color_lens

# 广州旧版羊城通数据分析（研究向，禁止违法使用）

## Duty

This article is for educational purposes only. Actions against the law of the People's Republic of China are strictly prohibited. We take no responsibility for any illegal actions.

Till now, the YCT system is implemented with a full network connection. Please DONT TEST THE SYSTEM OF LAW

## Getting Data

1. First, using an NFC reader to export data from the card. (Exact steps will not be provided here)
2. After getting a dump file, you can use any kind of HEX editor.

Here we use the same card to compare with.

From the beginning, the first line is the UID of the card.

## Balance Part

The balance now is CNY86.29

As we can see, the balance part is applied with a copy and XOR redundancy check. And this part is obscured by inverted order.

Line 90 and A0 is the same. FF FF DE 4A 00 00 21 B5 is the right data order.

FF FF DE 4A with XOR: FF FF FF FF - 00 00 21 B5 = FF FF DE 4A

00 00 21 B5 is the HEX code of 86.29 Decimal which needs divide by 100 to fit the balance as the image shows.

To be honest, FF FF FF FF is the maximum balance equal to CNY 40 million 。

### Have a Guess

This is the same YCT card used for a long time.

## Miscellany

### The Holder's Name

Line 140 contains the holder's Chinese name.

### The Date that Publishes and Expires(Theoretically)

Line C0 contains a string just like a date. Let me guess is the date that publishes and expires.

2008.9.18 - 2018.12.31
（这张卡还是被我用到了19年2月，还剩52.89，就当做羊城通的研究费吧，后期彻底销毁数据）

## Last

Never Settle

Title: 广州旧版羊城通数据分析（研究向，禁止违法使用）

Author: Jake Liu