Dear viewer, these subtitles were generated by a machine via the service YouTube and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/2533 Thanks!
[Music]
yes sir okay I think uh we are ready and
uh on our way to uh dive into the very
exciting world of industrial coffee
makers and without further Ado I give
the stage to you
guys power is on mute is yet
off the mute L is house okay
and wonder have
fun well then welcome to our talk
unexpected coffee I di into industrial
coffee
machines um I'm hey I'm doing offensive
security at daytime and at nighttime I'm
doing IND IND industrial coffee machine
hacking and other fun projects and
that's datac cop hi I'm cman or datac
cop or data for short and I'm mainly I'm
an electric engineer but mainly doing
networks and embedded Linux systems and
yeah
and and that's the car um but if that's
fine with you I will we would just go on
so first things first uh what's a coffee
machine or what's an espresso machine uh
we have coffee beans we ground the beans
and then we add basically just hot water
under pressure and then we have good
coffee if we did it right
um
and then what's a vending
machine and uh there are different types
of vending machines there are basically
uh two base types and one is there are
those
um uh those instant beverage machines
where you just get a cup and you press a
button and you get something that
was
made from water more or less um but
typically it's just powder and there are
um the other vending machines like stuff
in boxes or um vending machines for um
bottles and so on uh we won't go into
this detail but um that's for the first
part and what we what we actually have
here and then what's an espresso vending
machine
and that's more or less a hybrid of an
espresso machine and uh a typical powder
based vending machine and that means uh
we have the best and the both the best
and the worst of both words
actually um we
have not really a perfect uh coffee uh
Brewery and then we also have those
powder things and not really milk or
anything
um
but they exist and they're quite huge
usually and they allow special
combinations like uh lakato uh which uh
I will go in a a bit in a detail on how
this is made actually here in a few
slides and then uh basic
stuff
uh in this machine we have coffee and we
have toppings so uh what are or for the
coffee we have a brewer um that uh will
be on the next slide also and we will
open the machine later
too um and that one is designed for more
or less um a specific High throughput
especially for office um like 300
coffees per day yeah and also for low
maintenance so these machines typically
don't need uh daily maintenance like uh
big espresso machines um but uh those
are more or less uh I think you should
clean them once a week but that's just a
quick uh cleaning cycle and then the
large cleaning cycle if I remember it
correctly it's done more or less once
per month and typically uh not by the
company where this machine is standing
but by a separate company that's also
the supplying the coffee and all the
ingredients uh those machines typically
have uh fixed water installations that's
why we have uh a pump here and an
external water tank and uh uh luckily
this machine in the manual has uh a note
that says if you don't have fixed Water
by the way uh the uh water input valve
um has a rating so you can hook up uh a
pump there with 24 volts and 1.5 amps
Max which was quite nice for the camp or
you can also buy a add-on for it there's
also add-on with a big tank and you can
buy from the vendor too there are also
different add-ons you can like put on
the side and so on so it's like buying a
car more or less you can have all kinds
of
customizations and uh then uh yeah we
have fixed water uh we have uh coffee
beans and uh
milk is usually just supplied as milk
powder and those are toppings um so uh
there are different types there are also
vegan V uh types and we this machine
currently is filled completely with
vegan
toppings um and to actually mix the
powder with the hot water um we have or
inside there are some uh mixer
um uh Wheels more or less so you can see
here on the left or not really well but
we will see it later in the machine uh
on the left there is the coffee uh
Brewer more or less
please don't break any stuff uh in the
middle uh we have uh more or less the
closed uh mixer so from the top the um
the toppings will drop in and uh will be
mixed inside of this bowl um with water
and on the right there is basically a
second one but that's just a mixer uh
wheel so that's the opened mixer and
that mixer um makes the mixture creamy
and mixes the water with the topping so
you don't have crumbs in it uh and you
can um
also uh run them motor at different
speed um for example for the lato I
mentioned ear
earlier uh lakato typically is uh um or
for these machines is U milk in the
middle it's coffee and then it's milk
again and uh the machine actually makes
this differently it does two um pieces
of milk and then the coffee on top and
this works because uh the milk is mixed
at different speeds of the mixer so uh
they have different uh physical um
properties so that the coffee will
actually um be in a layer between the
two milk layers although the milk powder
is exactly the same so that's quite
interesting it's uh uh
how those vendors uh come up with quite
a few hacks on how to do um premium
coffee things and so
on and uh this is the whole machine how
it was also set up at lavanville uh
inside of the camp area uh in the metb
dome um and it will be later set up
again there so if you want a coffee or
um some Coco uh feel free to go there
and use the machine and but you can see
here um you or we have three of those
white um um containers where the powder
toppings are inside there and those uh
have a motor that will basically put in
the um powder into the mixer
bowls and uh about this
machine uh this is uh the company is
called R vendors uh it's a quite large
company and it seems to be uh initially
located in
Italy and the Machine itself is called
Laria Grande T um and then
some uh we don't know what they uh what
the um the rest actually means but there
are different types of this
machine um last year uh at metalab we
got a mail um from somebody who said
that uh they have at their office this
machine and it's and it's broken since a
year and they want to get rid of it and
uh if we would be interested in uh
repairing it or doing some other stuff
with it um they didn't want to just
throw it away but to maybe um give it to
people who um repurpose it or um repair
it and uh we both saw the the mail and
wrote to each other like uh coffee
machine um and in in the worst case we
can always uh build a coffee bot out of
it a cocktail bot yeah for the robo
Exotica um and the initial error was
that the Brewer motor um failed
initializing and for the Brewer motor is
um if we go to back to the picture if
you have the Brewer on the left you see
uh that there is a piston inside and
this piston is moved or the whole
Brewing chamber is moved for like um 15
to 20 cm
um for the whole mechanism to
work so just before before reping it um
it was standing around the mid lab hex
space for like three or four months and
it annoyed quite some members because we
don't have so much space but in the end
we were motivated to take our time and
repair it and so we going we're going to
show you the repair process how we
debugged it and how we managed to repair
it okay so um the company uh or the
people we got it from um already said
that they think uh it is probably a
mosfet um power driver problem for the
motor um and uh so we were debugging a
bit of the electronics and that's the um
board on the uh back in the back of the
machine so there are several boards uh
we will go into the uh the different
boards in the slides too in a bit um but
there is one main board and that's in
the back and there is all the Power
Electronics there and all the motors are
connected to this and there were two um
or the first uh you on the right the um
the bigger uh most fets uh we suspected
at first so
um that was also the information we got
from the people that they assume that
they are broken yeah but they they tried
to order them uh the electronics and
it's actually this data sheet um there
are some Automotive um mosfets and
that's a bit interesting most of the
electronics is actually Automotive
grade
um we don't know why but uh well
endurance and uh yeah coffee coffee is
uh critical
infrastructure um so that was our first
try and they tried to order them but uh
they are not complying with the uh aohs
directive of the EU um so they're not
let free so you can't get them at MAA or
any other electronics company anymore
but alexpress for the win yeah that was
really like uh 5 Seconds of search and
we found uh a bunch of
them uh it turned out those mosfets
weren't the problem so we swapped them
they're actually new inside there now um
but uh those were not the actual problem
so we uh further debugged the motor
itself there is a PCB on side of on top
of the motor and a magnetic wheel so
when the motor turns there is a turn uh
signal or there is a tachometer signal
uh back to the main PCB that tells the
um uh the microcontroller how far it has
moved and also uh with current sensing
basically the microcontroller can sense
uh how much pressure the motor is
currently applying to the whole Brewing
unit and we thought um maybe this these
sensors are actually uh at fault so we
took um a larger oscilloscope for no
reason and uh um a power supply but
those were actually working quite nice
and uh then since uh the machine needs
water we need to go to the
kitchen we had to set up the whole thing
in the in the kitchen yes including the
oscilloscope um and annoyed more
people um so what we actually did there
is uh we did a bit of tracing of on the
PCB uh where the motor um lines are
actually or the motor connections are
actually going to and uh it turned out
they um are they are split from for high
and low side into two chips and one of
those
chips yeah so on the left you can see um
there is this uh larger chip uh right
next to the blue um capacitor and there
are two chips right below it and it's
quite interesting those are for
completely different Motors
and uh I or we think they did it this
way because the upper chip uh does very
well
um
um uh Power zening so you can get an
analog value out of the uh chip for each
output um how much uh whats basically
are going out to the motor and uh the
the lower chips are the Lower Side of
the uh of the motor controller that uh
basically
just uh yeah control the negative side
of the on depending on how you turn the
motor and those are can actually also do
current sensing and they're not just uh
standard mosfets they have some kind of
electronics in inside of there so you
can you can break them a bit uh more
difficult and also on the input pin uh
you can actually do power sensing so if
you uh
Supply a logic value to the input pin to
actually um uh to switch through the
mosfet or to switch the mosfet and it's
go and the mosfet goes into Power
limiting it will try to lower the
voltage on its input pin depending on
how much uh over current it is currently
um having so um this was not implemented
on the board um but uh those are quite
interested uh quite interesting features
of those
mosfets so and also again AliExpress and
then after after Clemens Clemens did the
soldering we started to pray for the
first boot again and yeah we had our
first success we had got the first
coffee out of the
machine but
um it was Cafe Schwartz and it was
really black and we didn't want it to
risk a subscription for the toilet
because the machine wasn't clean for
like one or two years so we started the
cleaning process so we cleaned the whole
machine and uh we brought you some
pictures of the cleaning
process and it was quite dirty and after
that the machine was like like
new and uh the good thing is that um the
company that produced the machines uh
offers
uh the machine that produce the machine
offers a really good manual how to
disassemble the parts and everything so
it was quite easy to disassemble it and
assemble it again and uh yeah so we had
a clean machine and as next we're going
to show you some more parts of the
electronics okay
um
thanks okay so um
there are actually three bigger P pcbs
inside one is the one we showed before
that's uh the main PCB in the back um
that basically has most of the power
stuff um and then in the front we have a
touch display and that one was really
interesting when we uh opened the
machine the first time because uh we saw
that that's an arm imx6 processor so
it's running pretty we were pretty sure
it's running Linux and also there is a
SD card inside and uh it has some USB
and a gigabit Ethernet port um that's
everything of this is not used so you
can use the USB port to
um to program the
machine um but this also seems to be
added later or was added later um and uh
the second or the the third PCB is um uh
real power PCB because uh there is no no
typical boiler inside of this machine um
it has an induction boiler so uh it can
basically
vary uh it can basically change the
temperature of the water on the fly so
if when it's currently running uh it's
not heating the water if you press uh a
button on or if you want a beverage it's
basically heating the water on the Fly
and not taking too much energy
and also it's quite interesting uh you
can program different um water um
temperatures uh for the different
outlets and depending when they are
switched over the valves um you can get
a mixture of uh different water
temperatures which is I think quite
unique for this machine and also for
repairing or for for taking it apart um
those machines are uh typically really
big so there is a lot of space inside
you can more or less take the whole
machine apart you can replace everything
you can uh you can really
uh maintain the machine quite well so um
compared to those cheap plastic machines
um also that are sometimes on uh on
smaller offices uh these machines can
basically live forever if you have
enough um supply of
uh a few things that might break like
the valves or so on but they're all
standard
valves well then let's check out the
software hardware setup so as said c
already said we have two components
there there is like this there is a CPU
inside it's like a m controller 16bit
industrial or coffee processing unit and
there is a GPU it's a imix 6 arm Linux
board and uh on this Linux system there
is a QT binary running with uh
displaying the rui on the display the
rui is a HTML JavaScript based web
application and you can run it in your
browser actually it doesn't make coffee
but uh it it says it does and there is a
rear boot EXO
file
so you have a XA file you have arm CPU
and have Linux running
what um let's solve the mystery it's a
net binary for flashing configuration
files and extracting configurations and
it's run with mono on the Linux arm
processor well it works it it
works and uh when you and you put in a
flash drive with a specific folder
structure it uh boots this uh this uh
this tool to to to put the config on on
it or to get the config and I must say I
still don't understand how the boot
procedure still works because you have
the QT binary and the and the config
binary and I'm still not sure how they
know when to start what I tried to find
it didn't manage to find it in the
system so um you have also Windows tool
to program it it it looks like this it's
uh let's say last century more or less
the the red picture down there is also
animated also quite
nice I'm sure that was a feature request
and but I must say even though the uix
is quite uh question it is super
powerful conf configuration like this
you can really make uh power saving
menus you can make happy hours you have
a really a lot of configuration options
for the machine it's super nice but yeah
the interface is quite um interesting
let's say it like that
but let's get on the program on the
machine part so there is a programing
menu on the machine itself with touch
screen it looks like
this you see different
buttons uh it doesn't look very um
comfortable to use and I will come back
later to to this part why and what uh
let's first also check out the web app
um if you're um press the U manual
online button it will actually display
the PDF of the manual of the machine
from the SD card on the TFT display and
you can scroll through it it's quite
nice but it's also a bit annoying to
scroll I think there are a few hundred
Pages um so there is this web app it's
HML page and uh when you're on the menu
you can choose the beverage in the end
and there is like a page menu HTML where
the beverage is shown and if you choose
a beverage you come to a page confirm
page and uh they have like the selector
is like the parameter what what coffee
or cacao you want and if you press the
confirmation one it goes to another HTML
page and uh when you confirm it there is
this QT binary as far as I understand
understand the the process it will check
the URL with the parameter and we know
what coffee or beverage it will make and
when it's done it will change the url
again in the binary that you come to the
done page and will switch back to the
menu so so the API between the web page
and the uh the QT binary is actually the
URL
parameters so the the QT binary manages
the whole whole HTML in the back in the
end and uh shows it there let's show you
some excerpt from the JavaScript files
that found so that's how you how you how
it's implemented on the JavaScript the
whole uh thing or like arrays in
JavaScript and they have um a name and a
picture path and you can change the
names you can change the
pictures and it's also quite interesting
one even more interesting is
the the the JavaScript for the
prices like every AR part is one of the
beverage of the price in
sents but I'm not even sure if the
machine knows what currency it's running
on so seems so that there is no currency
logic behind it but I was digging into
binary the really interesting thing is
when starting it up it actually uh it
updates those files the binary updates
those files but I will show you now what
so I was digging at QT binary with gidra
and I found this function in there it's
called generate JavaScript price and
availability and uh let's see what this
means so there is code that generates
the JavaScript down there from the
binary from text more or less yeah from
text so the binary generates the
Javascript file in the end
because the config is on the machine and
not on the HTML files and JavaScript
files um so next uh we also check the
communication between the machine and
the front end more or less yeah so
between the Linux system in the front
and the the six 16bit uh processor in
the back uh there is a Serial um port
and uh we already saw in the Linux
system that it's opening the a TTY on
the um
imix um board more or less and
then just found estray in the system and
we're like
okay easy task let's try this out and
found that um
so you can see uh dark red and uh dark
green lines here and one line per or
they um they just uh one is sent uh to
the machine or to the controller one
comes from the machine the red line
comes from the controller in the back in
the back and the green line uh is sent
to the controller from the front Linux
system and it's roughly every second and
the uh if you don't do anything here um
more or less uh the binary command
that's or the binary message that's sent
from the Linux system is more or less
always the
same um the the red messages are
interesting because uh in the middle um
there is this text that the machine
displays in the lower half of the
machine so or the display displays in
the lower half in the machine um
so um and it has a quite weird
encoding um because uh if you see on the
in the top here um there is uh in German
for the uh for this Trace uh F Vasa of
bitter V and between of between the two
words of and bitter there is no space
there is no character nor anything
between there and that was quite weird
for us um and also um there was a weird
break on the display too so there there
was like a space between the two words
but it was not just a regular white
space so um more information about it
it's a binary protocol so the first part
is always uh binary and the last part is
always a binary code and also the um
commands that are sent from the touch
display to the back are um some binary
um
messages and uh those texts with a
missing space in the middle uh when
debugging
this or let's see uh let's look at it
here um when counting the characters uh
we always found that uh the whole text
is 32 Char long and uh the middle part
um where there is no space uh is always
16 characters or at 16 characters and um
who uh did a bit more of electronics
probably already knows where the
software comes from we like okay
H and then we realized in the end there
is this corrector display shout out 20
for the photo box in the binary kitchen
tent and in the end the text is usually
shown on such a COR display and they in
the end only use this display to show
the correctors instead to implement a
proper software for it because the older
machines only have these buttons and the
corrector display in the end so the
buttons you saw on the uh on the touch
display for the program menu uh probably
on a previous version of this machine um
the those were actually real buttons and
the texts are sent for those uh 16 uh
characters uh by two lines so 32
characters displays you have in this in
this really old vending machines and um
probably uh the whole back of the
machine still thinks that it's some kind
of machine that has physical buttons and
no touch
display and for a block diagram so those
are the three um pcbs we have the the
heater board we have the CPU and power
board and the Linux board um that's
connected over serial and everything
that is part of the machine even payment
and some and some kind of modem you can
plug in is connected to the 16bit
controller
so what is a bit frustrating because we
are hoping to do more hacking uh from
the Linux uh system um but we have to
deal with the 16 16bit controller so
it's super hard to you need to reverse
engineer every option in the end to
implement the same binary protocol to
configure the whole machine and work
with it it's quite tedious task in the
end next and then let's get our lessons
learned um always verify claims if
someone makes them because uh well
sometimes they are not uh
correct alexpress sells your Automotive
ships that you don't get in Europe or in
Austria especially the only problem in
Austria is with real luck because in
Austria it's a new law that you can't
get easy stuff anymore because of some
packaging directive and we really luck
because it was from the 1st of January
2023 in in charge and we we ordered it
like in December and got it before that
really lucky for us I think we actually
got it in January or in January but
still delivered but currently AliExpress
doesn't deliver to Austria or most of
AliExpress
sellers um as you see industrial
equipment is state-of-the-art
Legacy it's it's really it was a little
bit hard-breaking for us to see the
reality that we deal
with and one interesting thing is also
the windows configuration software is
not publicly available and we currently
doesn't have the latest version and we
can't can't use it for the coffee
machine configuration currently so this
machine is uh built in
2017 um so quite new actually um I think
those machine types were introduced
around uh 2015 or or 16 and the
screenshot you showed from uh we showed
from the windows tool I think was uh one
year before this machine appeared um and
if you look very long in the internet
and we spent several hours um uh looking
for stuff for on these machines uh you
can find it on some shady um download
Grabbers Grabber portals or whatever um
but we still haven't found a version
where we can actually program this
machine it's possible to program it over
the uh the touch display but uh yeah you
can take hours just for single
beverage so there's also some possible
future work uh in this regards so
there's also more possibilities for
software anal
analysis we would like to obtain the
programming
software um so if someone has something
lying around we will be happy to talk
with you or if you know somebody who
knows somebody who works at a coffee
Vending Company maybe um I still want to
understand how the boot procedure works
because there are two different binaries
and I couldn't Trace how they know if
the flash drive is in everything it's
still a ongoing um research for
me so if you want to help out or
interesting more for a machine talk to
us ping us um and we have two more
interesting
things so um there is RFC 2 324 who
knows it who has read
it okay quite a lot of people um so uh I
was playing around since if few years to
actually implement it on a coffee
machine and then this machine came
around and I said hey finally um a
machine uh that could run it um but it
turns out it bit it's a bit more
difficult and actually while working on
the machine and um uh looking at the
RFC uh the coffee pot control protocol
is really just more or less for coffee
pots so classic coffee pots um espresso
machines it's difficult uh also this
machine can uh do also uh can make tea
uh with uh tea powder and I've heard
there is a specific type that it's not
too bad um and also this one can
actually also uh do soup so there is
soup
powder um we don't have anything we
don't have tea we don't have soup uh but
uh because T typically you have to take
like 10 kilos of of it and we don't want
to risk to have 10 kilos of soup for
this machine lying
around um and um maybe a new RFC
extension for the coffee pot control
protocol is needed for coffee pots and
not teapots uh for those machines too at
least we have also Creme Brule as a
powder flavor yeah we have Creme
Brule it's quite tasty if you don't have
too much powder in your
in your coffee M yeah it's uh it was a
bit difficult to find the right
dosage um well and there's of course the
last question that everyone wants to
know does it run doom and well I can say
it can let's check it
[Applause]
out you have
a
okay there is uh actually uh a safety um
switch here so that you can't operate
the machine uh when it's turned on but
you have to operate the machine when
it's turned on to program it so there is
a anti- safety
uh uh key here um that is here in the
machine uh for
maintenance and it's it actually
switches completely switches off the
power and programming the machines there
is a uh there is a button uh in um
inside of here or actually two buttons
I'm not they do the same I'm not sure
why uh they put in two buttons but I
think uh this uh plastic press plastic
presses on the first button and it if
you press it uh for a second then it
will go into the program
mode I'm still waiting until our
management Wi-Fi hotspot uh turns on
it's in the machine inside we added
it so I can SSH into the
machine and uh so even though the the
serial um protocol is quite weird and
the setup is quite weird they I think
they're actually quite nice machines um
I think it's more the more of a
management issue of the project that it
turned out like this um because you
could do a lot more with those
electronics and um that's actually the
board here uh is custom but there is a
um system on a board here um that's uh
from uh very site so that's a vendor
that uh supplies you with um Linux uh
arm Linux ports uh where you can just
run software and I think it's even
running some kind of dbn uh they
published on the site probably on the
website probably a few years ago um you
have an ethernet port here and there was
no root password or anything um because
yeah if you have the machine open you
can do whatever you like uh and the root
FS is completely on the SD card so um
that's actually quite nice for swapping
out the logos or trying out things uh
you don't have to flash
anything
um H you want I guess
you so um it it has a touch display so
it had be done or it it has a display so
it had be done um we're running just uh
frame buffer Doom although the machine
itself is running uh
X11 um which is
fine um
and uh we already in before we started
to
um uh to look into the serial protocol
and the software we thought like we
could actually integrate those two parts
that you can either switch between
coffee mode and doom mode or actually uh
Implement a few uh things in Doom where
the coffee you get depends on your doom
points and uh if you die just at the
beginning you will just get hot
water but that's still uh to
do I need to kill 11
s so a bit of um information on the
machine itself all of those um
containers you can actually take out so
um that's more as empty currently for
example
um you can just take this this out um
the motor plugs in into the rear here
and operates the um the mechanism um for
the uh powder and
um it should also fit
again oh
yeah
yeah many all right our demo failed I'm
very
sorry um you can come to the village and
we will show it to you we're going to
fix
[Applause]
it thank you very much for your
presentation uh we are out of time but
uh since uh you're so may maybe uh tell
everyone where exactly uh can can they
find you um we are um more or less at
the metb or laville Village that's it's
on the m is the ah Village the the
village with the largest uh or the
longest name and it's the uh silver or
white um
Dome basically right next to caros West
I think c west probably is known by
everybody thank you very much yeah thank
[Applause]
[Music]
you