DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?

[PA0PBZ]

im not in hurry to contact keysight and this scope not my primary instruments i m using older scopes as primary..lets experiments

Alright, get a LAN card an read this: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1022248/#msg1022248

and this: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1022267/#msg1022267

[ELIK]

Hello all
Fight now with MSOX3034T. Did the 350mHz -> 1Ghz bandwidth successfully - mega-thanks to memset  (resolder just one strap resistor only, 46.4K to 78K.  In the channel filters was already the coils with 5 turns).

Now want to add licenses to my scope. Try to disassembly the dll extracted from last update pack for my MSOX3000. I see that now this DLL have much increased size against same DLL by pack 2.42 for MSOX3000A (40mb against just 10mb)...

By the way, for version 2.42 the patch address in the infiniiVisionCore.dll will be 0x27C7A4 ("04 00 a0 e1" to "00 00 a0 e3")

[pacmac]

Finally decided today to try and enable the un-enabled modules on my 2000 series, which thanks to @memset worked great.

The only problem I have (which I can live with) is that during bootup I get a warning:

Code: [Select]

System concerns detected
OS Version is not correct, please reload system firmware.

Now before the attempted the usb mod, I had already updated to version 42 and reading thru the threads found that 42 was not mentioned, so first I downgraded to version 41 before starting, that succeed with no warnings.

So I have 2 questions:

1) Does everyone else also get this warning message ?
2) If I re-upgrade to 42, will the mod persist and will it break it ?

Update

I can confirm that @memset's 2.41 fix also works on 2.4.2.

[RossS]

Now want to add licenses to my scope. Try to disassembly the dll extracted from last update pack for my MSOX3000. I see that now this DLL have much increased size against same DLL by pack 2.42 for MSOX3000A (40mb against just 10mb)...

Are you working with firmware version 4.08.2016071801?

I've been trying at this, but even an unpatched infiniiVisionCore.dll from the firmware image is giving me issues. With CFF Explorer, you can see its header has the machine type set to MIPS R4000, yet the disassembled instructions only make sense if you treat it as ARM.

Putting the DLL as-is into \program files\infiniiVision\ and re-launching infiniiVisionLauncher.exe gives this error:

Code: [Select]

System.MissingMethodException: Can't find PInvoke DLL 'infiniiVisionCore.dll'.
   at Agilent.InfiniiVision.infiniiVisionLauncher.Main(String[] args)
Forcibly setting the machine type to ARM Thumb in the DLL header (matching the DLL for the 2000X series) with no other changes and re-launching causes an immediate crash with the scope rebooting after checking file system integrity.

The file size of the DLL from the firmware image is actually slightly smaller than what's on the scope in ROM under \windows\ (36315896 bytes vs. 37348672). Unfortunately with the scope's copy in ROM, there's no easy way to copy it off. I haven't yet found a recovery program compiled for windows CE on ARM that can do this successfully.

I've found what appears to be the correct place in the file to patch, but that's useless without without being able to run it.

Can anyone theorize on why the DLL from the firmware image appears slightly malformed? Most other DLLs are like that as well, but some of them have the correct ARM Thumb header. There's also some infiniivision stuff on .NET that's completely intact which I've been able to patch and make the scope run successfully, but I haven't yet found anything actually useful to patch there.

[Daxxin]

while waiting for lan card i try some ...I think last time i tried usb 2.35 usb mod not prepared the stick in a proper way now i guess is ok but i get this..

GMAC DMA status register = 0x0
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Running infiniiVisionInstallHelper
Failed to start/configure network.
Starting ProcessStartupFolder
ProcessStartupFolder: \usb\Startup\
                                   running \usb\Startup\infiniivision.lnk...
System.MissingMethodException: Can't find PInvoke DLL 'AgilentLicensingUnmanaged.dll'.
   at Agilent.Cdf.Api.Licensing.Compact.LicenseSupervisor.b.a.f()
   at Agilent.InfiniiVision.infiniiVisionLauncher.Main(String[] args)

Ending ProcessStartupFolder

where's the _setup.xml file? cant find it

[PA0PBZ]

where's the _setup.xml file? cant find it

It's inside the infiniiVisionSetup.cab which is inside the firmware update .cab

I attached the 2.35 one as .txt

[Daxxin]

while waiting for lan card build from prof pcb fab i have build my own this the log now..
sorry PA0PBZ to bother u ..can u make short description or pm.. me about celoader ip..folders files etc

GMAC DMA status register = 0x0
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Running infiniiVisionInstallHelper
Running ConfigureNetworkNative
Loading \Agilent Flash\config\networkSettings.xml configuration file.
Waiting for network to configure.
<?xml version="1.0"?>
<networkConfig><dhcp>true</dhcp>
<ipAddress>146.223.229.241</ipAddress>
<subnet>255.255.255.0</subnet>
<gateway>146.223.229.1</gateway>
<dnsServer>192.25.42.10</dnsServer>
<hostName>a-dx2012a-64560</hostName>
<domainName></domainName>
<adapterName>GMAC1</adapterName>
</networkConfig>

Failed to start/configure network.
Starting ProcessStartupFolder
running \Secure\Startup\infiniivision.lnk...
Before P/Invoke
Ending ProcessStartupFolder
                           Exception 'Undefined Instruction' (1): Thread-Id=033f000e(pth=837d0a5c), Proc-Id=03f900ba(pprc=837d0744) 'infiniivisionLauncher.exe', VM-active=03f900ba(pprc=837d0744) 'infiniivisionLauncher.exe'
PC=4122dcf0(infiniivisioncore.dll+0x0051dcf0) RA=411b557c(infiniivisioncore.dll+0x004a557c) SP=0002f1d4, BVA=00000000
Exception 'Undefined Instruction' (1): Thread-Id=033f000e(pth=837d0a5c), Proc-Id=03f900ba(pprc=837d0744) 'infiniivisionLauncher.exe', VM-active=03f900ba(pprc=837d0744) 'infiniivisionLauncher.exe'
PC=4122dcf0(infiniivisioncore.dll+0x0051dcf0) RA=411b557c(infiniivisioncore.dll+0x004a557c) SP=0002f1d4, BVA=00000000
System.MissingMethodException: Can't find PInvoke DLL 'infiniiVisionCore.dll'.
   at Agilent.InfiniiVision.infiniiVisionLauncher.Main(String[] args)

[PA0PBZ]

Ok, short description of celoader, not in pm because others could be interested too.

If you boot the scope and halt the boot process by pressing <space> (RS232) you either end up in uboot (something I never managed to do) or in the celoader menu, depending on timing. One of the options in the celoader menu is "Download from platform builder", where you can boot from another system file by presenting a NK.BIN file over the LAN. Offering the file is what the celoader.exe I posted does: it listens for a BOOTME request and then sends the file to the target.

So what you have to do is uncompress the NK.BIN.COMP from one of the firmware update files into NK.BIN, put celoader.exe and NK.BIN in the same folder on a windows machine and start celoader.exe using the dos prompt. Uncompressing the COMP file can be done by a tool posted earlier in this thread, or I can post the tool when I'm home if you can't find it.

Now boot the scope, halt the boot process in the ce loader using <space> and select option d) Download from platform builder.
Once the scoop has booted your screen will stay blank (it will not run the infiniivision stuff) but you will be able to telnet into the scope.

After that you can/will have to find out what is wrong with your file system.
However, it could be that you are able to telnet into the scope as it is now because it looks like it fails to load the scope software and Windows CE could be fine.

[Daxxin]

thanks i did some steps but still not yet focused , i can stop serial connection in two way ..if i press space very early it stop to boot on uboot
where u have lots commands  with help.. i was even able to change ip with 'setenv ipaddr xxx.xxx.xxx.xxx'
here:

Using smsc device
TFTP from server 146.223.241.7; our IP address is 192.168.1.212; sending through gateway 192.168.1.35
Filename 'nk.bin.comp'.
Load address: 0x800000
Loading: T T T T T T T T T T

even i changed ipaddress , serverip and gatewayip (pointing to my pc with nk.bin) and saved with saveenv it still looking for old env


If i type space key a little bit late it stop in an advanced step where is shown 4 options

Mac address .......... (00:30:D3:20:E7:70)
Ip address ........... (192.168.1.36)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (0)
Load image 1 at startup

Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
        1 (0xd0600000)
        2 (0xd1600000)

l) Load flash resident image now
d) Download from ethernet now
u) Start u-boot by resetting
v) Verify Images
>System ready!
Preparing for download...
 Downloading image from platform builder
Setting MAC address GMAC_MAC_ADDR_HI_LO[0] = 0x800070E7, GMAC_MAC_ADDR_HI_LO[1] = 0x20D33000
Auto Negotiation complete in 170353 iterations
Link up
AutoNegotiate Full Duplex
AutoNegotiate 100 Base T
Reading MAC address 0x30 0xD320 0xE770
Setting MAC address GMAC_MAC_ADDR_HI_LO[0] = 0x800070E7, GMAC_MAC_ADDR_HI_LO[1] = 0x20D33000
INFO: GMAC Ethernet controller initialized.
InitDHCP():: Calling ProcessDHCP()
ProcessDHCP()::DHCP_INIT
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)

typing 'd' hangs after this messages .. . im monitoring with wiresharks there activity from scope ipaddress to pc ip

ps.s i start celoader.exe without params ..is that correct?

[PA0PBZ]

typing 'd' hangs after this messages .. . im monitoring with wiresharks there activity from scope ipaddress to pc ip
ps.s i start celoader.exe without params ..is that correct?

Yes, just celoader without params should work. Did you place NK.BIN (not NK.BIN.COMP!) in the same folder?
Are both the scope and celoader on the same subnet?

[Daxxin]

yes same subnet but with the advanced boot when i oress 'd' in wireshark i get request from ip 0.0.0.0 thats weird

[PA0PBZ]

Strange... This is what my scope does when halted in the CE Loader:
(As said earlier, I was never able to stop it in uboot)

U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  internal ecc 128 MiB

Debug serial initialized ........OK
RTC: 2016-9-3   21:5:45.25 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built May  7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008



P500 Boot Loader Configuration :

Mac address .......... (00:30:D3:XX:XX:XX)
Ip address ........... (192.168.1.190)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (0)
Load image 1 at startup

Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
        1 (0xd0600000)
        2 (0xd1600000)

l) Load memory resident image Load image 1 now
1) Load memory resident image 1 now
2) Load memory resident image 2 now
3) Load memory resident image 3 now
d) Download from platform builder now
u) Start u-boot by resetting
v) Verify Images

[PA0PBZ]

yes same subnet but with the advanced boot when i oress 'd' in wireshark i get request from ip 0.0.0.0 thats weird

Do you have a DHCP server?

[Daxxin]

i was able to boot from tftpd64 the nk.bin.com it loaded successful but i cannot connect with telnet
if i ping pc from scope is alive but if i ping the scope from pc unrearchable ..from wireshark boot address visible  ..very confused

no dhcp installed , or maybe my adapter not working fine.. tx or rx wrong wont able to load nk.bin.comp image too i guess

[PA0PBZ]

nk.bin.comp

As far as I know you can't use nk.bin.comp, see above.

if i ping pc from scope

How can you do that if you can't login?

no dhcp installed

You need DHCP to give the scope an IP address

[Daxxin]

nk.bin.comp

As far as I know you can't use nk.bin.comp, see above.

if i ping pc from scope

How can you do that if you can't login?

no dhcp installed

You need DHCP to give the scope an IP address

what i did i just loaded nk.bin.com through ftpd server and sending/checking through serial terminal connection from the earlier
uboot interface just type ftpboot after assigned all the ip's with 'setenv' + 'saveenv' for sure something is wrong even all files transfered
it cant ping itself looks like a firwall armored ip   

to assign ip by dhcp you set your scope ip 0.0.0.0 ?

[Daxxin]

OK now i was able to assign ip and load image to scope with celoader but still get errors

[0]: Address=0x80361000  Length=0x130656C  Name="" Target=RAM
 Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
Got EDBG_CMD_JUMPIMG
Got EDBG_CMD_CONFIG, flags:0x00000000
Launching windows CE image by jumping at address 0x  362000

Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built May 20 2014)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\GPIO\.\sh600_gpio_hw.cpp line 170: GPB driver, RegQueryDword('ISTPriority') failed, status:2
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\GPIO\.\sh600_gpio_hw.cpp line 170: GPB driver, RegQueryDword('ISTPriority') failed, status:2
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 00:30:D3:20:E7:70
Phy found addr 31 (ticks=2891)
WaitForLink Start (ticks=2893)
Link Detected (ticks=2896)

 GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
Flushed Transmit Buffer
phyCfg->dwSpeed 0x64
<--EDeviceInitialize

GMAC DMA status register = 0x600004
GMAC Device enable interrupt
DriverStart
GMAC Device enable interrupt
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Autonegociation Start (ticks=4919)
+StartAutoNegotiation: pDeviceContext 0xd0578fa0
Autonegociation End (ticks=7930)
WaitForLink Start (ticks=7931)
Link Detected (ticks=7934)

 GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
cable attached
Running infiniiVisionInstallHelper
Running launchNetworkServices
Starting Agilent LXI Services.
Time for NANDFLASH to load: 0 ms.
Time for SNANDFLASH to load: 0 ms.
System.MissingMethodException: Can't find an Entry Point 'RegisterNativeCompactLicensingCallbacks' in a PInvoke DLL 'Agilent.Cdf.Api.Unmanaged.dll'.
   at Agilent.Cdf.Api.Licensing.Compact.LicenseSupervisor.g.a.c()
   at Agilent.Cdf.Api.NativeInterop.RegisterNativeCallbacks()
   at Agilent.InfiniiVision.infiniiVisionLauncher.Main(String[] args)

[PA0PBZ]

to assign ip by dhcp you set your scope ip 0.0.0.0 ?

No, you set DHCP ON in the scope app, but yeah...
Fortunately it's on by default, so if you have a DHCP server in your network it should assign an IP address.

OK now i was able to assign ip and load image to scope with celoader but still get errors

Does telnet work now?

Are you using a NK.BIN from the same firmware version that is installed on the scope?

[Daxxin]

Are you using a NK.BIN from the same firmware version that is installed on the scope?

to tell  dont know yet what firmware is installed there is a way to discover ?
this error because i forgot to plug usb stick ..maybe?
my wince cab manager seems don't extract all files ..all files with truncked file names and _setup.xml

[Daxxin]

really dont know what i did exactly but the scope is started after i load 1.10 nk.bin and inserted the usb stick with extracted infiniivision and startup folder

Windows CE Kernel for ARM (Thumb Enabled) Built on Jun 16 2009 at 10:08:15
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Mar 16 2011)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
-EDeviceLoadEeprom 00:30:D3:20:E7:70
Phy found addr 31 (ticks=2757)
WaitForLink Start (ticks=2759)
Link Detected (ticks=2762)

 GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
Flushed Transmit Buffer
phyCfg->dwSpeed 0x64
<--EDeviceInitialize

GMAC DMA status register = 0x600004
GMAC Device enable interrupt
DriverStart
GMAC Device enable interrupt
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Running ceCreateUserAccounts...
Creating infiniivision user account: SUCCESS
Running infiniiVisionInstallHelper
Autonegociation Start (ticks=4786)
+StartAutoNegotiation: pDeviceContext 0xd0573960
Running ConfigureNetworkNative
Autonegociation End (ticks=7797)
WaitForLink Start (ticks=7798)
Link Detected (ticks=7801)

 GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
cable attached
Loading \Agilent Flash\config\networkSettings.xml configuration file.
TIMEOUT waiting for IsNetworkReady
<?xml version="1.0"?>
<networkConfig><dhcp>true</dhcp>
<ipAddress>146.223.229.241</ipAddress>
<subnet>255.255.255.0</subnet>
<gateway>146.223.229.1</gateway>
<dnsServer>192.25.42.10</dnsServer>
<hostName>a-dx2012a-64560</hostName>
<domainName></domainName>
<adapterName>GMAC1</adapterName>
</networkConfig>

Failed to start/configure network.
Starting ProcessStartupFolder
ProcessStartupFolder: \usb\Startup\
                                   running \usb\Startup\infiniivision.lnk...
Ending ProcessStartupFolder
                           Before P/Invoke
Our command line is -l All -l SCPIPS
Performing Startup

      creating \Agilent Flash\webupdate\Released build, Mar 16 2011, 10:32:42
Initializing FPGA...
****
FPGA Type: Idaho
Ver: 1.087 Released
Build Time: Wed Jan 04 19:40:14 2012
Build Machine: DW3647M2
****
Programming LAN option module...
Module option FPGA DONE bit should be LOW at this pointKeyboard firmware version mismatch, 26 (binary) vs 31 (keyboard)
Programming keyboard firmware...
  Initializing UART... ok
  Unlocking flash memory... ok
  Erasing flash memory... ok
  Blank checking... ok
  Writing memory... ok
  Verifying memory... ok
New keyboard firmware version 1.026... ok
Keyboard Info: Firmware version 26, Board id 7, Board rev 2
Startup sequence is complete.
Saved configuration invalid
System has been running 81.905029 seconds
Start Up Sequence 58.996056
Memory Load 49%
   System Physical Memory 38.336 / 79.695 MB
   Process Virtual Memory 43.250 / 1024.000 MB
-----> InfiniiVision is running <-----

[plesa]

Congratz. So I will guess that scope was using 1.10 before bricking

[TheAmmoniacal]

Anyone got recommendations (tips/tricks) on how to attack the InfiniiVision 1000 X-Series? Unlock the three licenses DSOX1EMBD, DSOX1B7T102 and DSOX1AUTO.

USB connection only, no firmware available yet.

[Daxxin]

Anyone got recommendations (tips/tricks) on how to attack the InfiniiVision 1000 X-Series? Unlock the three licenses DSOX1EMBD, DSOX1B7T102 and DSOX1AUTO.

USB connection only, no firmware available yet.

thanks but i think this old version infiniivision/skywalker1977 password is incorrect ..cannot log in telnet

[PA0PBZ]

Congratz. So I will guess that scope was using 1.10 before bricking

I don't think so, it downgraded the keyboard firmware:

Keyboard firmware version mismatch, 26 (binary) vs 31 (keyboard)

thanks but i think this old version infiniivision/skywalker1977 password is incorrect ..cannot log in telnet

Did you try twice? If that doesn't work try a more recent nk.bin?

[PA0PBZ]

Anyone got recommendations (tips/tricks) on how to attack the InfiniiVision 1000 X-Series? Unlock the three licenses DSOX1EMBD, DSOX1B7T102 and DSOX1AUTO.

Does it have a RS232 console port? I'd start by logging the boot sequence.