I did read your post and I'm not saying you're doing this (since you explicitly said you're not), but it is possible on an S+ machine to sneak an extra coin in. This is typically done by dropping the final coin for the maximum bet and an extra coin into the machine in very quick succession, before the lockout coil has a chance to engage. When that happens, the machine will allow you to spin the reels with your max bet wager, and then will pay out one coin from the hopper to pay the player back for the extra coin that was accepted.

If you are absolutely, positively not inserting an extra coin, you'll need to investigate why the machine thinks that you are.

Note that it's very difficult to fool the machine into thinking that a coin was inserted when it wasn't, so I'm not sure what to suggest other than cleaning your coin-in optics, and ensuring that the encoder (the plastic piece in the coin-in optics that forces the inserted coin to pass by the optics correctly) is the correct size for the coins you're using.

They work with MEI

ah, its the same signing they use to sign the OS and Game cards.. So if you figure out the Jurs, let me know.
ha

I will let you in on a little clue I discovered, the first 2 bytes of the Jurisdiction are not part of the signature.
Those are the only 2 bytes you can change without triggering a checksum error.

Why?  Because those 2 bytes are meant for VGT  (Video Game Terminal) ID.

:mindblown:

Any reverse engineering on the Jurisdiction needs to not include the first 2 bytes in the process.

Some keys used for checking the signing are in the BIOS...  But still need one more key, I think...
Some keys are in the boot sector of the OS and/or game card.     

If you compare Dev BIOS with Prod BIOS you will see.

Door optics not working?

Probably a dumb question, but would it work with an MEI validator or does it have to be a WBA?