A microphone listed in the service manual of an office coffee machine is the kind of detail that makes a hardware hacker put the cup down. Robin M. found exactly that in the documentation for a Spengler PSL50, asked the supplier why it was there, got a vague answer about future presence detection, and did what makers do: bought a spare display and controller module on eBay and opened it up. A few evenings later the machine was running Doom.
What was inside
The controller is nothing like the 8-bit board you might expect in a drinks dispenser. It carries an NXP i.MX 6 with an Arm Cortex-A9 core, boots a Yocto-built embedded Linux, and has Ethernet, USB, a microSD slot and headers for payment terminals, cup dispensers and energy-saving modules. Robin fed the board 24 V on the bench and probed an unlabeled connector. It turned out to be a 3.3 V UART running at 115200 baud. A Raspberry Pi wired to those pins gave a live boot console, and the console told the rest of the story.
Three weak spots and one old kernel
U-Boot had no password, so the kernel command line could be edited at the prompt. Pointing init at /bin/sh dropped straight into a root shell, from which the filesystem could be remounted and the root password changed. The USB update path looks for an autorun.sh plus a hash, but the secret used to compute that hash sits in plaintext on the machine, so anyone with filesystem access can forge an update that passes the check. The software stack is also old: Linux 3.10.17 and glibc 2.18. Robin’s diagnostic script found no evidence of audio recording, and most PSL50 configurations ship without the audio hardware at all. The microphone was a dud; the unlocked bootloader was the real find. For the game, fbDOOM was the right pick because it draws straight to the Linux framebuffer with few dependencies. Built against the ancient userspace, it ran on the bench board first and then on a real machine from a prepared USB stick.
Build it yourself (on hardware you own)
You do not need a coffee machine. Any retired router, set-top box or dead appliance board with an Arm SoC is a candidate for the same walkthrough. Hunt for the UART: look for a 3- or 4-pin header near the SoC, confirm with a multimeter that one pin idles at 3.3 V (that is TX), and never attach a 5 V adapter to a 3.3 V port. A Raspberry Pi’s GPIO14 and GPIO15 or a CP2102 USB-serial dongle (around PHP 150 at circuit.rocks) will do; cross TX to RX and share ground. Open a terminal at 115200 8N1, power the board, and tap a key during the U-Boot countdown. If a prompt appears, printenv lists the bootargs you can change. Keep notes, and report any unsigned-update finding to the vendor before you post it. The full account, with board photos, is on Hackster.
Frequently Asked Questions
What hardware runs inside the Spengler PSL50 coffee machine controller?
An NXP i.MX 6 applications processor with an Arm Cortex-A9 core running a Yocto-based embedded Linux (kernel 3.10.17, glibc 2.18). The board takes 24 V, has Ethernet, USB and microSD, and exposes a 3.3 V UART at 115200 baud that gives a U-Boot console.
How did Doom end up running on such old firmware?
Robin used fbDOOM, a port that draws directly to the Linux framebuffer and needs very few libraries, so it could be built against the machine’s outdated userspace. It was loaded through the machine’s own USB update mechanism, which accepts any package whose hash matches a secret stored in plaintext on the device.
What will I learn if I build this?
How to locate and safely connect to a UART on an unknown board, how to use a Raspberry Pi or USB-serial adapter as a console, how U-Boot hands off to the Linux kernel, how to read a root filesystem, and why plaintext secrets and unlocked bootloaders are a security problem. These are core skills for embedded systems and IoT security courses.
