Reverse Engineering the PAN QR Code

Note: The idea for this project stems from this unfinished IndiaFOSS project (https://archive.fossunited.org/fosshack/2023/project?project=e-PAN%20QR%20Reader) by Nemo.

India’s newer PAN cards contain an embedded QR code that is advertised to be “encrypted” and readable through only verified scanners. However, information regarding this specification is totally non-existent.
Starting with the official Android PAN QR Code reader application by NSDL, I reverse engineer the obfuscated app and build a fully open-source implementation capable of parsing and verifying these QR codes.

The talk is a case study in practical reverse engineering and discusses broader lessons for government-issued digital credentials: security through obscurity, undocumented formats and the importance of publicly auditable implementations.

• Tips on reversing obfuscated android applications.

• Techniques for static and dynamic analysis of proprietary formats.

• A real-world case study on security through obscurity in public infrastructure.