search

eeeeeta / blog-comments

Comments for the blog at theta.eu.org.
0 stars 0 forks source link

Reversing UK mobile rail tickets #13

Open utterances-bot opened 1 year ago

utterances-bot commented 1 year ago

Reversing UK mobile rail tickets

The UK has used small credit-card sized tickets to pay for train travel for years and years, since long before I was born — originally theAPTIS ticket1,which...

https://eta.st/2023/01/31/rail-tickets.html

xav-ie commented 1 year ago

What a cool post! I hope to see more!

tomfairey commented 1 year ago

Interesting to see someone else look into this too, found this write-up when I couldn't see validation events anymore! TTK is actually the app Avanti front-line staff use. Also interesting to see the TTK devs worked with you - always doubted they meant to have the app accessible to all...

IrregularShed commented 1 year ago

This post alone has made me subscribe to your RSS feed. Superb work!

redlukas commented 1 year ago

I can assure you the Devs did not name their class C2496p. Some Info gets lost during compilation and jadx just makes up some random, but distinct name and some classes and methods get added during compilation. while the decompiled code will perform the same as the original one, it might look quite different from what was originally written.

eeeeeta commented 1 year ago

I can assure you the Devs did not name their class C2496p. Some Info gets lost during compilation and jadx just makes up some random, but distinct name and some classes and methods get added during compilation. while the decompiled code will perform the same as the original one, it might look quite different from what was originally written.

@redlukas I'm aware! This was just intended as some light sarcasm, but I can see how that's not entirely clear (the footnote does attempt to hint that I know how jadx works, but you might not have clicked it). Apologies for any confusion caused.

redlukas commented 1 year ago

I can assure you the Devs did not name their class C2496p. Some Info gets lost during compilation and jadx just makes up some random, but distinct name and some classes and methods get added during compilation. while the decompiled code will perform the same as the original one, it might look quite different from what was originally written.

@redlukas I'm aware! This was just intended as some light sarcasm, but I can see how that's not entirely clear (the footnote does attempt to hint that I know how jadx works, but you might not have clicked it). Apologies for any confusion caused.

yeah, sorry, I completely overread the sarcasm and did not hit the footnotes. You have created an amazing writeup and I did not spare enough time to fully appreciate it.

BenjaminEHowe commented 1 year ago

Some paper tickets have Aztec 2D barcodes now as well, e.g. https://twitter.com/VIOLETHlLL/status/1100744581459656705

eeeeeta commented 1 year ago

@BenjaminEHowe indeed! that's a Paper Roll Ticket (PRT) printed on receipt paper, which the industry is moving to over the standard credit-card sized ticket (CCST) since they're dirt cheap (no magnetic stripe, for one). A lot of people are unhappy about this, as the PRTs are quite flimsy and don't fit in a wallet easily!

caraar12345 commented 8 months ago

Looks like TTK have put HTTP BASIC auth on the public key API now 🎻

alifeee commented 7 months ago

this is a great exploration :)

I do wish things were a bit more open source... 🙄