MSO2000 Application module hack - Page 1
Forum section: electronics / testgear

author: Stonent
author_rank: Super Contributor
timestamp: July 29, 2014, 04:06:47 pm
content: https://sites.google.com/site/blinkyoontz/hacktekLooks like you can add features with a small board and an eeprom.

author: Berni
author_rank: Super Contributor
timestamp: July 29, 2014, 04:19:20 pm
content: Wow you would think tek would use something more advanced that a off the shelf I2c EEPROM programmed with just a bit of data.

author: T3sl4co1l
author_rank: Super Contributor
timestamp: July 29, 2014, 11:06:34 pm
content: Of course, thecontentsof that EEPROM are subject to copyright law, so...

author: tinhead
author_rank: Super Contributor
timestamp: July 30, 2014, 10:18:31 am
content: Quote from: T3sl4co1l on July 29, 2014, 11:06:34 pmreally? all one need are these strings, in cleartext: "DPO2COMP", "DPO2AUTO" "DPO2EMBD".I doubt that Tektronix have copyright on these 3 words.

author: Stonent
author_rank: Super Contributor
timestamp: August 06, 2014, 06:33:55 am
content: Tek Strikes Backhttp://hackaday.com/2014/08/05/hardware-security-and-a-dmca-takedown-notice/

author: janoc
author_rank: Super Contributor
timestamp: August 06, 2014, 07:56:28 am
content: Quote from: tinhead on July 30, 2014, 10:18:31 amWell, the obviously think they do, according to the DMCA notice they sent. They are not the first ones trying to abuse the copyright law to lock out potential competitors. Companies designing crap DRM to milk customers and then trying to fix their poor engineering by unleashing the lawyer hordes should be really publicly shunned.It the same as what Lexmark tried to pull off with their "copyrighted code" in the chips inhibiting refilling their ueber expensive ink cartridges. However, I believe they have lost that one, so Tek could be risking a lot should someone stand up to them and bring it to court.They should have learned from Rigol - if anything, Rigol sold many more scopes to hobbyists because of their hackability. And pros will not bother voiding their warranties to save $500 anyway.

author: PA0PBZ
author_rank: Super Contributor
timestamp: August 06, 2014, 08:39:12 am
content: The original site has been taken down too now, but of course it is still here:http://web.archive.org/web/20140729081735/https://sites.google.com/site/blinkyoontz/hacktek

author: janoc
author_rank: Super Contributor
timestamp: August 06, 2014, 12:34:51 pm
content: Quote from: PA0PBZ on August 06, 2014, 08:39:12 amThe best part? That guy wasn't even the first one to find this, by his own words:QuoteHere is a post - from 2002, no less, describing the same thing for a different model scope:http://www.edaboard.com/thread2506.htmlAnd that was just quick googling in English.So the info is likely widely available for over 12 years already, Tek uses the same stupid technique in their new scopes and wonders that it gets hacked? I think they should lose any lawsuit resulting from this simply based on the fact that the measure doesn't satisfy the "effectiveness" criteria in DMCA.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: August 06, 2014, 01:27:28 pm
content: And now onSlashdotWay to invoke the Striesand effect Tektronix!

author: Stonent
author_rank: Super Contributor
timestamp: August 06, 2014, 01:44:45 pm
content: Funny thing. I downloaded the files last night because I anticipated this. I don't even have the scope.

author: kilohercas
author_rank: Regular Contributor
timestamp: August 06, 2014, 01:51:45 pm
content: Quote from: janoc on August 06, 2014, 12:34:51 pmi think from MDO4000, MDO3000, and MSO3000 series, they use secure eeprom, so it is impossible to hack tektronix oscilloscopes by applications key. It works only with old scopes. But even with new security, they still do mistakes by leaving information for hackers , so they can generate keygen to unlock scope. Few more years and tektronix will be just like Agilent, with very advanced security.

author: firewalker
author_rank: Super Contributor
timestamp: August 06, 2014, 04:32:53 pm
content: Quote from: Stonent on August 06, 2014, 01:44:45 pmWould you like to share?Alexander.

author: salfter
author_rank: Contributor
timestamp: August 06, 2014, 05:17:55 pm
content: Quote from: Stonent on August 06, 2014, 01:44:45 pmAs someone else posted, the Internet Archive had already stored a pre-takedown version of the page. The download links within (for the firmware files) are still good (as of right now, at least). The EAGLE board file is downloadable from OSH Park. I don't have the scope in question (used to have a 545A and an RM585A until the last move), but it seemed like a good idea to grab everything and zip it up before it finds its way to the memory hole.

author: hans
author_rank: Super Contributor
timestamp: August 06, 2014, 07:44:34 pm
content: From a hobbyist-community perspective I see Tek pushing their scopes to many video blogs all over the place (can easily count 5 serious channels) - and all of them are treating it like it was a gift.And now a hackaday article exists on their fancy new scope about a hack, and all of sudden its a "hot item". As far as I can see, there isn't really nothing new to see here.. just a confirmation it works on this series of scopes too.http://forum.tsebi.com/viewtopic.php?f=4&t=113https://www.eevblog.com/forum/reviews/hacking-tektronix-feature-modules/msg166162/#msg166162http://hackaday.com/2010/03/10/50mhz-to-100mhz-scope-conversion/#comment-129124I am not sure it's good or bad that other sites are blogging about hackaday vs Tek now.On one side, my impression of Tek has sunk even lower to a "we make expensive enterprise products"-brand.On the other side, I am now aware that Tektronix scopes software options can easily be added and the price is basically an "all-in" price.Just like so many people to my impression do with their Rigol gear - would it have been so popular / often recommended if that wasn't case? (although I guess the community has many smart & dedicated people that will eventually figure this stuff out)I think the best thing that could now happen if any of those blogger's that had their scope "given" to them from Tektronix is to step up and blog about the hackaday article, discuss the take down, maybe even demonstrate the hack in 3 easy steps, and let the community watch whether Tektronix are real dickheads or not (and just fix their broken licensing system if they are really serious about their stuff)

author: free_electron
author_rank: Super Contributor
timestamp: August 06, 2014, 08:40:21 pm
content: first : i don't condone stealing stuff. pay for the stuff you use. especially if you make money off of it.Second : you do not have a licence to use that software, even if it came pre-installed . just like you having a dvd with the windows install files does not entitle you to use that software. you need the key.but, if the valid keys were listed in plain sight ... and the strings are in plain text on Teks own website ....cat- >milk...Then again , if i post a picture of my house key on the internet and someone files a blank in that shape that does not give him the right to get into my house with it and make off with a bunch of stuff. However .. the judge may throw it out because i did not use caution protecting my key. leaving stuff in plain sight in a car .. don't cry if it gets burglarized. you could actually get sued because you are enticing ...

author: iRad
author_rank: Regular Contributor
timestamp: August 06, 2014, 09:37:08 pm
content: Quote from: free_electron on August 06, 2014, 08:40:21 pmAs stories go...But you put the stuff from your house into a box, and you had a garage sale and sold the box with the stuff inside to someone. You also put inside the box another hidden but locked box with other stuff inside it. And you made a feeble effort to hide the key to that hidden box, but in a public place. Now the person who bought your box figures out how to open that hidden box because they found the key you failed to hide well, in a public place. They did not have to trespass into your house to take that key. And they certainly took nothing from your house that you did not sell them...

author: firewalker
author_rank: Super Contributor
timestamp: August 06, 2014, 09:46:45 pm
content: I could use the key I made to enter your house, watch tv etc. Without messing or stealing anything. I considered the photo of the key as an invitation to your house.The machine I buy is mine to play with. The sharing of the trick I learned is something different.Alexander.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: August 06, 2014, 10:23:42 pm
content: Quote from: free_electron on August 06, 2014, 08:40:21 pm<assuming I'd bought this scope>Unlike most PC software, where there is a license agreement shown at install,I did not agree to any terms that stated I needed a license to use the software.Nowhere did it explicitly say I was not allowed to use it.Therefore I do not need a license. If I can make it work, I can use it.If, for example, there was extra memory fitted that could be enabled by removing a jumper, I don't think anyone could argue that doing so, or telling others how to, was in any way wrong.It's a scope, not a general purpose computer. The fact that certain functions are implemented in software is irrelevant.

author: free_electron
author_rank: Super Contributor
timestamp: August 06, 2014, 10:30:53 pm
content: Quote from: mikeselectricstuff on August 06, 2014, 10:23:42 pmyou may want to read the users manual of the machine... i'm willing to bet there is a software licencing agreement in it in the terms of 'if you power it up , you agree to it ...' and 'you will not reverse engineer , yadda yadda ...'

author: Stonent
author_rank: Super Contributor
timestamp: August 06, 2014, 10:36:35 pm
content: It's not much different than what IBM does on their mainframes. They send a much better one than you order but the software is configured to ignore all the extra hardware. Then when you need it, you call them up and they unlock the extra functionality with no need to take the system down.

author: Stonent
author_rank: Super Contributor
timestamp: August 06, 2014, 10:37:06 pm
content: As far as the blogs, I think that's the MDO3000 that everyone has.

author: free_electron
author_rank: Super Contributor
timestamp: August 06, 2014, 10:38:16 pm
content: from the mdo2000 users manual page 4 :"Copyright © Tektronix. All rights reserved. Licensed software products are owned by Tektronix or its subsidiaries or suppliers, and areprotected by national copyright laws and international treaty provisions.Tektronix products are covered by U.S. and foreign patents, issued and pending. Information in this publication supersedes that in allpreviously published material. Speci?cations and price change privileges reserved."

author: mamalala
author_rank: Unknown
timestamp: August 06, 2014, 11:04:01 pm
content: Quote from: free_electron on August 06, 2014, 10:38:16 pmSo what? They have a copyright on their software, which is to be expected. IWhat you quoted is not a license agreement. Someone who buys the scope already got a copy of the code, pre-installed on the scope.Here in Europe any "agreements" that are bascially shrink-wrapped are null and void. Agreements can only come valid if the buyer is made aware of, and agreed to, them at the point of sale. Any agreement that is inside the box, or has the form of "by opening this, you agree to that" simple has no relevance here.And then, unless someone in Europe would buy the scope directly from Textronix, and they made the buyer aware of any terms and conditions before the sale went through, any T&C's or license agreements will be between the seller and buyer. The seller can decide to re-use Tek's stuff 1:1 if he wants to. But that only means that at that point they just become _his_ T&C's or license agreement. Tek would still have no further say in the matter.So, again, because it is really important that people not living in Europe understand this: Any T&C's or license agreements that a buery is not made aware of at the point of sale, before the sale happened, are nothing more than justt a waste of paper and ink.Greetings,Chris

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: August 06, 2014, 11:29:30 pm
content: Quote from: free_electron on August 06, 2014, 10:30:53 pmNo way would a statement like that in a user manual hold up legally - not worth the paper it's printed on.Who reads manuals anyway?

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: August 06, 2014, 11:31:08 pm
content: Quote from: free_electron on August 06, 2014, 10:38:16 pmSo nothing about any restriction on use then.

author: Stonent
author_rank: Super Contributor
timestamp: August 06, 2014, 11:47:32 pm
content: Quote from: mikeselectricstuff on August 06, 2014, 11:31:08 pmYeah the way it reads to me yes the software is copyrighted and installed on the device. Since the module has no software just a string of text, then they can't say you're pilfering their software.

author: firewalker
author_rank: Super Contributor
timestamp: August 07, 2014, 08:09:00 am
content: I believe that a Judge (Europe) had ruled that hacking is allowed as long as the hacker doesn't make money (sell compatible Tek modules eg) or the company doesn't loose money. I think it was for software. I will try to find the details.Alexander.

author: janoc
author_rank: Super Contributor
timestamp: August 07, 2014, 08:45:33 am
content: Quote from: firewalker on August 07, 2014, 08:09:00 amCareful, there is no "Europe" in the sense of legal system or jurisdiction. EU has 28 member countries and 28differentlegal systems. There are some EU directives that have to be implemented by the member states (like the recent "right to be forgotten" rule or RoHS), but the actual implementation is up to the member states and will be different in every country, depending on how the rule is transcribed into the local law.So be very very careful about these statements - what may hold in one EU state may not be the case in another. E.g. UK is a common law country whereas the rest of EU is civil law. Rulings in Germany will not apply to cases in the UK and vice versa. So sweeping statements about shrinkwrap licenses being unenforceable or "hacking" for no commercial gain being legal could get someone in trouble if they don't check their local laws.For example: Dashboard cameras in cars are legal in most of Europe. However, they are not legal in Belgium and Austria. If you get caught with one by police in Austria, you can get hit with up to 20 000€ fine - because their courts have ruled that recording someone without consent is a privacy violation and they lumped it with things like illegal surveillance. Similarly, if you are using a GPS (satnav) or Waze on your phone with a database of stationary speed radars you can get a massive fine here in France - there is law forbidding devices that display precise location of traffic enforcement activities. So most satnavs and Waze had to update their firmware and display only alerts that you are entering a "danger zone" a few kilometers ahead of the radar when you are in France. Etc.

author: mamalala
author_rank: Unknown
timestamp: August 07, 2014, 09:10:49 am
content: Quote from: janoc on August 07, 2014, 08:45:33 amWhile generally true, the EU laws that the member countries must implement have the advantage that they can be fought for in an EU court if a country did not properly implement it. Also, the consumer protection laws about issues like shrink-wrap stuff (basically an unfair contract) and hacking for private purposes are rather old, so that by now there has been plenty of time for the countries to implement it. Keep in mind that a failure to implement EU directed laws in a timely and sufficient manner can (and usually will) the have EU to impose sanctions against such a country. Just for that reason alone they are often implemented in local law, simply to avoid consequences.Greetings,Chris

author: madires
author_rank: Super Contributor
timestamp: August 07, 2014, 10:55:47 am
content: If you haven't noticed yet, Tektronix has sent a DMCA take-down notice to Hackaday because they posted an article about hacking MSO2000's application modules. You can read the story athttps://www.techdirt.com/articles/20140806/07155928127/tektronix-uses-dmca-notice-to-try-to-stop-oscilliscope-hacking.shtml(includes the links to the post and the notice).

author: janoc
author_rank: Super Contributor
timestamp: August 07, 2014, 01:06:13 pm
content: Quote from: mamalala on August 07, 2014, 09:10:49 amMy point was less about the law not being implemented at all (that is indeed rare and there are consequences, as you are saying) but that the laws could be implemented slightly differently in every country. As always, devil is in the details - just look at the fights around the mandatory 2 year warranties for non-perishable goods (Apple ...). In Slovakia the warranty is 2 years, period, the seller has to honour it unless they can prove the that the fault is a consequence of the item being mishandled by the buyer. Here in France they have changed the law recently in a way where in the first 6 or so months (or the first year, not sure now) it is up to the seller to prove that the warranty is void because of the buyer mishandling the item, otherwise they have to honour it. After this period it is *up to the buyer to prove* that the fault is actually a consequence of a manufacturing problem and not a result of normal use - only then is the seller obliged to comply. I think we agree that that is a massive difference for the consumer - and both laws conform to the same EU directive!

author: janoc
author_rank: Super Contributor
timestamp: August 07, 2014, 01:09:46 pm
content: Quote from: madires on August 07, 2014, 10:55:47 amYes, reply #4 on the first page of this thread

author: nctnico
author_rank: Super Contributor
timestamp: August 07, 2014, 01:25:15 pm
content: Quote from: free_electron on August 06, 2014, 08:40:21 pmIn the EU: if you have the disk then you have a valid license.Regarding the EEPROM hack: I have seen that on many sites. Maybe Tektronix doesn't want it on hackaday but the trick is known for several years now.

author: PA0PBZ
author_rank: Super Contributor
timestamp: August 07, 2014, 01:28:45 pm
content: Quote from: janoc on August 07, 2014, 01:09:46 pmJust to defend madires: He posted this in a separate thread, then I posted a link to this thread to make him aware that there already was a discussion going on, then a moderator took his and my post and moved it over here. When I found out I deleted my post...His post still has the other thread's title: "Tektronix isn't happy about hackers"

author: kilohercas
author_rank: Regular Contributor
timestamp: August 07, 2014, 07:34:32 pm
content: Just wondering, they say DPO2COM is copyrighted code, ok, if i switch to hex, like 44 50 4f 32 43 4f 4d 50, does that is still under copyright, since is not the same code, but from information point of view, is. So they should include that to copyright law, but did they ( so all code should be translated to U8 S8 U16,S16, U32,S32 and copyrighted )?

author: David Hess
author_rank: Super Contributor
timestamp: August 07, 2014, 08:13:49 pm
content: This form of DRM reminds me of how Sega implemented their DRM and the resulting lawsuit:http://en.wikipedia.org/wiki/Sega_v._AccoladeI think there was another video game console case where the copyright was an on raster graphics image stored in the ROM which was checked to make sure the cartridge was "official" but I was not able to find it and I believe it become irrelevant with the DMCA anyway. The way I remember it, the court ruled that while the image was legitimately copyrighted, since it was needed to make the system operational, copying it was fair use.

author: allikat
author_rank: Contributor
timestamp: August 07, 2014, 09:35:43 pm
content: It's simple data in an (e)eprom, not even particularly complex data either. The hardest part of the hack is to make the eprom talk to the scope.

author: kilohercas
author_rank: Regular Contributor
timestamp: August 08, 2014, 06:20:45 am
content: Quote from: allikat on August 07, 2014, 09:35:43 pmwhere is no hard part. I made that module without going to shop, some foam, eeprom from old TV, and sim holder from siemens c25. After that only simple programming is needed to load data to eeprom. Also if you have original app module, you simply can put second eeprom on top of original, and program it with new code. but you have to disconnect address pins, and set them manually, and i2c line will be shared between two eeproms.Oscilloscope does the reading automatically, if you have good contacts, and correct code, it works without a problem

author: Tothwolf
author_rank: Regular Contributor
timestamp: August 09, 2014, 05:47:34 pm
content: Dear Tektronix,Because of your legal goons' blatant misuse ofSection 1201* of the DMCA to bully hobbyists and Hackaday, I will no longer purchase or recommend your test equipment to potential customers.*Section 1201 most certainly does -not- apply to the material Hackaday discussed. cf.Lexmark v. Static ControlLexmark International, Inc. v. Static Control Components, Inc.

author: janoc
author_rank: Super Contributor
timestamp: August 09, 2014, 11:25:35 pm
content: Quote from: Tothwolf on August 09, 2014, 05:47:34 pmThat was the Lexmark lawsuit. Tek should be really ashamed of themselves.

author: free_electron
author_rank: Super Contributor
timestamp: August 10, 2014, 01:56:20 am
content: Quote from: kilohercas on August 08, 2014, 06:20:45 amnot even needed. if you buy a quad size one the pages sit on consecutive i2c addresses...essentially a 24c16 is eight 24c02's on consecutive addresses.simply program the strings on the page offsets. probably will work perfectly fine.there is a page adressing change once you hit the 24c32

author: kilohercas
author_rank: Regular Contributor
timestamp: August 10, 2014, 07:01:16 am
content: Quote from: free_electron on August 10, 2014, 01:56:20 amI don't think this would work. Also, with MSO2024B, oscilloscope will read EEPROM only two times, but where is 3 functions to unlock.

author: miguelvp
author_rank: Super Contributor
timestamp: August 10, 2014, 07:06:47 am
content: I just have to LOL at using the sku string to unlock the feature what where they thinking?

author: Tothwolf
author_rank: Regular Contributor
timestamp: August 10, 2014, 08:51:19 am
content: After speaking with one of my clients, I'm expanding my boycott to all test gear and tools made by companiescurrently ownedby Danaher.Some of these include (not yet a complete list):FlukeFluke Networks (which is mostly just made up of what used to be Harris test gear and tools...well, what's left of them anyway.)PomonaTektronixKeithleyAmprobeRaytekHart ScientificDatapaqDH Instruments (DHI)IrconMatco ToolsAnother pro tip for Danaher / Tektronix... Do NOT piss off those who -sell- potential clients on using your crap in their labs and factories.Btw, for those with older unsupported Tektronix gear who aren't already aware that they can freely copy and redistribute manuals...Tektronix Policy on Copying of Out-of-date Materials(pdf) [tek.com]Release of copyright(pdf) [ko4bb.com]

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: August 10, 2014, 09:20:22 am
content: Quote from: Tothwolf on August 10, 2014, 08:51:19 amA bit of an overreaction perhaps....Given a choice between a bit of test gear that is known to be hackable and one that isn't, the former has to be preferable.I don't think a bogus DMCA notice from a legal dept to a site publishing info that was widely known is reason to influence a purchasing decision.Compared to things like patent trolling to stifle competition, or adding cumbersome DRM to products, this is really nothing to get upset about. All it has done is make the info more widely known.

author: artag
author_rank: Super Contributor
timestamp: August 10, 2014, 02:35:46 pm
content: So what are the possibilities here ?1. Tek are dumb, don't understand 'security', and are run by beancounters and idiot lawyers.Sadly, this could be the case. But even though it's not run by engineers any more, it still employs some good ones. I can't believe they thought this would go unhacked (though they might possibly objectto hacking keys coming from china rather than requiring that you do dangerous firmware mods to your expensive instrument).2. Tek have seen the sales wins achieved by HP and Rigol etc. as the result of their hacks. They don't need the upgrade sales to pay for the features, because they're making a healthy profit selling an unenhanced model and don't need the high-end buyers to subsidise it. And they want some of the action, so after making it an easy mod and seeing it get reported, they're out to make the most of it by harnessing Streisand-effect publicity.My money's on 2.

author: Tothwolf
author_rank: Regular Contributor
timestamp: August 10, 2014, 03:07:24 pm
content: Quote from: mikeselectricstuff on August 10, 2014, 09:20:22 amAu contraire...Tektronix has no right to tell people what they can or cannot do with somethingthat they've purchased. If Tektronix chose to sell a product with a feature "switched off" via a configuration option to lower their production costs, and a consumer subsequently figures this out and enables it, they have absolutely no right to then threaten hobbyists and Hackaday for discussing it.You Bought It, You Own ItIf money is the reason Tektronix / Danaher are going to issue a bogus DMCA notice and threaten a hobbyist site like Hackaday, then I can do my "small" part to protest their response and take away some of their bottom line. This doesn't mean I'm going to get rid of any of my own existing Tek gear, but I certainly won't be buying any new gear from Tektronix / Danaher any time soon.For Tektronix / Danaher's sake, hopefully none of my clients will call me up asking me to spec a lab full of gear between now and when they eventually decide to offer a public apology. There /are/ alternatives to pretty much everything they offer, but perhaps Tektronix forgot that?

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: August 10, 2014, 03:33:47 pm
content: Quote from: Tothwolf on August 10, 2014, 03:07:24 pmTrue but the fact is that everyone does it nowadays. Tek, Agilent, Flir, Rigol....If anything Tek have the advantage that it's trivially easy (though the later scopes apparently have better protection.These companies have to at least make it look like they're protecting stuff to please their shareholders. An occasional bit of lawyer bluster has no real effect, and certainly no reason to boycott anything.

author: janoc
author_rank: Super Contributor
timestamp: August 10, 2014, 03:35:35 pm
content: Quote from: artag on August 10, 2014, 02:35:46 pmExcept that by slapping publicly a site like Hackaday with DMCA notice is not going to bring you a lot of good will among their audience - exactly the people who would be buying the hackable gear otherwise. The Joe Littleguy is a lot more susceptible to going all gaga over crap like this and taking their dollars elsewhere than a big corp that is buying 100 of those scopes for their labs.So yeah, they will get publicity, but probably not the one they hoped for ...

author: Tothwolf
author_rank: Regular Contributor
timestamp: August 10, 2014, 06:16:07 pm
content: Quote from: janoc on August 10, 2014, 03:35:35 pmTektronix also seemed to forget that a "Joe Littleguy" can make or break a large sale when they also happen to be an independent sales consultant. A large company is likely to have no interest in tinkering with their gear to enable hidden features anyway (and is more likely to buy the more expensive model). In bullying hobbyists though, Tektronix is only harming themselves.Not that things have been going all that well for Danaher...Tektronix, five years after sale to Danaher, continues to shed jobs and struggleDanaher, Tektronix's takeover-minded owner, now can't make a deal

author: Lunasix
author_rank: Regular Contributor
timestamp: September 17, 2014, 08:25:51 pm
content: I just found at a reasonnable price a MSO2024 with the original DPO2COMP module. I would never have thought, before reading this post, that there was nothing else in this module...Fortunately, the global price was made whithout taking into account this module.

author: relu
author_rank: Newbie
timestamp: September 22, 2014, 08:48:26 pm
content: So, did anybody tried this hack?I have order the boards, the sim card holder and the memory. Soldered everything. Programmed the memory with the PICkit2.check that the eeprom is programmed correctly. plug in the module (another small PCB taped to have the right width).Aaaaand it doesn't work.Maybe I haven't checked carefully enough if the module makes contact with the scope.or maybe because I have Firmware version v1.52 PP3 15-Aug-12.or what other?Would be nice to hear that someone tried it and it works. . .

author: Lunasix
author_rank: Regular Contributor
timestamp: September 22, 2014, 09:22:21 pm
content: Tested for fun (I have original one) with very old revision and then with last revision, no problem. With a 08 eeprom, A2 (hard and soft) will always be 0. A1 and A0 are only selected by scope software, and A0 remains to 0. A1 will select key 0 or key 1 (normally, A1 is hard coded from slot to eeprom pin, allowing two keys), and will select in the eeprom the corresponding virtual key. Reading starts at address 04, find the string (terminated with 0) and reads 3 more bytes at FF (thus, ending on a 16 bytes boundary). If the scope reads garbage (or 0xFF), it will say it needs a software update, since value in the key isn't recognized (but supposed to be valid).

author: Lunasix
author_rank: Regular Contributor
timestamp: September 25, 2014, 11:00:02 am
content: Small eeprom (BGA, 0.8 x 0.8 mm) is wired directly on back of sim connector (don't drink before....).

author: drsurfer
author_rank: Contributor
timestamp: November 06, 2014, 12:00:24 pm
content: Relu, I was about to post the same messageyou did exactly what I did, ending in the very same frustrationMy scope is MSO 2024B with same v1.52 PP3 15-Aug-12 firmware.As soon as I can I will borrow another scope and I will connect to eeprom's I2C bus to understand what's going on.The first stupid thing I will try is to write protect the EEprom (the damn trace to cut is under the chip). A successful write could easily tell the presence of an EEprom in place of a ROM (or a write protected EEprom).Lunasix, can you clarify what do you mean with "old revision" and "last revision"? Scope firmware version ?DrSurferQuote from: relu on September 22, 2014, 08:48:26 pm

author: Lunasix
author_rank: Regular Contributor
timestamp: November 06, 2014, 01:48:05 pm
content: When I bought my scope (MSO2024), the software version was very old (2009 I think) and I've installed the v1.56 PP3 17-Jul-14 11:00 firmware.It is very difficult to remove the original Tektronix key I have (RS232), the new one is a bit smaller and very easy to remove thanks to the hole in the plastic support.Recently, I have had a problem : sometimes, the scope was displaying a warning "Not allowed to remove key during working, please reboot" (or something like that) and I was obliged to reboot the scope, and finally, the key was not working any more. A bad solder of a wire (SCL, not realy soldered, in place thanks to solder flux) was the source of the problem, now all is fine.I have programmed the eeprom with a board I have (PIC32), with a modified program, but I've seen that it was possible with MPLab.Eeprom is CAT24C08C4ATR, without write protect pin, but I've tested with Atmel 24C08, and the write protect pin was tied to VSSI've connected a Saleae analyzer with I2C protocol and nothing noticed like write attempt. It's only reading : if eeprom acknowledges readings, the scope has found a key. If the string is a valid one, it's ok, if not (like empty eeprom, all 0xff), it says it has found a key, and it asks for an update frmware as it can't use the unknown key. If you see nothing of that, you can be sure that the eeprom doesn't respond. First, try with an empty eeprom. If you see what I've described, try to programm it, if not, understand why.

author: drsurfer
author_rank: Contributor
timestamp: November 06, 2014, 04:03:48 pm
content: Thanks Lunasix.I never saw any message from the scope.My eeprom is programmed with all 0xFF but the null terminated strings at 0x004 and 0x204.According to your notes, if it was wrong I should see a specific message from the scope, but this didn't happen.My PCB is simply put in place with a cardboard . As far I can see, there isn't any "module presence switch", am I right?At this point I would feel more relaxed if I could try the slot with an original module, but I don't know anyone can borrow it near to me.CiaoDrSurfer

author: Lunasix
author_rank: Regular Contributor
timestamp: November 06, 2014, 04:39:42 pm
content: It's I2C : if circuit is present at right address, it responds. With a scope, it will not be obvious as there are other components on the bus, and eeprom access is not at the beginning. You should connect 4 wires (VSS, VDD, SCL and SDA) going out of the scope and verifiy that all are correct, before attempting to connect the eeprom.

author: drsurfer
author_rank: Contributor
timestamp: November 07, 2014, 11:25:11 am
content: Ok,finally it worked!!!!It was simply a mechanical issue: I just filed the PCB to allow it to enter more deeply into the slot.I did it because looking at your photos, I had the feeling that on my device the distance between the contacts and the board edge was larger.Just to be sure and build a finally reliable device, could you kindly provide me some actual measurements of your module? I need the outside dimensions of the module and the distances of the contacts from the edges. I refer to "contacts" because I have a different type of SIM card connector (see Relu's post).Thanks for your support and patience!

author: Lunasix
author_rank: Regular Contributor
timestamp: November 08, 2014, 09:05:23 am
content: Size of a key : 33.4 x 10.4 x 4.4mm (lightly smaller than the original, and without retaining slot, as the original is very hard to extract).Center of sim connector is at 11.95mm from left side of key and on center in vertical direction.

author: drsurfer
author_rank: Contributor
timestamp: November 10, 2014, 06:26:23 pm
content: Thanks for your info.So it's confirmed that the PCB published (and the SIM socket choosen) is simply too big.The center of SIM connector on it is at ~15 mm from the edge, so it's mandatory to file it as much as possible to have a reliable contact with the scope pads.I did a little investigation on the strings inside the last firmware, hoping to find a "magic" string that will enable at same time all the three features available. It seems this does not exist, but there are five strings that could enable some undocumented/abandoned/<whatever> features.Code:DPO2EMBD Embedded Serial Triggering and AnalysisDPO2AUTO Automotive Serial Triggering and AnalysisDPO2COMP Computer Serial Triggering and AnalysisDPO2AUTOMAX Extended Auto Serial Triggering and AnalysisDPO2VID Extended VideoDPO2AUDIO Audio Serial Triggering and AnalysiDPO2PWR Power AnalysisDPO2BTA Beta EnabledDPO2VID is the only string I've found referenced in some Tek docs related to our scopes.I hope that someone finds the time to do a little experimentation on these.

author: Lunasix
author_rank: Regular Contributor
timestamp: November 10, 2014, 07:17:02 pm
content: Thanks !I will try asap.

author: Lunasix
author_rank: Regular Contributor
timestamp: November 11, 2014, 11:21:50 am
content: AUTOMAX and VID are correctly detected. But I can't see any difference between AUTO and AUTOMAX, probably none, and video trigger (SECAM/PAL/NTSC) is now useless, and is already available without any key.Others have no effect, except warning.

author: drsurfer
author_rank: Contributor
timestamp: November 13, 2014, 08:02:56 pm
content: May be deeper in the firmware there are hidden other exploits, but I feel satisfied of the results I got and I will not spend more time on it.BTW, the binary format of firmware is straightforward, and even a linux beginner (like me) can easily find the way to do some investigations on it, so I will not disclose any details on the process.CiaoDrSurfer

author: Dreamster
author_rank: Newbie
timestamp: November 24, 2014, 10:14:56 am
content: Quote from: Lunasix on September 22, 2014, 09:22:21 pmHi.Can you elaborate on this? I see the request for software update but I am already at 1.56. Apart from the bytes set to DPO2COM\0 or EMBED, what should the rest of the eeprom be set to.Regards

author: drsurfer
author_rank: Contributor
timestamp: November 24, 2014, 11:29:18 am
content: All 0xFF, as in an erased eeprom.

author: Dreamster
author_rank: Newbie
timestamp: November 24, 2014, 01:01:04 pm
content: Quote from: drsurfer on November 24, 2014, 11:29:18 amIt does by the way work better if you remember that there is a difference between 2 as in ascii STX and 50 as in ascii "2"Actually wrote this comment before trying out the fix once I located my error. I should probably go home and sleep.

author: relu
author_rank: Newbie
timestamp: December 07, 2014, 06:30:07 pm
content: Hi all,I was quite busy lately, forgot to report that I finally got the module working.The problems was mechanical, there was poor contact between the module and oscilloscope.It seems that the sim connector on the PCB's I have ordered from OSH Park needs to be soldered right on the edge.See attached my module. . .

author: luisprata
author_rank: Regular Contributor
timestamp: January 31, 2016, 02:17:06 am
content: Eeprom worked for me.Besides that, I sniffed I2C bus of Application module slot... I found 0x76, 0x2b, 0x50 and 0x52 address. 0x50 and 0x52 are for eeprom reading... But what are the others for?BTW, I have a MSO2014 and I'm trying to upgrade bandwith...I figure out MPC870 U13(SMTX) and T12(SMRX) pins are routed to B23 and B25 pins on external connector...I'm going to build a TTL serial cable and try to get access to linux.

author: luisprata
author_rank: Regular Contributor
timestamp: February 02, 2016, 01:59:56 pm
content: Here is what I got"U-Boot 1.1.4 (Oct 29 2008 - 14:14:00) Tektronix, Inc. V1.01CPU: MPC870ZPnn at 133.333 MHz: 8 kB I-Cache 8 kB D-Cache FEC presentBoard: Tektronix Fusion MPC870 Main BoardVersion: 4 (QUAL) 4 channel MSOTek0001A ChipId: 0x1400cTek0001A SubBlocksId: 0x0Tek0001B ChipId: 0x1400cTek0001B SubBlocksId: 0x0CPLD Version: 0x11I2C: readyDRAM: 64 MBFLASH: 32 MBIn: serialOut: serialErr: serialNet: FEC ETHERNETEnter password - autobooting in 3 seconds## Booting image at efec0000 ...Image Name: Linux-2.4.20_mvl31-885adsImage Type: PowerPC Linux Multi-File Image (gzip compressed)Data Size: 1278107 Bytes = 1.2 MBLoad Address: 00000000Entry Point: 00000000Contents:Image 0: 868895 Bytes = 848.5 kBImage 1: 409199 Bytes = 399.6 kBVerifying Checksum ... OKUncompressing Multi-File Image ... OKcmdline is console=ttyS0,115200 quiet bigphysarea=10570 panic=2 root=/dev/mtdblock4 rw mem=175190k NO_option_boardLoading Ramdisk to 03e3a000, end 03e9de6f ... OKNo option module board foundChecking for firmware update...No USB mass storage devices found to update from.Linux 2.4.20_mvl31-885ads V 1.06 Tektronix Fusion Tue Apr 26 14:44:49 PDT 2011Warning: loading NiDKEng-1.6 will taint the kernel: non-GPL license - ProprietarySeehttp://www.tux.org/lkml/#export-taintedfor information about tainted modulesWarning: loading NiDUsb-1.6 will taint the kernel: non-GPL license - ProprietarySeehttp://www.tux.org/lkml/#export-taintedfor information about tainted modulesWarning: loading tek will taint the kernel: non-GPL license - ProprietarySeehttp://www.tux.org/lkml/#export-taintedfor information about tainted modulesScope application starting (normal mode)-----------------------------------------------------------------Running Init codeversionBuildFWVersionString(), TimestampString: 17-Jul-14 11:00versionBuildFWVersionString(), VersionFIRMWAREVERSIONversion: v1.56versionBuildFWVersionString(), Major ver num: 1 Minor ver num: 56hwInitmpc8xx GPIO open successfulInitializing Mpc8xxadg420a open successful.adg420b open successful.Initializing Adg420Initializing Adg420Initializing Adg420Initializing Adg420adg420b open successful.Initializing ExtTrigadc08d1020a open successful.adc08d1020b open successful.Initializing Adc08D1000Initializing Adc08D1000Initializing Dac121s101Initializing Dac121s101Initializing ad5160ad5305 open successful.Initializing ad5300tek0001 detected, patching device offsets.lm95241 open successful.lm95241 not present.Initializing Lm95241Initializing Lm95241Initializing ResetCpldFactory Checksum: Stored: 26914, Calculated: 26914 - OKSpc CheckSum: stored: 6395 calculated: 6395 - OKStarting POST diagsFinished POST diagsERROR in fpSharedPublic.cpp at 44: Could not get expected fp SW versiin.Fp Id response: 6 4 19Front Panel Software Rev 19 - expected -1.Installing -1 in front panel.fpSRecCheckSum /usr/local/nv/route66_fp.s19fpSRecCheckSum: open /usr/local/nv/route66_fp.s19 failedChecksum failed for /usr/local/nv/route66_fp.s19Fp software update function reports failure.IO error reading fp id after reprogram.Fp Id response after code update: 128 128 128Fp Id query response NOT as expected after update.cfgGetBoardModel: modelID 4 idStr MSO2014hcPtpInit: Starting PictBridge PTP subsystemfusadInitutilInit-----------------------------------------------------------------Running Start codediagStartfusionTrigStart(): calibrateTrigIf() ran 1 times and passedfusionTrigStart(): testTrigIf() for TEK0001A returned 0fusionTrigStart(): testTrigIf() for TEK0001B returned 0fusadStart-----------------------------------------------------------------Running Run codewfmMgr OK for diagsdiagRunfusadRuneth0: unknown interface: No such deviceeth0: unknown interface: No such deviceenetLinkPresent: ioctl failed, errno 19enetLinkPresent: ioctl failed, errno 19-----------------------------------------------------------------Scope startup complete; duration = 23.842631 seconds=================================================================PID to Task info:PID: 62 ThrdID: 16386 Task: tUsrRootPID: 63 ThrdID: 32771 Task: tExcTaskPID: 64 ThrdID: 49156 Task: errSuspendAllThreadPID: 65 ThrdID: 65541 Task: hwIntReceiverPID: 66 ThrdID: 81926 Task: fpIntTaskPID: 67 ThrdID: 98311 Task: fpIrqMonitorPID: 68 ThrdID: 114696 Task: usbHotplugPID: 0 ThrdID: 131081 Task: probesSharedUnloadCmdQueueThreadPID: 70 ThrdID: 147466 Task: fusad executivePID: 71 ThrdID: 163851 Task: UsbTmcOutputMgrPID: 72 ThrdID: 180236 Task: piUsbPID: 73 ThrdID: 196621 Task: piVGpibPID: 74 ThrdID: 213006 Task: Nios A listenerPID: 75 ThrdID: 229391 Task: Nios B listenerPID: 76 ThrdID: 245776 Task: execPID: 77 ThrdID: 262161 Task: autosetPID: 78 ThrdID: 278546 Task: calPID: 79 ThrdID: 294931 Task: diagPID: 80 ThrdID: 311316 Task: fpPID: 81 ThrdID: 327701 Task: hcPID: 82 ThrdID: 344086 Task: UsbSicInputMsgMgrPID: 83 ThrdID: 360471 Task: wfmMgrTestPID: 84 ThrdID: 376856 Task: searchPID: 85 ThrdID: 393241 Task: periodicZoomPID: 86 ThrdID: 409626 Task: periodicClockAnimationPID: 87 ThrdID: 426011 Task: periodicBusyIndicAnimationPID: 88 ThrdID: 442396 Task: mathPID: 89 ThrdID: 458781 Task: measPID: 90 ThrdID: 475166 Task: measImmedPID: 91 ThrdID: 491551 Task: piCmdIntfcPID: 92 ThrdID: 507936 Task: probesPID: 93 ThrdID: 524321 Task: refPID: 94 ThrdID: 540706 Task: rtlPID: 0 ThrdID: 557091 Task: thttpdPID: 112 ThrdID: 573476 Task: tVxi11SRQdPID: 0 ThrdID: 589861 Task: tVxi11RpcdPID: 114 ThrdID: 606246 Task: tVxi11FlushThreadPID: 0 ThrdID: 622631 Task: busPID: 0 ThrdID: 639016 Task: debugConsolePID: 117 ThrdID: 655401 Task: VgpibReadPID: 118 ThrdID: 671786 Task: VgpibWritePID: 119 ThrdID: 688171 Task: UsbTmcEventDispatcherPID: 0 ThrdID: 704556 Task: probesHandleBulkPowerChangeThreadPower Up Completed at 11:26:36Enter 'ctrl-\' twice to quit scopeAppReceived testTrigIfcMsgAck, nios = 1, payload = 10Received testTrigIfcMsgAck, nios = 0, payload = 1011:26:36 fusadSetNiosUsableOK to connect by: telnet MSO2014-05GK9V 107211:26:41 --- Power Up Phase Cal - PASSEDMSO2014-05GK9V login:MSO2014-05GK9V login:"

author: Edison517
author_rank: Newbie
timestamp: February 03, 2016, 05:04:44 pm
content: I wrote a quick program for Arduino that will program the 24LC08 chip to any of the 3 possible combinations. Just hook up the I2C lines and power & ground and run the programhttp://pastebin.com/raw/AMZRxq3T

author: luisprata
author_rank: Regular Contributor
timestamp: February 07, 2016, 03:53:28 am
content: After some work, I`ve removed password for root, accessed command line and went into dir /usr/share/tek where i found "fw_setenv" and executed:./fw_setenv model "MSO2024"After that, my oscilloscope thinks it is MSO2024.I think it could be possible just changing fwEnvUpdate.sh. So you have to mount firmware.img, change fwEnvUpdate.sh, change md5sum.txt with new md5 for fwEnvUpdate.sh, umount and that`s it.To change the file, put before last line of fwEnvUpdate.sh:$FW_SETENV model "MSO2024"echo "Finished updating environment variables."Besides showing MSO2024 I can't test performance after modification. If someone tested, please tell us.Sorry about bad english.Thanks.

author: DiodomanX
author_rank: Contributor
timestamp: February 08, 2016, 09:37:26 pm
content: I found thishttps://github.com/dmitrodem/tek_softhack, and install the modified firmware in my DPO2012B and all modules was unlocked, but i have an issue, without the modified firmware autoset take 2-3 seconds to work with 1M point record, with the modified firmware it takes about 5 and a half second, any one with hardware module can check this. Same for math functions, and i dont know if affect the decode of buses. Can someone confirm, i can share my update image.Enviado desde mi XT1563 mediante Tapatalk

author: luisprata
author_rank: Regular Contributor
timestamp: February 09, 2016, 03:16:43 am
content: DiodomanX,Thank you for the tip for software unlock.About autoset, I measured the time and it is about 3.8s with 1 channel enabled and probing 1kHz compensation signal. With or without hardware keys.But when I enable all 4 channel the time rises to 7s.Luis AP Barbosa.

author: DiodomanX
author_rank: Contributor
timestamp: February 09, 2016, 04:38:05 am
content: Then it is normal that time is increased, some progress in testing to increase the bandwidth?Enviado desde mi XT1563 mediante Tapatalk

author: DiodomanX
author_rank: Contributor
timestamp: February 10, 2016, 01:09:58 am
content: I will do it this weekend, can you tell me wich ic i have to search.Enviado desde mi XT1563 mediante Tapatalk

author: luisprata
author_rank: Regular Contributor
timestamp: February 10, 2016, 02:10:45 am
content: To check if you have a CPLD take a look at this video (10min10sec). It's an altera MAX II.About bandwidth upgrade, my earlier tests were wrong.After upgrading again, I could notice that filtervu shows me 200MHz max value instead of 100MHz before, and time\dv decrease to 2ns instead of 4ns before. So I really think there is a chance that have worked.I really would like to test it with a signal generator to check 3db frequency.

author: drsurfer
author_rank: Contributor
timestamp: February 10, 2016, 08:04:01 pm
content: HelloQuote from: luisprata on February 09, 2016, 05:49:39 amI have a MSO 2024B and I could do it for you.Please tell me exactly where I have to attach the RS232 level converter.I read "MPC870 U13(SMTX) and T12(SMRX) pins are routed to B23 and B25 pins on external connector", but I'm too lazy to actually find them.

author: luisprata
author_rank: Regular Contributor
timestamp: February 10, 2016, 08:58:42 pm
content: Look at expansion, you can put some small rigid wires into connector.They are 8th and 10th positions counting as shown in figure.Update: **** Please check voltage on TX and RX pins before connect...

author: drsurfer
author_rank: Contributor
timestamp: February 11, 2016, 08:29:45 am
content: Luis, I did the connections according your picture.I've verified that the markings on PCB match with your previous post, B25=RX (input) and B23=TX (output).I've connected GND to the matching pin on the other side, A23.No significant voltage at pins: on TX I would have expected to see 3.3V or similar.Then I've connected the TX pin (B23) and ground to my to USB 3V3 converter;I'm afraid to connect my converter output pin until I'm sure I'm doing right...No activity on terminal.Should I send some char to trigger the boot log start?At what baud rate should happen the communication ? (later) Ok, I've read on your posted log 115200 bps.

author: luisprata
author_rank: Regular Contributor
timestamp: February 11, 2016, 02:03:34 pm
content: QuoteNo.Terminal should be configured to "No hardware hand shaking".You have to get 3v when measuring TX pin. If you don't, probably your connection is not good. You can use metal case as ground.Thank you.

author: drsurfer
author_rank: Contributor
timestamp: February 11, 2016, 05:14:45 pm
content: My dear friend, I think it's time to give up.Trying to have a good contact, I think I've pushed too far the terminal: the connector spring contact went outside the black plastic shell.It was so pushed down that it was shortened with the ground terminal in front of it.This happens when your eyes are not so good as when you were young.Now I have disassembled the board and using a microscope I was able to restore the spring in its slot.Now when I measure voltage I read 220 mV from TX terminal, when the scope is turned on.I suppose that I have broken the output stage of my chip, it didn't survive to the overcurrent.Two weeks later:it did survive, luckily.I was doing something wrong. What? I don't know! Who really cares?

author: timb
author_rank: Super Contributor
timestamp: February 14, 2016, 11:12:38 am
content: Quote from: DiodomanX on February 08, 2016, 09:37:26 pmAnyone done this for 1.56 firmware? I'm having a rough time getting crosstools to build. So a ready made image would be nice.

author: DiodomanX
author_rank: Contributor
timestamp: February 14, 2016, 01:58:40 pm
content: I have a ready to flash image, i can share it with you.Enviado desde mi XT1563 mediante Tapatalk

author: computer7geek9
author_rank: Newbie
timestamp: February 23, 2016, 05:06:47 am
content: Does anyone have any info on doing this for a MSO3000b series? I know it is encrypted because it talks about loading keys in the manual. I really want to unlock it to 500mhz but this is the closest info I have found.

author: miguelvp
author_rank: Super Contributor
timestamp: February 23, 2016, 05:13:39 am
content: Quote from: computer7geek9 on February 23, 2016, 05:06:47 amNot my post but maybe?https://www.eevblog.com/forum/testgear/tektronix-dpomso-3000-and-4000-module/Note: it links back to this thread but adds some additional information.

author: computer7geek9
author_rank: Newbie
timestamp: February 24, 2016, 02:48:42 am
content: So I had a bit of a drunk moment and thought I had the mso3014b but its a mso2014b. I'm interested if anyone has had luck enabling the feature modules "DPO2AUDIO" or the other ones listed in the OS that are available only on the 3000 series and can confirm that they work?Also what did you do to remove the login password? I've always known the password of embedded linux machines that i work on

author: luisprata
author_rank: Regular Contributor
timestamp: February 24, 2016, 03:55:22 am
content: computer7geek9,In the bellow message, drsurfer says there are several strings in source code. But only few of them are properly recognized.https://www.eevblog.com/forum/testgear/mso2000-application-module-hack/msg547336/#msg547336About removing password, it's related with firmware update. You have to edit passwd file and update the firmware. I don't know if it will be helpfull with a generic embedded system.

author: computer7geek9
author_rank: Newbie
timestamp: February 24, 2016, 04:37:37 am
content: Ok, I was under the impression that he hadn't done anything with them.I'll take a look at the firmware file and see what I can do after I program the eeprom and get that working. Thanks!

author: drsurfer
author_rank: Contributor
timestamp: February 24, 2016, 06:59:04 pm
content: Hi, you're right, personally I didn't try other codes, but "lunasix" did and all other codes were not working or unuseful.You're free to try again, but I'm afraid it's only a waste of time.Quote from: computer7geek9 on February 24, 2016, 04:37:37 am

author: drsurfer
author_rank: Contributor
timestamp: February 24, 2016, 07:52:28 pm
content: It's always a good sensation when you prove you were wrong.I don't want to know what went wrong the other time, something stupid, I think.May be it's related to the old 1.52 firmware I had. I've just upgraded to the latest 1.56.Anyway here it is the boot log for my MSO 2024B scope.Code:U-Boot 1.1.4 (Oct 29 2008 - 14:14:00) Tektronix, Inc. V1.01CPU: MPC870ZPnn at 133.333 MHz: 8 kB I-Cache 8 kB D-Cache FEC presentBoard: Tektronix Fusion MPC870 Main BoardVersion: 4 (QUAL) 4 channel MSOTek0001A ChipId: 0x1400cTek0001A SubBlocksId: 0x0Tek0001B ChipId: 0x1400cTek0001B SubBlocksId: 0x0CPLD Version: 0x11I2C: readyDRAM: 64 MBFLASH: 32 MBIn: serialOut: serialErr: serialNet: FEC ETHERNETEnter password - autobooting in 3 seconds## Booting image at efec0000 ...Image Name: Linux-2.4.20_mvl31-885adsImage Type: PowerPC Linux Multi-File Image (gzip compressed)Data Size: 1278107 Bytes = 1.2 MBLoad Address: 00000000Entry Point: 00000000Contents:Image 0: 868895 Bytes = 848.5 kBImage 1: 409199 Bytes = 399.6 kBVerifying Checksum ... OKUncompressing Multi-File Image ... OKcmdline is console=ttyS0,115200 quiet bigphysarea=10570 panic=2 root=/dev/mtdblock4 rw mem=175190k NO_option_boardLoading Ramdisk to 03e3a000, end 03e9de6f ... OKNo option module board foundChecking for firmware update...No USB mass storage devices found to update from.Linux 2.4.20_mvl31-885ads V 1.06 Tektronix Fusion Tue Apr 26 14:44:49 PDT 2011Warning: loading NiDKEng-1.6 will taint the kernel: non-GPL license - ProprietarySee http://www.tux.org/lkml/#export-tainted for information about tainted modulesWarning: loading NiDUsb-1.6 will taint the kernel: non-GPL license - ProprietarySee http://www.tux.org/lkml/#export-tainted for information about tainted modulesWarning: loading tek will taint the kernel: non-GPL license - ProprietarySee http://www.tux.org/lkml/#export-tainted for information about tainted modulesScope application starting (normal mode)-----------------------------------------------------------------Running Init codeversionBuildFWVersionString(), TimestampString: 17-Jul-14 11:00versionBuildFWVersionString(), VersionFIRMWAREVERSIONversion: v1.56versionBuildFWVersionString(), Major ver num: 1 Minor ver num: 56hwInitmpc8xx GPIO open successfulInitializing Mpc8xxadg420a open successful.adg420b open successful.Initializing Adg420Initializing Adg420Initializing Adg420Initializing Adg420adg420b open successful.Initializing ExtTrigadc08d1020a open successful.adc08d1020b open successful.Initializing Adc08D1000Initializing Adc08D1000Initializing Dac121s101Initializing Dac121s101Initializing ad5160ad5305 open successful.Initializing ad5300tek0001 detected, patching device offsets.lm95241 open successful.lm95241 not present.Initializing Lm95241Initializing Lm95241Initializing ResetCpldFactory Checksum: Stored: 29892, Calculated: 29892 - OKSpc CheckSum: stored: 64237 calculated: 64237 - OKStarting POST diagsFinished POST diagsFp Id response: 6 4 19Front Panel Software Rev 19 - no update needed.cfgGetBoardModel: modelID 6 idStr MSO2024BhcPtpInit: Starting PictBridge PTP subsystemfusadInitutilInit-----------------------------------------------------------------Running Start codediagStartfusionTrigStart(): calibrateTrigIf() ran 1 times and passedfusionTrigStart(): testTrigIf() for TEK0001A returned 0fusionTrigStart(): testTrigIf() for TEK0001B returned 0fusadStart-----------------------------------------------------------------Running Run codewfmMgr OK for diagsdiagRunfusadRuneth0: unknown interface: No such deviceeth0: unknown interface: No such deviceenetLinkPresent: ioctl failed, errno 19enetLinkPresent: ioctl failed, errno 19-----------------------------------------------------------------Scope startup complete; duration = 22.829660 seconds=================================================================PID to Task info:PID: 62ThrdID: 16386Task: tUsrRootPID: 63ThrdID: 32771Task: tExcTaskPID: 64ThrdID: 49156Task: errSuspendAllThreadPID: 65ThrdID: 65541Task: hwIntReceiverPID: 66ThrdID: 81926Task: fpIntTaskPID: 67ThrdID: 98311Task: fpIrqMonitorPID: 68ThrdID: 114696Task: usbHotplugPID: 0ThrdID: 131081Task: probesSharedUnloadCmdQueueThreadPID: 70ThrdID: 147466Task: fusad executivePID: 71ThrdID: 163851Task: UsbTmcOutputMgrPID: 72ThrdID: 180236Task: piUsbPID: 73ThrdID: 196621Task: piVGpibPID: 74ThrdID: 213006Task: Nios A listenerPID: 75ThrdID: 229391Task: Nios B listenerPID: 76ThrdID: 245776Task: execPID: 77ThrdID: 262161Task: autosetPID: 78ThrdID: 278546Task: calPID: 79ThrdID: 294931Task: diagPID: 80ThrdID: 311316Task: fpPID: 81ThrdID: 327701Task: hcPID: 82ThrdID: 344086Task: UsbSicInputMsgMgrPID: 83ThrdID: 360471Task: wfmMgrTestPID: 84ThrdID: 376856Task: searchPID: 85ThrdID: 393241Task: periodicZoomPID: 86ThrdID: 409626Task: periodicClockAnimationPID: 87ThrdID: 426011Task: periodicBusyIndicAnimationPID: 88ThrdID: 442396Task: mathPID: 89ThrdID: 458781Task: measPID: 90ThrdID: 475166Task: measImmedPID: 91ThrdID: 491551Task: piCmdIntfcPID: 92ThrdID: 507936Task: probesPID: 93ThrdID: 524321Task: refPID: 94ThrdID: 540706Task: rtlPID: 0ThrdID: 557091Task: thttpdPID: 112ThrdID: 573476Task: tVxi11SRQdPID: 0ThrdID: 589861Task: tVxi11RpcdPID: 114ThrdID: 606246Task: tVxi11FlushThreadPID: 0ThrdID: 622631Task: busPID: 0ThrdID: 639016Task: debugConsolePID: 117ThrdID: 655401Task: VgpibReadPID: 118ThrdID: 671786Task: VgpibWritePID: 119ThrdID: 688171Task: UsbTmcEventDispatcherPID: 0ThrdID: 704556Task: probesHandleBulkPowerChangeThreadPower Up Completed at 20:28:37Enter 'ctrl-\' twice to quit scopeAppReceived testTrigIfcMsgAck, nios = 1, payload = 10OK to connect by: telnet MSO2024B-05NTD7 1072Received testTrigIfcMsgAck, nios = 0, payload = 1020:28:37 fusadSetNiosUsable20:28:42 --- Power Up Phase Cal - PASSED

author: luisprata
author_rank: Regular Contributor
timestamp: February 25, 2016, 02:38:40 am
content: Gooood!!!Now you can prepare a root blank password firmware.... mount firmware.img, untar filesystem.tar.gz, edit /etc/passwd to remove root password... tar filesystem.tar.gz again... calc m5sum... update md5sum.txt with new filesysytem.tar.gz md5 and unmount firmware.img.Then after boot serial messages press ctrl \ twice and you can get accesss to internal linux.

author: luisprata
author_rank: Regular Contributor
timestamp: February 25, 2016, 02:54:00 am
content: The log is identical to MSO2014, except for SPC and Factory check sums and..."cfgGetBoardModel: modelID 6 idStr MSO2024B"After upgrading, I can change this Model message to MSO2024 too, so I really think the bandwidth upgrade was successful.Thank you drsurfer, and I am so happy your scope serial is not damaged.

author: drsurfer
author_rank: Contributor
timestamp: February 25, 2016, 08:36:39 am
content: I think I will do this when I find a reliable way to attach the wires to the connector.Beside the personal satisfaction to have broken a lock, is there any pratical purpose in accessing to linux shell?Is there any chance to decrypt the original password? I'm not exactly a linux expert, as you may have understood...After a while: Could anyone try "taurus" as root password?I'm not at my desk...Quote from: luisprata on February 25, 2016, 02:38:40 am

author: computer7geek9
author_rank: Newbie
timestamp: March 01, 2016, 06:59:10 am
content: Well I managed to brick my mso2014b so thats fun. Any ideas on how to repair? I was attempting to install a firmware version with no password and it stayed on the splash screen for hours so I had no choice but to unplug it. Now it just has a white screen. Any ideas?

author: timb
author_rank: Super Contributor
timestamp: March 01, 2016, 08:54:45 am
content: Quote from: computer7geek9 on March 01, 2016, 06:59:10 amOhh, that's bad. Is it still under warranty? Tektronix might need to replace it.When Tek first sent me a MSO2024 (about 2 years ago), the first thing I did was to upgrade to the latest firmware. So I grabbed it from their site, popped it on an SD card and used a USB to SD dongle (I didn't have a sub-8GB USB drive handy) to load it. Same thing happened. Sat on the firmware screen for hours, so I finally unplugged it and...white screen.I relayed the info to my contact at Tek, hoping they maybe had a sequence to get into an emergency boot loader or something. She put me in touch with a technician who put me in touch with one of the firmware engineers. No such luck. They ended up replacing it with a brand new MSO2024B.Now, if you're not under warranty, maybe we can get some info out of the serial console as it boots. Perhaps force the boot loader to try the USB drive, if it's still intact.Worse case scenario, it might require figuring out how factory firmware is programmed in. Maybe an onboard debug connector or something.I know this isn't what you wanted to hear. :-/

author: computer7geek9
author_rank: Newbie
timestamp: March 01, 2016, 09:23:46 am
content: I tried connecting to the serial console but was unable to get any data, plus I don't know the password (hence why I was updating it). I will try again to see if I have the wrong pins on the connector or something, but I'm afraid I might be out of luck. I don't know what could've gone wrong. I just edited the /etc/passwd file, re-tar, re-gz, changed the MD5, then made an img file. I used and online md5 calculator so I wonder if thats what caused it, but I would expect to see some kind of "upgrade failed" problem if it was just an md5 error. Could it be that the serial port isn't even initialized?

author: drsurfer
author_rank: Contributor
timestamp: March 01, 2016, 09:30:07 am
content: I simply don't understand.I just posted the password, and decoding it from /etc/passwd is a trivial task for any casual "hacker" like myself.I haven't actually tried it, but there is no reason it does not work.The point is you hadn't a working console. Where do you hope to go, even with removed password?Anyway did you try to load the original unmodified firmware on a fresh USB key and retry flashing from scratch?

author: timb
author_rank: Super Contributor
timestamp: March 01, 2016, 09:33:05 am
content: One would think that it wouldn't overwrite the boot loader first, but I don't know exactly how the upgraded works. It obviously copies the installer into to ram. Judging by the white screen and lack of serial data, I suspect it may wipe flash before copying the new bootloader and OS over.If this is the case, the machine obviously wiped the flash and then encountered a silent error while copying the new data over.If that's the case, then the only way to get the thing going may be through some sort of JTAG process.

author: timb
author_rank: Super Contributor
timestamp: March 01, 2016, 09:35:07 am
content: Quote from: drsurfer on March 01, 2016, 09:30:07 amHe can't reload off the USB key. The scope won't even boot.When this happens you get nothing. Just a white display (meaning it's not getting past the bootloader).

author: drsurfer
author_rank: Contributor
timestamp: March 01, 2016, 09:48:08 am
content: Ah, ok. I misinterpreted his message.

author: computer7geek9
author_rank: Newbie
timestamp: March 01, 2016, 09:51:31 am
content: I haven't messed around with decoding passwords so i figured it would be easier to just remove it completely. I saw your post about the password earlier but it didn't click when I worked on it tonight.I have tried re-flashing the original firmware but it won't even go to the splash screen.Messing with embedded linux on a device with onboard memory is new to me as most of my experience is using development boards that boot from either usb or sd card so I have never had something that's not easily revertible to an older, working version. I'm just pissed at myself because I had all the modules working with the soft hack and I wanted to mess around with upgrading it to a 2024b for the hell of it. I have no use for the extra 100mhz, I just wanted to max the device out for the hell of it.

author: timb
author_rank: Super Contributor
timestamp: March 01, 2016, 09:56:52 am
content: Quote from: computer7geek9 on March 01, 2016, 09:51:31 amDon't beat yourself up. I've bricked plenty of routers in my day. It's easy to do when upgrading embedded firmware.I'm going to try and help you get your scope back in action. As soon as I get back to my lab in a couple of days, I can dismantle my 2024B and start looking for programming pads, what type of flash it uses, etc.I'm taking this as a personal challenge, mainly because my original unit bricked in the same way, with a factory firmware upgrade. So I'm curious how that can be fixed. Because there *has* to be an easy way to fix it. (If it's happened to two people, you can bet it's happened to many more.)

author: computer7geek9
author_rank: Newbie
timestamp: March 01, 2016, 10:04:22 am
content: Quote from: timb on March 01, 2016, 09:33:05 amIn fwUpdate.sh it talks about uBootExtract Tool (line 326) checking the bootloader on the device and on the update. It says "If we can't extract the version from the scope, then update." But since it is clearly not getting to this step, do you know how to JTAG the bootloader partition (in bootloader.img I assume) to the partition /dev/mtd0 (line 53). I have never loaded anything through JTAG.

author: computer7geek9
author_rank: Newbie
timestamp: March 01, 2016, 10:09:58 am
content: Quote from: timb on March 01, 2016, 09:56:52 amThat would be great. It would be really helpful to learn more about it since once I get in the workforce (currently a senior EE student), I will need to know more about embedded memory and how to fix this stuff, instead of just plugging in a new SD card.

author: timb
author_rank: Super Contributor
timestamp: March 01, 2016, 10:14:27 am
content: Quote from: computer7geek9 on March 01, 2016, 10:04:22 amThat's what I'm going to find out. I have extensive experience with uBoot. I'm hoping that the uBoot partition (mtd0) is still intact, in which case it may be a simple matter of finding an additional pair of pads on the main PCB (a debug console) that uBoot either outputs data to or takes data from.In which case, we can either command uBoot to look at the USB port or replace it with a working copy.I'm going to extract the firmware now and deconstruct the bootloader and figure out the partition arrangement.More info soon.

author: computer7geek9
author_rank: Newbie
timestamp: March 01, 2016, 10:23:56 am
content: Perfect. When I disassembled mine I noticed quite a few headers (with pins luckily) but didn't pay any attention to them as I just wanted to hookup uart. I will do some research on uBoot so I can hopefully understand anything you figure out haha

author: DiodomanX
author_rank: Contributor
timestamp: March 01, 2016, 12:48:57 pm
content: If anyone want the patched firmware sendme a PM please .Enviado desde mi XT1563 mediante Tapatalk

author: luisprata
author_rank: Regular Contributor
timestamp: March 01, 2016, 02:28:14 pm
content: timb,I look forward to more info about uboot.Luis.

author: luisprata
author_rank: Regular Contributor
timestamp: March 01, 2016, 03:04:15 pm
content: Looking at console messages side by side with scope screen:https://www.youtube.com/watch?v=0DUYwDC8nN0&feature=youtu.be1) Blank screen2) Uboot messages3) Splash screen4) Uboot loads kernel...So, no splash screen may indicate a bootloader partition (uboot) failure...Is there an easy way to reprogram firmware ?Or only usinghttp://www.nxp.com/products/interface-and-connectivity/wireless-connectivity/sub-1-ghz-wireless-solutions/universal-multilink-fx-high-speed-development-interface:U-MULTILINK-FX?Luis.

author: luisprata
author_rank: Regular Contributor
timestamp: May 26, 2016, 03:46:32 am
content: Recently I bougth a DPO2CONN ... But I couldn't get video on my monitor. It shows "15.734KHz / 30 Hz out of range" ...I suspect that some unused VGA pins are used to Console because there are a MAX3221 routed to this connector.CPLD is a MAX II EPM570T100I dont know how the board is detected by the system. Maybe a simple board present, or maybe some CPLD info. I`ll investigate it.Some internal pictures...

author: Le_Bassiste
author_rank: Frequent Contributor
timestamp: May 26, 2016, 04:44:51 pm
content: and here is my DPO2CONN purchased many years ago. right from the beginning, it constantly refused to connect to my home server, so i did some testing around the ethernet phy, only to find out that the !RESET from the FPGA to the phy wasn't properly asserted. a Q&D fix did the job...

author: luisprata
author_rank: Regular Contributor
timestamp: May 26, 2016, 07:27:34 pm
content: Le_Bassiste,Does your video output work? Could you check H-sync and V-sync frequencies? It will help me a lot.Thank you.

author: luisprata
author_rank: Regular Contributor
timestamp: May 26, 2016, 07:29:06 pm
content: Do you have any other useful information about this module?

author: Le_Bassiste
author_rank: Frequent Contributor
timestamp: May 28, 2016, 09:56:24 am
content: sorry, nope. module came in sealed original box w/o any description. VGA output works, but can't do any scaling, so it's basically useless anyway.

author: PA0PBZ
author_rank: Super Contributor
timestamp: May 28, 2016, 10:40:20 am
content: Quote from: Le_Bassiste on May 28, 2016, 09:56:24 amMeh, that should be a job for the monitor.

author: luisprata
author_rank: Regular Contributor
timestamp: May 28, 2016, 05:39:38 pm
content: My frequencies are the half of yours. 15.734kHz / 30Hz. Could you measure Y400 frequency oscillator? Thank you again.Update: My Y400 frequency is 25.175MHz.Update: I think maybe your monitor shows the frequency of the VGA mode used, not actual signals. Could you confirm that?

author: aibi1590
author_rank: Newbie
timestamp: October 07, 2021, 06:13:11 am
content: Hey I got one mso2012 and a white screen appears.I watch the ubootlog and stop at DRAM:64MBI infer that the flash is faulty.Is it still possible to repair this?

author: Krikke944
author_rank: Newbie
timestamp: April 04, 2023, 01:22:27 pm
content: If you still have a copy of the patched FW 1.56 I would like to try it out.

author: Minsoon
author_rank: Newbie
timestamp: April 27, 2024, 05:03:05 pm
content: Hi.~I purchased mso2014 used only yesterday.There is no logic probe option, so I plan to create this using artwork.I received good help from eevblog about the Agilent 54831 hack before.As expected, mso2014 information is also available here.I upgraded to the latest version 1.56 today.The serial port on the rear Side will also need to be made using a PCB.Can I ask for the patched firmware for App-Module Hack?thank you!.