Duty
本文章只作为研究使用，禁止使用于违反中华人民共和国法律的领域，文章作者不对任何违法行为负责。
本文章只用作研究學習使用，禁止使用於違反中華人民共和國法律之領域，著者不為任何違法行為負責。
This article is for educational purposes only. Actions against the law of the People's Republic of China are strictly prohibited. We take no responsibility for any illegal actions.
Till now, the YCT system is implemented with a full network connection. Please DONT TEST THE SYSTEM OF LAW
Getting Data
- First, using an NFC reader to export data from the card. (Exact steps will not be provided here)
- After getting a dump file, you can use any kind of HEX editor.
Here we use the same card to compare with.
From the beginning, the first line is the UID of the card.
Balance Part
Jump to line 90 to A0.
The balance now is CNY86.29
As we can see, the balance part is applied with a copy and XOR redundancy check. And this part is obscured by inverted order.
Line 90 and A0 is the same. FF FF DE 4A 00 00 21 B5 is the right data order.
FF FF DE 4A with XOR: FF FF FF FF - 00 00 21 B5 = FF FF DE 4A
00 00 21 B5 is the HEX code of 86.29 Decimal which needs divide by 100 to fit the balance as the image shows.
To be honest, FF FF FF FF is the maximum balance equal to CNY 40 million 。
Have a Guess
This is the same YCT card used for a long time.
The answer is CNY52.89
乘车次数部分
跳转到100、110行，我们可以发现还是相同的副本复制。
在之前，羊城通是不具备乘车次数优惠的一个政策，这两行原本应该是无用行，或者是已经开始记录乘车次数了。
其中，17 02指的是17年2月，06指的是当月乘车次数为6次。
前段的补位不知道是啥意思：02 C7 12 + FD 38 ED = FF FF FF
猜一猜
再猜猜上图？
Miscellany
The Holder's Name
Line 140 contains the holder's Chinese name.
The Date that Publishes and Expires(Theoretically)
Line C0 contains a string just like a date. Let me guess is the date that publishes and expires.
2008.9.18 - 2018.12.31
（这张卡还是被我用到了19年2月，还剩52.89，就当做羊城通的研究费吧，后期彻底销毁数据）
Last
羊城通相比中国各地的交通费算是特别实惠的了，也是一代人经常去便利店买东西的珍贵记忆。
