Pamela Anderson Hidden in Lecroy Wavepro Oscilloscope Firmware

[james_s]

Knobs slang for breasts? 

The floppy drive makes me laugh. Did they really ever use it when it was even being developed? One of the blokes I work with has an Agilent E5062A network analyser on his desk. It's got a floppy drive whereas the one I've got is the newer 5061B and hasn't. Every now and then the floppy drive seems to check whether there's a disk in the drive and causes the entire system to hold for about 5 seconds. Drives him nuts.

We have a couple TDS5000 scopes at work that have floppy drives, I use the drive somewhat regularly, it works fine. It's not as convenient as an SD card but at the time the scope was made floppy drives were still in widespread use. That LeCroy looks about the same age.

[ivaylo]

Why not let @azalys let them know at twitter?

[ezalys]

The fla file is a loader with zlib compressed firmware. It appears to set up the caches and mmu and other things and then it decompresses the image and jumps into it... nothing too fancy.

[Fungus]

One of the blokes I work with has an Agilent E5062A network analyser on his desk. It's got a floppy drive whereas the one I've got is the newer 5061B and hasn't. Every now and then the floppy drive seems to check whether there's a disk in the drive and causes the entire system to hold for about 5 seconds. Drives him nuts.

Doesn't it occur to him to, ummm, leave a diskette in the drive?

[mc172]

It makes it worse. It tries to read what's on the disk.

[shteii01]

Replace floppy drive with usb floppy drive emulator and use usb sticks: https://www.ebay.com/itm/5V-DC-SFR1M44-U-USB-Floppy-Drive-Emulator-w-1-44MB-Floppy-Drive-Easy-Install/162632652259?hash=item25dda955e3:g:aukAAOSwSutaHXgj

[martinator]

Maybe there is a problem with the autorec.sta file? It could be looking for a machine state that was originally on drive a:

[darkstar49]

I'm pretty sure the mentioned emulator model doesn't fit, as Lecroy only used slim line floppies... but anyway, should be discussed in another thread, if needed... as not much related to this one...  ;-

[timb]

I'm pretty sure the mentioned emulator model doesn't fit, as Lecroy only used slim line floppies... but anyway, should be discussed in another thread, if needed... as not much related to this one...  ;-

You’re right. Based on some of Pamela Anderson’s own home movies, it’s clear she much prefers hard disks over floppy disks. Very, very large hard disks. *Rimshot*

[tv84]

I was just poking around in the firmware image and found an easter egg. Here's how you reproduce it.

If you have the following firmware image... say from the Lecroy yahoo group. It's titled "Wavepro 9XX and DDA260 Firmwave V9.3.0 (Latest)"

Code: [Select]

$ md5 ./vxfusion.fla
MD5 (./vxfusion.fla) = c6bdcdc72ee55bc5d1ae725c657ced51

At an offset of 48465 there's a compressed image.

Code: [Select]

dd if=vxfusion.fla skip=1 bs=48465 of=data.z

Now you can unzip this any way you like... I used gzip with a prepended gzip header

Code: [Select]

$ printf "\x1f\x8b\x08\x00\x00\x00\x00\x00" |cat - ./data.z |gzip -dc > data.raw
gzip: invalid compressed data--crc error

CRC fails, but whatever. Now, at offset 4318044 there's a jpeg header. Curious!

Code: [Select]

dd if=data.raw skip=1 bs=4318044 of=pic.jpg
0+1 records in
0+1 records out
1069348 bytes transferred in 0.001037 secs (1031310783 bytes/sec)

and you get the following image:

https://imgur.com/a/LOnOO (NSFW)

The compressed image is a complete ZLIB block from [0000BD51-001D0EDA] and, as such, has no CRC32. It has an ADLER32 checksum (in this case: 6E569D7E).

Nice find!

[CJay]

Hmm, an HTTP daemon - does that model have an ethernet port on it?

I'm not sure you should try poking an ethernet cable into models, they probably won't like it

[The Soulman]

Hmm, an HTTP daemon - does that model have an ethernet port on it?

I'm not sure you should try poking an ethernet cable into models, they probably won't like it

As long as they don't encounter PoE.

[darkstar49]

as already said, not too sure about the http daemon, but if someone has a better explanation, he/she's welcome...  ;-)
here the (most probably only) function where the image is referenced, no need to be an assembler, nor a web expert to recognise some known stuff... 

[blacksheeplogic]

here the (most probably only) function where the image is referenced, no need to be an assembler

Not well hand written Power assembler. Either the person who wrote this was inexperienced in Power assembler (new to the team at the time).

[darkstar49]

here the (most probably only) function where the image is referenced, no need to be an assembler

Not well hand written Power assembler. Either the person who wrote this was inexperienced in Power assembler (new to the team at the time).

From (that and) other functions around that one, I’d tend to suspect a C compiler... the way registers are used is everything but ‘intuitive’ or ´natural’... and there are often  unnecessary register saving ops, which would be rather unusual for hand-written assembler...

[blacksheeplogic]

From (that and) other functions around that one, I’d tend to suspect a C compiler... the way registers are used is everything but ‘intuitive’ or ´natural’... and there are often  unnecessary register saving ops, which would be rather unusual for hand-written assembler...

For a non-leaf function the stack frame has not followed convention, it's also be grabbed early creating an unnecessary dependency (not typical of a compiler), the use of r29 & r3 is peculiar even for non-optimized output.

[macboy]

This is hilarious. I have one of these scopes (WavePro 960) with the LAN card. I'll have to check the firmware version and try to figure out how to get the http daemon to serve this.

[darkstar49]

Keep us posted !!!
If it doesn’t reply on standard ports, try to perform a portscan to see what ports are active...

[JustSquareEnough]

No response to Dave's lecroy tweet ? I couldn't find it when I searched but saw it come out when he tweeted it...

[videobruce]

You guys have way too much spare time...........................

[NiHaoMike]

I'm not sure you should try poking an ethernet cable into models, they probably won't like it

I can name a model who really likes Ethernet - Joanne Chiang. Of course, that's because she's a gamer and everyone knows gamers like Ethernet way better than Wifi.

Somewhat back on topic, I once embedded a picture of my friend Allie Moore into an OpenWRT image I created for another friend's WRT54G, accessible by opening "eegg.html" on the router IP. I don't think he ever found it.

[Berni]

Inside the software for Keysight Infiniium scopes i found a picture of Jesus.

It is hidden inside the main application exe file as a .NET resource. No idea if the software can be made to actually show the photo but the image file is certainly in there.

[darkstar49]

You guys have way too much spare time...........................

...'not too sure those who found it were looking for that sort of info...   

[Berni]

You guys have way too much spare time...........................

...'not too sure those who found it were looking for that sort of info...   

Well i did have a good reason for it. My scope lost some sample memory size after updating the software from the ancient version that came on it to the latest one.

Oh and Keysight also seams to be internally naming all the Infiniium scopes after dinosaur species, apart from one that's codenamed Toaster.

[darkstar49]

You guys have way too much spare time...........................

...'not too sure those who found it were looking for that sort of info...   

Well i did have a good reason for it. My scope lost some sample memory size after updating the software from the ancient version that came on it to the latest one.

Oh and Keysight also seams to be internally naming all the Infiniium scopes after dinosaur species, apart from one that's codenamed Toaster.

...'didn't have any problem with that... just saying that those who tear firmware images apart are typically not looking for sexy images, and that the whole story is thus not about having too much 'spare' time...