Not since the great jukebox war of 2007 has anyone been as dangerous as a drunken friend with a wallet full of one dollar bills. Now whenever [Reza] goes out to the pub, he can play tracks on the TouchTune jukebox for free.
TouchTune jukeboxes are basically a computer with a touch screen monitor connected to a club’s sound system and the Internet. Unlike old timey 45 or CD-powered jukeboxes, the Internet connection allows you to feed in a few bucks and play just about every song that has ever made the Top 40. TouchTune jukeboxes come with a remote for the barkeep and of course these remotes are sold online.
[Reza] got his hands on one of these remotes and found a handy button labeled ‘P1′ that adds a promotional credit to the TouchTunes jukebox – basically, a free song. Just taking a TouchTune remote to the pub probably wouldn’t work, though, as each remote is paired with its jukebox with an 8-bit ID.
To get around not knowing the ID for each TouchTune device, [Reza] simply tried them all with the help of an Arduino. After connecting a 433 MHz radio receiver to a logic analyzer, [Reza] set the remote ID to 0 and pressed the promotional credit button. The remote ID was then set to 255 and the free play button was pressed again.
This gave [Reza] a whole bunch of binary digits, the only difference between the remote with an ID of 0 and 255 being the 9th through 16th bits. By sending the promotional credit code over a 433MHz transmitter and incrementing the remote ID each time, [Reza] was able to try every remote ID and get a free credit every time his Arduino ran some code.
In the interests of portability, [Reza] made his own small board with a 433MHz transmitter that is easily pocketable for the next time he heads out to the pub. Finally, a solution to the guy who is willing to blow $20 on Aerosmith.
Filed under: digital audio hacks, security hacks
