4 replies to this topic

[chris1uk]

Hi, I work in amusement industry as an engineer and normally never look beyond my normal day but lately things are slow and I needed a new project(last time I reverse engineered some digi jukeboxes) I have been looking at sec meters and just dumped an eprom and wondered if any of you have any information on the structure of data. I have gathered some info from pdf from starpoint but the documents are not true to current versions. I would be grateful of any info you can provide and will provide a copy of the dump if you have any interest.

 

 

I recognise some of the data ie names of meters all 31 of them are 7 bytes long with a checksum appended at the end .  I expected the meters to be stored as 8 bytes 3 for reading followed by checksum 1 byte then a duplicate 2's compliment with checksum , but what I see in dump does not match the readings I took first so I am guessing obfusication or encryption ?

[chris1uk]

SOLVED

Turns out I had a corrupted meter .  I now know the checksum algorithm and am able to zero meters with ease   . I have yet to test my meter in a machine but it powers up and shows initial meter 0(refill) as a zero so I am confident(it fails to boot with bad checksums).

 

 

If anybody wants code(python) or more details just give me a shout.

[impact]

Hi ya Chris

 

I think one of the biggest things with sec is knowing how to reset them without killing them. 

[chris1uk]

If I get time at work tomorrow I will confirm if I have achieved this(without killing).  zero is easier than specific values due to the way data is stored and the fact that out of 31 meters its almost certain one remained at zero with good checksum to duplicate .  Only 512 bytes of the eeprom are used the first 248 are the meters in order from 0 - 30 reading (24bit) checksum(sum as 2's complement -1) followed by 2's complement with checksum.  Then its just meter names each 7 bytes followed by checksum with same method. after that its stuff I dont understand yet and is best not modified(probably serial numbers etc)

 

 

00 00 00 FF FF FF FF 02   ----- that is a zeroed meter with checksums

 

below is a python script to calculate the checksums

 

def calc_checksum (string):

    sum= 0

    for i in range(len(string)) :
        sum = sum + ord(string[i])

    temp = sum % 256 #mod256
    rem = -temp  #two's complement, easier way
    return '%2X' % (rem-1 & 0xFF)

[chris1uk]

The test was a complete success , the meter was tested and returned 0 on all readings.  Although it is possible to set the values to anything I feel it would be damaging if I released code that did that but may release an arduino sketch that zeros . I would be interested to hear of any hidden commands people may know of to clear a meter without hooking wires/clip on to the EEPROM