | --> Croatia (Gemplus)



+-----+-----+-----+3 (24..31) | .V | --> Value : $2 = 25u | | $6 = 50u | | $7 = 100u | | $3 = 200u | | $5 = 500u | | $8 = 1000u +-----+-----+-----+4..6 (32..55) | ss | ss | ss | --> Serial Number +-----+-----+-----+7 (56..63) | | --> Always $26 [TBC] +-----+-----+-----+-----+-----+8..12 (64..103) |c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter +-----+-----+-----+-----+-----+13..15 (104..127) | $FF | $FF | $FF | +-----+-----+-----+-----+16..19 (128..159) | $FF | $FF | $FF | $FF | " " " " | " | " | " | " |28..31 (224..255) | $FF | $FF | $FF | $FF | +-----+-----+-----+-----+32..35 (256..287) | $0A | $00 | $0A | $00 |36..39 (288..319) | $0A | $00 | $0A | $00 | +-----+-----+-----+-----+40..43 (320..351) | $00 | $00 | $00 | $00 |

" " " " | " | " | " | " |60..63 (480..511) | $00 | $00 | $00 | $00 | +-----+- ---+- ---+-----+


2.5.1.8c - Croatia (512 bits - HPT_D): ~~~~~~~~~~~~~~~~~~~~~~~~~~

Byte (Bit) Hexa

+-----+-----+-----+

0-2 (0..23) | $E9 | $30 | $8F | +-----+-----+-----+3 (24..31) | .v | --> v: Unit identifier $2 = 25 Units | | $6 = 50 Units | | $7 = 100 Units | | $3 = 200 Units | | $5 = 500 Units +-----|4 (32..39) | | --> Serial Number / Manufacturer area5 (40..47) | |6 (48..55) | | +-----+7 (56..63) | | --> [TBD]

+-----+-----+-----+-----+-----+8..12 (64..103) |c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter +-----+-----+-----+-----+-----+13 (104..111) | $FF |14 (112..119) | $FF |15 (120..127) | $FF | +-----+--- -+--- -+-----+16..63 (128..511) | $FF | . . + . . + $FF + +-----+- ---+- ---+-----+





" " " " | " | " | " | " |60..63 (480..511) | $00 | $00 | $00 | $00 | +-----+- ---+- ---+-----+



2.5.1.10 - Danmark: ~~~~~~~

Byte (Bit) Hexa +-----+-----+-----+-----+0..3 (0..31) | $E8 | $20 | $FF | $00 | | $E8 | $39 | $FF | $00 | +-----+-----+-----+-----+4..6 (32..55) | ss | ss | ss | --> Serial Number +-----+-----+-----+7 (56..63) | | --> [TBD] +-----+-----+-----+-----+-----+8..12 (64..103) |c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter +-----+-----+-----+-----+-----+13 (104..111) | $FF |

14 (112..119) | $.. |15 (120..127) | $.. | +-----+--- -+--- -+-----+16..63 (128..511) | $FF | . . + . . + $FF + +-----+- ---+- ---+-----+


Each unit is 0.01 Kr worth.

2.5.1.11 - England: ~~~~~~~

Byte (Bit) Hexa +-----+-----+-----+0..2 (0..23) | $A8 | $22 | $F7 | +-----+-----+-----+3 (24..31) | | -> Manufacturer [TDC] +-----+-----+-----+-----+4..7 (32..63) | .s | ss | ss | ss | --> Serial Number +-----+-----+-----+-----+-----+8..12 (64..103) |c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter +-----+-----+-----+-----+-----+13..15 (104..127) | $FE | $.. | $FF | +-----+--- -+--- -+-----+

16..63 (128..511) | $FF | . . + . . + $FF + +-----+- ---+- ---+-----+

Each unit is 0.01 £ worth.Serial Number = "2x/x/" b(51..36) "/" b(63..54) 6 digits 4 digits

2.5.1.12 - Estonia: ~~~~~~~



Byte (Bit) Hexa

+-----+-----+-----+-----+0-3 (0..31) | $E8 | $20 | $00 | $CE | | $E8 | $20 | $FF | $CE | | $E8 | $35 | $00 | $CE | | $E9 | $30 | $00 | $CE | | $E9 | $34 | $FF | $CE | +-----+-----+-----+-----+4 (32..39) | ss | --> sssssss = Serial Number5 (40..47) | ss |6 (48..55) | ss |7 (56..63) | sv | --> v = Value (see notes) +-----+-----+-----+-----+-----+8..12 (64..103) |c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter +-----+-----+-----+-----+-----+13 (104..111) | $FF |14 (112..119) | $.. | +-----+--- -+--- -+-----+16..63 (128..511) | $FF | . . + . . + $FF + +-----+- ---+- ---+-----+


Note 1: Each unit is 0.16kr worth.

Note 2: v=$0 Value = 188 Units (30 Kr) v=$4 Value = 313 Units (50 Kr) v=$8 Value = 625 Units (100 Kr)

2.5.1.13 - Germany (128 and 512 bits): ~~~~~~~~~~~~~~~~~~~~~~~~~~

Byte (Bit) Hexa

+-----+-----+-----+-----+0-3 (0..31) | $80 | $6F | $FF | $mm | --> Germany ($mm : manufacturer) | $A0 | $8F | $FC | | $mm : $1A : Orga [TBC] | $C0 | $8F | $FF | | $2A : Solaic | $D8 | $2F | $FC | | $4A : ODS | $D8 | $2F | $FF | | $8A : G+D | $F0 | $2F | $FF | | $AA : Orga | $F2 | $2F | $FF | | $CA : Gemplus | $F4 | $2F | $FF | | +-----+-----+-----+-----+4 (32..39) | | --> Serial Number5 (40..47) | |6 (48..55) | |

7 (56..63) | | +-----+-----+-----+-----+-----+8..12 (64..103)|c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter +-----+-----+-----+-----+-----+13 (104..111) | $.. |14 (112..119) | $.. |15 (120..127) | $.. | +-----+

Serial Number:



-------------

+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+| 1 | 2 | 3 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 |+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+-----+

Digit: 1 = b(27..24) - b(67..64) 2 = b(39..36) 3&4 = b(43..40) 5 = b(63..60) 6 = b(59..56) 7 = b(55..52) 8 = b(51..48) 9 = b(47..44)

Digits 10 & 11 are not coded in the memory [TBC].

2.5.1.14a - Greece (128 bits - OTE): ~~~~~~~~~~~~~~~~~~~~~~~

Byte (Bit) Hexa

+-----+-----+-----+-----+

0-3 (0..31) | $10 | $2B | $FF | $7B | --> Greece (Gemplus) | $92 | $3B | $FF | $7B | --> Greece (G+D) | $94 | $3B | $FF | $7B | --> Greece (G+D) | $98 | $35 | $1D | $7B | --> Greece (Solaic) | $E8 | $2B | $FF | $7B | --> Greece (Gemplus - 512 bits ???) +-----+-----+-----+-----+4-7 (32..63) | $.. | $.. | $.. | $.. | --> Serial Number (see below) +-----+-----+-----+-----+8..11 (64..95) |c512 | c64 | c8 | c1 | --> 4 stage octal counter +-----+-----+-----+-----+12 (96..103) | $.. |13 (104..111) | $.. |14 (112..119) | $.. |

15 (120..127) | $.. | +-----+

NOTE: For Greece the counter is twice the unit value of the card (200 bitsfor a 100u card).


Serial numbers for Solaic seems to begin by '11', Gemplus by '21', andSchlumberger by '31'. A new manufacturer appears with serial numbers beginningby '41'.

2.5.1.14b - Greece (512 bits - OTE):

~~~~~~~~~~~~~~~~~~~~~~~

Byte (Bit) Hexa +-----+-----+-----+-----+0..2 (0..23) | $93 | $AB | $FF | $7B | --> Greece (Gemplus) | $E8 | $20 | $FF | $7B | --> Greece (Schlumberger) | $E9 | $22 | $80 | $7B | --> Greece (Unknown manufacturer) | $E9 | $30 | $FF | $7B | --> Greece (Schlumberger) +-----+-----+-----+-----+4..7 (32..63) | ss | ss | ss | ss | --> Serial Number



+-----+-----+-----+-----+8..11 (64..95) |c512 | c64 | c8 | c1 | --> 4 stage octal counter +-----+-----+-----+-----+12..15 (96..127) | $FF | $FF | $FF | $FF | +-----+--- -+--- -+--- -+-----+16..63 (128..511) | $FF | . . + . . + . . + $FF + +-----+- ---+- ---+- ---+-----+


Serial numbers for Solaic seems to begin by '11', Gemplus by '21', andSchlumberger by '31'. A new manufacturer appears with serial numbers beginningby '41'.

2.5.1.15 - Lithuania: ~~~~~~~~~

Byte (Bit) Hexa +-----+-----+-----+-----+0..3 (0..31) | $E8 | $39 | $13 | $41 | +-----+-----+-----+-----+4 (32..39) | $vv | $07 -> 50u

| | $08 -> 50u | | $17 -> 75u +-----+-----+-----+5..7 (40..63) | xs | ss | ss | --> sssss Serial Number | | | | x [TBD] +-----+-----+-----+-----+-----+8..12 (64..103) |c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter +-----+-----+-----+-----+-----+13 (104..111) | $FF |14 (112..119) | $F0 |15 (120..127) | $FF | +-----+--- -+--- -+-----+16..63 (128..511) | $FF | . . + . . + $FF +

+-----+- ---+- ---+-----+

NOTE: The counter represents 1/10u

Serial Number = b(44..63) displayed in hexadecimal.

2.5.1.16a - Malaysia (Malaysia Telecom - 128 bits): ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Byte (Bit) Hexa

+-----+-----+-----+

0..2 (0..23) | $10 | $2B | $88 || $98 | $39 | $88 |

+-----+-----+-----+3 (24..31) | $.v | --> v: Value ($1=5 RM, $2=10 RM, $4=50 RM) +-----+4 (32..39) | | --> Serial Number / Manufacturer area5 (40..47) | |6 (48..55) | |7 (56..63) | | +-----+-----+-----+-----+-----+



8..12 (64..103)|c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter +-----+-----+-----+-----+-----+13 (104..111) | $FF |14 (112..119) | $FF |15 (120..127) | $FF | +-----+


Each unit is 0.1 RM worth.

2.5.1.16b - Malaysia (Malaysia Telecom - 512 bits): ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

+-----+-----+-----+0..2 (0..23) | $93 | $AB | $88 |

+-----+-----+-----+3 (24..31) | $.v | --> v: Value ($1 = 5 RM, $2, 10 RM, $4 = 50 RM) +-----+4 (32..39) | | --> Serial Number / Manufacturer area5 (40..47) | |6 (48..55) | |7 (56..63) | |

+-----+-----+-----+-----+-----+8..12 (64..103) |c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter +-----+-----+-----+-----+-----+13 (104..111) | $FF |14 (112..119) | $FF |15 (120..127) | $FF | +-----+-----+-----+-----+16..19 (128..159) | $FF | $FF | $FF | $FF | " " " " | " | " | " | " |28..31 (224..255) | $FF | $FF | $FF | $FF | +-----+-----+-----+-----+32..35 (256..287) | $0A | $00 | $0A | $00 |36..39 (288..319) | $0A | $00 | $0A | $00 |

+-----+-----+-----+-----+40..43 (320..351) | $00 | $00 | $00 | $00 | " " " " | " | " | " | " |60..63 (480..511) | $00 | $00 | $00 | $00 | +-----+- ---+- ---+-----+


Each unit is 0.1 RM worth.

2.5.1.16c - Malaysia (Citifon - 128 bits): ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Byte (Bit) Hexa

+-----+-----+-----+0..2 (0..23) | $10 | $2B | $16 |

+-----+-----+-----+3 (24..31) | $.. | +-----+4 (32..39) | | --> Serial Number / Manufacturer area5 (40..47) | |



6 (48..55) | |7 (56..63) | | +-----+-----+-----+-----+-----+8..12 (64..103)|c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter +-----+-----+-----+-----+-----+13 (104..111) | $FF |14 (112..119) | $FF |15 (120..127) | $FF | +-----+

2.5.1.17 - Republic of Moldova (MoldTelecom): ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Byte (Bit) Hexa +-----+-----+-----+-----+0..3 (0..31) | $E8 | $20 | $FF | $Bv | --> Value : $4, $B = 100u | $E8 | $2B | $07 | $Bv | $8 = 75u | $E9 | $30 | $B1 | $Bv | $C = 200u +-----+-----+-----+-----+4..7 (32..63) | ss | ss | ss | ss | --> Serial Number +-----+-----+-----+-----+-----+8..12 (64..103) |c4096|c512 | c64 | c8 | c1 | --> octal counter +-----+-----+-----+-----+-----+

13..15 (104..127) | $.. | $.. | $.. | +-----+-----+-----+-----+16..19 (128..159) | $FF | $FF | $FF | $FF | " " " " | " | " | " | " |28..31 (224..255) | $FF | $FF | $FF | $FF | +-----+-----+-----+-----+


Serial Number is 10 digits long, it begins by '075' for 75 units cards,'100' for 100 units cards and '200' for 200 units cards.

2.5.1.18 - Netherlands (PTT Telekom): ~~~~~~~~~~~~~~~~~~~~~~~~~

Byte (Bit) Hexa

+-----+-----+-----+-----+0-3 (0..31) | $80 | $37 | $FF | $mm | --> Netherlands ($mm : manufacturer) | $80 | $77 | $FF | | $mm : $1A : Orga [TBC] | $D8 | $37 | $FF | | $2A : Solaic | $F0 | $37 | $FF | | $4A : ODS | | | | | $8A : G+D | | | | | $AA : Orga | | | | | $CA : Gemplus

+-----+-----+-----+-----+4 (32..39) | | --> $4x : 5G | | $2x : 10G | | $6x : 25G +-----+5 (40..47) | | --> Serial Number6 (48..55) | |7 (56..63) | | +-----+-----+-----+-----+-----+8..12 (64..103)|c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter



+-----+-----+-----+-----+-----+13 (104..111) | $FF |14 (112..119) | $.. | --> $00 for empty cards ($80, $C0, E0, ...... )15 (120..127) | $.. | --> $00 for empty cards +-----+

Serial Number:-------------

+-----+-----+-----+-----+-----+-----+-----+-----+-----+| 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 |+-----+-----+-----+-----+-----+-----+-----+-----+-----+

Digit: 1 = b(27..24) 2 = b(63..60) 3 = b(59..56) 4 = b(55..52) 5 = b(51..48) 6 = b(47..44)

Digits 7,8&9 are not coded in the memory [TBC].

2.5.1.19a - Romania (128 bits):

~~~~~~~~~~~~~~~~~~

Byte (Bit) Hexa

+-----+-----+-----+0-2 (0..23) | $10 | $2B | $2F | | $10 | $2B | $17 | | $93 | $AB | $2F | | $98 | $20 | $2F | | $99 | $3C | $2F | +-----+-----+-----+3 (24..31 | | --> Serial Number / Manufacturer area4 (32..39) | |

5 (40..47) | |6 (48..55) | |7 (56..63) | | +-----+-----+-----+-----+-----+8..12 (64..103) |c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter +-----+-----+-----+-----+-----+13 (104..111) | $FF |14 (112..119) | $FF |15 (120..127) | $FF | +-----+

2.5.1.19b - Romania (512 bits): ~~~~~~~~~~~~~~~~~~

Byte (Bit) Hexa +-----+-----+-----+0..2 (0..23) | $E8 | $2B | $17 | +-----+-----+-----+3 (24..31 | | --> Serial Number / Manufacturer area4 (32..39) | |5 (40..47) | |6 (48..55) | |7 (56..63) | | +-----+-----+-----+-----+-----+



8..12 (64..103) |c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter +-----+-----+-----+-----+-----+13 (104..111) | $FF |14 (112..119) | $.. |15 (120..127) | $.. | +-----+--- -+--- -+-----+16..63 (128..511) | $FF | . . + . . + $FF + +-----+- ---+- ---+-----+

2.5.1.20a - Russia (CNM): ~~~~~~~~~~~~~

Byte (Bit) Hexa +-----+-----+-----+-----+0..3 (0..31) | $E8 | $2B | $FF | $01 | --> Russia - CNM (???) | $E9 | $30 | $FF | $01 | --> Russia - CNM (Schlumberger) +-----+-----+-----+-----+4..7 (32..63) | ss | ss | ss | ss | --> Serial Number +-----+-----+-----+-----+-----+8..12 (64..103) |c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter +-----+-----+-----+-----+-----+13 (104..111) | $FF |14 (112..119) | $.. |

15 (120..127) | $.. | +-----+--- -+--- -+-----+16..63 (128..511) | $FF | . . + . . + $FF + +-----+- ---+- ---+-----+


2.5.1.20b - Russia (MCTN - Moscow City Telephone Network): ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Byte (Bit) Hexa +-----+-----+-----+

0..2 (0..23) | $E8 | $30 | $CF | | $E9 | $30 | $07 | +-----+-----+-----+3 (24..31) | mm | --> Manufacturer: $01 = Schlumberger | | $03 = Schlumberger | | $04 = ??? | | $05 = ??? +-----+-----+-----+-----+4..7 (32..63) | ss | ss | ss | sv | --> sssss: Serial Number | | | | | v: Value (see note) +-----+-----+-----+-----+-----+8..12 (64..103) |c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter +-----+-----+-----+-----+-----+

13 (104..111) | $FF |14 (112..119) | $.. |15 (120..127) | $.. | +-----+--- -+--- -+-----+16..63 (128..511) | $FF | . . + . . + $FF + +-----+- ---+- ---+-----+


Value: The value is stored b(63..60) multiplied by 10, that is to say you read t



he area in reverse and you multiply by 10 ($A=50 Units, $C=30, $6=60).

2.5.1.21 - Slovakia (Slovenske Telekomunikanie): ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Byte (Bit) Hexa

+-----+-----+-----+0-2 (0..23) | $10 | $2B | $12 | | $92 | $3B | $FF | | $98 | $25 | $FF | | $98 | $35 | $0C | +-----+-----+-----+3 (24..31 | | --> Serial Number / Manufacturer area4 (32..39) | |5 (40..47) | |6 (48..55) | |7 (56..63) | | +-----+-----+-----+-----+-----+8..12 (64..103)|c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter +-----+-----+-----+-----+-----+13 (104..111) | $FF |

14 (112..119) | $FF |15 (120..127) | $FF | +-----+


2.5.1.22 - South Africa: ~~~~~~~~~~~~

Byte (Bit) Hexa

+-----+-----+-----+-----+

0-3 (0..31) | $92 | $3B | $FF | $06 | --> South Africa (G+D) | | | | $09 | --> South Africa (G+D) | $98 | $28 | $FF | $x4 | --> South Africa (???) | | $3E | | | --> South Africa (G+D) +-----+-----+-----+-----+4 (32..39) | | --> [TBD]5 (40..47) | ss | --> Serial Number6 (48..55) | ss |7 (56..63) | ss | +-----+-----+-----+-----+-----+8..12 (64..103)|c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter +-----+-----+-----+-----+-----+13 (104..111) | $FF |

14 (112..119) | $FF |15 (120..127) | $FF | +-----+

2.5.1.23 - Swaziland: ~~~~~~~~~

Byte (Bit) Hexa +-----+-----+-----+-----+



0..3 (0..31) | $E8 | $35 | $3B | $A3 | +-----+-----+-----+-----+4..7 (32..63) | ss | ss | ss | ss | --> Serial Number +-----+-----+-----+-----+-----+8..12 (64..103) |c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter +-----+-----+-----+-----+-----+13 (104..111) | $FE |14 (112..119) | $FF |15 (120..127) | $FF | +-----+--- -+--- -+-----+16..63 (128..511) | $FF | . . + . . + $FF + +-----+- ---+- ---+-----+

Serial Number = "SGAB" b(56..63) b(32..55) 3 digits 8 digits

2.5.1.24 - Swiss: ~~~~~

Byte (Bit) Hexa

+-----+-----+-----+-----+0-3 (0..31) | $D8 | $2A | $FF | $mm | --> Swiss ($mm : manufacturer) | $DD | $2A | $0F | | $mm : $1A : Orga [TBC]

| $DD | $2A | $2F | | $2A : Solaic [TBC] | $DD | $2A | $4F | | $4A : ODS [TBC] | | | | | $8A : G+D [TBC] | | | | | $9A : ??? | | | | | $AA : Orga [TBC] | | | | | $CA : Gemplus +-----+-----+-----+-----+4 (32..39) | vx | --> v: Value ($2=10 CHF, $4= 5 CHF, $6=20 CHF)5 (40..47) | xs | --> x: [TBD]6 (48..55) | ss | --> s:Serial Number7 (56..63) | ss | +-----+-----+-----+-----+-----+8..12 (64..103) |c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter

+-----+-----+-----+-----+-----+13 (104..111) | $FF |14 (112..119) | $FF |15 (120..127) | $FF | +-----+--- -+--- -+-----+16..39 (128..319) | $FF | . . + . . + $FF + +-----+-----+-----+-----+40..43 (320..351) | $00 | $00 + $00 + $00 + +-----+-----+-----+-----+44..47 (352..383) | $.. | $.. + $.. + $.. + --> See note. +-----+-----+-----+-----+48..63 (384..511) | $FF | . . + . . + $FF + +-----+--- -+--- -+-----+

Each unit is 0.01 CHF worth.

Serial Number = b(63..44) displayed in hexadecimal.

Cards beginning by $D82A have $F8884AA8 in b(352..383)Cards beginning by $DD2A have 'Eurochip' printed above the chip.

2.5.1.25 - Thailand:



~~~~~~~~

Byte (Bit) Hexa

+-----+-----+-----+-----+0-3 (0..31) | $92 | $3B | $FF | $07 | +-----+-----+-----+-----+4 (32..39) | ss | --> Serial Number5 (40..47) | ss |6 (48..55) | ss | +-----+7 (56..63) | | +-----+-----+-----+-----+-----+8..12 (64..103)| | | | | | --> octal counter +-----+-----+-----+-----+-----+13 (104..111) | $FF |14 (112..119) | $FF |15 (120..127) | $FF | +-----+


2.5.1.26a - Venezuela (CANTV - 128 bits):

~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Byte (Bit) Hexa

+-----+-----+-----+0-2 (0..23) | $10 | $2B | $1F | --> Venezuela (CANTV) | $98 | $35 | $1F | +-----+-----+-----+3 (24..31) | $.v | --> v: Value ($0 = 250, $2=1000 Bs, $4=2000 Bs) +-----+4 (32..39) | ss | --> Serial Number5 (40..47) | ss |6 (48..55) | ss |

+-----+7 (56..63) | | +-----+-----+-----+-----+-----+8..12 (64..103) |c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter +-----+-----+-----+-----+-----+13 (104..111) | $FF |14 (112..119) | $FF |15 (120..127) | $FF | +-----+

2.5.1.26b - Venezuela (CANTV - 512 bits): ~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Byte (Bit) Hexa

+-----+-----+-----+0-2 (0..23) | $93 | $0B | $1F | --> Venezuela (CANTV) | $93 | $AB | $1F | | $93 | $AC | $1F | +-----+-----+-----+3 (24..31) | $.v | --> v: Value ($0 = 250 Bs, $2=1000 Bs, $4=2000 Bs) +-----+



4 (32..39) | ss | --> Serial Number5 (40..47) | ss |6 (48..55) | ss | +-----+7 (56..63) | | +-----+-----+-----+-----+-----+8..12 (64..103) |c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter +-----+-----+-----+-----+-----+13 (104..111) | $FF |14 (112..119) | $FF |15 (120..127) | $FF | +-----+-----+-----+-----+16..19 (128..159) | $FF | $FF | $FF | $FF | " " " " | " | " | " | " |28..31 (224..255) | $FF | $FF | $FF | $FF | +-----+-----+-----+-----+32..35 (256..287) | $0A | $00 | $0A | $00 |36..39 (288..319) | $0A | $00 | $0A | $00 | +-----+-----+-----+-----+40..43 (320..351) | $00 | $00 | $00 | $00 | " " " " | " | " | " | " |60..63 (480..511) | $00 | $00 | $00 | $00 | +-----+- ---+- ---+-----+

Each unit is 0.25 Bs worth.


2.5.2 - 2nd Generation French Telecards (T2G) and derivates: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2.5.2.1 - French T2G: ~~~~~~~~~~

Byte (Bit) Memory Map

+-----+-----+0-1 (0..15) | $81 | $40 | --> French T2G +-----+-----+2..7 (16..63) | $NN |

| $NN | --> N: Serial Number| $NN | $001: 5u

| $NN | $003: 25u | $NV | --> V: Unit Value --> $005: 50u | $VV | $00C: 120u +-----+8 (64..71) | $xx | --> c(512) 4 stage octal Incremental-counter9 (72..79) | $xx | c(64) (see note for units set in factory)

10 (80..87) | $xx | c(8)11 (88..95) | $xx | c(1) +-----+12 (96..103) | $xx | --> $7F when not empty; $FF when empty +-----+13 (104..111) | $FF | --> Unused (Zone set to 1) +-----+-----+14..15 (112..127) | $.. | $.. | --> Certificate ($0000 when card is empty) +-----+-----+-----+-----+16..23 (128..191) | $.. | $.. | $.. | $.. | --> Authentification Secret Key



| $.. | $.. | $.. | $.. | All $FF when memory dumped. +-----+-----+-----+-----+24..31 (192..255) | $00 | $00 | $00 | $00 | --> Unused | $00 | $00 | $00 | $00 | +-----+-----+-----+-----+32.(256..263) | $* | --> 4 next = signature / First 4 bits = fuses +-----+-----+-----+33..35 (264..287) | $.. | $.. | $.. | --> Unused +-----+-----+-----+-----+36..39 (288..319) | $.. | $.. | $.. | $.. | --> Anti Tearing Flags +-----+-----+-----+-----+-----+-----+-----+40..46 (320..375) | $.. | $.. | $.. | $.. | $.. | $.. | $.. | --> User Defined +-----+-----+-----+-----+-----+-----+-----+ Area

NOTES: When memory is dumped, the address counter restarts at 000 when you reach address 511. Value for bits from 376 to 511 depends on the chip's version. At that date, 3 chip versions seem to exist.

On the first version of the chip the certificate b(112..127) cannot be erased when the card is empty. Some payphones do not erase certificate and do not set B(12) to $FF when card is empty.

For 50u and 120u cards 9 units are set in factory, 14 units are set in factory for 5u and 25u cards.

The User Defined Area b(320..375) can be defined as "not erasable".

2.5.2.2 - French T2G ("Numero Unique"): ~~~~~~~~~~~~~~~~~~~~~~~~~~~~

French T2G "Numero Unique" are some special cards: a defined number is automatically dialed when the card is inserted in a payphone. At this time only 5u cards are known to exist (but may be 25u will come?).

Byte (Bit) Memory Map

+-----+-----+

0-1 (0..15) | $81 | $40 | --> French T2G +-----+-----+2..7 (16..63) | $NN |

| $NN | --> N: Serial Number| $NN |

| $NN | | $NV | --> V: Unit Value --> $101: 5u "Numero Unique" | $VV | +-----+8 (64..71) | $xx | --> c(512) 4 stage octal Incremental-counter9 (72..79) | $xx | c(64) (see note for units set in factory)10 (80..87) | $xx | c(8)11 (88..95) | $xx | c(1)

+-----+-----+-----+-----+12..15 (96..127) | $nn | $nn | $nn | $nn | --> Dialed Number +-----+-----+-----+-----+16..23 (128..191) | $.. | $.. | $.. | $.. | --> Authentification Secret Key | $.. | $.. | $.. | $.. | All $FF when memory dumped. +-----+-----+-----+-----+24..31 (192..255) | $00 | $00 | $00 | $00 | --> Unused | $00 | $00 | $00 | $00 | +-----+-----+-----+-----+32.(256..263) | $* | --> 4 next = signature / First 4 bits = fuses



+-----+-----+-----+33..35 (264..287) | $.. | $.. | $.. | --> Unused +-----+-----+-----+-----+36..39 (288..319) | $.. | $.. | $.. | $.. | --> Anti Tearing Flags +-----+-----+-----+-----+-----+-----+-----+40..46 (320..375) | $.. | $.. | $.. | $.. | $.. | $.. | $.. | --> User Defined +-----+-----+-----+-----+-----+-----+-----+ Area

The automatically dialed number is stored b(96..127), it is stored in binaryand as a french national number (as dialed from France). The number must befrench number, because there is no room for the international prefix.

Example: $08E3248D represents the number "01 49 10 37 57".

Theses cards are special, because the dialed number is partially stored on thecertificate, so certificate is not used (does not matter because you may onlydial one number).

2.5.2.3 - Estonia: ~~~~~~~

Byte (Bit) Hexa +-----+-----+-----+-----+

0..3 (0..31) | $83 | $AD | $00 | $CE | --> Estonia (Schlumberger) +-----+-----+-----+-----+4..6 (32..55) | ss | ss | ss | --> ssssss = Serial Number +-----+-----+-----+7 (56..63) | $sv | --> v = Value (see note) +-----+-----+-----+-----+-----+8..12 (64..103) |c4096|c512 | c64 | c8 | c1 | --> 5 stage octal counter +-----+-----+-----+-----+-----+13 (104..111) | $00 | +-----+-----+14..15 (112..127) | $.. | $.. | --> Certificate ($0000 when card is empty) +-----+-----+-----+-----+16..19 (128..159) | $00 | $00 | $00 | $00 |

" " " " | | | | |28..31 (224..255) | $00 | $00 | $00 | $00 | +-----+-----+-----+-----+32..35 (256..287) | $F5 | $F5 | $F5 | $F5 | +-----+-----+-----+-----+36..39 (288..319) | $00 | $00 | $00 | $00 | " " " " | " | " | " | " |44..47 (352..383) | $00 | $00 | $00 | $00 | +-----+-----+-----+-----+48..51 (384..415) | $F5 | $F5 | $F5 | $F5 | +-----+-----+-----+-----+52..55 (416..448) | $FF | $FF | $FF | $FF | " " " " | " | " | " | " |

60..63 (480..511) | $FF | $FF | $FF | $FF | +-----+- ---+- ---+-----+

Serial Number = b(34..57) displayed in decimal.Each unit is 0.16 Kr worth.b(60..63) indicates the value of the card: $0 = 188 Units (30 Kr) $4 = 313 Units (50 Kr) $8 = 625 Units (100 kr)



2.5.2.4 - Russia: ~~~~~~

Byte (Bit) Hexa +-----+-----+-----+-----+0..3 (0..31) | $83 | $AB | $01 | $06 | --> Russia - MRTC (Gemplus) +-----+-----+-----+-----+4..6 (32..55) | ss | ss | ss | --> Serial Number +-----+-----+-----+7 (56..63) | $.. | --> Value $02 = 20 [TBC] +-----+-----+-----+-----+8..11 (64..96) | $00 | $00 | $00 | $00 | " " " " | | | | |28..31 (224..255) | $00 | $00 | $00 | $00 | +-----+-----+-----+-----+32..35 (256..287) | $F5 | $F5 | $F5 | $F5 | +-----+-----+-----+-----+36..39 (288..319) | $00 | $00 | $00 | $00 | " " " " | " | " | " | " |44..47 (352..383) | $00 | $00 | $00 | $00 | +-----+-----+-----+-----+48..51 (384..415) | $F5 | $F5 | $F5 | $F5 | +-----+-----+-----+-----+

52..55 (416..448) | $FF | $FF | $FF | $FF | " " " " | " | " | " | " |60..63 (480..511) | $FF | $FF | $FF | $FF | +-----+- ---+- ---+-----+

2.7 - The Octal Counter: ------------------

The counter area stores the card's units. Its initial value is specified bythe card issuer and is set during manufacturing.

The counter area is divided into a 5 stage abacus counter, or 4 stage abacus

counter. Depending on the chip you may: - Write a bit set to '1' to change its value to '0' (Eurochip family). - Write a bit set to '0' to change its value to '1' (T2G family).

The octal value of each stage is defined by the number of bits set to'1' (Eurochip and French T2G from France Telecom) or '0' (French T2G derivates)this stage value must be weighted by the coeficient 8^n (where n is among[4..0] or [3..0]).

Exemple (Eurochip or french T2G from France Telecom): ----------------------------------------------------- 5 stage octal unit counter with 15818 units.

Byte8 Byte9 Byte10 Byte11 Byte12 (c4096) (c512) (c64) (c8) (c1) -------------------------------------------------------------- 00000111 - 00111111 - 01111111 - 00000001 - 00000011 -------------------------------------------------------------- (3)octal (6)octal (7)octal (1)octal (2)octal -------------------------------------------------------------- Value = 3*8^4 + 6*8^3 + 7*8^2 + 1*8^1 + 2*8^0 = 3*4096 + 6*512 + 7*64 + 1*8 + 2*1 --------------------------------------------------------------



TOTAL = 15818 Units

Exemple (french T2G derivate): ------------------------------ 5 stage octal unit counter with 15818 units.

Byte8 Byte9 Byte10 Byte11 Byte12 (c4096) (c512) (c64) (c8) (c1) -------------------------------------------------------------- 11111000 - 11000000 - 10000000 - 11111110 - 11111100 -------------------------------------------------------------- (3)octal (6)octal (7)octal (1)octal (2)octal -------------------------------------------------------------- Value = 3*8^4 + 6*8^3 + 7*8^2 + 1*8^1 + 2*8^0 = 3*4096 + 6*512 + 7*64 + 1*8 + 2*1 -------------------------------------------------------------- TOTAL = 15818 Units

Two types of cards exist: - Cards who counts the remaining units (mainly eurochips and french T2G derivates) - Cards who counts the used units (mainly french T2G from France Telecom).

For cards who count the used units you need to know the value of card(to compute the remaining value of the card). You must be aware that agiven number of units are burned in factory (in order to test the card).

Exemple: For a 120 units French Telecard from France Telecom9 units are burned in factory, so a fully used card counts 129 Units.

Exemple of the WRITE and WRITECARRY sequences (Eurochip):--------------------------------------------------------

b64 ........................................... b103 ----------------------------------------------------

00000111 - 00111111 - 01111111 - 00000000 - 00000011-1 ^ WRITE(b102) 00000111 - 00111111 - 01111111 - 00000000 - 00000001-1 ^ WRITE(b103) 00000111 - 00111111 - 01111111 - 00000000 - 00000000-1 ^ ^ ^ 00000111 - 00111111 - 00111111 - 11111111 - 00000000 + WRITECARRY(b81) 00000111 - 00111111 - 00111111 - 01111111 - 11111111 + WRITECARRY(b88) 00000111 - 00111111 - 00111111 - 01111111 - 01111111 + WRITE(b96)-1 00000111 - 00111111 - 00111111 - 01111111 - 00111111 + WRITE(b97)-1 00000111 - 00111111 - 00111111 - 01111111 - 00011111 + WRITE(b98)

Etc ....

Note that you can only decrease the counter and it is not authorised to writein the counter a value greater than the old value.

NB: In fact, most of the card units do not represent telecom units, but moneyunits, for exemple in german cards each telecom unit represent 30 pfennigs.



2.7 - Electrical features:

Maximum ratings:----------------

| Symbol Min Max Unit---------------------+--------------------------- Supply voltage | Vcc -0.3 6 V---------------------+--------------------------- Input voltage | Vss -0.3 6 V---------------------+--------------------------- Storage temperature | Tstg -20 +55 øC---------------------+--------------------------- Power dissipassion | Pd - 50 mW-------------------------------------------------

DC caracteristics:------------------ | Symbol Min. Typ. Max. Unit---------------------------+----------------------------- Suplly current | Icc - - 5 mA---------------------------+----------------------------- Input Voltage (low) | Vl 0 - 0.8 V

---------------------------+----------------------------- Input voltage (high) | Vh 3.5 - Vcc V---------------------------+----------------------------- Input current R | Ih - - 100 uA---------------------------+----------------------------- Input current Clk | Il - - 100 uA---------------------------+----------------------------- Output current (Vol=0.5V) | Iol - - 10 uA---------------------------+----------------------------- Output current (Voh=5V) | Ioh - - 0.5 mA---------------------------------------------------------

AC caracteristics:

------------------ | Symbol | Min. | Max. | Unit |+----------------------+--------+------+------+------+| Pulse duration | tr | 50 | - | us || R address reset | | | | |+----------------------+--------+------+------+------+| Pulse duration | ts | 10 | - | us || R write | | | | |+----------------------+--------+------+------+------+| High level Clk | th | 8 | - | us |+----------------------+--------+------+------+------+| Low level Clk | tl | 12 | - | us |+----------------------+--------+------+------+------+

| Write window | Twrite | 10 | - | ms |+----------------------+--------+------+------+------+| Erase window | Terase | 10 | - | ms |+----------------------+--------+------+------+------+| | tv1 | 5 | - | us |+----------------------+--------+------+------+------+| | tv2 | 3.5 | - | us |+----------------------+--------+------+------+------+| | tv3 | 3.5 | - | us |+----------------------+--------+------+------+------+



| | tv4 | 3.5 | - | us |+----------------------+--------+------+------+------+| | tv5 | 3.5 | - | us |+----------------------+--------+------+------+------+| | tv6 | 5 | - | us |+----------------------+--------+------+------+------+| | tv7 | 5 | - | us |+----------------------+--------+------+------+------+| | tv8 | 10 | - | us |------------------------------------------------------

III) Schematics of Readers: =======================

3.1 - Reader 1 (THIS ONE WORKS FOR CHIPY): ~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~ The following schematics is a very simple one, which will enable you toread all kind of telecards with a chip, and also other memory cards.

A 4.7K pull-up resistor has been added for new generation telecards.

| +5V | C=200uF; R=2.2k (or less) Centronic / ____ Port ,/ ,--|____|--, Presence of *----------*----||----*---------------, the card | ,-------------+-------------, |Pin10 (Ack) --<--------*-----| 1 | 5 |---*--, R/W | RST +-------\ | /-------+ |Pin4 (d2) -->--------------| 2 +----+ + 6 |------|--*-- Vcc Clock +--------| |--------+ | |Pin3 (d1) -->--------------| 3 +----+----+ 7 |---, | - RAZ | RFU +-------/ | \-------+ | | | | 4.7K

Pin2 (d0) -->--------------| 4 | 8 |---|--* | | '-------------+-------------' | | - I/O | | |Pin 11 (Busy) --<----------------------------------------------'--|--' Gnd |Pin 25 ----------------------------------------------------'

3.2 - Reader 2 (DON'T KNOW WHICH SOFTWARE WORKS WITH THIS ONE): ~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

This Reader which is indeed a reader/writter will enable you to read/writemost of the more current memory cards (and notably telecards), and also smartcards working under ISO7816 protocol (Credit cards, SIM cards, Health cards,Videocrypt TV cards, etc ...).

+5V o | *-----------------, | |



,-------------, | + | Vcc | + |SUBD25 ,--|C1+ C2+|--, | KRS 232 1æF === | | === 1æF | / Smartcard '--|C1- M C2-|--' | / Connector RX | A | '-----o' o----*---------------o 13 o---------------|TX1 X In1|----------------*---------|---------------o 7 TX | | | ,-------|---------------o 42 o----------, -|TX2 2 In2|- 1/3 7406 | | ,-----|---------------o 2 Gnd | | 3 | ,---, ,---, | | | ,---|---------------o 87 o-, '----|RX1 2 Out1|--| 1 |o-| 1 |o-* | | | ,-|---------------o 3 | | | '---' '---' | | | | | *---|>|-*-------o 6 """ -|RX2 Out2|- | | | | | | ,-|>|-' ,---o 5 | | | | | | | | | 2xD | +5V + | | + | | | | | *-|----||---* o-||--|CV+ Gnd CV-|--||-, | | | | | | | 100nF | 1æF '-------------' 1æF | | | | | | | | """ | | | | | | | | | SUBD 25 """ """ | | | | | | |cPRINTER Port | | | | | | \ | PNP | | | | | | >|---, D0 - (4) RFU (RAZ) | | | | | | / | ,-,2 o----------------------------------------------|-' | | | | |e | | 10k D1 - (3) CLK ,---, ,---, 1/3 7406 | | | | | | | |

3 o-------------------| 1 |o--| 1 |o-------------|---|-|-* | | '-' D2 - (2) RST (W) '---' '---' | | | | | | |4 o----------------------------------------------|---' | | | | c \ | NPN D3 - (8) RFU (FUS) | | | | | >|----,5 o----------------------------------------------|-----' | | | e / | ,-, D4 - (7) I/O ,---, 1/6 7406 | | | | | | |6 o----------------------------| 1 |o--*---------' | | | """ | | D5 (Desativate Oscillator) '---' | 2xD ,---, | | | 10k '-'7 o------------------------------------|----|<|-*-| 1 |o-' | | | D6 (Vpp Command) | ,-|<|-' '---' | | |8 o------------------------------------|--|----------------|-|--------------' D7 | | *-|--------,9 o------x | | | | ,-----'------,

ACK (Presence of the card) | '----------------|-|--|Oscillator F|10o------------------------------------|-------------------' | '------------' BUSY (Synchronous Data Output) | | |11o------------------------------------' | """ GND | F=3.6864MHz25o-----, | | 100uH 1N4935 | """ ,-@@@@@--*-----------|>|--------*----*---------* +21V | | | | | | '---|| BUZ11 or | | | | ,->-|| IRF14 | | | | |---|'--, ,-, | 1nF | | | | 330k| | === |

| """ | | | | | | |6 '-' | | | ,------------------, | | +| 220æF | 5| Vcut Ext Vfb |7 | | ===+12V >--------*-------| MAX 643 |----*----' | | | LB1 GND COMP | | | | '------------------' ,-, | | + |1 |3 |8 | |22k | *----||----*-----*-----' '-' | | 10æF | | |



| """ """ """ | | ,---------, '----*--| 7805 |--*----> +5V | '---------' | 100nF === | === 100nF '-------*-------' | """

Component List ~~~~~~~~~~~~~~

Integratyed Circuits --------------------1xMAX232 (RS232<-->TTL Adapter)1xMAX643 (12-->21V Converter Controler)1x74LS06 (6 inverters)1x7805 (5V regulator)

Transistors Diodes ----------- ------1xBUZ11 or IRF14 4x1N4148 or other1xBC107 or antoher NPN 1x1N4935 or another fast commutation diode

1xBC177 or another PNP

Condensators Resistors Misc ------------ --------- ---- 3x100nF 2x10k 100uH self 1x1nF 1x330k 1xSmartcard connector 1x10æF 1x22k 1xSUBD25 Female 1x220æF 1xSUBD25 Male 4x1æF

Documents

Phone Cards