New Agilent scopes

[ferkapu]

One more: Is there a way to modify the serial nr. or model nr.?

[tnt]

This scope came with v1.x firmware installed and allowed to sign your own license files using the leaked key
In v2.x Agilent.Cdf.Api.dll has been updated and has some interesting strings:
SecureDataTool_DTDLeaked
SecureDataTool_DTD2
So new scope's probably use a different keyset

I just had a look and I see

SecureDataTool_DTDLeaked, PublicKey=002400000480000094000000060200000024000052534131000400000100010055EC267A0181512A09EB5A7AE847BDD5ED95332840E04594BC4F779A8EF8F2C974A3EAC4A782D0C71383CEAD1845C0A2D1251DB9180F83F8CB1C6D27E5C5FD6E0272288CC9A036B9C55DE614A201C6D9EBEE088E38965AFF890295647CA4C15A408BBC1CC55873A4BDA91471EA3FC41D1947ADA623C1241AD51F573F7765AED7

SecureDataTool_DTD2, PublicKey=002400000480000094000000060200000024000052534131000400000100010055EC267A0181512A09EB5A7AE847BDD5ED95332840E04594BC4F779A8EF8F2C974A3EAC4A782D0C71383CEAD1845C0A2D1251DB9180F83F8CB1C6D27E5C5FD6E0272288CC9A036B9C55DE614A201C6D9EBEE088E38965AFF890295647CA4C15A408BBC1CC55873A4BDA91471EA3FC41D1947ADA623C1241AD51F573F7765AED7

But. ... they're the same.



PS: These are public keys so there isn't any legal implication about posting them.

[benemorius]

This scope came with v1.x firmware installed and allowed to sign your own license files using the leaked key
In v2.x Agilent.Cdf.Api.dll has been updated and has some interesting strings:
SecureDataTool_DTDLeaked
SecureDataTool_DTD2
So new scope's probably use a different keyset

I just had a look and I see

SecureDataTool_DTDLeaked, PublicKey=002400000480000094000000060200000024000052534131000400000100010055EC267A0181512A09EB5A7AE847BDD5ED95332840E04594BC4F779A8EF8F2C974A3EAC4A782D0C71383CEAD1845C0A2D1251DB9180F83F8CB1C6D27E5C5FD6E0272288CC9A036B9C55DE614A201C6D9EBEE088E38965AFF890295647CA4C15A408BBC1CC55873A4BDA91471EA3FC41D1947ADA623C1241AD51F573F7765AED7

SecureDataTool_DTD2, PublicKey=002400000480000094000000060200000024000052534131000400000100010055EC267A0181512A09EB5A7AE847BDD5ED95332840E04594BC4F779A8EF8F2C974A3EAC4A782D0C71383CEAD1845C0A2D1251DB9180F83F8CB1C6D27E5C5FD6E0272288CC9A036B9C55DE614A201C6D9EBEE088E38965AFF890295647CA4C15A408BBC1CC55873A4BDA91471EA3FC41D1947ADA623C1241AD51F573F7765AED7

But. ... they're the same.



PS: These are public keys so there isn't any legal implication about posting them.

That key is still in the firmware, but it's only used if the serial number is old enough. See post #590

[tnt]

Yes I know, but both those keys are from the newer firmware. For some reason the same key is present twice under 2 different names.
The _DTDLeaked is an obvious name for the old one, but I would have expected the _DTD2 to be the newer keys used for new scope, but it's obviously not because it's the _same_ public key ...

So under what name is the newer key stored in the fw ?

[benemorius]

Yes I know, but both those keys are from the newer firmware. For some reason the same key is present twice under 2 different names.
The _DTDLeaked is an obvious name for the old one, but I would have expected the _DTD2 to be the newer keys used for new scope, but it's obviously not because it's the _same_ public key ...

So under what name is the newer key stored in the fw ?

I don't think I ran across any of the names you're talking about. As I recall, there was basically some code that did something like:

Code: [Select]

RSAParameters result;

int whichKey = someMethod(secureDataStorage->getSerialNumber());

if(whichKey == 0)
   result.modulus = "...";
else if(whichKey == 1)
   result.modulus = "...";
else if(whichKey == 2)
   result.modulus = "...";

return result;

Actually now that I think about it, it may have been determined by the divisionId and not the serial number. I stopped looking in to it after seeing the two extra keys so I probably shouldn't try to be too specific about the exact details. Either way, it was determined by something located in secureStorage, so if that could be accessed and modified then it would appear to be possible to get a new scope to use the original key again.

[SrS]

I think the "PublicKey=00240..." is information about the certificate used to sign the executables, not the license file.

Actually now that I think about it, it may have been determined by the divisionId and not the serial number.

Its determined by the last part of the InstrumentID, this is something like "modelnumer serialnumber date"
This is set when initializing the scope using the SecureDataTool.

Anyone knows what the securestorage is or where its located?

[ferkapu]

Let we complete the 3000 firmware line.

Here are the fw1.10, 2.12, 2.20: http://s3.toldacuccot.hu/dl.php?sid=7f8145a7a2dbaa324d84d44e5d01216a&file=1.10_2.12_2.20.7z

Please share the other ones.

Nobody to share the other versions? 

[benemorius]

Its determined by the last part of the InstrumentID, this is something like "modelnumer serialnumber date"
This is set when initializing the scope using the SecureDataTool.

Ah yes. That sounds right. As I recall, they just added a "0" "1" or "2" on to the end of the id string to select one of the keys. There was a separate check for an id without the extra character on the end which caused it to default to the original key.

[_Sin]

I wonder if the unfortunately leaked secure data tool could be used on a newer scope to reset/change the keys and/or serial number.

[benemorius]

I wonder if the unfortunately leaked secure data tool could be used on a newer scope to reset/change the keys and/or serial number.

I wondered that as well since that does of course seem to be its intended purpose. I had assumed initially that the tool was a standard windows program that accessed the scope via usb from a host computer, but it actually seems to be a wince binary meant to run on the scope itself. Unfortunately I don't know a lot about windows, much less wince, so I haven't really been able to take a serious look at this possibility.

[SrS]

Still you have to set the date back to 2011 before you re-initialize the scope.
So
1) Find a way to downgrade the scope to one of the v1.x firmware, maybe using the same sort of trick done by the Rigol's
2) Set the date back as far as you can with the firmware
3) Include the securedata tool in the firmware cab and modify the recipe.xml to clear the secure storage and initialize it with your model/serial

[_Sin]

How does the scope actually authenticate the update package? i.e. how does it know that it's valid, and/or that the version is newer?

I've not looked in detail, but it seems that it's just cab file with a script in it that runs things on the scope to update stuff. Obviously somewhere it's doing a bit more than that, and if you can't put a previous version on there's a check going on, but what is it actually checking, and how?

I'd expect at least a version number and some kind of signature, but I couldn't see where they are.

I've no need of this personally, so I'm not really inclined to poke around too much (plus, I have work to do!), but these sorts of things make me curious.

[ferkapu]

Can somebody confirm that on 3000series fw2.xx trials can be used forever?

[Hypernova]

Can somebody confirm that on 3000series fw2.xx trials can be used forever?

Now where did you get that idea from?

Oh yeah, I tried out the trial for the Spectrum Visualizer for the scope.
http://www.home.agilent.com/en/pd-2118936-pn-64997A/agilent-spectrum-visualizer-asv-software?cc=US&lc=eng

It's... pretty crap (for the 500USD they ask for it), the update rate is abysmal and the FFT resolution is poor too even though the scope is capable of much finer resolution. Even though the whole point is so you can do FFT waterfall the low refresh rate renders it unusable.

[hooj]

Guys, can someone explain me one thing, for example DSOX3012A.
It's 2 channel puppy but on the picture I can see it has all 4 BNC connectors:
http://www.home.agilent.com/ru/pd-1947496-pn-DSOX3012A/oscilloscope-100-mhz-2-channels?nid=-33573.970763&cc=RU&lc=rus
Is it so? DSOX3012A will have 4 channels but only 2 will work?
Can it be upgraded to DSOX3014A just with license purchase?
Or every DSOX3012A pictures are not true?

[lewis]

That's a picture of the 4-channel version.

Here's what the 2 channel version looks like:


Have a look on Google images

[hooj]

Ok, I see, Agilent site fool me 

[Hydrawerk]

I don't think there is alternate trigger. 

So what? When there is no alternate trigger on Agilent  DSOX2000, is it possible to get a stable view of two signals with a bit different frequency? (Yes, you can always use the RUN/STOP button. )

[mikeselectricstuff]

I've only ever seen alt trigger on a few cheaper scopes - not really sure why you'd want it - I suppose there might be some rare situations where you need to see the shape of 2 unrelated signals simultaneously. 

[Hydrawerk]

I saw the MSOX2014A on a trade fair www.amper.cz, so I took a few screenshots.

[ToBeFrank]

New firmware available:
2000
3000

The 2000 got some serious love:

• SW option DSOX2MEMUP has been added to allow all channels up to 1 Megabyte of MegaZoom acquisition memory.
• The standard memory has been upgraded to 100 Kilobytes of MegaZoom acquisition memory per channel.
• SW option DSOX2EMBD has been added to support hardware accelerated I2C and SPI serial triggering and analysis, including decode, lister, and search capabilities.
• SW option DSOX2AUTO has been added to support hardware accelerated CAN and LIN serial triggering and analysis, including decode, lister, and search capabilities.
• SW option DSOX2COMP has been added to support hardware accelerated RS232/UART serial triggering and analysis, including decode, lister, and search capabilities.

[Hypernova]

A heads up for people that have their scope refusing the .cab, try a secure erase. It's under save/recall.

[Hydrawerk]

https://www.eevblog.com/forum/reviews/my-new-toy-%29-agilent-dsox2002a-sex-on-a-stick!/30/

[rf-loop]

I've only ever seen alt trigger on a few cheaper scopes - not really sure why you'd want it - I suppose there might be some rare situations where you need to see the shape of 2 unrelated signals simultaneously.

Are you kidding?

Simplest possible example from yesterday. I want compare two separate signal generator waveforms. Both generators have its own clock. (they are not sync with each other but I want look and compare signal shapes conformity with several different settings. Without ALT trig I waste lot of time and time is money.)

Gen 1 to CH1 and Gen 2 to CH2 and compare wafeforms shape, scope to ALT mode. Set CH1 and 2 triggers and go...

How you do it without ALT trig. And this was just as simplest possible example.

ALT trig have been normal feature in oscilloscopes as long as I remember.
And this is not enough, there is also ALT trig with real dual timebase. (in history and today but these are not usual in entry level cheap scopes)

In analog scopes specially it is very normal feature in all professional analog scopes (I do not remember any scope what do not have it).

And even more, one Tektronix have real dual beam (not only dual trace) expensive model what have real dual independent beam in same CRT.

There is many situations where is useul to look two signals what are not sychronized and not only dual trace...

I think if there is not ALT mode it is just exeption.

If there is ALT trig with dual timebase this is littlebit more rare but also nice useful feature in many lab work.

But of course I have only around 40 years experience with lab work and field diagnose in industrial world where need repair and adjust things and becouse this it is possible that I do not know enough for claim that ALT trig is is in class "not useful"
But also, I have seen sometimes peoples have done bad mistakes with  ALT trig.

My Tektronix 7000 have it and more, also Tek 465 have it, Tek 2200 serias have it and Tek2400 serias have it. Do you think they do this feature just for nothing. If professionals do not need it they really do not make it.

It is real shame if this Agilent model do not have it.

[jpb]

I've only ever seen alt trigger on a few cheaper scopes - not really sure why you'd want it - I suppose there might be some rare situations where you need to see the shape of 2 unrelated signals simultaneously.

Are you kidding?

Simplest possible example from yesterday. I want compare two separate signal generator waveforms. Both generators have its own clock. (they are not sync with each other but I want look signal shapes with several different settings. Without ALT trig I waste lot of time and time is money.)
Gen 1 to CH1 and Gen 2 to CH2 and compare wafeforms shape, scope to ALT mode. Set CH1 and 2 triggers and go...

How you do it without ALT trig. And this was just as simplest possible example.

I suppose the approach without alternative trigger would be to trigger on one, save it as a reference waveform and then trigger on the other.