Loyalty Card EEPROM Point Rewriting: Exploiting Account Multiplier Glitches
The multiplier glitch lives in the EEPROM sector map, not in the game logic — rewrite the point block before the checksum recompute window closes and the terminal reads your injected balance as legitimate. That is the entire exploit in one breath, and anyone who tells you otherwise has never held a logic analyzer against a slot machine's card reader bus. 🎯
Most loyalty systems store accumulated points in a 24C-series serial EEPROM soldered to the player card PCB. The firmware reads a fixed offset, applies the multiplier tier, then writes back on card removal. The gap between read and write is your attack surface, and it is wider than the vendors want to admit.
The EEPROM Sector Map Nobody Audits
Here is the uncomfortable truth: Loyalty Card EEPROM Point Rewriting works because the multiplier tier byte sits adjacent to the raw point counter with zero memory protection. Pull a card, dump the 2KB image, and you will see the point counter at offset 0x1A and the tier flag at 0x1C. Flip the tier byte from 0x01 to 0x04 and the terminal applies a 4x multiplier on the next insertion cycle. The point counter itself never needs to change on the first pass.
What kills most amateur attempts is the checksum. These cards use a simple additive checksum across the first 0x40 bytes, stored at 0x7E. Rewrite the tier byte, recompute the additive sum, patch the checksum, and the terminal accepts the modified image without a flinch. No cryptographic signature, no rolling code, nothing. The whole scheme is security theater.
Multiplier Glitch Sequencing and Timing Windows
The multiplier glitch is not a static data edit — it is a timing exploit. The card reader polls the EEPROM every 400ms during an active session. If you inject the modified tier byte while the card is seated, the firmware reads it on the next poll and retroactively applies the multiplier to the session total. That means a 50-point session suddenly settles at 200 points before the cashier even prints the slip. 💰
The critical constraint is the write-protect pin. Most 24C02 chips have WP tied to ground, meaning the EEPROM is always writable. If WP is tied high, you need to lift the pin or use a glitch injector to pull it low during the write window. The injector approach is cleaner — a 3.3V pulse on the WP line during the 5ms write cycle is enough to bypass the hardware lockout without desoldering anything.
Account multiplier glitches also surface at the host level. Some systems push the multiplier tier from the server on card insertion, then trust the local EEPROM copy for the remainder of the session. If you rewrite the local tier byte after the server handshake completes, the host never re-validates. The session settles against the tampered local value. This is the highest-value vector because it survives audit logs — the server thinks it issued a legitimate tier-2 multiplier.
Checksum Recomputation and Anti-Tamper Bypass
Vendors who did bother with anti-tamper use a rotating XOR key derived from the card serial number. The key is stored in the terminal firmware, not the card, which sounds secure until you realize the key derivation routine is a 12-instruction loop with a hardcoded seed. Dump the firmware, extract the seed, and you can recompute valid checksums for any card serial in under a second. 😤
The real failure is that EEPROM point rewriting tools are commodity hardware now. A $12 CH341A programmer and a SOIC-8 test clip let anyone read and write these chips in 30 seconds flat. The barrier to entry collapsed years ago, and the loyalty card industry still ships the same unprotected 24C02 layouts. Point block integrity is an afterthought, and the multiplier tier byte is the softest target on the entire card.
One more mechanic worth flagging: some terminals cache the last-known point value in RAM and only sync to EEPROM on card removal. If you yank the card mid-session, the RAM cache is lost and the EEPROM retains the pre-session value — but the multiplier tier byte persists. Reinsert the card, and the terminal applies the elevated multiplier to a fresh session while the point counter resets to the cached baseline. That is a free multiplier on every insertion cycle, indefinitely.