oooh, the redbox uses full AES encryption!

and they always use the same key which is embedded in the executable right next to the encrypt() and decrypt() functions. well done, guys

correction: they hardcode two separate keys in the two separate places (that I've found so far) which use AES.

this code is enterprise as hell

you need the url for the base client? well you use Redbox.Rental.Services.KioskClientService.KioskClientServiceBaseUrl which is a property that'll ask the ServiceLocator to find an instance of IConfiguration to get the KioskClientServiceBaseUrl object out of it

they wrote their code as a fuckton of C# services that are always HTTP POSTing at each other

HTTP is, as always, the poor man's IPC

they logged the first six digits and last 4 digits of every credit card transaction.

HAVE YOU EVEN HEARD OF PCI?

Edit: this is technically allowed by PCI.

1234 56## #### 7890

can I buy a vowel?

I'm trying to tar up a redbox install and upload it, but each time the tar gets past 50% we find another file with PII in it

You're telling me!

OH HEY BAD NEWS:

when someone opens up the hard drive of a redbox unit, they can pull a file which has a complete list of titles ever rented, and the email addresses of the people who rented them, and where and when

the unit I've got an image for has records going back to at least 2015.

I was able to easily match one of them to a real name

I have 2471 transactions here.

Somebody I'll call Dave Fakename rented The Giver and The Maze Runner in Morganton, NC on 2015-05-23 at 6:43pm

found a THIRD set of encryption code.
this one is 3des instead of AES, and YEP they still hardcode the passkeys

Redbox.HAL.Configuration
.ConfigurationFileService implements IConfigurationFileService

STOP MAKING SERVICES AND FACTORIES AND INTERFACES AND JUST READ THE FUCKING JSON FILE YOU ENTERPRISE FUCKERS

AND HEY YOU DON'T NEED A SEPARATE C# CLASS FOR EACH XML FILE YOU LOAD

YOU CAN JUST HAVE AN XMLLOADER CLASS AND A GENERIC CONFIG FILE. PLEASE

this is the kind of code you get when you hire 20 new grads who technically know C# but none of them has written any software before

so these people wrote a mostly C# program, with some lua for glue scripting.

and then they implemented their own language. it's some bastardized version of BASIC

it's a compiled (to bytecode? I think?) cooperative-multitasking BASIC.

and god I wish it was the only one of those I'd ever seen

okay by "compiling" they mean "parsing". The output of the compiler is a list of tokens, the input is a text file

example code:

POP START-DECK
POP START-SLOT
POP END-DECK
POP END-SLOT

IF END-SLOT > MAX-SLOT-PER-DECK
SET END-SLOT MAX-SLOT-PER-DECK
ENDIF

Foone's official list of things they never expected to implement their own multitasking programming language, yet found one anyway:

* Redbox vending machine motors
* Wheel of Fortune (2011, Wii)

Redbox.HAL.IPC.Framework.ClientSessionFactory

PLEASE, NO MORE FACTORIES

MY CHILDREN ARE STARVING

oh good they implemented both an internal C# dynamic plugin loading system, as well as the ability to craft arbitrary Invoke()s over TCP/HTTP.

So you can call any C# function from anywhere on the machine, I think?

So, quick summary:
Redbox went bankrupt and the machines are getting in the hands of individuals. The disk image has been dumped. The software is being reverse engineered: they're not currently very useful, since they need to talk to a server that's gone.

But progress is being made

the devices themselves are windows 7 machines talking to the disc library. It's a small group of services talking to each other, mainly over HTTP

it's primarily written in enterprise-as-fuck C#, with some lua scripting, and the "HS" scripting language which seems to be proprietary to redbox machines.

I'm currently trying to acquire one so I can do more hands-on reverse engineering, but for now I'm focusing on the software and how it all interacts

and I'm told Doom has already been run on them. It's windows 7, it can run many doom sourceports.

With a little extra work you could probably play native MS-DOS Doom on them

MORE FUN FACTS:

it turns out the device has a database on it which lists the location of every single other redbox machine. full addresses.