Reverse‑engineering the Telebirr receipt QR code

Описание и применение

QR‑код Telebirr содержит вложенную структуру TLV, в которой хранится номер транзакции и контрольная сумма CRC‑16/CCITT‑FALSE. С помощью инструмента cheki.et можно быстро проверить платеж, избавив продавца от ручного ввода номера.

Задача

Shopkeepers in Ethiopia need a quick way to verify a customer’s mobile‑money payment without manually transcribing a 10‑character transaction number from a phone screen.

Результат

The decoded QR contains a nested TLV structure that holds the transaction number and a CRC. By enforcing the CRC and parsing the TLV, cheki.et can automatically verify receipts, eliminating manual transcription errors.

Рабочий процесс

• Scan the QR code to obtain an 80‑character base64 string.
• Base64‑decode to get a 58‑character ASCII hex string.
• Parse the hex string as EMVCo‑style TLV: tag, two‑digit decimal length, value.
• Extract tag 81’s value, which contains an inner TLV with tag 00 and the transaction number.
• Compute CRC‑16/CCITT‑FALSE over the original‑case characters including the 6304 prefix and compare to the trailing CRC.
• If CRC matches, accept the QR; otherwise reject and prompt for manual entry or receipt link.
• Use cheki.et to fetch the public receipt URL and display the bank’s record.

Доказательства

Scanning the QR gives you an 80-character string that is obviously base64 (trailing ==):

Источник

The tail is the first clue. 41424331443245334634 is ABC1D2E3F4 in ASCII hex, and anyone who has looked at payment QR codes will recognise 6304 followed by four hex digits near the end.

Источник

EMVCo QR codes use CRC-16/CCITT-FALSE: polynomial 0x1021, initial value 0xFFFF, no reflection, no final XOR, computed over every character before the CRC value, including the 6304 itself.

Источник

cheki.et enforces the CRC: a QR whose CRC doesn't match is rejected, and you're asked to paste the receipt link or, as a fallback, type the transaction number.

Источник