Alice Averlong🏳️⚧️oooh, the redbox uses full AES encryption!
and they always use the same key which is embedded in the executable right next to the encrypt() and decrypt() functions. well done, guys
correction: they hardcode two separate keys in the two separate places (that I've found so far) which use AES.
this code is enterprise as hell
you need the url for the base client? well you use Redbox.Rental.Services.KioskClientService.KioskClientServiceBaseUrl which is a property that'll ask the ServiceLocator to find an instance of IConfiguration to get the KioskClientServiceBaseUrl object out of it
they wrote their code as a fuckton of C# services that are always HTTP POSTing at each other
HTTP is, as always, the poor man's IPC
they logged the first six digits and last 4 digits of every credit card transaction.
HAVE YOU EVEN HEARD OF PCI?
Edit: this is technically allowed by PCI.
1234 56## #### 7890
can I buy a vowel?
I'm trying to tar up a redbox install and upload it, but each time the tar gets past 50% we find another file with PII in it
OH HEY BAD NEWS:
when someone opens up the hard drive of a redbox unit, they can pull a file which has a complete list of titles ever rented, and the email addresses of the people who rented them, and where and when
the unit I've got an image for has records going back to at least 2015.
I was able to easily match one of them to a real name
I have 2471 transactions here.
Somebody I'll call Dave Fakename rented The Giver and The Maze Runner in Morganton, NC on 2015-05-23 at 6:43pm
found a THIRD set of encryption code.
this one is 3des instead of AES, and YEP they still hardcode the passkeys
this one is 3des instead of AES, and YEP they still hardcode the passkeys
Redbox.HAL.Configuration
.ConfigurationFileService implements IConfigurationFileService
STOP MAKING SERVICES AND FACTORIES AND INTERFACES AND JUST READ THE FUCKING JSON FILE YOU ENTERPRISE FUCKERS
AND HEY YOU DON'T NEED A SEPARATE C# CLASS FOR EACH XML FILE YOU LOAD
YOU CAN JUST HAVE AN XMLLOADER CLASS AND A GENERIC CONFIG FILE. PLEASE
this is the kind of code you get when you hire 20 new grads who technically know C# but none of them has written any software before
so these people wrote a mostly C# program, with some lua for glue scripting.
and then they implemented their own language. it's some bastardized version of BASIC
it's a compiled (to bytecode? I think?) cooperative-multitasking BASIC.
and god I wish it was the only one of those I'd ever seen
okay by "compiling" they mean "parsing". The output of the compiler is a list of tokens, the input is a text file
example code:
POP START-DECK
POP START-SLOT
POP END-DECK
POP END-SLOT
IF END-SLOT > MAX-SLOT-PER-DECK
SET END-SLOT MAX-SLOT-PER-DECK
ENDIF
Foone's official list of things they never expected to implement their own multitasking programming language, yet found one anyway:
* Redbox vending machine motors
* Wheel of Fortune (2011, Wii)
Redbox.HAL.IPC.Framework.ClientSessionFactory
PLEASE, NO MORE FACTORIES
MY CHILDREN ARE STARVING
oh good they implemented both an internal C# dynamic plugin loading system, as well as the ability to craft arbitrary Invoke()s over TCP/HTTP.
So you can call any C# function from anywhere on the machine, I think?
So, quick summary:
Redbox went bankrupt and the machines are getting in the hands of individuals. The disk image has been dumped. The software is being reverse engineered: they're not currently very useful, since they need to talk to a server that's gone.
But progress is being made
the devices themselves are windows 7 machines talking to the disc library. It's a small group of services talking to each other, mainly over HTTP
it's primarily written in enterprise-as-fuck C#, with some lua scripting, and the "HS" scripting language which seems to be proprietary to redbox machines.
I'm currently trying to acquire one so I can do more hands-on reverse engineering, but for now I'm focusing on the software and how it all interacts
and I'm told Doom has already been run on them. It's windows 7, it can run many doom sourceports.
With a little extra work you could probably play native MS-DOS Doom on them
MORE FUN FACTS:
it turns out the device has a database on it which lists the location of every single other redbox machine. full addresses.
Ben Stokman@foone this thread makes me feel a lot better about my code.
Alexis@benjistokman @foone I haven't written code since copying BASIC verbatim from an old magazine for fun, and this makes me feel a lot better about my code.