Hacking the HDO1k/HDO4k Rigol 12 bit scope

[bob808]

I don't think the logic analyzer is necessary. Just use serial and try some standard baud rates and check if there's legible info in the second part of the boot. Also make sure it's 3.3V 3.0V (see next post) and not 5V.

[bob808]

Found some info that might be of interest, for the Rock 4 which is similar to a Raspberry Pi and uses the same RK3399 SoC.

UART2 is enabled as U-boot and Linux serial console by default. Check Rockpi4/dev/serial-console to use. Check Rockpi4/hardware/devtree_overlays to disable serial console on UART2.
UART2 & UART4 support a wide range of baud rate. It includes but not is not limited to the following baud rates. For instance, 115200bps. 500000bps, 1500000bps and so on.

And this one seems important:

IO Voltage

RK3399 have three IO voltages, 1.8V/3.0V/3.3V. For ROCK Pi 4, below is the default voltage:

| GPIO             | Voltage Level | Tolerance |
| ----------------- | ------------------ | --------- |
| GPIO3_C0    | 3.3V               | 3.465V |
| ADC_IN0      | 1.8V               | 1.98V   |
| Other GPIO  | 3.0V               | 3.14V   |

In Dave's video the serial line is 3.0V not 3.3V. So don't use more than 3V. Might have a max tolerance of 3.14V.
There are some level shifters on the pcb but the serial traces seem to go directly right under the CPU.

[bob808]

I had a play with uboot on a raspberry pi just to emulate the procedure and I was able to extract a file from /boot, modify it and write it back, all from the uboot shell.
Some manufacturers might set the countdown timer to a very low value so it's easier to miss it, but if you spam the keyboard after startup you should get into the shell.
The text to watch out for is:

Code: [Select]

Hit any key to stop autoboot:  0
After dropping into the uboot shell you should type "help" at first so you get a list of available commands:

Code: [Select]

U-Boot> help
?         - alias for 'help'
base      - print or set address offset
bdinfo    - print Board Info structure
blkcache  - block cache diagnostics and control
boot      - boot default, i.e., run 'bootcmd'
bootd     - boot default, i.e., run 'bootcmd'
bootefi   - Boots an EFI payload from memory
bootelf   - Boot from an ELF image in memory
bootflow  - Boot flows
bootm     - boot application image from memory
bootp     - boot image via network using BOOTP/TFTP protocol
bootvx    - Boot vxWorks from an ELF image
bootz     - boot Linux zImage image from memory
cmp       - memory compare
coninfo   - print console devices and information
cp        - memory copy
crc32     - checksum calculation
dhcp      - boot image via network using DHCP/TFTP protocol
dm        - Driver model low level access
echo      - echo args to console
editenv   - edit environment variable
env       - environment handling commands
exit      - exit script
ext2load  - load binary file from a Ext2 filesystem
ext2ls    - list files in a directory (default /)
ext4load  - load binary file from a Ext4 filesystem
ext4ls    - list files in a directory (default /)
ext4size  - determine a file's size
false     - do nothing, unsuccessfully
fatinfo   - print information about filesystem
fatload   - load binary file from a dos filesystem
fatls     - list files in a directory (default /)
fatmkdir  - create a directory
fatrm     - delete a file
fatsize   - determine a file's size
fatwrite  - write file into a dos filesystem
fdt       - flattened device tree utility commands
fstype    - Look up a filesystem type
fstypes   - List supported filesystem types
fsuuid    - Look up a filesystem UUID
go        - start application at address 'addr'
gpio      - query and control gpio pins
help      - print command description/usage
iminfo    - print header information for application image
imxtract  - extract a part of a multi-image
itest     - return true/false on integer compare
lcdputs   - print string on video framebuffer
ln        - Create a symbolic link
load      - load binary file from a filesystem
loadb     - load binary file over serial line (kermit mode)
loads     - load S-Record file over serial line
loadx     - load binary file over serial line (xmodem mode)
loady     - load binary file over serial line (ymodem mode)
loop      - infinite loop on address range
ls        - list files in a directory (default /)
md        - memory display
mii       - MII utility commands
mm        - memory modify (auto-incrementing address)
mmc       - MMC sub system
mmcinfo   - display MMC info
mw        - memory write (fill)
net       - NET sub-system
nfs       - boot image via network using NFS protocol
nm        - memory modify (constant address)
panic     - Panic with optional message
part      - disk partition related commands
ping      - send ICMP ECHO_REQUEST to network host
pinmux    - show pin-controller muxing
printenv  - print environment variables
pxe       - commands to get and boot from pxe files
random    - fill memory with random pattern
reset     - Perform RESET of the CPU
run       - run commands in an environment variable
save      - save file to a filesystem
saveenv   - save environment variables to persistent storage
setcurs   - set cursor position within screen
setenv    - set environment variables
setexpr   - set environment variable as the result of eval expression
showvar   - print local hushshell variables
size      - determine a file's size
sleep     - delay execution for some time
source    - run script from memory
sysboot   - command to get and boot from syslinux files
test      - minimal test like /bin/sh
tftpboot  - load file via network using TFTP protocol
true      - do nothing, successfully
usb       - USB sub-system
usbboot   - boot from USB device
version   - print monitor, compiler and linker version
Now this is where there might be surprises. The upper list is from a raspberry pi, and I do have "save"  and "usb" which make it easy. There's USB ports on the front of the oscilloscope so you should be able to add a fat formatted usb stick.
Also on the rpi the storage was under the "mmc" command. The oscilloscope should have 8GB storage.
You basically load the file of interest into RAM with something like:

Code: [Select]

load mmc 0:1 $loadaddr example.dtbwhere 0:1 is the device and partition
and then write it to usb with

Code: [Select]

save usb 0:2 $loadaddr example.dtb nr_of_bytesthis wrote the file to the second partition of the usb stick.
I had to input the correct number of bytes based on the size of the file in RAM.
I wrote back the modified file the other way around. But extracting/inserting files into the oscilloscope's storage might vary depending on available commands in the oscilloscope's uboot shell.

TFTP booting should also be available from uboot shell so you could use a minimal linux system from a local TFTP server that's for a rk3399 board and you might be able to get a bash shell to access local storage. 

edit: maybe don't write to the scope's storage until there's firmware available and ways for restoring it.

[dschiedsch]

So I opened up my baby and got to work with an isolated uart adapter (set to 3V thank you)
As people have guessed the 2nd set of /0/0/0 output is indeed a different baudrate
115.2kBaud

Below is the log I could get from that

Also I didn't have any success stopping autoboot via a keypress on the terminal

But i get dropped into a somewhat working terminal after boot

[dschiedsch]

Scratch that it's not only somewhat working but issueing a su command drops you right into a root shell ..... 

[dschiedsch]

What is the policy of posting binary and apk files here on the forum?
Is it allowed to post the apk of the scope app or will this violate some of the rules / copyright laws?

[Fungus]

So I opened up my baby

Below is the log I could get from that

"no fuel gauge found" 


(is yours a 1000 or a 4000?)

[tv84]

The Rigol HDO bird is a "auklet".

Imagine where I saw the name... 

[dschiedsch]

4000 series but no battery module attached

[Fungus]

The Rigol HDO bird is a "auklet".

Nah, it's a puffin.

[AlphaRne]

Hi,
I also got full root via the serial port and now also ssh and adb on a 4K model.
One can abuse the script /rigol/shell/start_rigol_app.sh to do stuff like adding an authorized key ....

All the code seems to be common for 1K/4K models it just checks against those numbers in multiple places to decide how to handle all kinds of things ...
The app is under /data/app/com.rigol.scope-1 and most of interesting code is in the native lib libscope-auklet.so inside the apk.

For those already playing with their root access, what is the sha1sum of /rigol/data/Key.data ?
Just wondering if they all use the same key .... the option code stuff is just using XXTEA for the Key.data and AES for the option verification so that's an easy one ...
 

[dschiedsch]

My sha1 of Key.data:
6bd97c3e184310efd30e45c27cccee1145b73b37

[AlphaRne]

So my key seems different ... attached is my key file decoder tool if anyone wants to try ...

[dschiedsch]

So my key seems different ... attached is my key file decoder tool if anyone wants to try ...

Will check once I'm in front of my PC again

So I guess the difficulty now is finding the corresponding signing key?

[pmaster]

Thanks for the UART log.

Interesting things found in the Kernel command line:
* Does not indicate that DM-verity is used (or is there more shown in cat /proc/cmdline ?)
* androidboot.selinux=disabled 
* SecureBootCheckOk=0

Further up in the log:
SecureBootEn = 0, SecureBootLock = 0

[ptluis]

Well I'm posting a photo of the HDO1000 PCB with the differences I've found between HDO1000 and HDO4000 PCB

The RED marks on the left looks like just small parts readjustment with minor changes in the copper tracks (the photo is not clear in this area)
The YELLOW marks are missing components.

There are also differences in the Silkscreen on the HDO1000 series, the majority is deleted. I Haven't marked in the picture.

Enjoy!

[tv84]

attached is my key file decoder tool if anyone wants to try ...

That XXTEA key is Rigol's default key. It can only be used to decode Key.data files. Each MSO SysVendor.bin has its own XXTEA key.

[AlphaRne]

Hi,
my vendor.bin just seems to be encrypted with the boring key consisting of 4 times 0xAB12CD34.
The block data inside the vendor.bin uses the default key again.
It contains the model number (id:5) the serial number(id:7) and the MacAddress(id:9).

[AlphaRne]

And here is my tool to decode key and vendor file.

[bob808]

Code: [Select]

[    3.476682] get PIN_PROGRAMB voltage: 1
[    3.476687] finish request gpio PIN_PROGRAMB 
This might be the button that's above the CPU.

[tv84]

Hi,
my vendor.bin just seems to be encrypted with the boring key consisting of 4 times 0xAB12CD34.
The block data inside the vendor.bin uses the default key again.
It contains the model number (id:5) the serial number(id:7) and the MacAddress(id:9).

You're correct. THe HDO Vendor.bin uses a default XXTEA key. Well, easier than the MSO. 

[eb4fbz]

So I opened up my baby and got to work with an isolated uart adapter (set to 3V thank you)
As people have guessed the 2nd set of /0/0/0 output is indeed a different baudrate
115.2kBaud

Below is the log I could get from that

Also I didn't have any success stopping autoboot via a keypress on the terminal

But i get dropped into a somewhat working terminal after boot

Code: [Select]

[   19.892393] ********net_link: recv This is StationMax-DSO by HXH!.
So this is somewhat based on MSO70000 StationMax? 

[2N3055]

So I opened up my baby and got to work with an isolated uart adapter (set to 3V thank you)
As people have guessed the 2nd set of /0/0/0 output is indeed a different baudrate
115.2kBaud

Below is the log I could get from that

Also I didn't have any success stopping autoboot via a keypress on the terminal

But i get dropped into a somewhat working terminal after boot

Code: [Select]

[   19.892393] ********net_link: recv This is StationMax-DSO by HXH!.
So this is somewhat based on MSO70000 StationMax? 

Software platform is..

[tv84]

It seems the new HDO software is prepared for the following devices:   

HDO1052  HDO2104  HDO4104  MSO8064  MSO8064A  DS70104
HDO1054  HDO2204  HDO4204  MSO8104  MSO8104A  DS70204
HDO1072           HDO4304  MSO8204  MSO8204A  DS70304
HDO1074           HDO4404           MSO8304A  DS70404
HDO1102           HDO4504                     DS70504
HDO1104           HDO4804
HDO1202
HDO1204

[tv84]

This is the contents of a vendor.bin decrypted.

And the contents of the decompiled dts file.