This is an old revision of the document!
To use the washing machines in my apartment complex you need to pay using a rechargeable contact card. I was curious to find out how it works.
 |  |  |
| the washing room | the payment terminal | the payment card |
It turns out it's an I²C EEPROM in a card. By recording the communication between the card and the machine I figured out where and how the credit value is stored.
 |
| the ID-1 proxy PCB and Bus Pirate in I²C monitor more |
Now I can read and write the value on cards using a Raspberry Pi or simple micro-controller, but also program my own cards to work with the machines.
 |  |  |
| using a RPi as card reader | using an Arduino as card reader | making own payment cards |
How is the I²C EEPROM used:
- the I²C EEPROM uses address 0xA0/0x70
- the values are stored over 2 bytes in little endian (the first byte the the least significant)
- static (unchanged) values are stored at 0xB2-0xB3, 0x1E-0x1F, 0x94-0x95. they seem to encode the type of card
- other static (unchanged) values are stored at 0x14-0x17, 0x26-0x28, 0x06-0x0D
- a reader counter is stored at 0x1C. It is incremented every time the card is read. 0 is encoded as 0x39C7
- the value of the card is stored at 0x28. 0 is encoded as 0x51AF. 0x2A-0x32 are copies of this value with the first byte decremented by 4 each time, and the second byte incremented by 4 (probably for error checking)
The sources for the ID-1 proxy are available here. I will no provide the source for the Raspberry Pi nor the Arduino, since it would easily be used for fraud. The purpose was just to find out how it works, and in case the support for the machine or cards ended.
