A few years ago in my own personal geekiness I started looking into seeing who had investigated the MB architecture. Found a few people online who did tear downs of the original band.
Any articles I found I’ve been tacking onto this thread I created after wondering about the app the CMs use to clear tapstiles.
I’ve scanned using the TagInfo app for near field info using NFC on my Samsung Galaxy (like this guy), but never took anything further than saying, “Huh.” and moving on.
There was a “security assessment” paper written on the Gen 1 bands, but IMHO is fairly generic and more of a thought experiment than a real assessment, but it does mention some very basic info.
This guy used a Raspberry Pi to play around with his band.