Hacking Slot Machines

[roboto]

for your viewing pleasure . entertainment purposes only.
<a href="http://www.youtube.com/v/dFYCDHE4BzM&rel=0" target="_blank">http://www.youtube.com/v/dFYCDHE4BzM&rel=0</a>
Masterminds Stealing Las Vegas .

[FORDSBS]

Did you take notice to the machines he was supposed to be learning on? SKILL STOP. HA HA 

[cowboygames]

I noticed that to Ford. All the machines in the security footage of the Jackpot win were skillstops also. Didn't know they used those at Harrahs or anywhere else in Vegas

[jay]

Some of the so-called security footage in this is really laughable.

They talk about a 1/2 inch opening in the cabinet -

There are three such openings.
1. Bottom of the cabinet. These machines are bolted to the stands so thats a negative.
2. There is a power cord entrance on the back. The backs are rarely accessable.
3. The coin tray.

I don't thing going up the hopper entrance is too easy. The divertor plate for one blocks this. One of the older cheats was a hook shaped insturment with a magnet on the end. You simply went dipping for quarters, picking up as many as you can with each pass of the wand. Physical blocks were quickly implemented to prevent this. Later on a bright light was used to mess up the hopper optics so that even a small 2 coin win could dump out 50 coins or more. Later the optics were shielded and time-outs on the hoppers were implemented.

However assuming this is the entrance......

Once inside an S+ you have a locked tray located behind the hopper with no openings accessible. There is a dime sized hole if you remove the board tray barrel lock.....

Even if you had compromised the tray and had access to the chip and were able to blindly clip a harness onto the chip. Rewriting it without first erasing it (10+ min under UV light) seems pretty improbable and to reflash it with the board active I don't think is do able. Just for fun lets say it was probable you would then have to go through the clearing of the error 61 and that white self test button is way way at the top the final step is a door close which would trip an alarm.

I just don't buy that this is the way it was done.

I maintain he paid off a $6/hr slot tech to insert his dirty chips or even better got them into the distribution chain back at IGT.

[jay]

IF I was going to hit the casino......back then.... knowing what I know now.....I think the most vulnerable electronic part of the system would have been the bill validators....of course I was not old enough to be in the casino in the first place.
 
The chips were in the bill heads, and bill heads were replaced, cleaned tested, updated and returned to operations by all the slot techs.
You simply update the bill head software to accept a monoply $1 as 300 or so credits.

Over the next six months you either replace enough heads through routine maint or you pay some rubby to stuff peant butter sandwiches into the bill heads forcing a maint cycle. You then come back and hit the casino. Of course you only get one night of this as the first monoply dollar found triggers a full blown investigation.

A couple problems with this - In this era the machines spit out only coins with hopper limits set between 300 - 400 credits. Thats a heck of a lot of change.
400 x $0.25 = $100 bucks. Thats about 5 buckets of coins. You try and pull out $1000 ..... You can't possibly carry it. Casino footage would be examined while you were cashing your quarters for dollars. Imagine hitting a hopper empty..... and a slot filler coming by to top up.... not good.

Of course you aren't working alone and just like the video.... this is where things fall apart quickly.
That and the relatively minor theft vs the concequenses would hardly make this worth it.

[Stolistic]

Even if you had compromised the tray and had access to the chip and were able to blindly clip a harness onto the chip. Rewriting it without first erasing it (10+ min under UV light) seems pretty improbable and to reflash it with the board active I don't think is do able. Just for fun lets say it was probable you would then have to go through the clearing of the error 61 and that white self test button is way way at the top the final step is a door close which would trip an alarm.

He would not have to reprogram the GAME PROM to make it work.  A piggyback onto the REEL PROM with new payout data and a reset of the CPU would cause the GAME PROM to reload the reel data from the cheater's chip.  No need for UV rewrite and no error 61 on boot, the GAME PROM would process the new reel data and payout accordingly.  If the reel data is reloaded AFTER each spin, the next spin would trigger the jackpot and then refresh the reel data from the original chip (since no longer piggyback'ed).

Sounds technically possible, but I agree that the whole fishing up the coin tray thing and locking onto the proper chip is quite a stretch, but who knows.

[staz]

lets see him do it on a s2000 lol.......impossible to get into a s2000

[cowboygames]

The man would have to be a f*#king magician. On an S2000, if you could open the belly door and IF the MPU tray lock wasn't installed, there's a very small chance a guy could line up a chip just right to do what they claim. On an S+ how did he get not only to the back of the 21" deep cabinet, but through the MPU tray. It's not like you open the machines up and can just look at those boards without removing them. Maybe an M model? Don't know how those were configured on the inside. S models had the MPU on the left wall, but weren't they encased in a tray also?

[staz]

speaking about locks what type of locks do mpu's have? that would look kinda cool having locks on those wholes of the trays lol....

[cowboygames]

Never had one, but looks to be the same as the cash box lock

[Buzz]

speaking about locks what type of locks do mpu's have? that would look kinda cool having locks on those wholes of the trays lol....

Staz  That's what I would do, put as many locks on a machine that I could. That way if a thief breaks into your house he can bust all the glass out of your machine and even maybe f*** the door up getting to the money. He's gonna get to the money one way or the other, but your machine looked COOL before it met him.

[DannyG804]

Staz  That's what I would do, put as many locks on a machine that I could. That way if a thief breaks into your house he can bust all the glass out of your machine and even maybe f*** the door up getting to the money. He's gonna get to the money one way or the other, but your machine looked COOL before it met him.
[/quote]

Lmfao!!! Awesome - Buzz you rock brotha

[uniman]

Even if you had compromised the tray and had access to the chip and were able to blindly clip a harness onto the chip. Rewriting it without first erasing it (10+ min under UV light) seems pretty improbable and to reflash it with the board active I don't think is do able. Just for fun lets say it was probable you would then have to go through the clearing of the error 61 and that white self test button is way way at the top the final step is a door close which would trip an alarm.

He would not have to reprogram the GAME PROM to make it work.  A piggyback onto the REEL PROM with new payout data and a reset of the CPU would cause the GAME PROM to reload the reel data from the cheater's chip.  No need for UV rewrite and no error 61 on boot, the GAME PROM would process the new reel data and payout accordingly.  If the reel data is reloaded AFTER each spin, the next spin would trigger the jackpot and then refresh the reel data from the original chip (since no longer piggyback'ed).

Sounds technically possible, but I agree that the whole fishing up the coin tray thing and locking onto the proper chip is quite a stretch, but who knows.

Not sure how the piggyback prom would be read instead of the machines reel prom? Would need to short or power down the reel prom I would think?
How the hell he got in there is the bigger question.
 But he did! http://www.reviewjournal.com/lvrj_home/1999/Jun-12-Sat-1999/news/11360949.html

Hope it it was worth it for all involved. 

[zarobhr]

Dennis Nikrasch, backed away from his promise to show authorities how he triggered the fraudulent jackpots.

[jay]

Well the article leads us to believe that perhaps only certain themes or models were vulnerable.
IN one part of the IGT video they showed an open slant-top ? any differences with respect to getting into these ?

[cowboygames]

Shouldn't be, same electronics, different cabinet...