Troubling Target
by redxlegion (redxlegion@yahoo.com)
The inspiration for this article came from an earlier article regarding Target's computer systems, but not so much the PDT/LRT. This article should hopefully fill some gaps. (That is, if I can tame the ADD long enough to form complete and orderly sentences.)
[First of all, for reference, you can make colons on the Symbol 6800 48-key keyboard with Func+Ctrl+O]
To begin with, the Symbol 6800 series PDT/LRT is basically a microcomputer with an annoyingly sized screen, gun-like shape, and barcode scanner at the "barrel" end.
They communicate with wireless access points throughout Target buildings over an RF network similar to the type you buy for your home. It's simply ordinary 802.11b (Wi-Fi). The WEP key might not be easy to extrapolate from network communication, especially not from outside the building where signal strength is pathetic, but should be easily gained from the PDT/LRT (which is from now on known as the PDT in this article, for sanity's sake).
Simply reboot the PDT (by turning it off, holding 4 and 5, and then turning it on again) and Ctrl+C during any point in the boot-up process. It'll break right out of those annoying batch scripts.
From then on you have access to numerous "drives" on the PDT. I've documented are A:, B:, D:, and E:.
A: appears to be where the DR-DOS OS itself resides.
B: doesn't appear to be more than a mirror of A:, but I could easily be mistaken.
E:, however, is very interesting.
It contains all the software for operation of the PDT. The software involved is really just a terminal program and some configuration programs. All those files should be contained in the directory ATV3000.
Within the root directory of E: there should be a file called NET.CFG. Can you guess what's in there? The WEP key mentioned earlier.
The good news is you can also get the login information such as user ID, password, and terminal init string, which are vital to accessing the terminal server's applications. Even beyond that you require an employee ID to log onto the network.
Those aren't even close to difficult to obtain. You can generate them yourself, in your mind. I've done so on several occasions, being very successful. One such number I came up with was 2922854. It functions as an employee ID and is accepted, but I can't verify if it's actually an employee's ID Anyways... back onto the point.
You'll want to copy the file ROICONF.FIL from D: onto E:. The storage on the PDT is a type of flash memory, so you'll have to type in FLASHCTL /W to enable flash writing ability in order to copy the file.
After you enable it, just type COPY E:ROICONF.FIL while you're sitting on the E: drive. You can close the flash control program with FLASHCTL /RO which may later on be a good idea because it eats all available memory on the PDT. Not right yet though. It has to be enabled for options to be saved.
Now you can run TNCFG3.EXE. That's the terminal config program. Of all the configuration programs on the PDT, this is the one you'll have the most fun with. You can make the beeping noises go away completely, if they so annoy you that you consider strangling your nearest Executive Convoluted Team Disseminated Department Leader.
Not only that, but you can enable your PDT to scan any type of barcode, even ASCII and control characters. I'm not sure what option those are in directly, but you'll know when you find them. When you reach that menu, you can use the up and down keys to flip through the various barcodes you can enable.
Press Enter to enable disabled barcodes. You can use the Left and Right keys to move the arrow up and down to select various aspects of the barcodes. When you find a barcode that asks for Enable ASCII - No, change that to Yes by pressing Space (Func+Backspace).
Don't worry about the min or max. Leaving them at zero will do no harm or good Now exit TNCFG3. Reboot the PDT. It'll cycle through all its annoying nastiness as per usual. It'll eventually reach the login prompt where you put in your employee ID. Put in whatever you want. But before you do that, follow the next step...
You should've done this the night before. Sorry I didn't mention this earlier, but perhaps now you'll know for later, and can perhaps just entertain yourself with the configuration options.
This is for those who really want to trouble Target. Just note, this hasn't yet been tried...
Now fire up Mozilla, Opera, whatever, and visit: www.telepen-barcode.co.uk/barcode-generator.asp
[Gaping evil grin]. If you're familiar with "A Nasty NT Bug," you may know where I'm going with this. I may be completely off my rocker, but having the server output a tab followed by backspace characters should crash the system, correct? Well, that handy dandy website will output for you a JPEG to print if you enter in: 9888888888
Keep that barcode handy for what happens next.
All right, you've logged onto your Symbol 6800 PDT. You're at the foolish menu of the damned, and instead of inputting a number, type in Loop and hit Enter. It's a program that's not explicitly mentioned anywhere in any documentation on any of Avalanche Wavelink's (the client/server package Target uses for PDTs) website or any such thing, at least not that I know of. It's just a simple program where the PDT scans something, sends it to the server, and the server spits back what it scanned. Get out your handy dandy barcode you printed the night before. Scan it.
You just scanned a barcode with a tab and nine backspace characters, which should bring the server to a screeching halt.
That is, if I didn't interpret "A Nasty NT Bug" correctly somehow, which I'm sometimes guilty of. If my logic is right, though, you've just troubled Target enough that they'll have to suffer through an Windows NT 4.0 reboot.
Another detail I'm not privy to is if each store has its own server, or if the servers are regional.
I'd just like to say that I don't condone the existence of middlemen or retail in general, and I believe that people should experiment without boundaries. So learn all you can despite the ignorant masses, even if you belong to them!