the sorcery of copper

User Tools

Site Tools


This is an old revision of the document!

To use the washing machines in my apartment complex you need to pay using a rechargeable contact card. I was curious to find out how it works.

washroom.jpg card-reader.jpg original-card.jpg
the washing room the payment terminal the payment card

It turns out it's an I²C EEPROM in a card. By recording the communication between the card and the machine I figured out where and how the credit value is stored.

the ID-1 proxy PCB and Bus Pirate in I²C monitor more

Now I can read and write the value on cards using a Raspberry Pi or simple micro-controller, but also program my own cards to work with the machines.

rpi.jpg arduino.jpg own-card.jpg
using a RPi as card reader using an Arduino as card reader making own payment cards

How is the I²C EEPROM used:

  • the I²C EEPROM uses address 0xA0/0x70
  • the values are stored over 2 bytes in little endian (the first byte the the least significant)
  • static (unchanged) values are stored at 0xB2-0xB3, 0x1E-0x1F, 0x94-0x95. they seem to encode the type of card
  • other static (unchanged) values are stored at 0x14-0x17, 0x26-0x28, 0x06-0x0D
  • a reader counter is stored at 0x1C. It is incremented every time the card is read. 0 is encoded as 0x39C7
  • the value of the card is stored at 0x28. 0 is encoded as 0x51AF. 0x2A-0x32 are copies of this value with the first byte decremented by 4 each time, and the second byte incremented by 4 (probably for error checking)
waschkarte.1430698209.txt.gz · Last modified: 2015/05/04 02:10 by kingkevin