Resources

People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!

FairPlay is a line of scoreboards made since 1975 by the Fairtron Corporation. The scoreboard in the authors league date all the way back to 1992. The goal of the hacker was to make the wired implementation into a wireless one.

The boards are wired up to 100V AC power with a low voltage signal line. The board itself has E26/A19 bulb sockets for all of the different things in baseball (strikes, balls, etc.). The scoreboard has a line that goes underground all the way to the scoring booth. Since nobody wanted to be in the booth, the scoreboard become unused throughout many of the games.

The author decided to attack the controller box, since getting an oscilloscope out to the scoreboard would be complicated. The controller has an old time Motorola 68HC11 and a 128K EPROM. Normally, they would read out the EPROM, throw it in a disassembler and reverse engineer everything via code. However, the author thought that the signal would be simple enough reverse engineer from simply blackbox testing.

The FairPlay signal uses RS-232 signal levels (+5V and -5V) with a proprietary protocol. A 1 bit is +5V and a 0 bit is a -5V. Each symbol is 30 microseconds long. A 0 symbol is 5 microseconds high and 25 microseconds low while a 1 symbol is 20 microseconds high and 10 microseconds low. The messages go from controller to board, there is no path for a response from the scoreboard.

The data going across the wire directly mapped to different bulbs being lit up on the scoreboard. The scoreboard uses a 56 bit message word every 50 milliseconds. They determined all of the fields by simply pressing buttons on the controller and seeing what change was made. The data going across the wire directly mapped to different bulbs being lit up on the scoreboard. Well, sort of.

For the ball, strike and out fields on the scoreboard, each bulb directly matches the bits in the message; one bit for one bulb. The score and the inning are controlled by a single byte in the message. But, how is this possible? Each digit is made up of 13 bulbs! Several of the bits that could be turned on were ONLY possible with other bits being turned on as well. The numbers for the display are shown below:

007 
5 1 
567 
4 2
337

Eventually, the author came up with a way to represent each numbers as a mapping of bits. To fully implement a wireless version of the scoreboard, they hooked up a Raspberry Pi Zero to the talk UART to the controller with MAX3232, which is a converter of data from RD232 to TTL. Now, the scoreboard could be used wirelessly! Overall, great post on scoreboards and reverse engineering!