I am looking for anyone who can please provide information on the NCR
5305 ATM.We are an OEM internet terminal manufacturer and are planning on converting the very cheap NCR 5305 ATM into a fully functional and highly converged bill payment, reservation and ticket issuing terminal.
This is because our daughter company's ATM division has closed down and had to recall approximately 1000 NCR 5305 ATMs; instead of re-selling these we have decied to use them as a device you can approach with your phone bill and swipe your credit card to pay it. Other options include buying tickets to the movies, making hotel and car hire reservations, purchasing mobile phone credit, making airline bookings etc.
We do however have some problems as there is a significant lack of information on this machine.
We need to know how to be able to modify specific aspects of the device so that it can peform our functions whilst still acting as a cash dispenser. In particular we are looking for information on how the ATM receives data from it's card reader, how such data is fed through the specific hardware (Display, SDC, and the actual Processor Cage), and how/where/when the OS/2 Warp runtime and NCR S4 Self Service Software System stores, manages, and processes such data.
I have several questions including:
The Sankyo MCM260 2R0485 Card Reader is a custom made device made by Nidec Sankyo Seiki for NCR only. Sankyo will not provide any datasheet(s) on this device as it is made explicitly for NCR and they are bound by a non-disclosure-agreement.
I would thus like to know if anyone has these datasheet's or can tell me:
How is this reader any different from the other Sankyo MCM260 DIP readers ?
Why does this reader have 7-PINs coming off the PCB and what are they (identify each pin) ?
Is this output clocked TTL serial or some custom data output made for the NCR hardware ?
Does this reader capture Tracks 1 & Tracks 3 or just Track 2 ?
Once the data is fed off of this 7-PIN connector and into the back of the SDC how is it treated: ie - is it converted, merged with any other data, partially/fully encrypted, or in anyway modified whatsoever ?
Is the RS232 DB9 "DIP" labelled connector coming off of the SDC feeding ONLY the data captured from the card reader or is it combined with other data such as that coming from the keyboard or PIN-PAD ?
What baud, bit, parity, and other settings is this RS232 DB9 "DIP" channel (NCR serial 2) setup as ?
Once a card is inserted into the dip reader this stimulates the ATM: what exactly occurs on a software level once a card is inserted ?
In the Electronic Journal (EJ) the track 2 data captured is in the
4564xxxxxxxx1234 format or otherwise where a significant majority of the track is missing: is there anyplace the ENTIRE TRACK 2 DATA IS STORED (in RAM or HDD) and how could one capture/see/use this during an event ?Is there anyway one can configure the OS/2 Warp system or the S4 NCR Software to capture the entire TRACK 2 DATA and store this - ie by altering the STARTUP.CMD file to load a custom made program BEFORE the S4INITS.EXE program is executed:
This would simply alter the command line of the STARTUP.CMD file to include the first line (a custom made capture program) before the NCR software was loaded:
---------------------------------- track2capturer.exe start /f /fs s4inits.exe
----------------------------------
Would this work and how would one write such a program - ie would you need to locate the IO IRQ INTERRUPT etc for the incoming Track 2 data and then have this track2capturer.exe program (running in usermode) just stay in RAM awaiting for such input OR would one also have to have a Kernel Mode Driver loaded in the CONFIG.SYS in the fashion of a ROOTKIT SYSTEM DRIVER ?
Anyway all information is appreciated.
I think the easiest way would be to simply tap the Sankyo card reader and have each wire sniffed with a raw logic sniffer and then captured and stored in non-volatile memory for later download to computer.