TcXWave

Hardware & Field

TcXWave

Turning locked-down POS terminals into kiosks, and reading their firmware first.

Problem

Four Toshiba TCxWave 6140-E45 point-of-sale terminals, destined to become wall-mounted home-automation kiosks. They fought back: locked boot behaviour, a touch panel that would not wake the screen, USB ports that needed cycling after power events, and firmware of unknown provenance. Before trusting them on the network, I wanted to know exactly what was inside.

Diagnosis

Two problems, one before the other. First, understand the firmware: if these machines were going to boot my OS and join my network, I needed a verified copy of what shipped on them. Second, tame the hardware: touch wake, USB cycling, and power behaviour are all firmware/BIOS-level problems, not operating-system ones.

Action

  • Dumped both 32 MiB SPI flash chips with flashrom, twice each, and hash-compared the reads
  • Parsed the Intel flash descriptor and ME regions with ifdtool and a small Python script
  • Extracted the firmware tree: 11,074 files
  • Decoded the BIOS setup language: 19,256 lines of IFR
  • Inventoried 193 fan and thermal controls
  • Wrote purpose-built scripts for the parts that were locked down: touch-to-wake, USB port cycling after power loss, and power tuning
  • Netbooted NixOS onto each terminal from the fleet's boot infrastructure and mounted them around the house as kiosks

Outcome

  • Four terminals in daily service as bedside, kitchen and office kiosks
  • A verified, documented firmware baseline for hardware that shipped with none
  • Reusable scripts for touch wake, USB recovery and power behaviour
  • Point-of-sale e-waste doing useful work instead of going to a skip

What I'd do differently

Pending

Reflection to be written by Jupiter.

Clock
--:--:--—Local time