Author Topic: Agilent MSO 5000/6000/7000 - anyone hacked these scopes? (Read 268101 times)

blacknoise · « **Reply #250 on:** July 24, 2014, 12:18:16 am »

I have modified the firmware 4.20.0008 (the last FW for the Windows XP version) on my older MSO9254A to accept any license key without valid HOTIDs and SIGN(atures).

Precisely spoken, after the patch 14 respectively 12 zeros are sufficient for the HOTIDs and SIGN(ature)s in the license file.

For this patch you have to modify about 40 bytes of the code in the file "agscope.exe" using a hex editor.

If an Admin reads this post: Is it allowed to attach here a small (about 9 kbyte) zip file with all informations how to patch the firmware (please excuse my question - i am quite new here...)?

In some weeks i should receive a new Agilent 9xxx with Windows 7 - and of course i will try to "port" my patch to the more actual firmware of this instrument... ;-)

Kind regards

Carrington · « **Reply #251 on:** July 24, 2014, 12:27:55 am »

Quote from: blacknoise on July 24, 2014, 12:18:16 am

If an Admin reads this post: Is it allowed to attach here a small (about 9 kbyte) zip file with all informations how to patch the firmware (please excuse my question - i am quite new here...)?

Hi, welcome to the eevblog forum!

I'm not an administrator, but I don't think there is any problem with that.

Cheers.

blacknoise · « **Reply #252 on:** July 24, 2014, 01:13:37 am »

Than i wish you good luck and much fun with this flood of options... ;-)

Kind regads

blacknoise · « **Reply #253 on:** July 24, 2014, 04:03:12 pm »

Some time ago i tinkerd a simililar license hack for the Agilent MSO54831D with the 5.71.0000 firmware on Windows XP - see the attachement.

Kind regards

eb4fbz · « **Reply #254 on:** July 30, 2014, 08:17:24 am »

Hello,

Someone knows how to remove the Secure Enviroment license? I enabled all the licenses and now i realized that SEC blanks ram settings after power-cycling and can't be disabled

HighVoltage · « **Reply #255 on:** July 30, 2014, 10:15:11 am »

Quote from: eb4fbz on July 30, 2014, 08:17:24 am

Hello,

Someone knows how to remove the Secure Enviroment license? I enabled all the licenses and now i realized that SEC blanks ram settings after power-cycling and can't be disabled

What Model are you talking about?

I think I read somewhere here in this forum to stay away from this SEC option, but I am not sure anymore to what model this was in regards.
I have the MSO7000B Series and enabled all options and have absolutely no problems.

mikeselectricstuff · « **Reply #256 on:** July 30, 2014, 01:29:31 pm »

I'm pretty sure someone found a way to remove SEC - I think it's somewhere in this thread

eb4fbz · « **Reply #257 on:** July 30, 2014, 02:06:43 pm »

MSO6032A. I've read the entire post after my mistake, but no one explains how to remove SEC, just https://www.eevblog.com/forum/testgear/agilent-mso-500060007000-anyone-hacked-these-scopes/msg392716/#msg392716 but doesn't explain it's consecuences and i'm scared, does it remove all licenses?

eb4fbz · « **Reply #258 on:** July 30, 2014, 02:28:03 pm »

Ok, just tried readFeatureRegister, that returned 0xFFFE.
Then writeFeatureRegister(0xFFFF) but all licenses were still there, readFeatureRegister returned 0xFFFF, but after power cycling it's again at 0xFFFE.
Also tested writeFeatureRegister(0x0), that remains at 0 after power cycling, but same licenses are still there, including SEC.

Also tried removing SEC-000000000000-000000000 line from /bin/license.bak but i guess it's just a backup.

dfnr2 · « **Reply #259 on:** July 31, 2014, 05:05:36 am »

How to clear the SEC option for MSO5000/6000/7000 scopes:

This fix is thanks to abyrvalg.

The SEC option clears the lowest bit in a nonvolatile "Feature Register." If this bit is clear, the setup directories /setups,/data,/config, and /masks are remapped from persistent drive C: to ram drive /ram0, to prevent persistent storage of setup information.

If the SEC option is detected at startup, the Feature Register bit is cleared.

In order to permanently clear the SEC option, you must

1) clear the Feature Register (reset to 0xffff)
2) Remove the SEC option from the license file.

Using FTP and Telnet:

1) Telnet into the scope:

Code: [Select]

   $ telnet <ipaddr> 5810

2) log in with panther/pictures
3) clear the feature register:

Code: [Select]

   -> clearFeatureRegister()
   Tffs Drive 0: Programing units 119 to 119
   value = 1 = 0x1

4) copy the license file to /ram0:

Code: [Select]

   -> cmd
   [vxWorks]# cd bin
   [vxWorks]# file copy license.lic /ram0
   copying file license.lic -> /ram0/license.lic

5) FTP to the scope using another terminal or FTP program

Code: [Select]

   $ ftp <ipaddr>
   log in with panther/pictures

6) retrieve the license.lic file:

Code: [Select]

   ftp> cd ram0
   ftp> get license.lic

7) edit license.lic to remove the "SEC" line

8 ) put the license.lic file back on the scope:

Code: [Select]

   ftp> put license.lic

9) from the telnet window, copy the edited license.lic file back to C:/bin:

Code: [Select]

   [vxWorks]# file copy /ram0/license.lic license.lic
   copying file /ram0/license.lic -> license.lic

10) Reboot the scope.

If you don't have an FTP client, but can capture text from the telnet program, you can use the following variant:

Using TELNET only:

1) Telnet into the scope:

Code: [Select]

   $ telnet <ipaddr> 5810

2) log in with panther/pictures
3) clear the feature register:

Code: [Select]

   -> clearFeatureRegister()
   Tffs Drive 0: Programing units 119 to 119
   value = 1 = 0x1

4) list the license.lic file

Code: [Select]

   -> cmd
   [vxWorks]# cd bin
   [vxWorks]# cat license.lic
   ( the license.lic file is listed in the terminal window)

5) select and the license.lic file text from the terminal window and copy to the clipboard.

6) Paste the selection into an editor, remove the line containing the "SEC" option, and select the resulting text, and copy back to the clipboard.

7) re-write the license.lic file:

Code: [Select]

   [vxWorks]# cat > license.lic

8 ) paste the edited license.lic file from the clipboard into the terminal

9) hit Ctrl-D to close and write the license.lic file

10) Reboot the scope.

If you don't have any licenses on the scope that you wish to preserve, the you can skip steps 4-10 in the above procedures. Just delete the license.lic file:

Code: [Select]

   [vxWorks]# cd bin
   [vxWorks]# rm license.lic
   [vxWorks]# reboot

Dave

HighVoltage · « **Reply #260 on:** July 31, 2014, 06:48:41 am »

Thank you so much for this valuable information

eb4fbz · « **Reply #261 on:** July 31, 2014, 10:21:05 am »

Thanks so much!!! I was able to remove SEC license!

You need to write 0xFFFF to License register and remove the SEC-000000000000000-00000000 line from license.lic. I suppose that the register triggers license re-check from license.lic file.

cjpilot · « **Reply #262 on:** October 03, 2014, 12:18:45 pm »

I have a DSO7014B that is in this boot looping cycle where the LED's on the front just cycle and it never starts up. I have tried OVER and OVER the procedure to boot from the Thumbdrive but it will not come up 'Lately'... However over the course of 2 to 3 days I had tried (without the thumbdrive) to turn it off and on every so often and once it came on, which shocked me, I got my thumbdrive that one time and updated All the firmware. I turned it off after that and it has never come back on since. If there are any hints you can give an Old technician on a way to get this Oscope back up and running I would really appreciate it. Another question would be if there is 'ANY' other way to boot OR load the system software onto the scope as I really think that is the problem. Or even a way to maybe link up to the Oscope to monitor what it is actually doing as it is trying to boot up which may lend a hint to what is the problem as it is trying to boot. Thanks in advance for any and all help.

mikeselectricstuff · « **Reply #263 on:** October 03, 2014, 12:38:15 pm »

Quote from: cjpilot on October 03, 2014, 12:18:45 pm

I have a DSO7014B that is in this boot looping cycle where the LED's on the front just cycle and it never starts up. I have tried OVER and OVER the procedure to boot from the Thumbdrive but it will not come up 'Lately'... However over the course of 2 to 3 days I had tried (without the thumbdrive) to turn it off and on every so often and once it came on, which shocked me, I got my thumbdrive that one time and updated All the firmware. I turned it off after that and it has never come back on since. If there are any hints you can give an Old technician on a way to get this Oscope back up and running I would really appreciate it. Another question would be if there is 'ANY' other way to boot OR load the system software onto the scope as I really think that is the problem. Or even a way to maybe link up to the Oscope to monitor what it is actually doing as it is trying to boot up which may lend a hint to what is the problem as it is trying to boot. Thanks in advance for any and all help.

AIUI It should always be possible to boot from the drive using the method of turning on, waiting for the LED test, turning off, then turning on with the USB drive. The code is loaded and run from RAM sho shouldn't be dependent on any earlier FW update. Your symptoms sound like it has a bad FW image, but it should be possible get past this.
Once booted from RAM you can then do a firmware update
Of course it is possible there may be a hardware fault preventing it starting - the fact it came on once could suggest this is the case. At the very least I'd suggest checking all the supply rails coming out of the PSU for voltage and ripple , as PSU issues are quirte common (in general, not on this particular scope) and easy to test for.

cjpilot · « **Reply #264 on:** October 03, 2014, 01:50:21 pm »

Thank you so much for the post. The very first thing I did when it went down was to verify All the Power supply voltages and Regulator voltages per the ''''VERY LIMITED'''' service manual I downloaded online. I may just go over them again to make sure I did not miss anything. It just seems to me that there is a minor problem with it since it did come on that one time and took all the Firmware updates just fine and did all the rebooting while updating, but I could very well be wrong also and it could be a very Major problem... Thanks again.

mikeselectricstuff · « **Reply #265 on:** October 03, 2014, 02:17:00 pm »

Quote from: cjpilot on October 03, 2014, 01:50:21 pm

Thank you so much for the post. The very first thing I did when it went down was to verify All the Power supply voltages and Regulator voltages per the ''''VERY LIMITED'''' service manual I downloaded online. I may just go over them again to make sure I did not miss anything. It just seems to me that there is a minor problem with it since it did come on that one time and took all the Firmware updates just fine and did all the rebooting while updating, but I could very well be wrong also and it could be a very Major problem... Thanks again.

Bear in mind that what it's doing at startup is selftests, but appears to not getting far enough as to be able to display anything.
Did you update the Graphics FW file? This is the FPGA code - dodgy FPGA config might be consistent with failing before display starts.

cjpilot · « **Reply #266 on:** October 03, 2014, 02:36:58 pm »

Updated all Four files. sys7000A.jzp , gsp7000A.jzp , lib7000a.jzp , lpk7000A.jzp And after that I think it only came back on ONE time. And has never come out of the boot loop since...

cjpilot · « **Reply #267 on:** October 03, 2014, 05:59:17 pm »

Is there any way to took link a computer or device to this Oscope to monitor the process of the boot up sequence to possibly see where/what it is hanging up??

Is there any other way to Load the sys firmware onto the machine besides the USB way to get it to boot up??

Would it be to any advantage to try to use an Older version of the SYS firmware on a thumbdrive to see if it would take the older version?? And where might I locate an older version?

Sorry for all the questions but it sure would be nice to be able to get this going without having to send it in.

dfnr2 · « **Reply #268 on:** October 03, 2014, 06:59:28 pm »

Are you able to telnet in to the scope during the looping?

cjpilot · « **Reply #269 on:** October 03, 2014, 07:44:33 pm »

Not sure what that is. I will have to research this and find out what hookups are necessary and what software I will need.

cjpilot · « **Reply #270 on:** October 06, 2014, 07:23:47 pm »

From what I am reading about linking up to the Oscope you need to actually gain access to the menu's in the Oscope to tell it you are trying to Link with it over the Network OR Direct to your PC?

Maybe I am not reading about this correctly but since my Oscope wont even boot I dont think I would be able to SEE/TALK to the Oscope?? Thanks again everyone for all your comments to try and help me to get this to boot up again. And if anyone at all has any more ideas I welcome your input and thank you ahead of time very much.

bitrat · « **Reply #271 on:** October 14, 2014, 03:50:32 pm »

Quote from: blacknoise on July 24, 2014, 01:13:37 am

Than i wish you good luck and much fun with this flood of options... ;-)

Kind regads

it works! Thx soooooooo much!

And I think the only reason why there's no reply for the wonderful hacking is few people have a 9000 series scope.

Look forward to your next surprise.

cjpilot · « **Reply #272 on:** October 23, 2014, 02:23:45 pm »

Just had another of these scopes DSO7014B go into the Boot Looping Cycle. WOW. It is like an EPIDEMIC around here. Now the total is at Three of them. The first one has never responded again and continues to Loop. The second one 'Finally' read from the USB drive and booted and I updated ALL 4 files -- and it was fine for 3 weeks being turned on/off every other day, But I just tried it again and it has failed. Now a third one is Looping, and it Will Not boot for the USB drive either. I have questioned the person that was using it when this third one went out and here is what they said..." I pushed the ON button and just after that (about 2 seconds) I inserted my USB Thumbdrive and all I got was those looping lights". If anyone out there might have any more ideas about solving this boot up issue I would really appreciate it so very much. Thanks in advance.

alex.forencich · « **Reply #273 on:** October 23, 2014, 04:10:55 pm »

Try putting all of the update files on the root of an empty flash drive and boot the scope with the drive plugged in. I think I may have run into this issue before when an update did not compete successfully. The scope should have a failsafe boot loader that can boot off of the flash drive. Reinstall all four files when it boots up, then reboot it again.

cjpilot · « **Reply #274 on:** October 23, 2014, 05:50:20 pm »

Thank you so very much for the reply/suggestion. I have already tried that several times with all three scopes. I really hate to have to send these in for repair as I know they will change the mainboard and it will be very very expensive. Thanks again.


EEVblog Main Site	EEVblog on Youtube	EEVblog on Twitter	EEVblog on Facebook	EEVblog on Odysee

Author Topic: Agilent MSO 5000/6000/7000 - anyone hacked these scopes? (Read 268101 times)

Share me