S2000 Bench setup for research

[mikec200]

Hello all.  New to NLG, and I'm going to be doing something with an S2000 that probably is not done much.  I have a need to setup an operable S2000 with the minimal hardware on basically a board so I can have full access to all the electronics during operation.  I'm a computer security professional who will be investigating both the software and hardware design of the S2000 in the hopes of uncovering some unique vulnerability vectors, particularly in the random number generation and gaming algorithms in the device. My goal is to find something of interest to turn into a paper to sumbit for one of several computer security conferences.  I realize this probably a very difficult task, but one I'm well suited for with my computer engineering background, and with so little research on the topic I'm willing to bet for as good as IGT has been at making the machines secure, there are still vulnerabilities, bugs, etc, that could potentially be uncovered. I was originally looking at the S+ platform because of the readily available information I could find on both the operation and theory and the slower processor which would make it easier to watch with my current logic analyzer and other tools.  However I've decided the S2000 would be a much more relevant platform to modern day machines.  If any one has any insight or advice into a open bench top setup I would greatly appreciate it.  Also I'm looking for as much documentation on the S2000 as I can find as well as any other info which might be helpful.  I'd greatly appreciate any info members here wish to share which may be of value in the effort.   I've begun to acquire many of the obvious components I'll need, cpu board, displays, power supply, harness, reels, etc, but don't necessary have all of the documentation to get me up to slot tech speed, or have any idea yet what might be possible to omit, or potentially replace with other hardware, i.e. the door optics replaced with just a toggle switch, etc.  If any one is an experienced slot tech and is willing to chat, I'd love to speak with you.

I'm looking forward to being a member here and getting to learn a lot and hopefully give back some as well.  Also hoping that this project might be a fun endeavor not just for me but some of the the  die hard slot techies around here.

Thanks.

Mike

[TZtech]

Hi There and welcome to NLG

Interesting project - Please keep us posted
There a a lot of sub assemblies on the S2000 - I think You best bet would be to get a standard S2000 machine - to get it a bit more compact remove the entire top box (You can disconnect the amp and speakers as this wont affect your testing - Dont know if You still need ticket printer) Move the reels to the top of the machine (You may need to extend reel wiring harness and then tilt the entire processor assembly and cut out the top of the reel shelf to gain access)

Alternatively if You are lucky you may be able to source a 960 test rig that allows you acces to the processor etc (There is a current thread with such a tester for the S+/Pe+ platforms - http://newlifegames.net/nlg/index.php?topic=19601.msg160982;topicseen#new

Bear in mind that the S2000 (i960 platform) although widely found is pretty much obsolete - IGT now concentrates mostly on the AVP platform.

Ian

[cowboygames]

Why would a guy even need the machine case? Other than bypassing the door optics, which is easy and much discussed on here, all other sensors are switches that can be jumpered out and everything else in the machine could be set up on a bench and plugged in for game play and monitoring. Even the MPU can easily be plugged in with all trays and housings removed. I've thought about doing this many times, but eventually decided it wasn't worth sacrificing a game for something I wanted more for personal interest vs personal need.

[mikec200]

TZtech and cowboygames

I'll be sure to provide updates as they come.  I decided on the S2000 because it still was widely depolyed versus the S plus so as long as its in widespread use its relavant to vulnerability research. Kind of like windows xp, its basically obsolete, but still in widespread use which makes it an attractive place to explore.  I  figured that I'm going to end up with both a complete functional machine which I'm sourcing here in the next week, and the bench top device as the complete machine will make for good reference.   Compact isn't as much of a concern as the access to the bits and pieces while in operation, and I've seen the S+ tester your taking about.  That probably would be ideal if there was an S2000 equivalent but still kind of hampers access to the CPU board from what I have seen.  Cowboygames, if I could follow up with you once I have some more of the bits and pieces in hand starting next week, would you be interested in providing me some general assistance, i.e. answering some questions, maybe a phone call or two,  seeing as you have at least thought this out a bit?  Obviously I don't care one bit about the case in the bench top setup so its good to hear my thinking isn't way off on making this a reality.

Thanks.

Mike

[cowboygames]

I'd be glad to help. Honestly though, until about the 20th of the month I'm gonna pretty tied up with vacation and thefirst few days of work so phone help will be out till then. Any questions here on the site, no problem and maybe some better as I am sure there are others who will be interested in following the progress and sharing opinions/information on this topic. It also provides a reference source later on for others who might want to attempt a similarproject. I would first recommend reading the topics that cover optics bypass and jumping out the belly door/cash box door switches. Beyond those, the whole game can be set up to run pieced out on a bench

[mikec200]

Coyboygames,

No worries, I wont have parts for the bench top for atleast another week and the following week work will have me tied up so I'm practically on your same timeline. I maybe will have a complete machine this weekend (which I'm going to leave intack other than some simple mods to make use easier), so I should also be able to gather a ton of info from that as well. I'll try and keep the questions here for now anyway as you said so folks can follow the progress and chime in if they have questions, ideas and suggestions.  I already came across the thead on the door optics bypass but I'll look for the other switch jumper ones as well. Trying to gather and learn as much as I can the next week or so to hit ground running when the bits and pieces start to come in.

Thanks.

Mike

[cowboygames]

sounds good, oughta be fun

[Foster]

Even if there are software vulnerabilities, it is highly improbable that a none employee of a casino could exploit it.
And every game is under the careful eye of Casino Security, so any obvious physical attack is going to draw their attention to it.
Even strong static discharges to the machine have been done by IGT machine did not malfunction and was still playable.
Also someone is going to know every error the machine has within 1 sec of the event because SAS host polls every 40-200ms
I am not saying that the S2000 does not have any weaknesses but with cameras on them that will stop 99.99999% of any chance of some one exploiting it.
IF someone came up with an exploit and could get it into a machine without some one knowing right away, a gaming agent is going to find it the next time that machine is audited
They pull the chips and run 2 or 3 checks compare it to a legit binary of the chip, CRC, and another type test something like  a MD5 but it is called something else, if any one of those tests fail they will investigate it.
speaking of the CRC there is one most eprom programming software does but IGT has its own that they use.
The Game chips that store the main OS are 8 bit wide but the OS is 16 bit wide which makes it harder to look at the OS, without interleaving the 2 chips.

[mikec200]

Foster,

I'm not really looking at the physical vulnerability aspects because casinos are such a heavily surveiled area, and are nowhere sophisticated enoughtfor the audience I would want to present to.  What I'm looking at would in practice require no more access than any player would have.  What I want to explore is weaknesses in the game algorithm and random number generation which are often areas that are vulnerable in computer systems.  My end goal would be to be able to predict the random number generation sequence and use something like a smart phone with a custom application to help improve odds.  This is a very general explaination of where I'm looking to go, but not far from work that has been done in encryption systems used in computers where what is seemingly impossible to crack codes are breakable with some clever thinking and knowing how the system works.

Mike

[Foster]

Even if you could figure out how the RNG works and if it is predictable it most likely would not do any one any good.

The S2000 RNG is probably generating numbers the whole time the machine is on, after it finishes its boot and I suspect the seed number also changes over time.
A new number is generated every millisecond or faster, since the main CPU clock is 16MHz.
The only time that I suspect that it the RNG routine is on hold would be during a hard error, while it is playing the current game, etc.

The S2000 grabs the latest number on the random number stack to determine the outcome once a bet is placed.
 
I can guarantee that the programmers have made it harder to predict the next number due to what Ron Harris did in Atlantic City involving a Keno game.
He had legal access to the source code to the software for that system because he was a NGC agent that analyzed computer code in any gaming machine or the like.

The only information an average player could input into an app is the physical stop for each reel if they can determine it by looking at the reel symbols.
Which does not translate into virtual stops

There are 64+ virtual stops per reel depending on the theme. the average is 72,
Here is what I found for virtual stops for the following Five times pay 90, Ten Times pay 120, Twelve Times Pay 128, Triple Dollar with Mystery Reel Action I counted 256 virtual stops.
The higher the value of the symbol the lower the number of stops assigned to it. usually the top award is assigned one virtual stop, there are exceptions to this.
Since blanks are symbols and on a single line game they are 50% of the symbols they usually make up 45% or more of the virtual stops.
The S2000 translates the virtual stops into physical stops, the virtual stops can only be seen when doing a game history which is limited to the last 10 games played and the average player in a casino had not be trying to use a key to access that information.

[mikec200]

Foster - I hear what your saying and yes I believe IGT has done its damnest to protect that RNG from prediction.  However in my industry cryptographic algorithms of many more orders of complexity have been broken when thought unbreakable, random number generation thought to be good enough has been proven to be woefully inadequate, etc.  When you have closed systems like this that get little scrutiny, often times there is a false sense of security and a few but notable occurences of interesting event, often with inside access, such as Ron Harris.  When more eyes begin to be placed on it and interest is drawn to the topic, often times a lot of fasicinating things begin to be found.  I've learned time and time again in my industry, if one human created it, another or group of others can find a way to break it. Also 16Mhz is nothing compared to computational resources its very easy to bring to bear in the IT industry.  We have graphics cards with 3000+ cpu cores running at 100s Mhz to 1Ghz speeds and you can write custom software with mathmatical computation algorithms to run on them, not just process graphics data. That is potentially 3 teraflops of computation, which levels the playing field significantly if I reduce the the possibilites to check.   Combine that with precomputation of outputs to do look ups and its possible to treat this like and encryption problem and brute force your way into learning the RNG sequence.  Also aside from when a player presses a button, I'm not seeing a whole lot of good sources of entropy to provide good seeds to the RNG, so even with out cracking open a machine, just based on the research I've been able to do thus far, there are already possibilites to consider and ways to radically up the computational ante to overcome something that might not be easily known. The virtual reel doesn't pose that much of an issue especially when you can get the layout from a PAR sheet, so it only creates more possible outcomes to check which you just throw computational power at. I'm not doing this to ultimately create some sort of system for me to exploit at a casino, as if I'm successful and present the research, I doubt I'd be let near a machine in any casino from that point on.  The whole point of this project for me to look at a system that isn't widely reviewed and possiblity leverage tools that would not normally be used against this system to see what is possible, not pull a Ron Harris. 


But please keep up the questions because its helping me to really think this out in detail and get thoughts and opinions from folks who know these systems.

Mike

[CommTech]

Hi Mikec200,
Welcome to NLG!
While I  agree that the RNG inside these machines are not truly random, nor may not have a high entropy seeding, the problem is that the player has no accurate feedback of were the RNG sequence is at any given moment.
As Foster said, the RNG's are constantly running at a very high speed.  Forget the fact that the player has no real feedback as to what pattern of numbers generated coincides with what reel and what reel stop ... Even if it was possible to predict some kind of pattern from the RNG, there would be no possible way for the player to react fast enough to press the "spin" button at exactly the correct moment to stop the RNG on a winning number sequence.
Even what Ron Harris did with the RNG's at Atlantic City, with his inside access to the source code of the Keno program, it was a KENO program that gave Ron actual numbers to work with ... and even with those numbers, combined with a computer program he only had a very small chance (I think it was like 3 percent) that he could predict the next round of 8 numbers, by the previous set  that was revealed.
Unlike KENO, slots have no revealing numbers to base any computations on.
You say that these machines have not been closely scrutinized; this could not be further from the truth.  Slot machine manufactures such as IGT go to extreme lengths to insure their machines are hack proof. 
Unlike many computer networks, were you can monitor the communications between nodes, and possibly use Man in the Middle attracts on a weak system, the end user on a slot machine has no access to the data streams within the machine.

Just my 2 cents.

Joe 

[Foster]

All I know is any system is vulnerable.
The thing is the information still useful since it changes thousands of times a second anyways.
yeah you might be able to guess every number the machine is going to generate but you cant predict which one it uses because it is grabbed at the bet (within a few milliseconds anyways) and that point in time that the bet is placed is determined by a human, except on my machine when I turn on my autoplay device, when max bet light comes on then the max bet is placed on mine.
and I can tell you that the cycle times vary a few milliseconds each game another variable to throw off predictability.

Let me give you an example back in 2009 or was it 2010
I had Haywire Deluxe in my S2000 (using a SB100177) I hit the top award 2 times (progressive) but each 23-26 hours apart both at 3-5am

I had the theme in the machine within the last 18 months put it on auto play do you think it would hit it again nope not even one time.
Yes I have hit other top awards
Tabasco, Double Diamond, Triple Dollar MRA - the Triple Dollar might as well been a Wide Area Progressive with 256 virtual stops per reel.

Each play is an independent outcome.

[mikec200]

Commtech - I fully appreciate how much IGT has scrutinized the system, but it's done with tunnel vision as insiders.  Microsoft for instance has a huge internal security team for their software, I know I use to work in it, and they still are handed vulnerabilities by researchers everyday with no access to code and far less resources.  Part of what attracts me is I'm willing to bet there are some trade offs that were made because of the amount of physical security intrinsic to the environment the machines operate in. I'm optimistic because outside of the slot industry there is little interest in the devices, but computer security research would have many techniques which we use daily that would apply here.  I'm not suggesting I'll even be successful in my endevor, but there are some bright points that show promise, and in my circles it more about what you can learn from the challange anyway, and if I and a colleague who has agreed to help can find something presentable, it's all the more fulfilling.

Most folks probably feel this is a waste of time, but I'll guaranteed they don't understand just how breakable what as been considered traditionally unbreakable can be.  I've watched it time and time again in nearly 2 decades in IT and it all starts with someone that has the gall to challenge what most believe is incapable of being challenged.

As I've said before please keep  the thoughts, questions, insights, etc. coming, I'm learning more and more with each reply I'm receiving.

[mikec200]

Just and update on where I am on this.  Parts are starting to trickle in,  I currently have, the power supply, power distribution, door I/O and cabinet I/O cards in.  On the way are a complete wiring harness, motherboard, CPU board (minus proms though), multimedia lite board with simm, VFD display assembly, speakers and sound amp, Win/Paid Credit display, reels, coin in/out meters, button set (multi-denom), WBA-12-SS bill validator, and PSA-66-001N ticket printer. I was supposed to also pickup a complete 5 times pay S2000 machine with player tracking hardware today, but the seller couldn't have it ready in time, so I probably won't have that until some time next week.  I know there are some swiches I'll need as well, i.e. reset and possibly a w2g switch, but also a substitute for the cherry switch which I can also do the door optics on.  If I'm missing anything beside the proms or the switches I've mentioned or you have any suggestions for stuff I should also acquire please let me know.

I've also managed to compile a ton of documentation from wiring diagrams to various manuals, but I have yet to come accross a maintenance manual, If anyone can point me in the right direction on that, I'd appreciate it.

[reho33]

stayoutadabunker had an S+ test rig (which I think he still uses) for the bench. It is an S+ mounted on wood with no cabinet. Maybe he will chime in here and make a comment or two?

[mikec200]

Thanks for that info.  Looking forward to him chiming in.

[Foster]

IF you look on eBay use IGT S2000 as the search and sort by price lowest to highest with shipping you will come across many parts you might need.
 
In a machine in a casino the cherry switch turns on a light that is mounted behind the BV and maybe to an alarm or door monitor system in a casino setting.
You can use the switch as easy way to bypass the optics. I did in my machine.

Trying to add a W2G jackpot to credits switch would be easy if you have the wires for it. other wise you are going to have to add wire into the cabinet I/O harness for one side of the switch and ground of course for the other.
In a regular main harness you will only have 4 spade connectors
2 used for the handle switch and 2 used for the Jackpot Reset switch. in fact you will have some connectors you wont be using in a test setup because you wont be installing the Fluorescent lights normally)

[mikec200]

Thanks Foster.  Most of the parts I've received or I'm waiting on actually are from eBay.  I almost always look there first for anything.  I'm figuring I'm going to have a lot of left over spaghetti in the main harness I'll never use in the complete internal harness I have coming.  But I won't hack it up as I'll end up probably turning this into a functioning machine when I'm done.  Actually because of the rarity I would love to try and acquire WOF pieces over the next year for that purpose and it would probably take at least that long to find the key elements specific to that game.

I'm figuring I can sub any old switch in my config for the cherry at least on the door optic bypass use.  It's my understanding that cherry switch is normally open for the light contacts and normally closed for the contacts used in the door bypass, so I'm thinking a plain double pole switch will do the job, and a couple momentary switches for the reset and w2g.  Anything else you suggest I must jumper out or possibly need a switch for to get the test rig to work on the bench?   Also I don't have a stock power switch so if you have a suggestion there I would be very interested.

[Foster]

if you have received a complete machine harness you should have received the power switch
It is a Double Pole Single Throw switch

[CommTech]

Commtech - I fully appreciate how much IGT has scrutinized the system, but it's done with tunnel vision as insiders.  Microsoft for instance has a huge internal security team for their software, I know I use to work in it, and they still are handed vulnerabilities by researchers everyday with no access to code and far less resources.  Part of what attracts me is I'm willing to bet there are some trade offs that were made because of the amount of physical security intrinsic to the environment the machines operate in. I'm optimistic because outside of the slot industry there is little interest in the devices, but computer security research would have many techniques which we use daily that would apply here.  I'm not suggesting I'll even be successful in my endevor, but there are some bright points that show promise, and in my circles it more about what you can learn from the challange anyway, and if I and a colleague who has agreed to help can find something presentable, it's all the more fulfilling.

Most folks probably feel this is a waste of time, but I'll guaranteed they don't understand just how breakable what as been considered traditionally unbreakable can be.  I've watched it time and time again in nearly 2 decades in IT and it all starts with someone that has the gall to challenge what most believe is incapable of being challenged.

As I've said before please keep  the thoughts, questions, insights, etc. coming, I'm learning more and more with each reply I'm receiving.

I completely understand what you are saying about computer security.  I have learned so much over the past few years on this subject by listening to Steve Gibson of GRC's "Security Now" Podcast series.
It will be interesting to see what you find.

[IFFV68]

Very interesting thoughts & Ideas.
I hope no one ends up in the slammer for Hacking.
I would think I.G.T. may want to visit someone?
All of this wanting to know & advertising it is a Red Flag to ??
Just my $.02.

[mikec200]

Foster - harness is a complete harness but anything that was plugged into it was removed to be sold as a separate component.  Figured I could refer to wiring diagrams and some questions here to find a suitable substitute.  With your info and the wiring diagram I think I now have it squared away.

Thanks.

[mikec200]

Very interesting thoughts & Ideas.
I hope no one ends up in the slammer for Hacking.
I would think I.G.T. may want to visit someone?
All of this wanting to know & advertising it is a Red Flag to ??
Just my $.02.

IFFV68,

Thanks for the interest.  My intent here is not for illegal purposes, its about research and opening a dialogue on the topic of vulnerability research in gamine machines, and I would hope that if anything does come of this IGT will be interested in discussing those findings, much like how vulnerability disclosure is handled in the IT arena.  If I was looking to do this to find a way to beat the casinos, I definitely would not be publically taking about it here or anywhere else.  The term "hacking" has a bad connotation to it because so often times it is used to refer to the nefarious side of being curious about the operation of a device.  In this case you could call this investigation "hacking" in its purest form (but I won't use that term) because it seeks to understand the operation of the machine, but then the same can be said about a lot of the mods, and other topics discussed here.  I frown on the use of term because it gives a very negative connotation to very positive and meaningful research and desire for knowledge.  The intent of the term originally was meant to refer to being curious about the operation of a device and examining how it functions in exactly this manner, but has grown to be better associated with the illegal side of computer intrusion primarily, hence why this work is being performed as computer system vulneraility research and will be handled along with any finding as such. In addition should anything come out of this research, part of the disclosure process will be to work with IGT in a responsible manner to provide an opportunity for them to address any such findings.  Besides if IGT has done their due diligence in the design of the machines and software then they should feel very good about the security of there machines and have little to come ask questions about and should welcome such scrutiny.  Bringing such attention would be a sure tip off there is somethign they don't want explored, which would cause alot more folks to be interested, and go much further underground about the work.

Hopefully this should quell any issues with the work that is to be done once the bench top research machine is actually operational.

[stayouttadabunker]

...In addition should anything come out of this research, part of the disclosure process will be to work with IGT in a responsible manner to provide an opportunity for them to address any such findings....  

This means NLG members will not see the results of your research.

Why?
Because IGT won't allow any of your findings to be published without their consent.

Furthermore, there's no way in hell that IGT will let a bunch of home slot owners be part of the "disclosure process".

Good luck with your project.

Please correct me if I am misunderstanding anything?