Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse engineering an e-ink display

zeus.ugent.be

Post reply on HN
Print view View original

11–20 of 56 posts

Re: Reverse engineering an e-ink display

#11

Post by redfast00 »

blutack wrote: post #6

Nice article - is the idea to communicate with the tags with their stock firmware using another CC25x series chip or dev board? Unfortunately, that might be tricky without the private keys in the controller. User manual [0] describes a per site 128 bit AES keys used for the RF comms. Might be easier to just write fresh firmware for them - there's some code here [1] for driving the display that could be ported to the…

The idea is indeed to communicate with the tags with their stock firmware (not necessarily using another CC2510, since these aren't made anymore, but that's a possibility).

AES is symmetric cryptography, so that should be possible to extract from the firmware. The tags also show a QR code when the aren't initialized yet, this is likely the setup key. I also read that even if tags are already initialized, it's still possible to reset them with some kind of PUK (not sure how to get that PUK though)

I couldn't find a datasheet for the e-paper screen, so even if re-implementing communication with stock firmware proves to be infeasible, I'll still need the dumped firmware to figure out how the e-paper screen is controlled.

Re: Reverse engineering an e-ink display

#12

Post by dcow »

dave78 wrote: post #8

I wonder if there are larger implications to reverse-engineering this. When I worked in retail in high school, I was told repeatedly that if a price was marked on a shelf, then there are laws that require the store to sell that item for that marked price. (IANAL so I don't know the nuances there, but it makes sense). If it becomes easy to change these displays with a new price wirelessly, that could be a really nasty…

I’ve only seen a store honor the floor price when it was clearly wrong like once and it was for an item that they were trying to get rid of anyway. I’ve heard the lore too and can’t understand how it could be legally binding for a store to sell an item at the sticker price. Wouldn’t people just walk in with little stickers and mark stuff down as they wished? My wife works in retail and confirms that stores don't just give out items at a loss when the price is mislabeled. They fix it and apologize. My experience confirms this too.

These days stores essentially just map an item’s UPC to a price in a DB in their point of sales software. The price isn’t encoded on the tag. Which brings me to my question: why the heck are we making an eink price tag with heavy security when the source of truth is the POS anyway? I mean no negativity about reversing one, it’s a super interesting and fun project. Just, “why?” in the first place does this thing exist? Maybe it’s just convenience and saves on labor costs to be able to update the price of all the items in your store at once and not pay a human to go out and relabel them?

Re: Reverse engineering an e-ink display

#13

Post by reaperducer »

dcow wrote: post #12
dave78 wrote: post #8

I wonder if there are larger implications to reverse-engineering this. When I worked in retail in high school, I was told repeatedly that if a price was marked on a shelf, then there are laws that require the store to sell that item for that marked price. (IANAL so I don't know the nuances there, but it makes sense). If it becomes easy to change these displays with a new price wirelessly, that could be a really nasty…

I’ve only seen a store honor the floor price when it was clearly wrong like once and it was for an item that they were trying to get rid of anyway. I’ve heard the lore too and can’t understand how it could be legally binding for a store to sell an item at the sticker price. Wouldn’t people just walk in with little stickers and mark stuff down as they wished? My wife works in retail and confirms that stores don't just…

the source of truth is the POS anyway

In a technical, ideal sense the PoS is the source of truth. But life is messy.

PoS may lose connectivity. PoS may be running an outdated version of the software. PoS is based on some unreliable operating system or low-end PC, and is unreliable. PoS doesn't know about the store manager's last minute special because the distributor sent too much stock. Stores don't have in-house IT guys.

From a legal standpoint, in some states, the price on the shelf label is the source of truth. My grandmother lived in a state where if the price on the shelf was lower than in the PoS you got the item for free.

She was very good at catching those errors and complained bitterly when the law was changed so that the customer only got the lower price.

Re: Reverse engineering an e-ink display

#14

Post by mig39 »

dave78 wrote: post #8

I wonder if there are larger implications to reverse-engineering this. When I worked in retail in high school, I was told repeatedly that if a price was marked on a shelf, then there are laws that require the store to sell that item for that marked price. (IANAL so I don't know the nuances there, but it makes sense). If it becomes easy to change these displays with a new price wirelessly, that could be a really nasty…

I once scored a big bunch of coffee because the local Canadian Superstore confused cents with dollars. The price was listed in cents per kg instead of dollars!

At first they refused to honour the price, and fixed their mistake.

I sent an e-mail with photos to their corporate office. I received a phone call from someone who was laughing and thought it was all funny. He told me to go back to the store, and as much as I could carry, they would honour the posted price.

Cost me like less than a dollar for 4 or 5 kilos of coffee!

Re: Reverse engineering an e-ink display

#15

Post by rhd »

dcow wrote: post #12
dave78 wrote: post #8

I wonder if there are larger implications to reverse-engineering this. When I worked in retail in high school, I was told repeatedly that if a price was marked on a shelf, then there are laws that require the store to sell that item for that marked price. (IANAL so I don't know the nuances there, but it makes sense). If it becomes easy to change these displays with a new price wirelessly, that could be a really nasty…

I’ve only seen a store honor the floor price when it was clearly wrong like once and it was for an item that they were trying to get rid of anyway. I’ve heard the lore too and can’t understand how it could be legally binding for a store to sell an item at the sticker price. Wouldn’t people just walk in with little stickers and mark stuff down as they wished? My wife works in retail and confirms that stores don't just…

Here's an example in Michigan's law:

The Shopping Reform and Modernization Act, or Scanner Law, requires that most items on store shelves be clearly displayed with the price; by signage, electronic reader, price sticker, or any other method that clearly and reasonably conveys the price to a consumer in the store at the place where the item is located. If an automatic checkout system (scanner) charges you more than the displayed price of an item, and:

the transaction has been completed, and you have a receipt indicating the item purchased and the price charged for it; Then:

You must notify the seller that you were overcharged, within 30 days of the transaction, either in person or in writing. Within two days of receiving your notice, the seller may choose to refund you the difference between the amount charged and the price displayed plus a "bonus" of ten times the difference, with a minimum of $1.00 and a maximum of $5.00. If the seller does not pay you both the refund and the bonus, you may bring a lawsuit to recover your actual damages or $250.00, whichever is greater, plus reasonable attorney fees up to $300.00. You may instead file a complaint in a small claims court without an attorney.

https://www.michigan.gov/ag/consumer-protection/consumer-ale...

Re: Reverse engineering an e-ink display

#16

Post by reaperducer »

layer8 wrote: post #7

It still somehow breaks my intuition that it’s cost-effective to have thousands of these deployed in each supermarket. I mean, I do understand it rationally, but it’s still weird.

Supermarkets already have inventory robots (look for the high-contrast markers around the store), and shelf-stocking robots are on the way. It makes sense that the next step is to eliminate another human job and give it to the robots you already have running around the store.

Re: Reverse engineering an e-ink display

#17

Post by reaperducer »

redfast00 wrote: post #5
Mraedis wrote: post #2

I wonder how popular this tag must be/have been to be able to find someone that had already dissolved/sandpapered it? Can't wait for the follow-up on this, turn that e-waste into something usable!

When I recently visited, I saw that the local IKEA uses these tags, so I'd guess these are rather popular.

I saw them at a Walmart in Texas a few years ago, so they're probably quite widespread by now.

Re: Reverse engineering an e-ink display

#19

Post by dave78 »

rhd wrote: post #15
dcow wrote: post #12

Earlier quoted context omitted.

I’ve only seen a store honor the floor price when it was clearly wrong like once and it was for an item that they were trying to get rid of anyway. I’ve heard the lore too and can’t understand how it could be legally binding for a store to sell an item at the sticker price. Wouldn’t people just walk in with little stickers and mark stuff down as they wished? My wife works in retail and confirms that stores don't just…

Here's an example in Michigan's law: The Shopping Reform and Modernization Act, or Scanner Law, requires that most items on store shelves be clearly displayed with the price; by signage, electronic reader, price sticker, or any other method that clearly and reasonably conveys the price to a consumer in the store at the place where the item is located. If an automatic checkout system (scanner) charges you more than th…

I think that page backs up what I thought, at least for Michigan. The law views the price displayed on the shelf as being the correct price, and if the POS system doesn't match then the law says the POS system is wrong. Also there's another interesting FAQ there which further reinforces it.

Now, if an e-ink display is changed by a hacker, that's obviously fraud and presumably the store wouldn't have to pay up, but I assume that would be tough to catch because the store wouldn't likely assume it had been hacked and even if they thought so they'd probably have to prove it somehow.

From the FAQ:

What if the wrong price is displayed for an item and the clerk catches it before I pay; am I entitled to buy the item at the displayed price?

This is a fact-specific question best answered by a court. A store may not knowingly charge or attempt to charge a price higher than the price displayed for that item. Therefore, the consumer may have a claim if the store will not sell the item at the price displayed. However, the consumer may face obstacles convincing a court that the store knowingly charged the higher price when the pricing mistake is not intentional and will result in an obvious windfall to the consumer.

Re: Reverse engineering an e-ink display

#20

Post by blutack »

redfast00 wrote: post #11
blutack wrote: post #6

Nice article - is the idea to communicate with the tags with their stock firmware using another CC25x series chip or dev board? Unfortunately, that might be tricky without the private keys in the controller. User manual [0] describes a per site 128 bit AES keys used for the RF comms. Might be easier to just write fresh firmware for them - there's some code here [1] for driving the display that could be ported to the…

The idea is indeed to communicate with the tags with their stock firmware (not necessarily using another CC2510, since these aren't made anymore, but that's a possibility). AES is symmetric cryptography, so that should be possible to extract from the firmware. The tags also show a QR code when the aren't initialized yet, this is likely the setup key. I also read that even if tags are already initialized, it's still p…

Some of the marketing mentioned private keys so I stupidly assumed a per transmission negotiation mechanism but of course they probably just mean "symmetric key". A per tag key extraction would be annoying though presumably. The PUK mechanism is very interesting, I'm interested to see what you find in the firmware...

For the display, this poster has something similar and talks about a datasheet - there's even a pinout for the flex cable (and it's supposedly SPI) [0]. It's for the 2.6" version not the 2.7 though so might be totally different. A comment on the post (by this person [1]) claims that they have working cleanroom CC2510 code that drives the display but who knows.

Great project anyway - I look forward to part two (and what you find on that flash chip)!

(Edit: sorry if you know this already, but there's a manual for the labels themselves [2] implying the setup page is permanently stored in one of the 4 slots - hopefully in that external flash chip)

0: https://epongenoir.blogspot.com/2017/10/

1: http://andreiprojects.blogspot.com/

2: https://fccid.io/2ACQM-EDG1-0260-A/User-Manual/User-Manual-5...

Post reply on HN