Compatible Anti Cheat Device for Gaming Machines Supporting Different Communication Buses
Gaming machines use different communication buses: RS-232, RS-485, CAN bus, I2C, USB, and proprietary variants. An anti-cheat device that supports only one bus type cannot protect all machines in a mixed fleet. A multi-bus anti-cheat device supports all common bus types through hardware switching (selecting the correct bus interface) and protocol auto-detection (identifying the bus type and loading the correct protocol decoder). This article describes how a multi-bus anti-cheat device works and how to select and deploy one for a mixed-bus fleet.
Gaming Machine Bus Types and Where They Appear
RS-232 (serial): used on older fish tables and slot machines (pre-2015). Operates at 9600-115200 baud. Voltage levels: ±12V. Uses 3-5 wires (TX, RX, ground, optionally RTS/CTS). RS-485: used on newer fish tables and multi-player machines (post-2015). Operates at 9600-256000 baud. Voltage levels: ±5V differential. Uses 2 wires (A/B differential pair). Supports multiple peripherals on the same bus (multi-drop). CAN bus: used on modern slot machines and integrated systems. Operates at 125-1000 kbps. Voltage levels: 2.5V differential. Uses 2 wires (CAN High/CAN Low). Supports multiple nodes with collision avoidance. I2C: used on internal machine communication (between mainboard and display controller or sound module). Operates at 100-400 kHz. Voltage levels: 3.3V or 5V. Uses 2 wires (SCL/SDA). Proprietary buses: used by some manufacturers who modify one of the standard buses with custom timing, addressing, or encryption. These require a custom decoder that the manufacturer must provide.
A multi-bus anti-cheat device must support at least RS-232, RS-485, and CAN bus (which covers 90% of gaming machines in the field). Support for I2C and proprietary buses is a bonus that expands coverage to internal buses and custom implementations.
How Multi-Bus Support Works: Hardware and Software
The device has a multi-interface input stage. The input stage includes a bank of bus interface circuits — one circuit for each supported bus type. An automatic switch (a multiplexer controlled by the device’s microcontroller) selects the correct interface circuit based on the detected bus type. The switch operates in less than 1 second after the device is connected to the machine.
The detection process: when the device is connected to the machine’s communication port, the input stage samples the voltage levels and signal characteristics on each pin of the connector. If the sampled signals match RS-232 characteristics (±12V, idle state is mark/high), the switch selects the RS-232 interface. If the signals match RS-485 characteristics (±5V differential, idle state is indeterminate), the switch selects the RS-485 interface. If the signals match CAN bus characteristics (2.5V differential, recessive state), the switch selects the CAN interface. The detection is based on electrical characteristics, not protocol decoding — it works before any messages are received.
After the bus type is detected, the device’s software loads the protocol decoder for that bus type from its firmware library. The decoder knows the message format, addressing scheme, and timing for the detected bus type. The device is now ready to monitor and filter bus messages. The entire process (hardware switching + software loading) takes 10-60 seconds.
Bus-Specific Protection Features
For RS-232: the device monitors the TX and RX lines between the mainboard and each peripheral. It detects external devices that are connected in parallel to the RS-232 bus (by monitoring voltage levels — an unauthorized device loading the bus causes a detectable voltage drop). For RS-485: the device monitors the A/B differential pair and detects external devices by watching for bus contention (two devices transmitting simultaneously, which is abnormal on an RS-485 bus). For CAN bus: the device monitors the CAN High/CAN Low lines and detects external devices by watch for unauthorized CAN IDs in the message stream. CAN bus messages include a sender ID, which makes unauthorized sender detection straightforward.
The bus-specific protection is more effective than generic bus monitoring because it exploits the electrical and protocol characteristics of each bus type. A generic monitor might miss a subtle anomaly that a bus-specific monitor detects because it knows how that bus type normally behaves.
Deploying the Multi-Bus Device in a Mixed Fleet
The device connects to each machine’s communication port using the appropriate connector adapter (DB9 for RS-232, USB-C or DB9 for RS-485, DB9 or proprietary for CAN). The operator does not need to know the machine’s bus type before connecting — the device auto-detects it. The only information the operator needs is the list of legitimate peripheral addresses for each machine (obtained from the machine’s technical manual). The address list is entered once per machine during the initial setup. After setup, the device remembers the configuration for that machine and reloads it automatically on subsequent connections.
For permanent installation: one device per machine, 120-200 dollars each. For portable inspection: one device moved between machines, 120-200 dollars for the entire venue. For a venue with 30 machines of mixed bus types, the permanent installation cost is 3600-6000 dollars. The portable inspection cost is 120-200 dollars plus 15-30 minutes per machine per inspection cycle.
Frequently Asked Questions
Q: Will the multi-bus device work with a machine that uses a proprietary bus?
A: It depends. If the proprietary bus is electrically similar to one of the supported standard buses (RS-232, RS-485, or CAN) and the bus messages follow a standard format, the device may detect it as the closest standard bus type and provide partial protection (RF filtering and voltage monitoring). Full protocol-level protection (message filtering) requires a custom decoder for the proprietary bus. Contact the anti-cheat device manufacturer to see if they can develop a custom decoder for your specific machine model.
Q: How do I know which bus type my machines use?
A: Check the machine’s technical manual under “Communication Interface” or “External Port Specification.” The bus type is listed (RS-232, RS-485, CAN). If the manual is unavailable, examine the communication port connector — RS-232 typically uses a DB9 male connector, RS-485 uses a DB9 female or terminal block, and CAN uses a DB9 with specific pin assignments (CAN High on pin 7, CAN Low on pin 2). A technician can verify the bus type with a multimeter or oscilloscope in 5-10 minutes per machine.
Q: Can a single multi-bus device connect to two buses simultaneously (e.g., a machine that uses RS-485 for peripherals and I2C internally)?
A: The device supports one bus connection at a time (it auto-selects the active bus interface). For machines with two separate buses, two devices are needed (one for each bus). Alternatively, protect the external bus (RS-485) with the device and use physical-layer protection (RF filtering) for the internal bus (I2C) — the I2C bus is inside the cabinet, so it is less accessible to external attackers and physical-layer protection is usually sufficient.