Liberating Advants Terminals

by Loki

You may have seen these floating around in your hometown.  They are relatively new Internet kiosks called Advants Terminals (www.advants.com).

With a price like $1 for five minutes, it's almost a crime to even use these things.  So the following is my ordeal with liberating one of these terminals that resides in a coffee shop in my hometown.

One day I walked into my local hangout to get a coffee and when I went to sit down with my beverage I noticed a computer looking thing on a low table in the corner.  Almost immediately I went into hack mod.

Many a question ran through my head such as: what OS is it running?, what kind of connection does it have?, what are the systems specs?, can I run Quake?, and most importantly, how can I use it for free?  Well here's the low-down people.

All of the Advants Terminals I've come across have been Wintel boxes: 8 GB HD, 500 MHz Celeron, 48 MB of RAM, and an ATI Rage 128 video card.

To keep the kiosk "secure" instead of running the normal Windows Explorer shell, it runs a program called NetShift (www.netshift.com).  As long as it is running this, pretty much all useful operations are impossible.

So to get started the first thing I did was pull the plug.  When I tried this I found that the plug was somehow attached to the wall.  They did this by having a screw go into the ground plug at a diagonal and putting pressure on the inside of the ground plug hole.  To get past this all you have to do is reach under and unscrew until the plug comes out of the wall.

Now, since the beginning of my experiments with this kiosk they have upped the security a bit by encasing most of the computer in a larger cabinet (sort of like a stand-up arcade game) and putting in a relatively useless Uninterruptible Power Supply (UPS).  If the machine doesn't turn off when you pull the plug you should hear a beeping in the lower part of the cabinet.  If you are using one of the smaller "desktop" terminals it should just go off immediately.

When you plug the box back in it will power up.  Now this is where it may be different from box to box.  The screen may or may not be scrambled while this happens.

The box I play with started out not being scrambled, then was, and now isn't.  So you may have to do the rest of this without being able to clearly see the screen (don't worry, it isn't that hard).

You will get your normal boot thingy (yes, that's a technical term).  BIOS is always passworded in my experience but if you want to screw with it, that's your prerogative.  To get to it just hit Del as usual.  I won't go into that because I haven't messed with it (yet).

Just after it is finished with he RAM and HD check is your chance to get into DOS, hit Ctrl+Esc (not F8), and you should get the Windows "safe mode" boot prompt letting you choose Normal, Safe mode, Command prompt only, and a few other little options.

Now this takes a little timing and finesse but it can be done, so don't be discouraged it you see a Windows 95 loading splash screen - just hit Ctrl+Alt+Del and go at it again.  Once you get to this stage you're just about half done.  For you people with a scrambled screen, you should see a somewhat recognizable white bar across your scrambled screen that means you've got it.

Now hit 6 and Enter.  This will get you the DOS prompt.  For you people with scrambled screens, type cls and Enter to see if it clears the screen.  If so, you've got it.

From here it defaults to C:\ so you're going to have to go to the Windows directory (cd Windows).  Now here is the tricky part for you people who are doing this blind.  Type edit SYSTEM.INI and you should get a blue screen that is the familiar MS-DOS edit program.  Now we are going to change the shell from NetShift to Explorer.

Now hit the down-arrow two times and enter: //

This will comment out the shell=netshift\naska.exe line.

Then hold down the Fn key and that will turn the right-arrow key into the end key, so basically Shift+end will move your cursor to the end of the line.

Now hit Enter and type: shell=explorer.exe

Don't mess up, because this could cost you the box if you botch it.  It should look something like this:

[boot] oemfonts.fon=vgaoem.fon //shell=netshift\naska.exe shell=explorer.exe system.drv=system.drv drivers=mmsystem.dll power.drv

Alt+F followed by X and Enter will save and exit you back to the DOS prompt.

Now type win and hit Enter and you're on your way to a free net box.

The power supply is ATX and if it boots into Windows and you typed the shell wrong it'll try to shut down.  Shutting down means you either have to get inside the locked case to turn it back on or you have to call Advants and wait for them to come back out and fix it (I've had to do this three times!).  If it says something about it being a bad shell or something, pull the plug and go again.

Now if that sounds like a real bummer to do blind, you're in luck.

There is another way, but I felt like explaining the way I did it my first time.  The way I just explained is the most fun and the most hackish.  It's also the quickest and has the least potential for destruction of the box, especially if the screen isn't scrambled.

The box, when it is running NetShift runs War FTP and most of the boxes allow anonymous access.  There are two ways you can take advantage of this.  They both involve getting the box's IP.

To do this click the free CNET button, and use CNET's web search.  Search for "your IP".  This will locate a site that will show you your IP when you visit it.

Now that you have that, you can do one of two things.  One, you can go home, FTP to the box, download the SYSTEM.INI, edit it and re-upload it, then go back to the box and reboot.  Or you can get something called VNC (www.uk.research.att.com/vnc).  With this prog you can log into your own box from the net and see your desktop in real time.

So once you have VNC on your box at home, all you have to do is put a dollar into the Advant's box, type your home IP into the "goto" form and you'll get your home desktop.

From there you can use that even after your time runs out to do whatever you want on your home box because the page address never changes so it won't kick you off.  This is helpful because you can now upload things from your home box to the Advant's box, such as a new SYSTEM.INI.

If everything worked out right you should be in Windows and you can have all the fun you want exploring around.  Just remember - when you're done put it back to NetShift so some "K-Rad Elyte H4x0r" doesn't come along and destroy the box or shut it down.  You can then have fun later the next time you want to use the box.  Don't forget to share your free net access while you're supervising.  People will appreciate it more than you know and you're bound to make a few friends that way.

I personally have put GLQuake on the box that I use and it runs pretty well.  The connection is most likely a crappy DSL shared on a LAN modem somewhere so it's not really suited for much.  I've seen it get 15k a sec but it usually gets 5-7.  The IP range from what I've seen is 38.28.129.* and 38.28.130.* if you'd like to scan for the boxes.  I've yet to have any luck that way though.

It says on Advant's web site that they will soon be switching to the Linux OS to bring down the cost of the box and thus lower Internet prices.  When they do that, I'll get on top of it and write a follow-up article on liberating the new OS.

I'd also like to give props to my man Agile for being there for moral support, free drinks, and more than one time preventing me from doing stupid crap (and hitting me when I did do something stupid).