Tek 4 Series Hack

[ghida]

Hi there,

Anyone here working on/interested in unlocking options on the Tek 4 5 6 series ?

I started working on it but I need help. Also I do not currently have one of these scopes.

Any interest ?

G.

[darkstar49]

Very different beasts... series 3 & 4 are iMx6 based and run a derivate of the former MDO3K/4K firmware, I think series 5 & 6 are Intel-based, but just as you, I don’t have any of these... and they remain pretty expensive on the (2nd hand) market, somehow out of range, even for the ‘advanced’ hobbyists...

[ghida]

I would buy one right away... but only if it could be cracked.

I somehow got confused and thought the firmwares were the same, but you are right, not the same hardware.
My interest is in the series 4 and specifically the MSO44.

I have found how most of the licensing works...
It uses an RSA signature in the license file. There is a license database in the scope and the signature is verified in multiple modules.
So it is not really possible to do a keygen unless there is a flaw in the way the signature is verified.

However... just like the Rigol MSO5000 hack, the firmware could be cracked... I am 99% sure I found what to change.
But I would need someone with a MSO44 or MSO46 and some knowledge, to test it.

PS: If there are people with more reverse engineering experience around, you are welcome to join the effort.
Look for the tek::okdb namespace, InstrumentManager object, "verify" function...

[salviador]

have anyone ever tried on the tek4 series, news about it?

[P51256SL-07]

I'm intestered too, but probably the series 4 is too much expensive to make test on it and I didn't see any good opportunity on ebay.. 

[maxwelllls]

I have an MSO54 and win10 option. I have made a GHOST image of the system, which can run in VitrualBox VM, but cannot start ScopeApp. Dynamic debugging will try to read data from a specific memory address when the software is started, most likely the value of a hardware peripheral(probably  HostId). Since the VM has no associated hardware, return 0x0000000000000000 and the program crashes.
I grab full memory dump by triggering WIN10 blue screen, but don't know how to analyze it.
As for Tek :: OKDB Namespace ghida mentioned, I'm not a professional reverse engineer(just a EE guy), so I don't know how to do it.
Anyone interested please PM me