S2000 Bench setup for research

[mikec200]

Stayouttadabunker,

I think you're going to find IGT has more limitiations to prevent the disclosure of research than you think.  Much of what would be done in the analysis would fall under fair use of a product by the end user as well. About the only case where IGT would have a foot hold to stop publication would be if they employed a "protection measure" which needs to be circumvented in order to gain access to code which could be covered under DMCA.  Unless they protect the data on the the proms say by encrypting the code, there isn't likely a protection measure to be circumvented here. From what I have read here, the proms are easily readable, so this does not appear to be the case. Also just because a company is given an opportunity to address any issues found during a remediation period prior to publishing ("responsible disclosure") doesn't mean the issue and the research around it will never get disclosed or the generalities around it can be discussed without providing specifics.  We battle this over in the IT side all of the time, and there isn't an awful lot the manufacturer can do about preventing the information from being released as long as nothing illegal was done in obtaining it, where they may have a opportunity in court to seek an injunction.   

One could argue some of the discussions here on NLG could be things IGT would have a problem with, but I haven't seen anything in the threads where IGT or any of the other makers of devices discussed here have had an issue with this site and its content.

[crgadyk]

If you're all about open disclosure and information gathering... maybe you should fill out your profile so that people can learn about you. Just in case you do find something ground breaking and after talking to IGT, you all of a sudden come up "missing". We'll at least have something to tell the authorities 
 

[mikec200]

Crgadyk,

Wow, I should take that personally but I won't, as I suspected I was going to stir the pot a bit with this discussion.

Basically the only difference between my profile and yours is  gender, age and location and you have a few pictures of machines you own, which I can't provide as I have none yet.  Not sure how age and location really matter that much here, and gender should be obvious from my user name, but if you really need more info on me here goes.  I'm male, 30 something, IT industry consultant in Metro Atlanta. I have have a background from an education standpoint in computer engineering, and my professional background is in IT covering application development, computer security(network and application), back office infrastructure and systems, and network routing and switching, which I practice thru my own company.  My research is purely form an personal interest stand point along with that of some IT industry collegues that specialize in areas that would be of help in this effort. Anything else you want to know I'm happy to share within the confines of what doesn't get into excessive information sharing that violates my privacy.  I also don't want or intend for this effort to be an advertisement for my company at this site which is why I haven't shared any details on it.  If you need to get a hold of me my email address is posted in my profile, and if its not visible please let me know, as I'm figuring the "hide email address from public" option does not prevent registered members from seeing it, if not, I'll gladly change it.  Unless anyone here feels I need all this in my profile let me know, otherwise I'll stick with the basics others have opted for.



Also I would think just the public discussion about what I'm looking into and what I'm sharing should indicate my willingness to be open, as some folks have already suggested I probably shouldn't discuss this project.  And I have plenty of folks who know me and are aware of my research in the event I go missing as you suggest, so that is not a concern I have.

[crgadyk]

It was actually a joke since there is always stories of people who try to go up against IGT and lose miserably. But either way, thanks for the information 

[reho33]

Personally I don't believe that anything would happen. IGT would have to go after the MAME crowd, etc. So I support the OP in his efforts. If he did find a code flaw and didn't report his findings to IGT, I believe that would be irresponsible as you would have a "moral obligation" to at least let them know. If IGT didn't take action after that, well, shame on them. See what happened with the I phone, after a group "jailbroke" it to work with any carrier, ATT had to allow others to use it.

[mikec200]

It was actually a joke since there is always stories of people who try to go up against IGT and lose miserably. But either way, thanks for the information  

If it was meant jokingly, then I can appreciate a good joke.  If you have any background on such stories I'd love to hear it.  Can't hurt knowing where folks have treaded before and what the outcome is, but I'd be willing to be in those cases it wasn't pure research at the heart of the matter, likely more of a personal gain issue, and not done under fair use.

[mikec200]

Personally I don't believe that anything would happen. IGT would have to go after the MAME crowd, etc. So I support the OP in his efforts. If he did find a code flaw and didn't report his findings to IGT, I believe that would be irresponsible as you would have a "moral obligation" to at least let them know. If IGT didn't take action after that, well, shame on them. See what happened with the I phone, after a group "jailbroke" it to work with any carrier, ATT had to allow others to use it.

Reho33 - great post, couldn't agree more.  The whole point in vulnerability research is to improve security not undermine it, which is why there is an implicit obligation to inform the affected party.  Their response is their choice but most end up coming around to correcting the issue, not fighting to keep it quiet when everyone works together.

[reho33]

And you know what the great thing is? We, regular people here on this forum, figured out a whole lot of "non sanctioned" add ons and solutions for the S+, S2000, and I game platforms. We figured it out for FREE for ourselves, for furthering the hobby and for the love of it. IGT with all their paid guns and engineering talent couldn't figure out how to make stand alone TITO? Just goes to show you that sometimes free development IS better! Maybe they should pay US for all the cool things that we have developed. (Think deep fried Twinkies). Some on here disagree saying that you only have the right to use the product as it is and not to play with it. If I choose to deep fry my Twinkies does Hostess have the right to sue me saying that Twinkies were never meant to be "deep fried" and that by doing so I have violated there fair use agreement? I think not. So please tell me where I am wrong in supporting the OP in his quest for find "vulnerabilities" in IGT's source code for their games?

[mikec200]

And you know what the great thing is? We, regular people here on this forum, figured out a whole lot of "non sanctioned" add ons and solutions for the S+, S2000, and I game platforms. We figured it out for FREE for ourselves, for furthering the hobby and for the love of it. IGT with all their paid guns and engineering talent couldn't figure out how to make stand alone TITO? Just goes to show you that sometimes free development IS better! Maybe they should pay US for all the cool things that we have developed. (Think deep fried Twinkies). Some on here disagree saying that you only have the right to use the product as it is and not to play with it. If I choose to deep fry my Twinkies does Hostess have the right to sue me saying that Twinkies were never meant to be "deep fried" and that by doing so I have violated there fair use agreement? I think not. So please tell me where I am wrong in supporting the OP in his quest for find "vulnerabilities" in IGT's source code for their games?

Again couldn't agree more.  Love the Twinkies fair use comparison by the way!

[mikec200]

Update:

Most parts are in and I've been working thru figuring out the jumble of wires I received for a harness, and making great head way with the field supplement schematics and diagrams. It would be much easier with a complete machine for reference, but then I miss out on all the schematic reading fun (I need to get well acquainted with it any way).  Reel harness was missing by accident, but is on its way, along with eproms for the S2000 mpu board (I still need to get key and clear eproms as well).   Pictures to follow after I pickup some switches and begin to lay this thing out a bit in organized manner.

Question on the the door harness and VFD.  The door harness I got has the small black molex connector on it for the 7 segment display, so I'm assuming the harness came out of a slant top or one of the uprights where the VFD and 7 segment are all lined up.   My VFD connects with the small little flat 5 pin connector and the 2 pin power connector back to the I/O motherboard with harness I have, and I have 2 options on 7 segment displays, one (PN# 25321300 rev A)which has the old large white molex connection (homemade adapter or wiring hack up needed to use) and I have one (PN# 75128401  rev A) with the black connector that also has the small white connector which appears to go to the VFD from what I have seen in some of the photos here.  Here is the question.  Can I use the VFD connected direct to the I/O motherboard (jumper 2 a netplex jumper as I recall going to VFD driver PN#75117700 rev D), and the 7 segment with the black Molex connector and skip connecting the VFD via the 7 segment display board?  Or do I just need to suck it up and rewire that connection and put a large white molex on it and use the other older display that lacks a VFD connection. I am aware the pin outs are different thanks to some great threads on the molex adapters from the white to black connections, so at least I have the pin outs between the 2 connectors straight if i need to adapt/makeshift connect it.   I know the machine the harness came out out of used the I/O board for the VFD connection based on it being part of the harness assembly and that harness relating to the schematics, just not sure how things are going to react with a 7 segment that has the VFD pass thru and no VFD attached. Any insight is appreciated.

Its a bit of a frankenslot from a parts perspective, then again the whole bench set up is anyway, but the prices were hard to pass up on some of the items so if I need to ditch a few and add a piece or two to get what I have functional its not a huge issue. It is what it is.

Also if any one has PAR sheets they can share on SB100059 and SB100064 I would much appreciate it.  I'm going to use these in conjunction with SG000362 and VS011GX1 and VFD0007.  If there is anything I need to know about those combinations I'm all ears.

[Foster]

The VFD and 7 Segment display are never connected to each other
the very small white connector you see on the 7 segment display is for the multi-denom LED box and touch pad.

The white connectors on the motherboard are Molex Mini-Fit Jr (most of the white connectors that look like them in the S2000 are also Mini-Fit Jr
the ones with a arrow shape on them are also molex but are called something else (door optics, bell)
the black connector on your 7 segment and harness is a Molex Micro-Fit 3.0
the ones that go to the BV are Molex SL 0.100 connectors (look similar to the audio connection on back of internal CD/DVD drives (yes they latch into the matching connector)

Cabinet and Door I/O are connected to the motherboard by SENET you need make sure you plug them into the right SENET port on the motherboard (yes they are labeled)
The Door SENET plugs into the top of the door I/O a 12 or 14 pin connector
door I/O passes also passes the SENET bus to the display
You will have a spare senet port on the motherboard.
Cabinet I/O is responsible for the physical meters, bell, handle, hopper, candle
if you do not have the meters you will need to do the bypass in the meter connector - a 10 pin SL connector cut the black wire and the wire next to the black one strip both and twist then together or connect the meters. if you do not you will get meter disconnected error.

Netplex handles all the following
VFD
Printer
Bill acceptor
Spectrum II
V
when you plug in the netplex the only one that has to be in particular netplex port on the motherboard is the 12 pin connector - it has the extra wires that go to the BV door switch you must either install a switch that you can turn off and on or jumper the 2 wires (they will be green wires with small female connectors on them.

[mikec200]

Foster,

Thanks for clearing up the VFD versus touchpad, looking at those photos again I now see what I missed.  So the question is then can I still use that touchpad enabled display without a touch pad connected?

On the rest of the connectors I did manage to figure out proper placement of all of the Senet connections and that Door I/O is connected by that additional cable back to the I/O Motherboard Door Senet connector, but that is still good info for anyone reading this thread regardless, as it took me a while going thru the wiring diagrams and schematics to figure that out.  I do have meters but knowing how to bypass could come in handy if space becomes a premium.  Good to know on the netplex that the ports used by anything but the BV are totally generic.  The schematic I have been referring to had J2 connecting to the VFD (althoght not specifically marked for the VFD just traced in associated diagrams), J14 marked as the printer netplex, and J10 as the BV netplex.  I have both a PSA-66-001N printer and WBA-12-SS BV so I'll be hooking those up for sure, but again as space becomes a premium I may want to remove or bypass out as needed.

I know I need to bypass the door encoders, and now also the BV door switch,  I'll want a jackpot reset switch, but are door drop and card cage switches needed or necessary to bypass?

Once this is all setup and running if there is any specific logic timing anyone has needed for a particular component or in figuring out how to interface something to mimic a component, I should be able to help with that using an 8 channel logic analyzer.

[Foster]

In the S2000 the card cage is usually bypassed by default, you have to remove a resistor or such to enable it, just leave it as is.
It is to detect when some one removes the MPU to gain access to it.
I have not come across a S2000 that has it enaled as of yet.

There should be a jumper installed for the drop door. in the main harness.
Do not confuse it with the belly door jumper in the door harness.

you can use the 6-6-3 7 segment display without the touch pad. the 6 6 3 is the number of digits for winner paid 6, credits 6, and credits played 3 there is also a 5 5 2 that does not have the touch pad port on it, when you change the machine from 5 5 2 to 6 6 3 in the key config menu, yes you will have to do so or you will get an error.
you do not need the touch pad but you will be limited to 1 denom, unless you get a touchpad, with a 6 6 3, even though the newer button harness has the wiring for the denom switch on the deck
to use the denom button on the deck you have to use a 5 5 2 display

[mikec200]

So that is what the card cage is.  I was thinking it had to do the casino cage, maybe payout related.  Belly door jumper I found with the factory bypass, that's NJ specific as I recall reading, so I was expecting to see that setup for me.  Drop door I think I need to do something about as it just a couple of  slide on connectors that need to be hooked to something, but I need to double check that.

Thanks for confirming the touch pad isn't needed.  I knew about needing to change the 552 vs 663 in the setup, but didn't now how to tell which display  was which  other than maybe counting 7 segments but the touch pad connector makes it easy. That is a good piece of info that the demon switch won't work with a 663, which I'm sure would have drove me crazy at some point.

Thaks again for the info.

[Foster]

The drop door is s long wire with a 2 pin connector just like the belly door.
none of the wires for the drop door are orange.

[mikec200]

Another update:  I managed to get most of the parts assembled on to a board this weekend and verify what I could is working, i.e. power supply, VFD display, MPU board at least powers and errors without eproms.  I have the final pieces showing up today and should know if the system is functional.  Thanks to several members for there assistance, including Foster.  Pictures to follow tonight most likely.  I was also able to acquire a complete and operational 5 Times Pay S2000 machine this weekend as well, but was able to figure out most of the wiring without needing it for reference. I'm expecting however that it will come in very handy for troubleshooting. I would just throw the MPU in the from the complete machine, but would rather not take any chances at the moment. Having never seen the inside of one of these machines other than during a reset for hand pay at a casino, I can say you you can learn alot about a machine using no other reference other than the S2000 Field Service Supplement, provided you have an electronics background. However this site and its members are and have been a incredible resource nonetheless.   

[mikec200]

Good news to report.  Post office was a day late with my parts, can't complain though as it gave me an opportunity to play with the complete machine.  Got proms in and reels connected tonight and the bench top is alive after a main battery swap to a cr2032 and holder.  I need to redo the initial accounting setup as I screwed up the coin denom some how and I think something is up with the bill validator as I haven't heard it do a thing, but everything else that is expected to happen is.  Need to figure out some reel mounting and play button mounting yet as well.  I tried taking some pictures with my camera phone but they look like crap as it doesn't want to focus right in the basement light so I'll need to grab my old digital camera which is going to need a charge first.  Should have more to report and some photos finally tomorrow. Still in need of par sheets for the two stepper bases noted above which will help with making some make shift reel strips.

[mikec200]

Its working fully with the exception of a faulty bench BV and no permanent mounting yet of reels or buttons.  Confirmed by swapping BV from my complete 5X Pays machine.  Anyone have any idea why a BV will not cycle on power up yet, works in test modes using the dip switches?  One thing I did note is the faulty BV is a WBA 12 SS transport with a WBA 11 head, but I understand that should work.  Will try WBA 12 head from 5X Pays in faulty transport later and see if it makes a difference

Still on the hunt for PAR sheets for  SB100059 and SB100064 if someone can help out.

[mikec200]

BV update - leaning toward software on the unit is incorrect for IGT, there is no info as to what version of software is on it.  Oh well was only $15 bucks complete.  I can still get credits on the machine using the BV from the complete machine.

[CVslots]

Wonder how this project is going?

[mikec200]

CVSlots,

Its going, a deluge of work and some personal stuff has slowed it a bit more than I'd like, but such is life.  I got my BV issue solved, so the bench unit is fully operational.  Still need to get reels and buttons more properly mounted, but its a secondary need at the moment.  Also interesing to have a complete and working machine to just put some extended no cost play on. I've observed some interesting things in the first 15 minutes from power on, so really interested to dig deep, its likely no more than coincidence, but does seem to backup why they don't get put into use right away when first installed in a casino.   Still looking for par sheets on the SB100059 and SB100064, and if you know of any leads on that its appreciated. Started looking at software but there are some challenges there its going to take some time to work through to really get down to doing the research I want to do.  Also want to look at communications to the BV and see if a BV emulator can be cooked up for the S2000.  That would have some value to folks here I'm sure.

I'll continue to post as things progress and I'm obviously monitoring the board and checking in from time to time so please feel free to check in with me.

[Mirage_Chaser]

CVSlots,

I've observed some interesting things in the first 15 minutes from power on, so really interested to dig deep, its likely no more than coincidence, but does seem to backup why they don't get put into use right away when first installed in a casino.

I don't know about that. I have worked in the industry for years and when a machine goes on the floor, brand new or used, they go on right after setup (or clear and setup). With the exception maybe of a bill and a paytable test. Volatility can be high up to 1 million games but it evens out over time so there is no reason for a game to not go live from 0 meters. Besides accounting/audit have a cow when every .01 is not accounted for, they usually insist on a full clear before a machine goes live.

[mikec200]

Mirage_chaser,

I've read some interesting discussion here about burn in time prior to allowed use by the public on caloors for new banks of mac  Interesting to hear it is not universally done.  Individually it might be less of a concern as well, just seems there might be something to letting the rng run a bit prior to actual gaming.

[Mirage_Chaser]

I would be surprised if it is widely done at all.

It seems like an armature move.

Look at it this way, all slot machines have a target % and they will reach that % regardless of how the machine pays in the first few days of going live. You are basically saying that machines are not put on the floor right away because they may pay out at an unusually high rate- but even if that were true (which it may or may not be because high volatility does not equal high payout) any knowledgeable slot director or manager would be glad to have that on the floor to bring interest to the games. More winners means more players. And if you can get a game to have big interest the moment it goes on the floor then that equals more play which in turn means higher win/day.

[CVslots]

CVSlots,

I've observed some interesting things in the first 15 minutes from power on, so really interested to dig deep, its likely no more than coincidence, but does seem to backup why they don't get put into use right away when first installed in a casino.

Like higher payouts in the first 30 or so games? If so, so have we, and many other members here have experienced the same. It also seems to occur when machine comes out of attract mode, whether in a casino or a home setting. BUT! These are in no way rock solid hypotheses, only pure speculation....and more than likely PURE coincidence.