Ghosted by the Manufacturer, He Rewrote the App on His $6000 Cotton Candy Machine

Block’s Retro Repairs picked up a used Red Rabbit CT-606 cotton candy vending machine for three hundred dollars. New, these units sell for around six thousand. The exterior looked custom and ready for an arcade floor, yet inside it still ran a full Android 7 system on a Rockchip industrial board wired straight into stepper drivers and control boards. What arrived was broken in more ways than one.

Years of rock-solid sugar filth had accumulated, jamming the whirling skull. Some of the thermocouple wires had worn thru and were shorting out against the aluminum enclosure, not in the proper location. The batteries in the remote temperature sensor abruptly died one day, and there was no automatic way to renew them. After cleaning and re-insulating the sensor, relocating the thermocouple to the top of the head, and resetting the temperature objectives to 250 degrees Celsius, the machine resumed spitting out appropriate flower-shaped floss in a variety of colors. Then we went ahead and adjusted the furnace timeout settings, which had been set to a laughable zero seconds, allowing the induction coil to properly warm up before turning on. The mechanical portions were restored to working order, but the software was not.

Sale

Nostalgia Cotton Candy Machine – Retro Cotton Candy Machine for Kids with 2 Reusable Cones, 1 Sugar…

• Flossing sugar or hard candies – unique Extractor head allows you to use traditional flossing sugar or your favorite hard candies to make delicious…
• Cotton Candy kits – this unit works perfectly with any Nostalgia cotton candy kit – try the cotton candy flossing sugar (Ccfs300), or the hard candy…
• Simple operation – warm up the unit, add your flossing sugar, and enjoy your cotton candy in just a few short minutes

Pricing, product catalogs, and a variety of configurable choices were all stored on a distant server. Every time the computer booted up, it would send its hardware ID (which was simply a combination of its WiFi mac address and CPU serial number) to some Chinese domain without even bothering with a password, let alone checking to see if it was legitimate. The server then looked up which account was running the machine and returned the entire product database in JSON format. The machine’s screens allow the operator to change business hours, stock counts, and the amount of floss to produce, but they cannot change the actual costs. The machine remained locked to the old owner’s account, so he had to submit a support ticket, but Red Rabbit never responded.

The system was moved and isolated on its own little local network with no internet connection. He then enabled ADB on a custom Android build. The CT Terminal application and its SQLite product database were both installed on the device itself. When he looked at the database, he noticed that there were all the flavor images (some were even stored locally, while others were pulled from the web) and Chinese store names that turned out to be just little proverbs, original prices of $5 and $7, and some sales history showing he’d sold around 655 of the lower end cones and 494 of the higher ones for a grand total of $6700.

Even after multiple attempts to edit the database file and manually rewrite it back onto the system, the on-screen interface remained unchanged. These efforts appeared to enhance the machine’s chances of becoming stuck in a boot loop. It took months of putting up with the temperamental candy machine before a near-brick forced his hand and prompted him to perform a full factory reset on the control software, which also required resetting all of the temperature settings from scratch. That simple procedure removed the remaining settings that were incompatible with the hardware, and the machine began producing cotton candy much more consistently than before. Frustratingly, the account binding issue persisted, and we encountered a problem when he performed the first reboot following the reset; it would only stay in offline mode if he could establish a network connection first.

As a last resort, the only option was to modify the original application. Unfortunately, a lack of programming skills, along with the fact that much of the code was written in Chinese, made the task lengthy and difficult. To be honest, he was fortunate to have free access to code chatbots, or massive language models, which ended up doing a lot of the heavy lifting, allowing him to test over a dozen different versions before he found something that worked. The resulting code patch introduced a hidden options menu that could only be reached by injecting some custom code rather than using the regular default way.

From there, you could set the price of every flavor to $3, set them all to zero for a free play session, or make all of the prices go up or down by a certain percentage. We also managed to divert those network calls that were previously going out to the remote server, so the app would accept a weak local connection instead of attempting to connect to a real internet link. That meant that even if the server went down or he received account change notices in the future, the machine would continue to churn out candy.
[Source]