EMV tag decoder — BER-TLV and ISO 8583 field 55

Every object is a tag, then a length, then that many bytes of value. Both parts carry rules that a generic viewer gets wrong, and both are where a dump stops decoding.

9F 26 08 1234567890ABCDEF
│  │  │  └── value, exactly 8 bytes
│  │  └───── length, short form (below 0x80)
│  └──────── second tag byte; bit 8 clear, so the tag ends here
└─────────── first tag byte: low five bits all set (1F), so the tag continues
             bit 6 clear, so this holds a value rather than nested objects

77 81 A4 …
   │  └── one further length byte: 164 bytes, not 129
   └───── 0x81 means "one length byte follows"

Bit 6 of the first tag byte is what says a tag is a template holding more objects inside it — 77 and A5 have it set, 9F26 does not. This decoder reads nesting from that bit rather than from a list of templates it knows, which is why it descends correctly into a proprietary template it has never seen before.

• 95 — Terminal Verification Results. Five bytes recording what the terminal checked and what it found. It is the first thing to read on a declined chip transaction, and the last thing anyone wants to decode by hand. Note that it records the terminal's findings only: an issuer decline arrives in tag 8A and leaves the TVR clear.
• 82 — Application Interchange Profile. What the card says it supports: SDA, DDA or CDA, whether cardholder verification happens, and whether the issuer can be authenticated.
• 9B — Transaction Status Information. What actually got performed, as opposed to what was supported. Reading 82 and 9B together answers “was this even attempted?”, which is usually the real question.

A reserved bit that is set is reported rather than ignored. In real data that almost always means the value is offset by a byte, and a decoder that silently skips it hides the actual fault.

• Amounts are shown assuming two decimal places, and the reading says so. The exponent lives in a different tag that is often absent from the same dump, so a currency like JPY would be read wrong — stating the assumption is better than guessing silently.
• Tag 9F10, Issuer Application Data, is shown as raw hex. Its layout is scheme-proprietary and differs between Visa, Mastercard and RuPay; naming a byte here would be inventing a specification rather than reading one.
• Template 80, the format 1 GENERATE AC response, is a bare concatenation with no tags inside it. Splitting it requires the CDOL that requested it, which is not in the response, so its bytes are shown whole.
• Unknown tags still decode. BER-TLV carries its own structure, so a proprietary 9Fxx or BFxx tag is parsed correctly and simply reported as not being in the dictionary.