Student ID magstripe disected.

Screenshot of Bus Pirate magstripe script in action.

In an earlier post I got a cheap mag stripe reader working with the bus pirate and started dumping some cards. Many cards are pretty self explanatory but a view have way to many fields to be able to decipher with only one or two cards.

I got a couple of friends to let me swipe their student ID’s to try and separate all the fields to meaningful values, here’s what I got:

;[STN][PC][REVN][002066820][TYPE][030228]?[LRC]

STN – 7 digit student ID or staff number depending on whether it’s a student card or staff card.

PB – Parity character for the ID, it’s normally included in the ID but not always needed when filling out forms etc. I’ve tried to figure out the checksum method used but gave up, doesn’t appear to be anything simple or the method used with any standard barcode, ie, EAN, UPC etc. Interesting thing to note about this digit is that it’s not always present, for example it’s present on the 2010 card but not on the 2009 card. I’m assuming this is done as an easy way to invalidate cards every year but opens the flaw that you can use the same card again in a years time.

REVN – This seems to be 2 revision digits, “01” for most but found it as “02” on some.

TYPE – “1” for a student card and “3” for a staff card

STATIC – The number sequences are the same for all cards. They probably have meanings that are mostly static

LRC – Normal LRC checksum.

The access system used doesn’t seem be be real interested about any values on the card but rather uses the entire string as validation, this idea was confirmed by the fact that you can have your access rights changed without having your card re-encoded.

Creating a fake card is really easy, simply walk over to one of the notice boards and write down one of the couple of thousand student numbers, assume it’s revision “01” which is correct for most, select “1” for the type and add the static part and encode, most writers will take care of the LRC, start sentinel and end sentinel for you.

Advertisements

~ by s3c on 2010/03/20.

4 Responses to “Student ID magstripe disected.”

  1. I just want say that this is great, I recently bought a bus pirate and I am waiting for it to arrive. One of the first things I was going to do was to mag stripe my university id card. We also have a ‘swipe’ card which is a separate card used only for access to rooms, when the RFID (mifare cards) in the uni ID doesn’t work. Some doors have rfid, some have magreaders.

    So thanks, this is great. I will keep updated with this blog. I plan to get a website up in the next week or so.

  2. I’d love to hear about it if you dump a couple of student cards, kinda interested to know how other systems do it.

  3. So I got my bus pirate, and I am now in the processes of getting the mag strip reader to work. There are no markings on the PCB which is kind of making it hard. Difficult to even tell if its working! But I will keep trying to get it working and get back to you when I finally get it. I am using the logic analyser mode to identify what each wire does. I am using your earlier post as a rough guide, do you remember what sampling rate you used?

    • Not really no, just guessed it by eye, anything that just shows pulses should be fine.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

 
%d bloggers like this: