hay I’ve been serching the net and I the net and I found louds of hacks
In my holiday I found out how to hack:
- Coke machines
Thanks to ch0pstickninja for teaching the world about the menu, and for Fire for assisting with research.
PREFACE
Coke vending machines are everywhere. They’re getting more and more like regular computers with LEDs that show little “ICE COLD” messages and whatnot. Well, there’s a lot more to those little built-in computers than you may think. Included in the low-level operating system that these babies run on is an actual debug menu that gives you access to all sorts of machine information and possibly gives you free cokes in older machines.
WHICH MACHINES WORK?
There’s a very strict list of vending machines that have the debug menu. First off, they’re all COCA-COLA product vending machines. This means the giant, un-missable picture on the front must show any of the following: Coke, Dasani (Water), Barq’s Root Beer, Vanilla Coke, Cherry Coke, Sprite, Evlan (water), Fanta, Fresca, Frutopia, Hi-C, Sprite Remix, Mad River, Mello Yello, Minute Maid, Nestea, Odwalla, Mr. Pibb/Pibb Xtra, Planet Java, Power Ade, Seagram’s Ginger Ale, Simply Orange, Sparkletts, or Tab. Of course anything Diet or Caffeine free works too.
The machine must have an LED screen. Some of the older ones just allow the LED to be set to a price amount and won’t have the debug menu. You’re safer if the little LED is telling you something. Usually it will scroll a little message like “Ice Cold Cokes”. Newer machines are more likely candidates.
ACCESSING THE MENU
To enter the menu, there’s a button combination. HERE’S THE ONLY THING YOU HAVE TO REALLY REMEMBER:
[4]-[2]-[3]-[1]
The buttons are numbered depending on how they are positioned. They will either be vertical (more likely), or in horizontal rows of 4 buttons per row. If it is vertical, the first button is #1, the one below it is #2, and so forth. If the buttons are in horizontal rows, the first button is #1, and the one to the right of it is #2. The numbers work like a type writer after that. In rows of 4, the first button of row 2 will be button #5. So, to review, getting in to the debug menu looks like this:
COKE MACHINE::::::
$1.00 ——-
————-
[ Coke ] <– Hit this button last
[ Coke ] <– Hit this button second
[ Diet Coke ] <– Hit this button third
[ Sprite ] <– Hit this button first
[ And so on ]
————-
Some text should show up on the LED (probably the word “Error”, we’ll explain what it means next sections). If nothing happens, your machine doesn’t have the debug menu.
NAVIGATION
To navigate from option to option (What they are is next section), remember the numberings we gave the buttons. They work as follows:
Button [ 1 ] – Exit/Back
Button [ 2 ] – Up
Button [ 3 ] – Down
Button [ 4 ] – Select
OPTIONS
Depending on the age of the machine, you will get a varying amount of default options available.
On older machines: SALE, VER, EROR, and RTN
On newer machines: CASH, SALE, EROR, and RTN
CASH – Machine Earnings Display
The CASH option will display how much money is in the machine currently. It generally takes a second or two to load. From here, you can scroll up and down through 12 or 16 different options, depending on the machine age. These other options display how much money was spent on each individual item, classified through its button (or slot, as I like to call it) number.
A neat side note about the slot numbers is that there are more slot numbers than there are actual slot, so usually the last 4 buttons contain zero money. This could be so that the same OS could be used on bigger machines, but the newer machines have even more slot numbers.
SALE – Total Sale Count
The SALE option displays how many drinks have been sold out of the machine. This tends to be cumulative, but not on all machines. The stock guy is probably supposed to reset this each time he re-stocks. Also, this has the same sub-options as the CASH option, where you can scroll up and down and see how many drinks have been sold from each slot.
VER – System/Machine Version?
This option will cause a large alphanumeric string to scroll across the LCD. The number looks very much like a serial number, but doesn’t vary from machine to machine. It is most likely the OS or machine version number, but of the older machines that have the option, I haven’t seen one that doesn’t have the same number.
EROR – Error Log
There are 8 different types of errors – COLJ (Column Jams), VEnd (Vend Mechanism), door (Door Switch), sels (Select Switch), CHAR (Changer Errors), acce (Acceptor Errors), StS (Space-to-sales errors), and bVal (Bill Validators). The separate types and actual errors are useless, as you assumably can’t get inside the machine, BUT(!) you can clear the errors. Hold the enter (Number 4) button down for about 2 seconds, and it should clear the error.
RTN – Return
This is simply the return option. Selecting this will exit the debug menu. On newer machines, pressing the BACK button at the main menu will not exit, and RTN must be selected.
A side note: The menu can also be exited by pressing the coin return button.
EXTRAS
By holding in the coin return button and not releasing, on the newer “big-button” machines, this will display the internal temperature in Fahrenheit, as in “42F”.
**Update**
There are many more menu options that are only accessible if they’ve either been enabled from the computer inside the machine, or on the internal computer behind the door (Probably not feasible for you to access).
CPO – Coin Payout Mode
You can can dump coins from the coin mechanism, and the various menu options allow you to choose which type of coins (Nickels, dimes, etc.) are dumped.
tVFL – Tube Fill Mode
This is useless to you. This allows you to load coins into the coin tubes, which you can’t do from the outside.
TEST – Test Routines
This allows you to test the following various routines:
SE Allows you to test the buttons. Will give you number
of button when you press it
SP Sold-out paddle test. Not quite sure, most likely internal function.
Su Sold-out switch test. Same as paddle.
CO Motor test. Will run various column motors.
Cn Coin test. Put in a coin and it will tell you what kind of
coin it is.
nA Note acceptor test. Same as Cn, but for bills.
dSP Display test. Will illuminate various LEDs.
vErS Rattles off version number.
RELY – Relay test
This tests the relay electronic control of various parts. Do not do, as it will cause damage if various internal parts are not unplugged before usage.
PASS – Password
This is not normally accessible, but allows you to change the menu password from the 4-2-3-1. Whoo!
PrIC – Price Setting
Used to set the price for a drink. Not sure how to work it, but it seems simple enough.
StOS – Space-to-sales routine
Lets you change the STS routine and other options. This means that various buttons will all mean the same thing, i.e. the 6 coke buttons don’t actually vend from 6 different columns, but vend from one (changing when one runs out of course).
COn – Machine Configuration/Permissions
This is the machine config menu that decides what of these options you are allowed to access through the outside panel. This is probably only accessible with the door open. I won’t go into detail, but I’ll list the Config numbers and what each do: C1 sets price menu on, C2 sets special (manufacturer) options on), C3 disables the “ICE COLD COKE” message. C4 is autoviewing of menu when door is opened, C5 is door switch status, C6 is mysteriously reserved for “future use”, C7 determines whether your money credit stays in for 5 minutes or indefinitely, C8 is Force Vend, C9 allows multiple vends without putting in more money (i.e put in a 5 and get 3 cokes and then your change), and C10 is Escrow Inhibit.
CCoC – Correct Change Only Control
Adjusts Correct Change only rule to your liking.
TIME – Time Adjustment
Allows you to set the machine’s local time.
LANG – Language Selection
Not sure how many languages are supported, but there are apparently more than just English.
USEFULNESS
Unless you can get behind the door, there’s little you can do with this except impress your friends. However, if you’re able to set the C-switches properly, you’ll be able to manipulate the machine in any way you want, get free drinks, change the price, set up cool buy-one-get-one-free deals, etc, etc 
. Not to forget, knowledge is power. One step closer to free sodas!
- Copier
Step 1- Insert you document(s) into the machine thru the feeder or scanner.
Step 2- Set all you settings.
Step 3- Once you have everything set up, go to the librarian, friend, or some nerd and ask him to borrow some money but you’ll return it to him within 2 minutes! After you finish the money will come back out of the coin inserter. Insert your coins or bills in the coin inserter attached or built-in.
Step 4- This is the tricky part but once you mastered it, it gets easier. What you need to do is: Once it’s all set up make sure no one is looking, press the green “Start” Button on the machine but almost instantly press the “coin return” button on the inserter. Your money will come back out!
The trick is that when you put your money in the inserter the inserter sends a message to the photo-copy machine saying that there are sufficient funds to make a copy, but if you’ll notice there is a 2 second delay from when you insert the money to when the machine will tell you that you are “ok” to make a copy so buy pressing the coin return button automatically after pressing start the inserter doesn’t know that you made a copy until 2 seconds later.
Good Luck! Don’t use this to steal money from the school or place where you’re doing this. I use this in case I don’t have any money with me. Please let us know if you tried it on any other brands and they work!
- Elevators
Tired of being on an elevator and someone else gets on every floor you go down to? Well I was also, until I found out you could skip the floors that people would like to get on at. This works best in big office buildings with 30 floors and it sometimes takes like 15 minutes to get to floor 1.
Okay, the only thing you need to do is press down the close door button, and the floor you would like to go to at the same time.
Then it should skip all the floors that people want to get on and go straight to your floor that you would like to get off on. This can also piss some people off I would imagine. This trick has also worked on all the office elevators I have tried so far.
- Bluetooth mobile phones
Download my Bluetooth hackpack (+ some games xD):
http://www.plunder.com/Bluetooth-hack-pack-download-82941.htm
- Douwe egberts coffee machines
The crash hack
A software bug can be used to let the machine crash. When this happens, the “whipper” is not activated but the coffee already brewed is dumped in the eagerly waiting cup. This is the procedure:
1. Place cup.
2. Press the coffeepot button (see photo). Display sez: two cups or something similar.
3. Select extra strength (optional).
4. Press “coffee (black)”.
5. Now remove cup. The machine goes through its brewing cycle, the progress bar in the display showing its progress.
6. The whipper starts whirring, but no coffee appears.
7. Replace the cup. After about half a minute the display blanks, then briefly shows total dispensed beverages.
8. Now a little tune is played, twice. During the second time the coffee slowly is dispensed into your cup. With no foam!
The menu hack
Incredibly, after I discovered this hack I found a similar hack on i-hacked.com involving a Coke machine! In any case, the crash hack was too troublesome to be exploited on a regular basis. So when I observed a menu appearing when the door (front) of the machine was opened to refill coffee and powder, I tried to get into the menu without using a key. This proved to be shockingly easy, thanks to a incredibly stupid design flaw. The “door open” switch, used to tell the software to enter the “menu” mode, is a long way from the lock. To activate the switch, all you have to do is pull the upper left corner of the door towards you. See the arrow on the photo. About an inch (2-3 cm) should be sufficient. Now the procedure is as follows:
1. Pull the corner. The displays shows a selection.
2. Press button “4″ (see photo). Now you’re in the menu.
3. Release corner.
4. Use “up” and “down” (1 and 2) to navigate to the Operator menu, then press OK. Don’t use the Technician menu. You can seriously fuck up the machine with that.
5. Each beverage has its own setup. Go to the “Coffee, black” entry.
6. Now select the “Powder” entry. The buttons change to “-”, “+”, “->” and “OK”. Place the cursor under the number to be edited with “->” and press “+” or “-” to change it. Adjust the number from 006600 (6.6 g) to something stronger. I set it to 009600 (almost 10 grams), which is much better. When finished press “OK”. The setting of this value is buggy, sometimes the wrong numbers change. Oh well…
7. Set “Whipper 5″ and “Whipper 5 speed” to 000000. I’m absolutely clueless as what these values stand for. Maybe they’re seconds. But since we don’t want foam on our coffee, zero is fine.
8. Now press “ESC” (4) to return to the beverage selection. Do your thing with other beverages as needed. You will find that these have different settings, like milk, sugar and powder.
9. Other fun settings include beverage pricing, which is not applicable to my situation as there is no coin safe in my machine, contrary to the one on the photo.
10. Press “ESC” until the menu disappears and the display says “<<>>”.
11. Done!
I could not find a way to actually change the beverages. Maybe there is a menu setting for that, it could also be pre-programmed into the machine. The Technician menu only concerns the pulps, valves and heaters in the machine. Don’t mess with its settings, but the some of the tests could be fun.
- LED signs
Hacking BetaBrite LED Signs
I am sure you have seen them, they are everywhere. They are in our Schools, Bars, Workplaces, shops, well pretty much everywhere you look. I am talking about LED signs. In this article we will discuss how using some very basic tools take over these signs and use them to display what we want them to say. In PART1 We will discuss how we can be able to take over a lot of them “remotely”, and then in PART2 we will discuss how we can build a special cable that will allow us to interface them with our computers to do some cool stuff.
The type of LED signs we will be discussing in this article is the BetaBrite 1036 series. These displays are insanely popular because they support 8 colors, animations (cherrybomb being the coolest of course), dot-matrix pictures, and font choices for a very reasonable price. Once you start looking for them, you will be surprised how many places have them.. They are EVERYWHERE. Problem is they always have a boring message on them, advertising Specials, News, etc.. I would seriously prefer they say “I-Hacked.com” =)
I think you will be surprised how the messages are programmed into these units. They can be programmed by 2 different ways.
- Using a proprietary cable and software (both of which you have to buy from the company but we will discuss that later)
or
- Using a Special Remote Control which you get when you purchase the unit.
For the first part of this article we are going to focus on the remote control. You will notice that most models of BetaBrite LED signs have a IR port that enables us to program the sign with the remote that came with it. Funny thing is, the remote controls are universal between all the different BetaBrite models. That means if we have a BetaBrite remote control, We can program a large percentage of the LED signs we see with the text that we would like to see. So where can you get those remotes? I had found a small supply of 20 remotes, but they are now sold out. Your best bet is to look on google or froogle for BetaBrite Remotes or something. They shouldnt be that hard to find.
To Program a sign with your new remote use the following steps:
- Press PROGRAM to put the sign into one of the following modes (Use Back to move modes and ADV to select mode)
-PROG TEXT ‘A’ for entering text messages.
-PROG DOTS ‘A’ for creating dot-matrix style graphics
-SET TIME changes the sign’s date
-SET PASSWORD used to prevent someone from changing your messages. =)
-CLEAR MEMORY deletes all text and graphic files
(’A’ is a file name, from A to Z)Since we want to put OUR message in there, select PROG TEXT A and press ADV. - Using the keypad, type out your message. If you need to insert characters (like the ‘-’ in i-hacked.com) Press the SYMBOL or !. Then press select to choose the special character or graphic. Yeah this sucks, but it keeps the remote smaller.
- Once you are done with your message, hit the RUN button twice. You should now see your message!
We will continue our discussion using the BetaBrite 1036 series LED signs. I chose these displays because they are the most common model, and very easy to come by. I must note that the cable we are going to construct will probably work on MOST BetaBrite signs, and possibly other vendors as well. To quote the last article “Once you start looking for them, you will be surprised how many places have them.. They are EVERYWHERE. Problem is they always have a boring message on them, advertising Specials, News, etc.. I would seriously prefer they say “I-Hacked.com” =)” Except, this time I want them to show people what I-hacked is all about!
In order to make the cable, you will need the following parts:
- Standard 25′ RJ-12 Phone Cable. This is phone cable that has 6 wires inside. Very important that you don’t use one that only has 4. (RadioShack 279-422)
- Female DB9 Connector (RadioShack 276-1538 )
- D-Sub Hood (RadioShack 276-1513)
- BetaBrite Sign you want to “hack”
- Misc Soldering supplies
The following image of the pinout was taken from the Adaptive Networking Manual (page 32) however it has been edited to simplify our cable construction.
You will see that we will only need to identify and connect three wires from the RJ-12 cable to the DB9 connector. In the above pinout, the colors of the wires are identified, however I would suggest that you double check everything with a multimeter before hooking it up to your computer. You will notice that the conductor wires inside my cable were not color coded. I am always in the habit of verifying everything before I cut, and after I solder to ensure that I didn’t mess anything up. I would hate to fry my com port or even worse my BetaBrite! Ok lets get started building the cable.
:CONSTRUCTING THE CABLE
Being the good hacker you are, I am going to assume that you have identified Pins 1, 3, & 4 from your RJ-12 Cable, stripped the ends and tinned them, giving you something similar to this:
You will notice that my conductor wires all are silver!
Now all we need to do is connect these wires according to our pinout above.
Reading from Left to Right, we see pins 2, 3, and 5 are correctly soldered to the corresponding conductor wires
After you have verified the above connections, you are going to want to make a small jumper between pins 7 & 8 on the DB9 Connector. I used a small piece of solid core wire that I had laying around, but you could really use anything. (like one of the pieces that you cut from above)
Pins 7 & 8 have been jumpered
That’s it! Now all you have to do is put your Sub-D hood on, and your cable is completely finished.
:TALKING TO THE SIGN
Now that we have our cable completed we get to have the fun. Connect your cable to your computer (com port 1) and to your betabrite sign. (You may have to remove a panel depending on your version of sign). You will need to download a few basic tools to ensure that your cable is working properly
1) For Windows users download BetaBriteHelloWorld.exe. (from remote-control.net)
2) For *nix people, you can use this simple perl code. (from wls.wwco.com)
3) For Mac People you can either use the perl code above or use MacBrite
Ok, now go have some fun with your sign.. Yeah I know you are going to send “I hacked this sign =)” as your first message… That’s ok, indulge. =) If you don’t have a Betabrite sign to play with, run down to your local quickie mart and plug into the Lotto sign… Trust me they wont mind.
Ok, at this point the sky is the limit. You can control this thing with your computer. Using some google searches you can find all kinds of good software that you can use. Looks like a hacker named wumpus1 has released a BetaBrite API, have it show Caller ID information, or have it display weather info.
But my personal favorite software for my new betabrite toy is called BetabriteHeadlines from remote-control.net. This application allows us to utilize RSS to feed our Betabrite with info.
Have fun,
~ Thomisback!
P.S. All my old trainers can be downloaded from:
http://www.plunder.com/Old-trainers-by-Thomisback-download-82949.htm
Note: Some of them might not work anymore!!!
Also, thanks to I-hacked for the information
