Pachinko Interface connections

[drcrippen324]

very interested in the idea of the coin mec and using the Cr buttons keep us posted please

[daverob]

Well I've pretty much come to the end of what I can figure out about the card reader interface without obtaining a working card reader unit to reverse engineer.

Current state of play is that I've built a small interface board to go between the card reader connector and the parallel port of one of my spare laptops. From this I can write simple software to control and observe the signals on all of the inputs and outputs on this connector.

It was pretty easy to put together something that can read the parlour buttons and display numbers on the 7-segment displays. But the serial interface lines are proving to be a bit of a problem to work out.

As anyone who's done any reverse engineering before can tell you, proprietry serial interfaces are not easy to figure out without having a working example to observe, as you have no idea of the character timings, or the inter-character delays neccesary to make it work.

All I've managed to get out of the serial interface is that if I activate the 'BRDY' (Card Unit Ready) line, then the 'PRDY (Stand Ready) line will pulse a couple of times, then remain active for about 10 seconds.

I've tried sending pulses and characters back along the 'BRQ' line at various symbol rates and timings, along with changing the state of the 'BRDY' line, and nothing seems to effect the timing of the pulses on the 'PRDY' line, and I haven't seen any activity on the 'EXS' line at all.

I have written a program that tests a different combination of timings and character rates about every 12 seconds and will log any differences to a file, and the file is still empty after running this program for over two weeks.


I've put a wanted ad on the auction site for a card reader unit, so that I can continue my experiments. If anyone has any leads on somewhere that speaks very little Japanese can obtain one from, then please let me know.

In the mean time I'm going to make a couple of modifications to the interface, and try my luck at probing the RJ-12 connector, and see if I can get that one to talk a bit easier.

[daverob]

OK I realise I'm resurrecting an old thread, but after a whole load of tracing circuit diagrams from reverse engineering the pachi circuit boards, searching for datasheets, and trawling through thousands of postings on Japanese forums, I've finally found some information that has helped me figure out the purpose of the RJ12 connector.

As far as I can tell, the RJ12 connector is used as a security verification so that inspectors can check a pachi to make sure it is running original unhacked software on it's secure processor(s).

This connector performs the same function as the small red slot connector also found on many pachis, the only difference is that the RJ12 connector is opto isolated differential signals and includes a reset signal, (so it can be connected without having to power down/reset the machine), the red connector only contains the clock and data signals.

Generally the red slot connector will be used to check the authenticity of the LETech LE2280 (V2) or LE4280 (V4) processor, the RJ12 seems to be for the IDNAC or SUBNAC type processors. Since these processors perform the random number generation and the decision making that determines whether a win is due, it is considered quite important that machines in parlour use are running original code.

One Japanese site that sells security checkers quite clearly shows how they are used and where they are plugged in.

http://www.aaa-inc.net/sekyurithi.htm

I'm not certain (yet) what exact information is output on these connectors, some sites seem to indicate that the V2 processors can be written to, and that it's not that difficult to read the entire unencrypted program code out of any of these processors, but I can't seem to find any specific details.

It's also possible that these connectors have a dual purpose and can be connected to a parlour computer for information monitoring, but I haven't found any evidence of this yet.

[compirate]

Fantastic Work!!!

Always wondered what that red connector was for!

I have the same connector on my card readers and ball loaners, but it may be for something else.

[Eddie]

Its guys like Daverob that make this site so damn great!!!!!!!!!!!

[Sid]

Great Detective Work Daverob!!!

[hanabi]

Well I don't understand any of it!!

But it's blinking impressive stuff!!

Well Done!!!!

[daverob]

Well I don't understand any of it!!

For those less technical amongst us...

In Japan there is a fair sized underground trade in counterfeit main processors for Pachinko and Pachislo machines. These processors have had their code modified so that when they are used in a machine in a parlour, the payout rate is skewed in a way that can be exploited by criminal gangs.

This can be done with or without the knowledge of the parlour owner, and is not immediately obvious when a machine has been compromised.

For this reason manufacturers have used a semi-secure processor for the main CPU, this processor has an authenticity function built into it, so that when it is connected to an appropriate reader, you can easily tell the difference between a genuine one and a fake.

A few of us here can't seem to sleep at night unless we know what every connector does on the back of our pachinko machines. Up until now the connectors used for to connect the authentication reader have been a bit of a mystery. So rather than commit myself to an eternity of insomnia, I decided to put my reverse engineering skills to the test.


Back on a more technical note, I'm not sure that the RJ12 connector (on Sankyo Lumina frame machines at least) can be used for any other purpose, as the main audits and controls are handled by the main processor on the cell, and the RJ12 connector goes to the pay-out processor on the frame. From what I can tell, there doesn't seem to be an interface to transfer the data between the two processors. So the most information you're going to get is the number of balls payed out, and the screenshots of hall computers that I've seen have a lot more information.