![\"\"\/](\"https:\/\/i.ebayimg.com\/images\/g\/iMwAAOSwZHpnKa0T\/s-l1600.webp\")
<\/figure>\n<\/div>\n\n\nI recently had a customer bring in his Echo. He purchased it from a vendor, but the operator setup menu was locked with a PIN number that nobody knew. I was tasked with trying to recover and\/or reset it. JVL support said the only solution was a new I\/O board for $380 which I would then have to pass on to the customer, so I decided to try other means.<\/p>\n\n\n\n
Performing a factory reset on the machine made no difference. The PIN number still persisted even after replacing the internal SD card with a fresh installation. I assumed the PIN number must be stored somewhere on the internal I\/O board. Looking at the I\/O board, I saw an EEPROM which I dumped using a ch341a, but within the dump there was nothing remarkable.<\/p>\n\n\n
![\"\"](\"https:\/\/oerinet.net\/blog\/wp-content\/uploads\/2025\/07\/image-1.png\")
<\/figure>\n<\/div>\n\n\nSo, I resorted to poking around in the software itself. The JVL software runs on top of a stripped down version of Linux. Having experience already working on these machines, I knew there was a webserver running on port 88 that allowed access to operator setup, but I did not know if that also required a PIN or not. Turns out it does not, and I was able to recover the PIN remotely via my web browser.<\/p>\n\n\n\n
Below is the method I used to recover the operator setup PIN:<\/p>\n\n\n\n
- \n
- I obtained a shell by booting into the game and pressing CTRL + ALT + F2 which dropped me to a console.<\/li>\n\n\n\n
- My original method (easier\/better method is below):<\/strong>
I plugged in an Ethernet cable and set up networking by runningifconfig eth0 10.0.3.5<\/code> and confirmed I could ping my router<\/li>\n\n\n\n- I navigated my desktop PC web browser to
http:\/\/10.0.3.5:88\/setuphd\/machine\/standalone\/setup\/setupsystem.htm<\/code> which brought up operator setup with no PIN check<\/li>\n\n\n\n- I navigated to Access Control and clicked the button “Change Operator’s PIN”. For some reason, I was unable to change the PIN from this screen. The web server appeared to hang and I had to restart the machine. So I decided to focus my efforts on recovering the PIN.<\/li>\n\n\n\n
- The PIN was prepopulated in the setup but obfuscated like a password, so I resorted to some jQuery. I opened the browser console and entered this code to load the jQuery library:
var jq = document.createElement('script');<\/code>jq.src = \"https:\/\/ajax.googleapis.com\/ajax\/libs\/jquery\/3.5.1\/jquery.min.js\";<\/code>document.getElementsByTagName('head')[0].appendChild(jq);<\/code><\/li>\n\n\n\n- Next, I ran this code to return the value of any password box:
$('[type=password]').val();<\/code>
which yielded output'2233'<\/code><\/li>\n\n\n\n- I went to the physical machine and entered 2233 and I was into operator setup!<\/li>\n<\/ol>\n\n\n
\n![\"\"](\"https:\/\/oerinet.net\/blog\/wp-content\/uploads\/2025\/07\/pin-reveal.gif\")
<\/figure>\n<\/div>\n\n\nAs these games transition ownership from commercial vendors to home users, it’s inevitable that more games will be purchased with locked operator setups. This was a fairly straightforward way of recovering a lost PIN on these JVL machines, and I’m glad I was able to help give this machine another life.<\/p>\n\n\n\n
Update 7\/8\/25:<\/strong> The above can be simplified without the need to set up networking, jQuery, etc. The PIN is available in plain text via
http:\/\/machine_ip:88\/REQUEST\/SetupAccess_GetOperator<\/code>. A simple netcat console command on the machine itself will do the trick.<\/p>\n\n\n\necho GET \/REQUEST\/SetupAccess_GetOperator | nc localhost 88<\/code><\/p>\n\n\n\n![\"\"](\"https:\/\/oerinet.net\/blog\/wp-content\/uploads\/2025\/06\/image-1.png\")
<\/figure>\n<\/div>","protected":false},"excerpt":{"rendered":"The JVL Echo and Encore are touchscreen arcade machines with 100+ games that used to be found in bars and restaurants. Now they are part of a forgotten era of arcade gaming, largely replaced by cell phones. However, a home collectors market is emerging for those who want to play these machines for their nostalgia. … Continue reading “Recovering the operator setup PIN on a JVL Encore or Echo”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-25","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/oerinet.net\/blog\/wp-json\/wp\/v2\/posts\/25","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/oerinet.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/oerinet.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/oerinet.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/oerinet.net\/blog\/wp-json\/wp\/v2\/comments?post=25"}],"version-history":[{"count":21,"href":"https:\/\/oerinet.net\/blog\/wp-json\/wp\/v2\/posts\/25\/revisions"}],"predecessor-version":[{"id":60,"href":"https:\/\/oerinet.net\/blog\/wp-json\/wp\/v2\/posts\/25\/revisions\/60"}],"wp:attachment":[{"href":"https:\/\/oerinet.net\/blog\/wp-json\/wp\/v2\/media?parent=25"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/oerinet.net\/blog\/wp-json\/wp\/v2\/categories?post=25"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/oerinet.net\/blog\/wp-json\/wp\/v2\/tags?post=25"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
- I navigated my desktop PC web browser to