A Mini Vending Machine To Ramp Up Your Sales

A common sight in the world of hackerspaces is an old vending machine repurposed from hawking soda cans into a one-stop shop for Arduinos or other useful components. [Gabriel D’Espindula]’s mini vending machine may have been originally designed as an exercise for his students and may not be full sized, but we can see it or machines like it taking away some of the demand for those surplus models.

Its construction mimics that of some older 3D printers in using laser-cut ply to form the components of a box. Behind a clear lockable door are the shelves containing the products, at the back of which are continuous rotation servos that will drive the spiral Archimedes screws that eject the products. To the side is a membrane keypad and display, and the whole is drawn together with an STM32 board and an Arduino. It supports both RFID card login and keyboard login, and though it’s not finished we can see it forming the basis of a very useful system.

He’s posted the most recent progress in the form of a video that we’ve placed below the break. All the various files are available for download, so should you fancy one yourself then you have a good chance of success.

Continue reading “A Mini Vending Machine To Ramp Up Your Sales”

Hacker Pops Top On NFC Vending Machines

Vending machines used to be a pretty simple affair: you put some coins in, and food or drink that in all likelihood isn’t fit for human consumption comes out. But like everything else today, they are becoming increasingly complex Internet connected devices. Forget fishing around for pocket change; the Coke machine at the mall more often than not has a credit card terminal and a 30 inch touch screen display to better facilitate dispensing cans of chilled sugar water. Of course, increased complexity almost always goes hand in hand with increased vulnerability.

So when [Matteo Pisani] recently came across a vending machine that offered users the ability to pay from an application on their phone, he immediately got to wondering if the system could be compromised. After all, how much thought would be put into the security of a machine that basically sells flavored water? The answer, perhaps not surprisingly, is very little.

The write-up [Matteo] has put together is an outstanding case study in hacking Android applications, from pulling the .apk package off the phone to decompiling it into its principal components with programs like apktool and jadx. He even shows how you can reassemble the package and get it suitable for reinstallation on your device after fiddling around with the source code. If you’ve ever wanted a crash course on taking a peek inside of Android programs, this is a great resource.

By snooping around in the source code, [Matteo] was able to discover not only the location of the encrypted database that serves as the “wallet” for the user, but the routine that generates the encryption key. To cut a long story short, the program simply uses the phone’s IMEI as the key to get into the database. With that in hand, he was able to get into the wallet and give himself a nice stack of “coins” for the next time he hit the vending machines. Given his new-found knowledge of how the system works, he even came up with a separate Android app that allows adding credit to the user’s account on a rooted device.

In the video after the break, [Matteo] demonstrates his program by buying a soda and then bumping his credit back up to buy another. He ends his write-up by saying that he has reported his findings to the company that manufacturers the vending machines, but no word on what (if any) changes they plan on making. At the end of the day, you have to wonder what the cost-befit analysis looks like for a full security overhaul when when you’re only selling sodas and bags of chips.

When he isn’t liberating carbonated beverages from their capitalistic prisons, he’s freeing peripherals from their arbitrary OS limitations. We’re starting to get a good idea about what makes this guy tick.

Continue reading “Hacker Pops Top On NFC Vending Machines”

The First Vending Machine Hacked Liquor Laws: The Puss And Mew

It is fair to say that many technologies have been influenced by human vices. What you may not realize is that vending machines saw their dawn in this way, the first vending machine was created to serve booze. Specifically, it was created to serve gin, the tipple of choice of the early 18th century. it was created as a hack to get around a law that made it harder to sell alcoholic drinks. It was the first ever vending machine: the Puss and Mew.

Continue reading “The First Vending Machine Hacked Liquor Laws: The Puss And Mew”

Donut vending machine without microcontroller

No Microcontroller In This Vending Machine, D’oh!

You might think that a microcontroller would be needed to handle a vending machine’s logic. For one thing, only the correct change should activate them and the wrong change should be returned.  If the correct change was detected then a button press should deliver the right food to the dispenser. But if you like puzzles then you might try to think of a way to do with without a microcontroller. After all, the whole circuit can be thought of as a few motors, a power source, and a collection of switches, including the right sized coin.

That’s the way [Little Puffin] approached this donut dispensing vending machine. What’s really fun is to watch the video below and wonder how the logic will all come together as you see each part being put in place. For example, it’s not until near the end that you see how the coin which is a part of the circuit is removed from the circuit for the next purchase (we won’t spoil it for you). Coins which are too small are promptly returned to the customer. To handle coins which are the right size but are too heavy, one enhancement could be to make them fall through a spring-moderated trap door and be returned as well. We’re not sure how to handle coins which are the right size but too light though.

Continue reading “No Microcontroller In This Vending Machine, D’oh!”

Simple Ethereum Vending Machines With NodeMCU

Recently, we covered how to use the Etherscan API to query data (a wallet balance) from the Ethereum blockchain with NodeMCU. It’s a very useful method for retrieving information from a blockchain on embedded systems where storage and memory are an issue.

It has some limitations though. Most notably, it’s polling the API at some interval to retrieve information whether it has changed or not. I would like to be able to receive data more efficiently than this, and quickly enough to make simple vending machines possible. While we’ve seen videos of Bitcoin-based Red Bull vending machines before, they required an NFC card to use.

If we could receive information about Ethereum transactions quickly and reliably enough, we could build a similar vending machine without requiring an NFC card as an intermediary. Simply send to an address via some method, and receive goods!

It turns out we can do exactly that with NodeMCU using WebSocket. Like HTTP, WebSocket is a communications protocol that uses TCP connections (typically over port 80), but it allows full-duplex communication. In other words, you can establish a connection to a server, and send/receive messages without needing to poll the server.

As in the previous example, we’ll use a NodeMCU running Lua. You may wish to refer to it for compile options and information about the screen, which will be the same in this case. Unlike the previous article, you will not need an API key from Etherscan to use this service (not yet, anyway). As usual, we’ll start off by connecting to WiFi:

wifi.setmode(wifi.STATION)
wifi.setphymode(wifi.PHYMODE_B)
station_cfg={}
station_cfg.ssid="Your SSID"
station_cfg.pwd="Your Password"
station_cfg.save=true
wifi.sta.config(station_cfg)

Connecting to a server with WebSockets is easy, but since we’re not using HTTP, we’ll have to remove the https:// and replace that with ws://. (Note: not wss:// because we’ve not enabled encryption yet.)

ws:connect(‘ws://socket.etherscan.io/wshandler’)

Next, we need to report back when the connection is established as the trigger to run additional code. It will return an error code if the connection fails to be established. Handling these error codes in a sensible way is an excellent feature, but we’ll handle that later:

ws:on("connection", function(ws)
    print('got ws connection')
    end)

Now, we need to extend the above to subscribe to an Eth address, and add some new code to do something when a transaction occurs. Note that the API requires that you subscribe to an address within 60 seconds of connecting. It also states that you have to send a ping event to the server every 20 seconds to keep the connection alive, so we’ll need to set a recurring timer for that.

If you’re using ESPlorer, you can send the ping request manually by entering =ws:send('{"event": "ping"}') and pressing Send. This is a useful way to test the connection status.

The address I used seems to have frequent transactions so is reasonable for testing. Be advised though that sitting and waiting for a transaction to happen to test the code creates a slow development cycle so some patience is necessary here.

ws = websocket.createClient()
ws:on("connection", function(ws)
    print('got ws connection')
    ws:send('{"event": "txlist", "address": "0x2a65aca4d5fc5b5c859090a6c34d164135398226"}')
    end)

ws:on("receive", function(_, msg, opcode)
    print('got message:', msg, opcode)
    end)

You should see something like what follows below. The first message is a simple confirmation of connection, the second confirms your subscription to an address, and the third is what you get sent when a transaction occurs. You can subscribe to up to 30 addresses with a single connected device! Note that the data is all in JSON format, which is something we’ll take advantage of later.

got message: {"event":"welcome"} 1
got message: {"event":"subscribe-txlist", "status":"1", "message":"OK, 0x2a65aca4d5fc5b5c859090a6c34d164135398226"} 1
got message: {"event":"txlist","address":"0x2a65aca4d5fc5b5c859090a6c34d164135398226","result":[{"blockNumber":"5532531","timeStamp":"1525098009","hash":"0xe5ec497cb5b38811e8bf5db67a056a2bdd4aa9b68df5c8e8225cb300cbcfa413","nonce":"3363391","blockHash":"0xf446f77d92ed29c221e8451b8048113969ed305a7dd49177e10b422e8e2c4bda","transactionIndex":"172","from":"0x2a65aca4d5fc5b5c859090a6c34d164135398226","to":"0xec5fdfba35c01c6ad7a00085e70e8f30cd121597","value":"24418350000000000","gas":"50000","gasPrice":"4000000000","input":"0x","contractAddress":"","cumulativeGasUsed":"7896403","gasUsed":"21000","confirmations":"1"}]} 1

That’s quite a mess of transaction data, and unfortunately the datum of interest is in the ‘result’ field – which is nested JSON. In the last article, we converted simple JSON to a Lua table using the excellent sjson module. We’ll do the same here after verifying the message type is a transaction (txlist).

ws:on("receive", function(_, msg, opcode)
    print('got message:', msg, opcode)
    ok, ethdata = pcall(sjson.decode, msg)
    if ok then
        msgtype = (ethdata["event"])
        if msgtype == "txlist" then
...

The NodeMCU documentation specifically notes that nested JSON can cause out-of-memory errors. For that reason we use pcall (protected call) to contain any such errors when decoding our JSON message. Next, we extract the contents of the ‘value’ field, nested within the ‘result’ field:

if msgtype == "txlist" then
    wei = ethdata.result[1].value
    print (wei)
    eth = wei/1000000000000000000
    print (eth)
    end

It took me a few hours to figure out how to deal with nested tables, but in the end it was actually quite clean and easy — I was just being dense. Now, we need to add a basic provision to handle errors when the websocket is closed:

ws:on("close", function(_, status)
    print('connection closed', status)
    print('Reconnecting...')
    ws = nil -- required to Lua gc the websocket client
    tmr.alarm(0,4000,tmr.ALARM_SINGLE,transact) -- This reconnects after 4 seconds
end)

To wrap it all up, we encase the code in a couple of functions — first, one to establish a connection, subscribe to the right address, and notify when there is a transaction. Next we need one to display the amount of Eth transferred. Finally, we need a ‘ping’ function to call every 20 seconds or less to keep the connection alive. Overall this turned out to be more robust than expected and has yet to encounter an error. Check out the full code listing here. Note that I’ve also added a little code above to interface with a 128×32 OLED screen, the same one we used previously.

Now that it works, let’s consider im/practical applications. It’s a neat way to display Ethereum transactions in real-time, say if you do livestreaming and accept Eth donations and want them to trigger something fancy. Or, you could make a somewhat insecure vending machine. Clearly, getting a secure WebSocket up and running is the next order of business.

You could also set a timer where the length depends on the amount of Eth received. This would allow for things like public advertisements that go away for a while if someone pays a fee. (Please don’t do this!) Maybe a conference room for rent with the power controlled this way? Hackerspace membership payment? An electric bicycle that charges you for power used?

In any case, it’s not legal to use cryptocurrency as a form of payment in my country so I can’t implement any of the above examples at this time. If you’ve got a better application, please share it in the comments!

Get Your Smarties Or M&Ms From A Vending Machine

There are some debates that split the world down the middle. Serious stuff: M&Ms, or Smarties*? Yes, the two chocolate beans may bear a superficial resemblance to each other, but you’re either a Smartie lover, or an M&M lover. No compromises.

[Maximusvo] has sensibly dodged all questions of brand loyalty in his text if not in his images even though it’s obvious what kind of confectionery he’s working with in his candy vending machine. The hard-shell chocolates are loaded into a hopper, from which a colourful cascade is released onto a scale. When the desired weight has been accumulated, it is tipped into a drawer for the hungry recipient.

Behind it all is an Arduino with a motor to release the beans, a load cell to weigh them, and an LCD display to give a status report. A motor vibrates the chute to ensure they move down it, but as can be seen in the video demo below the break it’s not doing an entirely successful job. There is an external buzzer to indicate delivery, and aside from the wooden construction of the machine there are 3D printed parts in the scale.

Continue reading “Get Your Smarties Or M&Ms From A Vending Machine”

Vintage Vending Machine Makes The Perfect Gift

Nothing says ‘I Love You’ like an old vending machine, and if it is a restored and working vintage Vendo V-80 cola dispenser then you have yourself a winner. [Jan Cumps] from Belgium was assigned the repair of the device in question by a friend. He started off with just a working refrigerator and no electronics. In a series of repairs, he began with replacing the mechanical coin detector’s switches with optical and magnetic sensors to detect the movement of the coin. These sensors are in turn connected to an Arduino which drives the dispensing motor. The motor itself had to be rewound as part of the repair. Since the project is on a deadline, the whole thing is finished using protoboards and through-hole parts. The final system works by dispensing one frosty bottle every time a coin is inserted.

In contrast to most vending machine repairs, this project was a simple one. Instead of using an off-the-shelf coin detector, a simple LED and photodiode pair brought the hack to life. This could easily be adapted to any machine and even be used to create a DIY vending machine on the cheap.  Continue reading “Vintage Vending Machine Makes The Perfect Gift”