It's been done: The Keysight 1000 X-Series DSOs run Doom!

[ginbot86]

I'm really proud of myself with this hack. It took a lot of work to eventually gain access to the Windows CE desktop on my DSOX1102G. After successfully doing so, I decided to do what needed to be done, making my scope run Doom.

Check out the blog post here:
https://ripitapart.com/2018/10/15/gaining-access-to-the-windows-ce-desktop-and-doom-on-the-keysight-dsox1102g-oscilloscope/

[Berni]

Nice work!

Not sure what useful things could be done from this but it is cool to see. Perhaps we could run some extra software in the background of the main scope app to add some new functionality. Win CE has .net framework so its easy to write software for it in C# and remotely debug it too.

[ginbot86]

So far it seems applications are kind of limited. Launching the oscilloscope software results in the WinCE window elements being drawn on top of the InfiniiVision software, and it's rather unstable in this mode. However, with local command-line access, firmware operations could be a bit easier to do without blindly mucking around since we now have an interactive in-system environment to work with.

[HighVoltage]

Very impressive hack

[Keysight DanielBogdanoff]

Wow! Nice hack, that looks like it was quite the project!

[T3sl4co1l]

What's the CPU on that thing, anyway?  x86?  Do you need anything special to run that, or is it literally DOOM2.EXE (or chocolate-doom.exe and related files, or..)?

Tim

[ginbot86]

It's running on an ARM-based SPEAr600 SoC. All you need is an ARMv4i WinCE or .NET binary.

I'm using the ARM build of Chocolate Doom for WinCE.

[EEVblog]

  

[thm_w]

What's the CPU on that thing, anyway?  x86?  Do you need anything special to run that, or is it literally DOOM2.EXE (or chocolate-doom.exe and related files, or..)?

Tim

https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/
https://www.st.com/en/microcontrollers/spear600.html

It's running on an ARM-based SPEAr600 SoC. All you need is an ARMv4i WinCE or .NET binary.

I'm using the ARM build of Chocolate Doom for WinCE.

link?
I didn't see it here: https://github.com/chocolate-doom/chocolate-doom/releases

edit: extracted cab is attached from OPs link below. You need to copy these files to the device, copy the wad file, then run setup to choose resolution, etc. then run chocolate-doom.exe -iwad "/location/doom.wad"
Shareware version of wad file is here: ftp://ftp.fu-berlin.de/pc/msdos/games/idgames/idstuff/doom/win95/doom95.zip

[ginbot86]

It's available in their v1.3.0 archive: http://www.chocolate-doom.org/downloads/1.3.0/chocolate-doom-1.3.0-wince.cab

I don't remember if it actually was able to extract itself on the scope. If not it can be manually extracted (or I could just share a link to it on Dropbox or something).

[rsjsouza]

That is quite a nice hack. Very impressive.

[FERCSA]

Nice! I waited for a write up for a while, since I saw your first posts in the 1000X thread. You're the guy who hacked the iphone's battery (HDQ) too, right? (after a quick search on your site, yes)
I still have my ev2300 somewhere

Do you have any intention to tap onto the SPEAr600's jtag port? Or look into the infiniiVisionLauncher.exe with some r.e. tool?

[ginbot86]

Yep, that's me! Admittedly I've stalled out mostly on the battery fuel gauge front ever since TI stopped their sample program for hobbyists and students. I intend to clean up my program and release the source (including experimental Data Flash code) but it's faaaaar on the back burner.

I probably won't open my scope until after the warranty's expired on it, but at least the application binaries are extractable from the .ksx firmware update file. The furthest I've done with reverse-engineering the programs on the scope is just searching for text strings.