Search code examples
loggingemv

Parsing EMV tag 9F4F (Log Format)

I am trying to parse EMV tag 9F4F (Log Format). This returns a string:

9F 27 01 9F 02 06 5F 2A 02 9A 03 9F 36 02 9F 52 06 DF 3E 01 9F 21 03 9F 7C 14

This result consists of Tag+Length, but it is not TLV encoded. I know that the first tag is 9F27 with length 01 (i can see this in cardpeek). But how can i parse/dismantle this string of Tag+Lenght pairs?

In the EMV 4.3 Book 3 - Annex D5, shows an example of such a log format but it doesnt show how to read/parse this result.

In Table 45, lengths and tags are shown for clarity. They do not appear in the log record which is the concatenation of values (no TLV coding).

The format of this result is clearly not TLV, but does anyone know what format it is in - if there is any? Or is it just a concatenated string of tag + length values?

Solution

  • The Log Format (9F4F) is a list in tag and length format (i.e., "TL" instead of TLV) See description in Table 33 on page 141.

    In your example, "9F 27 01 9F 02 06 5F 2A 02 9A 03 9F 36 02 9F 52 06 DF 3E 01 9F 21 03 9F 7C 14" means:

    • 9F27 01 (Cryptogram Information Data)
    • 9F02 06 (Amount, Authorised)
    • 5F2A 02 (Transaction Currency Code)
    • 9A 03 (Transaction Date)
    • 9F36 02 (Application Transaction Counter)
    • 9F52 06 (Terminal Compatibility Indicator)
    • DF3E 01
    • 9F21 03 (Transaction Time)
    • 9F7C 14 (Visa Customer Exclusive Data)

    It's almost identical to the example in D5.