CueCat Hacks

navigation

operations

About

CueCat

The CueCat is a nifty little piece of hardware. It's an optical barcode reader that plugs into your PS/2 port. Simply swipe the glowing red "mouth" of the reader across a standard barcode, and the output is fed into your computer via the keyboard interface. Neat!

How much would you expect to pay for one of these cool toys? $30? $15? $7? The answer? Nothing! You may be asking "How'd you manage that?", but it's actually quite simple. Go to your local Radio Shack, walk up to a clerk, and simply say "Hi! I want a CueCat!" (If they give you a blank stare, say "You know, the barcode thingie.") The clerk will say "Cool!", and proceed to hand you a Special Radio Shack catalog (with barcoded item identifiers), and a bag containing a CueCat CDROM, instruction guides, and the Barcode Reader. Give the clerk some information (name, address, etc.), and you walk out with a free barcode reader! (Note: This information is no longer valid, as RadioShack no longer distributes the CueCat, and Digital Convergence has pretty much gone out of business. Surprise!)

Now, the dilemma. What do you do with your new found toy?

The idea of the product isn't a bad one. The software that comes with the CueCat reads the barcodes you scan, connects to the main server, and compares the barcode you scanned with the ones present in its database. If it finds a match, the software will kick you to the cooresponding website. So say you're drinking a Pepsi. You scan the barcode off the bottle, and your computer connects you to Pepsi's website. The system recognizes thousands of barcodes, and knows the relevant websites. The bad part, is that each scanner is assigned a unique serial number. When you install the CRQ software, you are given a unique "activation" number. These numbers are attached to you, and your name floats around as a candidate for targetted advertising and Gestapo habit-tracking. Screw that.

We're not interested in the software. (Mine hasn't even been opened.) We're interested in the neat little reader, and the unlimited possibilities that it brings!

When you connect your reader, open up a text editor and scan a barcode. You'll see something like this:

.C3nZC3nZC3nYD3b6ENnZCNnY.fHmc.C3D1Dxr2C3nZE3n7.

The output isn't what you expected, is it? That's because there's a lot more information in there than a simple 12 digit number sequence. The output isdivided into 3 sections, seperated by periods.

The first (and usually longest) section is your unique serial number, assigned to your CueCat. This string never changes, regardless of what you scan. An ALT+F10 Signal preceeds the serial number, as a "wake-up call" to the software.

The second string defines the barcode type. There are many types of barcodes out there, from UPC and its variants, to ISBN, EAN, and others. This is the part of the output that identifies which type it is.

The third, is the barcode data itself. The reason it's not simply a numeric sequence, is because the makers of the CueCat didn't want their toy to be used for reasons other than its intended purposes. So they implemented a weak "string substitution" style of encryption. (In reality, base64+XOR)

Give a geek a cool toy, and he will play with it. Give millions of geeks the same toy, and it evolves into a new toy.

How to Decode

So we geeks started digging deep into how the scanner works. The "encryption" was cracked in very little time, and software has been developed to decode the scanner's output. Let's look at our above example again:

.C3nZC3nZC3nYD3b6ENnZCNnY.fHmc.C3D1Dxr2C3nZE3n7.

This is the result of a barcode scan from a cup of Oreo YoCrunch Yogurt. The actual barcode reads:

0 46675 00080 8

Ignore the first string from the scanner output, as that's the serial number. The second string defines this as a UPC-A Barcode, however that is unimportant in the decoding process. To decode the third string, use this chart as a reference:

(Adapted from http://uscan.sourceforge.net/upc.txt)

    A   B  C
   ---------
0 | C3  n  Z
1 | CN  j  Y
2 | Cx  f  X
3 | Ch  b  W
4 | D3  D  3
5 | DN  z  2
6 | Dx  v  1
7 | Dh  r  0
8 | E3  T  7
9 | EN  P  6

Break the final string into the matching patterns from the chart, and you get the following:

C3 D 1 Dx r 2 C3 n Z E3 n 7

Now, simply plug in the numbers from the left side of the chart, replacing the cooresponding pattern.

0 4 6 6 7 5 0 0 0 8 0 8

Whee! We see it matches the original barcode.

Updates

March 27, 2003
Added a note indicating you cannot acquire the CueCat from RadioShack anymore.

February 15, 2002
I've rewritten this page to conform with Accipiter.org's current style.

September 29, 2000
I've been adding minor contributions to CueCat development, and now it's time for one a bit bigger. I have written a script for The mIRC IRC Client that decodes the CueCat output. This is a totally inefficient way of decoding, and I know there's a better way of doing it. However, this script DOES work, and it works fairly well. You can download it in the "Software" section of this page.

UPDATE: Whoops! I found a bug! Some strings for the number '8' weren't decoding properly due to the order of the string substitution in the script. The problem has been corrected in version 1.1.

UPDATE: Silly Me. The mIRC Editor will NOT load the script! The formatting for the INI file was incorrect in versions prior to 1.2. This problem has been fixed in 1.2. My apologies. (Wow! 3 versions in one night. Sheesh.)

September 26, 2000
For some time now, the people over at Digital Convergence (the makers of the CueCat) have been sending out legal notices to website owners who have hacked their CueCat. They claim that these websites are infringing on their Intellectual Property. To preserve the variety of software out there for the CueCat, I've started distributing it on this page. If you have developed a piece of software that you would like to be mirrored here, or if you want me to link to your CueCat project page, please feel free to contact me.

Software

mIRCue
mIRCue is a CueCat decoder that I have written for the mIRC IRC Client.

Current:
Download mIRCue Version 1.2

Old:
Download mIRCue Version 1.1
Download mIRCue Version 1.0

Other Software
CatScan.txt - A Perl Script that decodes the output, by Andrew Stellman.
curcatd1.0.zip - Another decoder written in perl, by Kevin Fowlks.
DeCue.txt - Larry Wall's (remarkably short!) Perl Script decoder.
cuecat-0.1.4.tar.gz - The Linux Kernel Patch for the CueCat, by Pierre-Philippe Coupard.
KittyCode - A decoder written in Javascript, by Dustin Sallings.
Cat.txt - Yet another Perl decoder, by Colin Cross.
cuecatvb.zip - A CueCat Visual Basic decoder application by Graf Reiner, with bugfixes by Doug Ericson.

Links

http://www.jounce.net/~maarken/ - A cool little web app that decodes the output automagically.
http://opensource.lineo.com/cuecat/ - The CueCat Project page
http://www.flyingbuttmonkeys.com/useofthingsyouownisnowillegal/ - The FooCat BarCode page
http://air-soldier.com/~cuecat/ - Loads of information on the Hardware side of the CueCat.
http://www.logorrhea.com/cuecat/mirrors.html - The CueCat Decoder Mirror List
http://anon.razorwire.com/catscan/ - Andrew Stellman's CatScan page
http://www.beau.lib.la.us/~jmorris/linux/cuecat/ - CueCat Resources
http://blort.org/cuecat/ - A CueCat Software/Drivers page
http://www.fluent-access.com/wtpapers/cuecat/index.html - CueCat Principles of Operation
http://s1066194.umsl.edu/cuecrap/ - CueCrap- Crap About CueCat
http://www.jaggedsoft.com/cuedog/ - The CueDog, a CueCat Decoder for Win32 Systems
http://kickme.to/delphicat/ - Delphi Software Development for the CueCat