I predict that self checkout will only remain in the more trustworthy areas…
Transacting was your way of leaving a calling card for the investigators/analysts to find you... You stole regardless of how you did it.
Reminds me a bit of the shopping cart theory.
For prices displayed on the shelf-label inside the store the law is usually not that strict (YMMV), as a shop-owner can refuse sale on check-out (otherwise I could put a pricetag on e.g. a shopping-basket and the shop-owner would be legally required to sell me the basket...).
Besides, most shops I've seen (in Europe) already moved from Infrared communication to RF (NFC or proprietary), for centralized shelf-label management without handheld devices. So all this study (and the underlying reverse engineering of the IR-protocol) might do is probably accelerate the transition from IR to RF-based ESL...
This is not the case for groceries in Massachusetts at least. If there’s a discrepancy between the tag’s price and the scanned price the store must charge the customer the lowest of the two: https://www.mass.gov/price-accuracy-information
I've seen similar things posted on here before that had a binary build only and zero technical documentation. It was really hard to see any kind of research or education value in those.
Categorising things as "bananas" tricks the checkout into accepting the weight of an item, and you pay the appropriate price per bananagram.
To me this is about having protocols that are suitable so not anybody can write to these labels without knowing a store secret or using replay attacks.
Its value is to provide a standardized hardware platform for (white hat) hackers for probing, prototyping, refining and sharing of security research in the fields its hardware supports (Sub-GHz RF, NFC, IR, and custom external boards via simple Input/Output pins).
Prior to that, everyone who wanted to research e.g. RF security had to either build/assemble something custom or buy much more expensive equipment. This created a barrier to collaborate on research, as everyone had to buy/build the same setup.
On top of that, Person A researching some RF topic selected an RF-transceiver from Company X, Person B used a component and a proprietary SDK of Company Y, so consolidating both work streams for a better foundation for all RF-related research required alot of time and effort from someone, breaking workflows of at least one group of researchers, etc.
In contrast, security research which utilizes Flipper Zero can be reproduced and built upon by everyone. All the work is harmonized on the same Hardware architecture, so it's easy for someone familiar with the platform to dive straight into a new idea without having to build a new breadboard, select a chipset, buy additional probing equipment etc.
it's mostly about efficiency. IR based, an employee needs to physically walk around. RF based, place a transmitter or two in the building and the system now works fully automated.
I should not have to put up with children going "JUST SECURE YOUR NETWORKS BRO" because they spent $30 on some eBay "maurauder" dongle to be a pissant.
Source: Early interest in wifi security, including in other people's networks, lead me down an education and career in security
I'm pretty tired of being the network guy in the field playing remote hands having to be on the front lines of all of this bullshit having to explain to decision makers that a bunch of shitty kids are running around and there's no real solution that we can just "fix" this with.
I'm tired. If they're not deauthing our networks they're breaking into rooms with the goddamn card copying and fuzzing functionality and stealing shit.
Infrared ESL Research Toolkit for Flipper Zero
Protocol study • Signal analysis • Controlled display experiments on authorized hardware
Owner-authorized lab display experiment
[!IMPORTANT] TagTinker is a research tool.
It is intended only for protocol study, signal analysis, and controlled experiments on hardware you personally own or are explicitly authorized to test.
This repository does not authorize access to, modification of, or interference with any third-party deployment, commercial installation, or retail environment.
[!WARNING] Strictly prohibited uses include:
- Testing against deployed third-party systems
- Use in retail or commercial environments
- Altering prices, product data, or operational displays
- Interfering with business operations
- Bypassing pairing, authorization, or security controls
- Any unauthorized, unlawful, or harmful activity
TagTinker is a Flipper Zero app for educational research into infrared electronic shelf-label protocols and related display behavior on authorized test hardware.
It is focused on:
This README intentionally avoids deployment-oriented instructions and excludes guidance for interacting with live commercial systems.
tools/tagtinker.html)Where is the .fap release?
The Flipper app is source-first. Build the .fap yourself from this repository with ufbt so it matches your firmware and local toolchain.
What if it crashes or behaves oddly?
The maintainer primarily uses TagTinker on Momentum firmware with asset packs disabled and has not had issues in that setup. If you are using a different firmware branch, custom asset packs, or a heavily modified device setup, start by testing from a clean baseline.
What happens if I pull the battery out of the tag?
Many infrared ESL tags store their firmware, address, and display data in volatile RAM (not flash memory) to save cost and energy.
If you remove the battery or let it fully discharge, the tag will lose all programming and become unresponsive ("dead"). It usually cannot be recovered without the original base station.
I found a bug or want to contribute — how can I get in touch?
You can contact me on:
I'm currently traveling, so response times may be slower than usual. Feel free to open issues or Pull Requests anyway — contributions (bug fixes, improvements, documentation, etc.) are very welcome and will help keep the project alive while I'm away.
TagTinker is built around the study of infrared electronic shelf-label communication used by fixed-transmitter labeling systems.
At a high level:
This project is intended to help researchers understand:
For the underlying reverse-engineering background and deeper protocol research, see:
TagTinker is limited to home-lab and authorized research use, including:
It is not a retail tool, operational tool, or field-use utility.
You are solely responsible for ensuring that any use of this software is lawful, authorized, and appropriate for your environment.
The maintainer does not authorize, approve, or participate in any unauthorized use of this project, and disclaims responsibility for misuse, damage, disruption, legal violations, or any consequences arising from such use.
If you do not own the hardware, or do not have explicit written permission to test it, do not use this project on it.
Any unauthorized use is outside the intended scope of this repository and is undertaken entirely at the user’s own risk.
This is an independent research project.
It is not affiliated with, endorsed by, authorized by, or sponsored by any electronic shelf-label vendor, retailer, infrastructure provider, or system operator.
Any references to external research, public documentation, or reverse-engineering work are included strictly for educational and research context.
This project is a port and adaptation of the excellent public reverse-engineering work by furrtek / PrecIR and related community research.
Licensed under the GNU General Public License v3.0 (GPL-3.0).
See the LICENSE file for details.
This software is provided “AS IS”, without warranty of any kind, express or implied.
In no event shall the authors or copyright holders be liable for any claim, damages, or other liability arising from the use of this software.
This repository is maintained as a narrowly scoped educational research project.
The maintainer does not authorize, encourage, condone, or accept responsibility for use against third-party devices, deployed commercial systems, retail infrastructure, or any environment where the user lacks explicit permission.
Research responsibly.