Sniffing the Rigol's internal I2C bus

[Uup]

However, some of the zip files are corrupt... (dstool.zip, RiGen-1.zip, ScopeCommander.zip)

no, they not

Really? 

I just tried again now, from a different computer this time as well. Same result, get an 'unexpected error in archive' message when trying to unzip those files.

[zombie28]

Here is optimized signing function with all necessary checks for valid signature generation:

Code: [Select]

char private_key[] = "8..."; <-- fill with valid key
char prime1[] = "AEBF94CEE3E707";
char prime2[] = "AEBF94D5C6AA71";
char curve_a[] = "2982";
char curve_b[] = "3408";
char point1[] = "7A3E808599A525";
char point2[] = "28BE7FAFD2A052";

void ecssign(char *serial, char *options, char *lic1, char *lic2)
{
    mirsys(800, 16)->IOBASE = 16;

    sha sha1;
    shs_init(&sha1);
    char *ptr = serial;
    while(*ptr) shs_process(&sha1, *ptr++);
    ptr = options;
    while(*ptr) shs_process(&sha1, *ptr++);
    char h[20];
    shs_hash(&sha1, h);
    big hash = mirvar(0);
    bytes_to_big(20, h, hash);

    big a = mirvar(0);  instr(a, curve_a);
    big b = mirvar(0);  instr(b, curve_b);
    big p = mirvar(0);  instr(p, prime1);
    big q = mirvar(0);  instr(q, prime2);
    big Gx = mirvar(0); instr(Gx, point1);
    big Gy = mirvar(0); instr(Gy, point2);
    big d = mirvar(0);  instr(d, private_key);
    big k = mirvar(0);
    big r = mirvar(0);
    big s = mirvar(0);
    big k1 = mirvar(0);
    big zero = mirvar(0);

    big f1 = mirvar(17);
    big f2 = mirvar(53);
    big f3 = mirvar(905461);
    big f4 = mirvar(60291817);

    epoint *G = epoint_init();
    epoint *kG = epoint_init();
    ecurve_init(a, b, p, MR_PROJECTIVE);
    epoint_set(Gx, Gy, 0, G);

    for(;;)
    {
        incr(k, 1, k);

        if(divisible(k, f1) || divisible(k, f2) || divisible(k, f3) || divisible(k, f4))
            continue;

        ecurve_mult(k, G, kG);
        epoint_get(kG, r, r);
        divide(r, q, q);
       
        if(mr_compare(r, zero) == 0)
            continue;

        xgcd(k, q, k1, k1, k1);
        mad(d, r, hash, q, q, s);
        mad(s, k1, k1, q, q, s);

        if(!divisible(s, f1) && !divisible(s, f2) && !divisible(s, f3) && !divisible(s, f4))
            break;
    }

    cotstr(r, lic1);
    cotstr(s, lic2);
}

[cybernet]

Wow, I haven't been following this post, but it looks like it might be awesome! So has there been a key generator built for the DSA815? Or does this only work with the DS2000 oscilloscopes?

As of right now there is no implemetion for the DSA815. But I am working on it

do you see the ECC parameters in the DSA firmware ? in gel DS2 GEL file its as easy as "strings file|grep ..."
ps: the algo that takes the license string input and converts it to HEX - is more capable than the way its used on the DS2 ... e.g. all kinds of special chars - but i only implemented /reversed what i saw being used by the DS2k.

[synapsis]

To help some people out, the MD5 for the Windows app I released (RiGen-1.zip) is:

e5165fee6155ceb9d8cae6176acf4c37

[zombie28]

Here is my current state. There are a few checks and simplifications. For me it works perfectly. Still missing something?

Code: [Select]

    [...]
    if (r==0) fail=1;
    if (s==0) fail=1;
    [...]


This check won't work - r and s are pointers, so this code checks whether they are NULLs, but doesn't check if their values are equal to zero

[DL5TOR]

Wow, I haven't been following this post, but it looks like it might be awesome! So has there been a key generator built for the DSA815? Or does this only work with the DS2000 oscilloscopes?

As of right now there is no implemetion for the DSA815. But I am working on it

do you see the ECC parameters in the DSA firmware ? in gel DS2 GEL file its as easy as "strings file|grep ..."
ps: the algo that takes the license string input and converts it to HEX - is more capable than the way its used on the DS2 ... e.g. all kinds of special chars - but i only implemented /reversed what i saw being used by the DS2k.

That is the point. I can not find them. Also on thwe dsa815 the updatefile is not a gel file it is a sys file that will not load in ida with the gel-plugin.

One thing i did find is that the option is marked as 000# and if i use the segments from the key that i have i get aaab

[olsenn]

you see the ECC parameters in the DSA firmware ? in gel DS2 GEL file its as easy as "strings file|grep ..."
ps: the algo that takes the license string input and converts it to HEX - is more capable than the way its used on the DS2 ... e.g. all kinds of special chars - but i only implemented /reversed what i saw being used by the DS2k.

What do these parameters look like (example)? What are you grepping for? Could viewing the .sys file in a hex editor be the key to this one?

[ve7xen]

Really? 

I just tried again now, from a different computer this time as well. Same result, get an 'unexpected error in archive' message when trying to unzip those files.

Pretty sure you're doing something wrong:

Code: [Select]

$> md5sum RiGen-1.zip
e5165fee6155ceb9d8cae6176acf4c37  RiGen-1.zip
$> unzip -t RiGen-1.zip
Archive:  RiGen-1.zip
    testing: dotNetFx40_Full_setup.exe   OK
    testing: miracl.lib               OK
    testing: msvcp100.dll             OK
    testing: msvcr100.dll             OK
    testing: RiGen.exe                OK
No errors detected in compressed data of RiGen-1.zip.


[zombie28]

Here is my current state. There are a few checks and simplifications. For me it works perfectly. Still missing something?

Code: [Select]

    [...]
    xgcd(k,q,k,k,k);
    [...]
      if (divisible(k, tmp)) fail=1;
    [...]


There is another problem - original value of k gets destroyed during xgcd(...) call, so divisibility check should be done before this call (take a look at my code a few posts above).

[DL5TOR]

you see the ECC parameters in the DSA firmware ? in gel DS2 GEL file its as easy as "strings file|grep ..."
ps: the algo that takes the license string input and converts it to HEX - is more capable than the way its used on the DS2 ... e.g. all kinds of special chars - but i only implemented /reversed what i saw being used by the DS2k.

What do these parameters look like (example)? What are you grepping for? Could viewing the .sys file in a hex editor be the key to this one?

I did just that i opend the sys file in a hex editor and did a serch for the keys that are used  in the ds20000 with no result. One  thing that is poitive is that the mcu is the same

[Orange]

you see the ECC parameters in the DSA firmware ? in gel DS2 GEL file its as easy as "strings file|grep ..."
ps: the algo that takes the license string input and converts it to HEX - is more capable than the way its used on the DS2 ... e.g. all kinds of special chars - but i only implemented /reversed what i saw being used by the DS2k.

What do these parameters look like (example)? What are you grepping for? Could viewing the .sys file in a hex editor be the key to this one?

I did just that i opend the sys file in a hex editor and did a serch for the keys that are used  in the ds20000 with no result. One  thing that is poitive is that the mcu is the same

If you boot the DSA815 it says "decompressing...".
Maybe the sys file is compressed ?

[olsenn]

I did just that i opend the sys file in a hex editor and did a serch for the keys that are used  in the ds20000 with no result. One  thing that is poitive is that the mcu is the same

If the .sys file is just the firmware, perhaps hooking said MCU up to a JTAG debugger and downloading the firmware that way would help. I'm look to see if there is anything I can figure out when I get home; I would really like to see this get hacked

[cybernet]

if somebody wants me to have a look send me such a file ;-) - DS2 fw contains for example the zlib inflate/deflate algo - but there it only seems to be used by the PNG image format.
jtag is definitly the way to go anyway because it eases the process so much. i recommend 20$ amontec jtag key tiny - best invest

[Orange]

DSA815, V1.07

[studio25]

@zombie28
Thank you for your feedback. I slept in 48h only 6h. Now I see clearly what crap I've written.

[true]

Here is optimized signing function with all necessary checks for valid signature generation:

That's a bit cleaner, but we're getting to the point of absurdity now, the thing works and is faster than it needs to be. Still, I'll put this in my updated copy, thanks.

[alank2]

I found this document about clearing/cleaning memory on various Rigol scopes:

http://www.tequipment.net/ProductImages/Rigol/DS1302CA/media/DS1302CA_doc_7.pdf

It mentioned a security clear to clear the NOR FLASH 16MB - I wonder if this could possibly help people with the mangled serial number.  Not likely I realize, but I'll bet that S/N is stored in the NOR FLASH 16MB in some sort of configuration file...

[CodyShaw]

So, what are the downsides to using the keygen (2072)? Are there issues on what FW version it works best on, and reverting is not working as of current, or is it all clear for use for new people?

[cybernet]

attached you will find a FLAIR signature file for IDA pro (you need kraters bfin plugin !) -  it contains around 300 subs that i reversed, (un)fortunately no comments got exported so you are spared by my comments ;-) but it should give a pretty clear indication of MIRACL, Bootloader, USB, the whole ADI stuff, some TWI, SPI routines.

I've tried it with a FW02 file, it gives some results - the blackfin GEL loader is buggy i have to say that, something is not right with the address fixup - so if someone wants to seriously do this i strongly suggest you do a JTAG memory dump - the match rate should then be 100% and u dont have any dead references. for the DG4000 firmware the loader format is slightly different i patched the blackfin loader and i can import it, *but* i will stay put until i get a JTAG memory dump due to above issues. (it is much easier with a memory dump)

i also looked at the DSA file for a couple of hours, not much luck - so far i didnt spot any hidden packed formats, nor any header that looks familiar - i even ran the file completely as it is and ROT13 (they are not *that* stupid ;-) through a disasm, except tons of ILLEGAL opcodes nothing - only thing left thats doable is maybe a filesystem image hidden in there - but binwalk found nothing - so it is packed, crypted etc somehow - im not a DSA owner, but if i were one i would leave the file alone, and do a JTAG dump as well - i saw in daves teardown pics there is a jtag port next to the blackfin - so that should be no issue.

[alank2]

So, what are the downsides to using the keygen (2072)? Are there issues on what FW version it works best on, and reverting is not working as of current, or is it all clear for use for new people?

Some people have experienced a mangled S/N with it changing from 13 digits to a 14 digit that ends in 0001, but I think these are people who tried bandwidth options on the FW 05.

I can tell you that on the latest firmware FW 02 (00.01.01.00.02) that my experience is that a DSAZ code will install without any issues or changes to the S/N and also that you can even uninstall it with the USB SCPI uninstall command and completely go back to stock.

[Orange]

I found this document about clearing/cleaning memory on various Rigol scopes:

http://www.tequipment.net/ProductImages/Rigol/DS1302CA/media/DS1302CA_doc_7.pdf

It mentioned a security clear to clear the NOR FLASH 16MB - I wonder if this could possibly help people with the mangled serial number.  Not likely I realize, but I'll bet that S/N is stored in the NOR FLASH 16MB in some sort of configuration file...

Declassification, or clearing test equipment is probably a mandatory thing in the USA. You see this also on Tektronix, Agilent and Fluke equipment. Every vendor has some sort of document to describe how the secret DMM values can (must) be cleared if the thing leaves the office or premises of the CIA

On the Scope is does only clear the stored stuff, and hopefully not the serial number, but you never know with RIGOL 

[M. András]

hahh according to that pdf file it have 3 damn 32MB ddr2 memory for aquisition, is that sooo expensive to stick a simple pc memory card in the scope for this purpose? and it costs hundreds of dollar premium?

[CodyShaw]

So, what are the downsides to using the keygen (2072)? Are there issues on what FW version it works best on, and reverting is not working as of current, or is it all clear for use for new people?

Some people have experienced a mangled S/N with it changing from 13 digits to a 14 digit that ends in 0001, but I think these are people who tried bandwidth options on the FW 05.

I can tell you that on the latest firmware FW 02 (00.01.01.00.02) that my experience is that a DSAZ code will install without any issues or changes to the S/N and also that you can even uninstall it with the USB SCPI uninstall command and completely go back to stock.

So what can't the keygen unlock? Is it limited to bandwidth?

Or will the keygen unlock the bandwidth too, as long as you weren't messing around trying to get at it in FW 05?

[marmad]

hahh according to that pdf file it have 3 damn 32MB ddr2 memory for aquisition, is that sooo expensive to stick a simple pc memory card in the scope for this purpose? and it costs hundreds of dollar premium?

32MB x 16 bits - so 3x 64MB x 8 bits.

[mickpah]

jtag is definitly the way to go anyway because it eases the process so much. i recommend 20$ amontec jtag key tiny - best invest

seems a nice little jtag, price is good. Pity they can't find a better shipping solution even the cheapest, slowest shipping to the southern hemisphere is 33 euro - for a 45 gram pcb I hate when suppliers do this