Wednesday, June 27, 2012

DIY Replace the USB cable for WASP WLS9500

I'd like to take a moment and call WASP out on their complete bullshit overpriced USB cables for their barcode scanners. Specifically the WLS9500:

Overly Complicated for Profit

First off the cables have about a 80% failure rate within 3-4 months, from my experience.

Second the price they want for a replacement cable is ridiculous, on average around the web about $55 USD.

They use a RJ-50 aka the RJ-45 10 pin adapter for the connection to the scanner. Why an RJ-50? They must be using those 10 pins for something really cool right? Surely they wouldn't do this just to charge more to their customers and make it difficult to fix yourself...

When you take the plug end out of the scanner to look at the pin out you see this:

1- Black
2- Red
3- Black
4- White
5- White
6- Black
7- Green
9- White
10-White

When you get down to it and manage to get the actual plug end uncovered from the "protective" sleeve that they've glued and molded onto the plug, which is no small task might I add, you see that most of it is just blank pieces of plastic taking up space.

Pins 4,8,9, and 10 are complete bullshit, just pieces of plastic, there's not even copper wire in them, 100% plastic. Useless, unneeded, plastic that serves no purpose.
White Lies

Pins 1 and 6 are looped together with one piece of wire in a U shape. And wouldn't you know, it doesn't work properly without 1 and 6 looped, what an amazing coincidence that you COULD make this thing with just a standard RJ45, or a RJ11 and make it easily serviceable, replaceable, and able to be done in house.

The "Magic" Wire
So after you eliminate those 6 pins you're left with your regular 4 USB wires in slots 2,3,5,7.

Awesome Splice Job


Actual pinout
1- Black - Looped to 6
2- Red - USB
3- Black - USB
4- Useless
5- White - USB
6- Black - Looped to 1
7- Green - USB
8- Useless
9- Useless
10- Useless

Ordered the equipment online, crimper ~$40, ends .99 / each. If you have a small fleet of these things to take care of, like I do, I suggest you make the investment also and tell WASP to get bent.

Friday, June 22, 2012

Fun with HP Printers

There are few things in life that are as entertaining as the confusion and chaos that ensue when you make minor changes to the environment/daily routine of people that do office work.

Something as simple as changing the display on a network printer will immediately cause 1 of two reactions, total and complete mental shutdown or complete denial of acceptance into their reality aka they ignore it.

Once upon a time one of the l0pht team made a small utility called the HP Display Hack, sili circa 12/8/97 according to the useage output. This allows you to change the standard message on HP printer displays. There are several other utilities you can do this with, such as HiJetter by Phenoelit. Also you can just telnet/putty in on 9100 and issue @PJL RDYMSG DISPLAY="BlahBlah".

So anyways, I wrote a script to find you local network, scan 1-254 and find anything that responds to ping, then check if it will establish a telnet connection on port 9100, if so use the HP Display Hack program to randomly change the message to 1 of the 10 options (change if you like, up to 16 characters).

Not particularly evil, but always good for a laugh, especially when the help desk gets a call about the printer in the accounting office stating it's uploading documents to the CIA. Or the internal printer fire in the warehouse.

-=Script=-

@echo off
setlocal enabledelayedexpansion
::find network
for /f "tokens=2 delims=:" %%i in ('ipconfig ^| find /i "Ip Address"') do set network=%%i
for /f "tokens=1,2,3 delims=." %%i in ("%network%") do set network2=%%i.%%j.%%k
::Scan for Active Hosts
for /L %%i in (1,1,254) do ping -n 1 -w 60 %network2%.%%i | find /i "reply" >> ~temp1
for /f "tokens=3 delims=: " %%i in (~temp1) do echo %%i >> ~temp2
del /f /q ~temp1 > nul
::Check for port 9100 (aka printers)
for /f %%i in (~temp2) do (
    set t=!random!
    set r=!t:~1,1!
    if !r! == 1 set message="[READY] TO ROCK"
    if !r! == 2 set message="Uploading to CIA"
    if !r! == 3 set message="FEED ME A KITTEN"
    if !r! == 4 set message="Spelling Error"
    if !r! == 5 set message="Internal Fire"
    if !r! == 6 set message="OUT OF LETTERS"
    if !r! == 7 set message="Self Destruct:ON"
    if !r! == 8 set message="PCLOAD LETTER"
    if !r! == 9 set message="POWER FLUID LOW"
    if !r! == 0 set message="Insert Coin"
    set r=
    set t=
    start /min telnet %%i 9100
    ping -n 5 127.0.0.1 > nul
    netstat -n | find /i "%%i:9100" | find /i "Established" && hpnt.exe %%i "!message!"
    taskkill /f /IM telnet.exe
)
del /f /q ~temp2 > nul
exit


As stated previously hpnt just issues the @PJL RDYMSG Display="whatever" command over telnet. It could be done with a piped text file to netcat also as there's no way I know of to send commands to a telnet session in pure batch.

Thursday, June 21, 2012

Master Lock Warded Padlock Teardown


This is the Master Lock Warded padlock. Not a particularly impressive lock, but I've never taken one apart before. So I took one apart.
I removed the heads off the bottom posts that hold all the metal plates together.
All I had was a hand file. It took a while, but I finally got the bottom plate off.





Here we have the bottom plate (what's left of it) the key way circle and the shackle spring.  The key way circle sits loose trapped between the bottom and second plates of the lock.













Here we have the lock, from the bottom, with the bottom plate off. The spring goes into a hollowed out portion on the shackle and is what makes it pop up when the locking mechanisms are released by the key.



 After getting the bottom plate off, the rest came off relatively easily. They didn't exactly just all fall off like I had hoped, but I managed to get them off with just a small chisel to separate the plate then a flat head screw driver to move them up and off the posts.
Here's a picture of the lock half disassembled.

       Here's the plates that have been removed bottom on the left moving up to the right.


The second to last plate latches into a groove on the bottom of the shackle and prevents it from falling out when opened. Notice the groove on the shackle below. This is also the longer side of the shackle that is drilled out to accept the spring.

Next we come to the lower release for the shackle. This is part of two individual locking mechanisms.
The wire sits in a groove on the shackle.

                            When the key is inserted and turned it moves the wire out of the way.


                             The middle groove on the shackle is where the locking wire sits.

                                      
                                                   Here is just the plate with the wire.


Next is the upper locking mechanism. It also is a spring like release. When the key is inserted and turned it pushes the two sides apart removing it from the upper grooves on the shackle. (see previous shackle picture, the top groove is where this sits. It is a double sided groove.)


This is a series of pictures of the plates from top to bottom as you take the lock apart, some identical plates in series were not photographed as they added no value to the content.















                                 Here is the full lock disassembled bottom at the left top at the right.
                                            
                                                       The bottom half of the lock plates:
                                                 
                                                          The top half of the lock plates:





Wednesday, June 20, 2012

Wireshark Filters - For a Different Popular Music Site

Grab music off of a different very popular music site...

src host s18.first.am or s19.first.am or s20.first.am or s25.first.am or s3.first.am or x1.first.am or x2.first.am or x3.first.am or x4.first.am or s2.first.am or s4.first.am or s5.first.am or s6.first.am or s7.first.am or s8.first.am or s9.first.am or s10.first.am or s11.first.am or s12.first.am or s13.first.am or s14.first.am or s15.first.am or s16.first.am or s17.first.am or x5.first.am or x6.first.am or x7.first.am or x8.first.am or s21.first.am or s22.first.am or s23.first.am or s24.first.am or s26.

I'll leave it as an exercise to the reader to figure out what the domain name is supposed to be.

You're going to end up with all kinds of crap along with what you want. Such as text files, image files, you're looking for audio/mpeg.
Cleaned up the filter. Now it only grabs the audio files

I hate doing crap manually so here's a script add the extension to the files.

-=Script=-
 @echo off
ren *.audio%2fmpeg *.mp3

Yep that's it, you might have some OBJECT files left over, those are crap, just delete them. There may also be other stuff, I only did a short capture.

Open all the files in Winamp and send them to Auto Tag, then use MP3Tag (as was pointed out to me) to rename the file name from the metadata.