Guest
I am looking for anyone who can please provide information on the NCR
5305 ATM.
We are an OEM internet terminal manufacturer and are planning on
converting the very cheap NCR 5305 ATM into a fully functional and
highly converged bill payment, reservation and ticket issuing terminal.
This is because our daughter company's ATM division has closed down and
had to recall approximately 1000 NCR 5305 ATMs; instead of re-selling
these we have decied to use them as a device you can approach with your
phone bill and swipe your credit card to pay it. Other options include
buying tickets to the movies, making hotel and car hire reservations,
purchasing mobile phone credit, making airline bookings etc.
We do however have some problems as there is a significant lack of
information on this machine.
We need to know how to be able to modify specific aspects of the device
so that it can peform our functions whilst still acting as a cash
dispenser. In particular we are looking for information on how the ATM
receives data from it's card reader, how such data is fed through the
specific hardware (Display, SDC, and the actual Processor Cage), and
how/where/when the OS/2 Warp runtime and NCR S4 Self Service Software
System stores, manages, and processes such data.
I have several questions including:
The Sankyo MCM260 2R0485 Card Reader is a custom made device made by
Nidec Sankyo Seiki for NCR only. Sankyo will not provide any
datasheet(s) on this device as it is made explicitly for NCR and they
are bound by a non-disclosure-agreement.
I would thus like to know if anyone has these datasheet's or can tell
me:
How is this reader any different from the other Sankyo MCM260 DIP
readers ?
Why does this reader have 7-PINs coming off the PCB and what are they
(identify each pin) ?
Is this output clocked TTL serial or some custom data output made for
the NCR hardware ?
Does this reader capture Tracks 1 & Tracks 3 or just Track 2 ?
Once the data is fed off of this 7-PIN connector and into the back of
the SDC how is it treated: ie - is it converted, merged with any other
data, partially/fully encrypted, or in anyway modified whatsoever ?
Is the RS232 DB9 "DIP" labelled connector coming off of the SDC feeding
ONLY the data captured from the card reader or is it combined with
other data such as that coming from the keyboard or PIN-PAD ?
What baud, bit, parity, and other settings is this RS232 DB9 "DIP"
channel (NCR serial 2) setup as ?
Once a card is inserted into the dip reader this stimulates the ATM:
what exactly occurs on a software level once a card is inserted ?
In the Electronic Journal (EJ) the track 2 data captured is in the
4564xxxxxxxx1234 format or otherwise where a significant majority of
the track is missing: is there anyplace the ENTIRE TRACK 2 DATA IS
STORED (in RAM or HDD) and how could one capture/see/use this during an
event ?
Is there anyway one can configure the OS/2 Warp system or the S4 NCR
Software to capture the entire TRACK 2 DATA and store this - ie by
altering the STARTUP.CMD file to load a custom made program BEFORE the
S4INITS.EXE program is executed:
This would simply alter the command line of the STARTUP.CMD file to
include the first line (a custom made capture program) before the NCR
software was loaded:
----------------------------------
track2capturer.exe
start /f /fs s4inits.exe
----------------------------------
Would this work and how would one write such a program - ie would you
need to locate the IO IRQ INTERRUPT etc for the incoming Track 2 data
and then have this track2capturer.exe program (running in usermode)
just stay in RAM awaiting for such input OR would one also have to have
a Kernel Mode Driver loaded in the CONFIG.SYS in the fashion of a
ROOTKIT SYSTEM DRIVER ?
Anyway all information is appreciated.
I think the easiest way would be to simply tap the Sankyo card reader
and have each wire sniffed with a raw logic sniffer and then captured
and stored in non-volatile memory for later download to computer.
5305 ATM.
We are an OEM internet terminal manufacturer and are planning on
converting the very cheap NCR 5305 ATM into a fully functional and
highly converged bill payment, reservation and ticket issuing terminal.
This is because our daughter company's ATM division has closed down and
had to recall approximately 1000 NCR 5305 ATMs; instead of re-selling
these we have decied to use them as a device you can approach with your
phone bill and swipe your credit card to pay it. Other options include
buying tickets to the movies, making hotel and car hire reservations,
purchasing mobile phone credit, making airline bookings etc.
We do however have some problems as there is a significant lack of
information on this machine.
We need to know how to be able to modify specific aspects of the device
so that it can peform our functions whilst still acting as a cash
dispenser. In particular we are looking for information on how the ATM
receives data from it's card reader, how such data is fed through the
specific hardware (Display, SDC, and the actual Processor Cage), and
how/where/when the OS/2 Warp runtime and NCR S4 Self Service Software
System stores, manages, and processes such data.
I have several questions including:
The Sankyo MCM260 2R0485 Card Reader is a custom made device made by
Nidec Sankyo Seiki for NCR only. Sankyo will not provide any
datasheet(s) on this device as it is made explicitly for NCR and they
are bound by a non-disclosure-agreement.
I would thus like to know if anyone has these datasheet's or can tell
me:
How is this reader any different from the other Sankyo MCM260 DIP
readers ?
Why does this reader have 7-PINs coming off the PCB and what are they
(identify each pin) ?
Is this output clocked TTL serial or some custom data output made for
the NCR hardware ?
Does this reader capture Tracks 1 & Tracks 3 or just Track 2 ?
Once the data is fed off of this 7-PIN connector and into the back of
the SDC how is it treated: ie - is it converted, merged with any other
data, partially/fully encrypted, or in anyway modified whatsoever ?
Is the RS232 DB9 "DIP" labelled connector coming off of the SDC feeding
ONLY the data captured from the card reader or is it combined with
other data such as that coming from the keyboard or PIN-PAD ?
What baud, bit, parity, and other settings is this RS232 DB9 "DIP"
channel (NCR serial 2) setup as ?
Once a card is inserted into the dip reader this stimulates the ATM:
what exactly occurs on a software level once a card is inserted ?
In the Electronic Journal (EJ) the track 2 data captured is in the
4564xxxxxxxx1234 format or otherwise where a significant majority of
the track is missing: is there anyplace the ENTIRE TRACK 2 DATA IS
STORED (in RAM or HDD) and how could one capture/see/use this during an
event ?
Is there anyway one can configure the OS/2 Warp system or the S4 NCR
Software to capture the entire TRACK 2 DATA and store this - ie by
altering the STARTUP.CMD file to load a custom made program BEFORE the
S4INITS.EXE program is executed:
This would simply alter the command line of the STARTUP.CMD file to
include the first line (a custom made capture program) before the NCR
software was loaded:
----------------------------------
track2capturer.exe
start /f /fs s4inits.exe
----------------------------------
Would this work and how would one write such a program - ie would you
need to locate the IO IRQ INTERRUPT etc for the incoming Track 2 data
and then have this track2capturer.exe program (running in usermode)
just stay in RAM awaiting for such input OR would one also have to have
a Kernel Mode Driver loaded in the CONFIG.SYS in the fashion of a
ROOTKIT SYSTEM DRIVER ?
Anyway all information is appreciated.
I think the easiest way would be to simply tap the Sankyo card reader
and have each wire sniffed with a raw logic sniffer and then captured
and stored in non-volatile memory for later download to computer.