Can anyone explain (at a high level) how dodgy casinos pirate slots? How do they get hold of the software and how do they fake the connection to the providers server that holds the RNG etc?
I've no idea about the faking process
, but I think the code sits somewhere else, not on a genuine provider's server. They likely rebuild a game from scratch and serve it from their own places.
They swap out the legitimate API server with the fake API server, and as long as the fake makes enough correct noises to satisfy the client (a copy of the html, javascript and graphic files copied from a legitimate server and hosted on an illegitimate website), it can reply with pretty much anything it wants as long as that conforms with the data structures of the API (the communication interface between the client and server).
For example, the screenshot below is part of an API response from a spin request made to a legitimate game server running in demo play (for brevity I haven't included prior API responses which will provide game definitions to the client, although again these could be faked out). Fairly quickly you'll understand what the server is telling the client to do:
* The central reelsBuffer is what you see on screen (symbols ranked from 1 low to 8 high - this provider doesn't store the reel bands on the client, so the fake API server is free to reinterpret that as it wishes)
* The winLines explicitly describes what you won
* There are sections to describe features, jackpots and other functionality - which not shown here but could be similarly manipulated.
As far as the client is concerned,
this API response is gospel - so a fake API server can tell it anything it wants, and the client will - if it understands it - happily play that out... add or remove winlines, change the paytable, "just miss" for bonus every single spin etc. Heck, for silliness, it would be possible to make starburst look high variance, and the server return a near-identical response (apart from unique identifiers and timestamps) every single spin that pays 95% of your stake. The client wouldn't care, although the player might think it's a bit boring 🤣
Which is where the trust element of online gambling comes in, once that trust has been lost (e.g. a casino running pirate games, a game that doesn't conform to the game rules, or an incompetent test provider) then pretty much all bets are off... someone is about to lose their shirt, it's just a matter of who the "mistake" (whether accidental or malicious) favours...
