Been also digging into making a PDF parser for their very complicated schedule files, not that they follow it anyway :)
MasterSegment is the length of the string at the end of the encrypted data that contains the secret key
To decrypt - we do the following
1. Take masterSegment (88) length - from the right of the data - this has the private key
2. Everything from 0 to the end - master segment is the raw data - that needs to be decrypted
3. Decrypt the 88 characters using the public key - that will give you a pipe separated string of the private key (random guid from MDS) and a time stamp (to scramble it)
4. Now use the private key and decrypt the data stored from step 2.
5. Parse the decrypted data - and rejoice
6. KSUE -means key issue
7. __$$_jmd - the public key that we obtain
__$_s1 : variable name for the Security object in the Helper.js file - that file has the calls to actually decrypt the data.> /MasterZoom is the sum of the zoom levels from the routes_list.json file. That is the index in the routesList.v.json -> arr array where we have the public key stored. IF THE ROUTES_LIST CHANGES, REMEMBER TO CHANGE THE INDEX TO BE CORRECT /
> /Salt Value - the element is at the 8th position. So we can essentially pick any number from 0-100 (length of the s array in the file), get the length of the element, and then go to that index the following funky looking code will evaluate to 8. Salt has a length of 8 /
> /Initialization Vector Value - the element is at the 32th position. So we can essentially pick any number from 0-100 (length of the IV array in the file), get the length of the element, and then go to that index the following funky looking code will evaluate to 32 - IV has a length of 32 /
And my favorite:
> masterSegment - length of data to be extracted from the encrypted response - 55 is just a fake //FAKE VARIABLES to throw off people hahahahaha
You can also see that the encrypted data stream is coming from https://maps.amtrak.com/services/MapDataService/trains/getTr... which is an Amtrak-hosted backend service.
If you look at the top comment in https://www.amtrak.com/services/maps.trainlocation.html you'll see the name of the consultant that probably worked on this.
// cw: FORCE the bloody stations to show at the initial zoom level. If this is not done, there is
// a possibility that stations will not show in the initial map load.
// I crib this shamelessly from SO...because it is so useful!!
// http://stackoverflow.com/questions/3125065/how-do-i-limit-panning-in-google-maps-api-v3
This code is hilarious.
Open https://www.amtrak.com/services/maps.trainlocation.html with a headless Chrome instance and get all of the data from the global `resolver` JS variable (see: `resolver.routes`, `resolver.trains`, etc.)
$.get(_$_sal_5,{ }) .done(function(d){ var x12 = d.trim(); console.log(JSON.parse(__$_s1._$_dcrt(x12.substring(0,x12.length-masterSegment),__$_s1._$_dcrt(x12.substr(x12.length - masterSegment),__$$_jmd).split('|')[masterSegment-88])) )})
I'm sure someone else can take thus further, but, its a mess of javascript. I think its hand-rolled encryption too from a cursory look at the __$_s1._$_dcrt function
I no longer am in a situation where I need tracking, but a couple of years ago I had the need for tracking my daily commuter train. I had to resort to scraping the website to find the status. If it was late, I had a push notification sent to my phone (a combination of a free app engine deployment and pushbullet). I tried to get integration via Tasker to set my alarm back if the train was more than [x] minutes, but never got to that point.
I really hope that you make some progress on this, though I wish you didn't have to and Amtrak shared the data.
[0]: https://github.com/bianjiang/crypto-js-npm/blob/1762940b9eef... [1]: https://maps.amtrak.com/rttl/js/AS.js