Trying to hack the DSOX1204(A/G) firmware - Page 1
Forum section: electronics / testgear

author: stafil
author_rank: Regular Contributor
timestamp: April 06, 2020, 01:04:55 am
content: This is were I am so far.The 1200AXSeries.02.10.2019111333.ksx is really just a `cpio` archive. We can extract it using:```$ cpio -iv < ../1200AXSeries.02.10.2019111333.ksxsw-descriptionsw-description.sigcustomer.postinstall.shcustomer.preinstall.shFPGA1000A.binxFPGA1200A.binFPGA1200A.binxinfiniivision-firmware-bin.tar.bz2instrument-dso.squashfsstandardsplash.pnguImageuImage.spear600-keysight-infiniivision-1000-xseries-4channel.binuImage.spear600-keysight-infiniivision-1000-xseries-4channel-ecc4.bin134571 blocks```Then the `instrument-dso.squashfs` is just a squashfs, which we can again extract using the squasfs tools this time. It contains the root filesystem of the linux buildroot.```$ unsquashfs.exe -d rootfs -f instrument-dso.squashfsParallel unsquashfs: Using 16 processors3917 inodes (4722 blocks) to write[============================================================================================================================================================================================================|] 4722/4722 100%created 3287 filescreated 494 directoriescreated 622 symlinkscreated 0 devicescreated 0 fifos```If we go into rootfs we can now see that it is just linux rootfs tree:```$ lsbin boot dev etc firmware home lib media mnt proc run sbin sys tmp usb 'User Files' usr var```We can change the root password by editing the etc/shadow, and enable ssh by creating a soft link from `etc/init.d/sshd` to `etc/rc[2-4].d/S50sshd` (No sure which is the actual mode it will boot into).Once we are happy with the changes we can create a new `instrument-dso.squashfs` by using the `mksquasfs` tool:```$ mksquashfs rootfs archive/instrument-dso.squashfs```And then create the image with cpio:```$ ls | cpio -ov -H crc > ../1200AXSeries.02.10.2019111334.ksx```Now we should be able to load the image, and have ssh enabled and have root access, right?Well, no. The problem is that they are using the `swupdate` tool and have a file called `sw-description` which contains sh256 hashes for all the files and they sign this file using the public key in `usr/share/ca-certificates/keysight/Rocky-SWU-Signing-only.pem`.If we want to be able to install this image we have to be able to ssh to the box, and change that file with our own public key, which we will use to sign our image.So we are stuck in a chicken and egg problem.Anybody has any better idea now how to enable ssh?

author: tv84
author_rank: Super Contributor
timestamp: April 06, 2020, 01:54:51 pm
content: Quote from: stafil on April 06, 2020, 01:04:55 amYou can open ksx easily with 7zip.Can you share here the "swupdate" tool and "Rocky-SWU-Signing-only.pem" file?BTW, usually wesignwith a privkey and then use the pubkey toverify.

author: stafil
author_rank: Regular Contributor
timestamp: April 06, 2020, 07:12:53 pm
content: Quote from: tv84 on April 06, 2020, 01:54:51 pmswupdate is open source. You can find it here:https://github.com/sbabic/swupdateTheir public key is:```-----BEGIN PUBLIC KEY-----MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCwwXhBjYKCBLYev928vxW5JTyQ+zGryJcMdogZYUa2V8+2t21n5JX5RCq3uDgWaXhwxDKj/gYFJ0d8cmMCSGf297yt9fZL2pZkuNwoXUY9lzIT0yDxQv+X2UrCJLMtGOcPt3cFQCKlB3Gs/mwK4Df7LhYzV/c84adFxvgK/VuhlQIDAQAB-----END PUBLIC KEY-----```The binary compiled of swupdate is at:https://send.firefox.com/download/8204aa6fa99b6caf/#OVfQFaIBDULPP0Wsdpq8LA

author: Keysight DanielBogdanoff
author_rank: Unknown
timestamp: April 06, 2020, 09:42:36 pm
content: I'll jump in and add my typical caveat:Keysight does not support hacked hardware and you do so at your own risk. Additionally, if you try to up-hack and sell for a profit there's a good chance you'll hear from the lawyer folks.If you are doing this at your own risk to your own hardware, we generally aren't going to do anything about it.I, personally and not on behalf of Keysight, views are my own, yada yada, feel like this:

author: stafil
author_rank: Regular Contributor
timestamp: April 06, 2020, 10:07:13 pm
content: Quote from: Keysight DanielBogdanoff on April 06, 2020, 09:42:36 pmThanks Daniel! Wow, first because I wasn't expecting anybody from Keysight to respond here, and secondly because that's a (generally) very mature position for a company (not going out of users that try to hack their equipment for fun)Of course it goes without saying that I don't expect Keysight to support my, soon to be bricked, oscilloscope.Also this is just for fun and knowledge and definitely not planning to sell my Keysight.Finally if at any point you feel the slightest bit uncomfortable by my actions, please do let me know and will cease immediately.

author: tv84
author_rank: Super Contributor
timestamp: April 06, 2020, 10:51:10 pm
content: So it's a RSA-1024 public key. I think that your only chance of changing anything would require JTAG access and/or bootloader dump/rewrite.

author: TK
author_rank: Super Contributor
timestamp: April 06, 2020, 11:03:55 pm
content: I am not sure if SW hacking is needed, as serial decoding is now included standard and the only upgrades are BW10 and BW20.If you start from an EDUX1052A, you can mod (I don't like to call it a hack, as you are just adding and exchanging components in the PCB) it to a 70MHz DSOX1202G for around $50 in parts and get 2Mpts, 200,000wfm/s, wavegen, Segmented Memory, FRA and additional serial protocols (SPI, CAN, LIN).The front-end mod brings the scope to 200MHz capable input, so the only thing I can think BW10 and BW20 add is more smaller time scale with the horizontal knob.

author: stafil
author_rank: Regular Contributor
timestamp: April 06, 2020, 11:12:08 pm
content: Quote from: TK on April 06, 2020, 11:03:55 pmBW20 is not a bad upgrade, is it?

author: TK
author_rank: Super Contributor
timestamp: April 06, 2020, 11:34:47 pm
content: Quote from: stafil on April 06, 2020, 11:12:08 pmWhich model did you buy

author: stafil
author_rank: Regular Contributor
timestamp: April 06, 2020, 11:37:46 pm
content: Quote from: TK on April 06, 2020, 11:34:47 pm1204A, and before you ask, no I don't really *need* the extra BW. It's just a matter of why not

author: TK
author_rank: Super Contributor
timestamp: April 06, 2020, 11:43:51 pm
content: Quote from: stafil on April 06, 2020, 11:37:46 pmOf course, pure hacker spirit. BTW, if you only do a SW hack, you can always go back to the official firmware and you are not voiding any warranty, I guess... unless you mod to add the wavegen HW (why not spirit, right?)

author: stafil
author_rank: Regular Contributor
timestamp: April 06, 2020, 11:49:36 pm
content: Quote from: TK on April 06, 2020, 11:43:51 pmI like to believe that my software skills are much more advanced than the hardware ones, so no wavegen mod at the moment. But you never know what the future will bring

author: TK
author_rank: Super Contributor
timestamp: April 06, 2020, 11:54:20 pm
content: The 1200X software has a bunch of php scripts for remote control... maybe you can find a hole and execute linux commands remotely without ssh

author: stafil
author_rank: Regular Contributor
timestamp: April 07, 2020, 12:03:52 am
content: Quote from: TK on April 06, 2020, 11:54:20 pmI had a look at that. The attack surface doesn't look that large. I saw a possible hole at `$response = $jService->ProcessExecRequest($saveType, $args);` but couldn't find a `saveType` that would actually execute something.In the infiniiVisionCore binary I see in the data section a string "Unable to execute shell command", so maybe the have a way to execute shall commands somehow? Haven't figured out yet which function uses this.

author: tv84
author_rank: Super Contributor
timestamp: April 15, 2020, 07:25:39 pm
content: Quote from: stafil on April 07, 2020, 12:03:52 amAlso, didn't find any connection to that string.Nonetheless, I confirmed thatsw-description.sigis the RSA-1024 (with SHA256) signature ofsw-descriptionfile. So we definitely need a way to change theRocky-SWU-Signing-only.pempubkey file in order to resign a "refreshed" sw-description.

author: stafil
author_rank: Regular Contributor
timestamp: April 15, 2020, 07:58:23 pm
content: Another possible way is to go in through SCPI.Either using the "syst:prod:sscr", which I believe sets bootup parameters, and change it to boot into "single user" modeOr using the command that calls "setSystProdRunProcess". It's not "syst:prod:run:process" however, so probably we have to do a bit of decoding of their SCPI command tree to find which SCPI command it is.Also there is this "deb:command" command, that expects xml. Not sure the exact format though.Edit: I believe that the scpi command that will invoke the "setSystProdRunProcess" is ":syst:prod:rpr"Edit2: Found something interesting in the symbols:0x00807b58 .dword 0x00808020 ; str.500MHz_Bandwidth0x00807b5c .dword 0x00808034 ; str.BW50Capable of 500Mhz maybe?!?

author: thomasb9511
author_rank: Contributor
timestamp: April 17, 2020, 01:42:47 am
content: 1. If you can change the root password, can you login as root?2. What are the file permissions on `usr/share/ca-certificates/keysight/Rocky-SWU-Signing-only.pem` and the folder it is in?

author: stafil
author_rank: Regular Contributor
timestamp: April 17, 2020, 02:12:31 am
content: Quote from: thomasb9511 on April 17, 2020, 01:42:47 am1.I cannot find a way to even get to a login prompt (telnet, ssh, etc..)2.# ls -ld usr/share/ca-certificates/keysight/drwxr-xr-x 2 root root 4096 Nov 12 19:31 usr/share/ca-certificates/keysight/# ls -l usr/share/ca-certificates/keysight/Rocky-SWU-Signing-only.pem-rw-r--r-- 1 root root 272 Nov 12 19:31 usr/share/ca-certificates/keysight/Rocky-SWU-Signing-only.pem

author: thomasb9511
author_rank: Contributor
timestamp: April 17, 2020, 02:44:07 am
content: Quote from: stafil on April 17, 2020, 02:12:31 am1. Wonder if the binaries even exist. How are you running these commands?2. can you do whoami?I wonder what perms the running user have in terms of launching processes in bin/.

author: thomasb9511
author_rank: Contributor
timestamp: April 17, 2020, 02:53:22 am
content: Maybe you could run sshd(if it exists) as the running user -https://serverfault.com/questions/344295/is-it-possible-to-run-sshd-as-a-normal-user

author: stafil
author_rank: Regular Contributor
timestamp: April 17, 2020, 02:54:12 am
content: Quote from: thomasb9511 on April 17, 2020, 02:53:22 amHow? If I could login, I wouldn't need to run sshd...

author: thomasb9511
author_rank: Contributor
timestamp: April 17, 2020, 02:56:41 am
content: Quote from: stafil on April 17, 2020, 02:54:12 amHow are you running ls?

author: stafil
author_rank: Regular Contributor
timestamp: April 17, 2020, 03:00:21 am
content: Quote from: thomasb9511 on April 17, 2020, 02:56:41 amOh.. That's from the extracted image. I can extract the image on my PC

author: thomasb9511
author_rank: Contributor
timestamp: April 17, 2020, 03:05:49 am
content: Fair enough.If I'm correct, we would need to change the "Rocky-SWU-Signing-only.pem" that may live on the scope in order to change things then. Less the update process uses the cert in the update.

author: stafil
author_rank: Regular Contributor
timestamp: April 17, 2020, 03:12:58 am
content: Quote from: thomasb9511 on April 17, 2020, 03:05:49 amAbsolutely right.

author: thomasb9511
author_rank: Contributor
timestamp: April 17, 2020, 03:19:29 am
content: Or alter the routine that calls swupdate and change the -k parameter to point to a different cert.Either requires altering something inside the scope.

author: tv84
author_rank: Super Contributor
timestamp: April 17, 2020, 05:04:32 pm
content: Quote from: stafil on April 15, 2020, 07:58:23 pmThat's this table.

author: thomasb9511
author_rank: Contributor
timestamp: April 17, 2020, 05:09:39 pm
content: Quote from: tv84 on April 17, 2020, 05:04:32 pmA feature flag table?

author: tv84
author_rank: Super Contributor
timestamp: April 17, 2020, 07:20:31 pm
content: Quote from: stafil on April 15, 2020, 07:58:23 pmNice! Worth investigating.Edit: Included a list of all SCPI commandshere.

author: thomasb9511
author_rank: Contributor
timestamp: April 17, 2020, 08:42:35 pm
content: Wonder if the version of nginx and/or php the web server is running has any exploits.

author: stafil
author_rank: Regular Contributor
timestamp: April 17, 2020, 09:56:21 pm
content: Quote from: thomasb9511 on April 17, 2020, 08:42:35 pmI highly doubt it for ndginx, but php is possible.I also see the cups port and the rpc ports open, so that would be another attach surface if you are interested investigating.

author: stafil
author_rank: Regular Contributor
timestamp: April 17, 2020, 09:58:48 pm
content: Quote from: tv84 on April 17, 2020, 07:20:31 pmCorrect. But didn't have any luck with syst:prod:sscr, or syst:prod:rpr.One returns `-440 Query UNTERMINATED after indefinite response` and the other `System error`

author: stafil
author_rank: Regular Contributor
timestamp: April 17, 2020, 10:04:34 pm
content: Quote from: tv84 on April 17, 2020, 07:20:31 pmBTW, which decompiler is this one that you are using? looks cool

author: stafil
author_rank: Regular Contributor
timestamp: April 17, 2020, 10:16:04 pm
content: Quote from: tv84 on April 17, 2020, 10:13:57 pm`syst:prod:sscr?` would just return empty string

author: stafil
author_rank: Regular Contributor
timestamp: April 17, 2020, 10:16:48 pm
content: Quote from: tv84 on April 17, 2020, 10:12:02 pmReally nice, but also really expensive

author: stafil
author_rank: Regular Contributor
timestamp: April 17, 2020, 10:27:53 pm
content: Quote from: tv84 on April 17, 2020, 10:17:52 pmI think you are onto something but `syst:prot:sscr ON` returns "Character data not allowed"1 or 0, returns "Numeric data not allowed"

author: tv84
author_rank: Super Contributor
timestamp: April 21, 2020, 04:11:10 pm
content: Quote from: stafil on April 17, 2020, 10:27:53 pmThere is a system flagSEALED_STATE_KEYthat stores the "sealed" state of the scope. When the scope is in the "sealed" state, some of the interesting SYSTem SCPI commands are discarded.To check if a scope is (un)sealed, one can use:SYSTem:PRODuction:SEAL?If it returns 1 (ON), means it is "SEALED"

author: thomasb9511
author_rank: Contributor
timestamp: April 21, 2020, 04:46:16 pm
content: Quote from: tv84 on April 21, 2020, 04:11:10 pmNot optimal, but I wonder if there is a console port on the pcb? If,so I wonder if it has a shell, and what user it has

author: stafil
author_rank: Regular Contributor
timestamp: April 21, 2020, 06:27:36 pm
content: Quote from: thomasb9511 on April 21, 2020, 04:46:16 pmThat's a good idea, but I don't think I have ever opened something up to try to hack it and didn't end up destroying it..

author: thomasb9511
author_rank: Contributor
timestamp: April 21, 2020, 07:20:42 pm
content: Quote from: stafil on April 21, 2020, 06:27:36 pmWonder if someone has a guide or video if there are any traps to taking it apart.

author: pizzigri
author_rank: Regular Contributor
timestamp: October 28, 2020, 02:51:01 pm
content: Sorry to resurrect an old thread like this, but I was looking at this Keysight scope, and wondering whether anyone managed to actually succeed in the hack.Franco

author: TK
author_rank: Super Contributor
timestamp: October 28, 2020, 03:23:42 pm
content: Quote from: pizzigri on October 28, 2020, 02:51:01 pmAll the features are now included in the base price, so no need for a SW hack. The only hacks are BW with requires hardware mods ranging from a quick resistor swap and more advanced if you are starting from the EDU models. If you start from the DSOX, then just a resistor swap can give you full BW

author: pizzigri
author_rank: Regular Contributor
timestamp: October 28, 2020, 04:27:07 pm
content: Hey TK, that was exactly what I was after, a BW increase... it's over 350 Euro and is actually presented as a SW package, hence the idea that it was some unlock sw key. But, if it's only a resistor swap - well, wow! do you happen to have the details? I have not found it in the forum, however I'm looking for the DSOX1202/4G, so maybe it's under some other name.Thank you! It's really appreciated.

author: TK
author_rank: Super Contributor
timestamp: October 28, 2020, 07:11:59 pm
content: Quote from: pizzigri on October 28, 2020, 04:27:07 pmSorry!!! You don't get full BW with the resistor swap!!! Not enough caffeine in the morning...

author: uski
author_rank: Frequent Contributor
timestamp: October 29, 2020, 01:11:34 am
content: I believe that instead of focusing on the efforts on how to "hack" the scope without opening it, we should focus on how we can actually install the options (generate keys, yada yada)Because :1) Our friendly Keysight folks will probably be less concerned if the hack requires opening the scope. And to be honest (I know you are reading Keysight) they will also have less incentive to make the process more difficult, if the barrier to entry is higher. Whereas if it's too easy, we might end up with a super protected scope and we don't want that. I can even imagine that they will leave it open on purpose... for hobbyist use. No company will do that. But hobbyists will. Keysight will sell more scopes and people will want to buy, at work, the scope they are using at home. WIN WIN !2) We have limited time/resources to find a hack so we should focus on what brings the most valueJust my opinionAs a matter of fact I am currently looking for a scope for home use and I am considering only hackable scopes (which is why I started reading this thread).

author: wxqhigh
author_rank: Contributor
timestamp: October 07, 2021, 08:19:00 am
content: New keysight edux1052a Teardownhttps://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/msg3733414/#msg3733414

author: thaamike
author_rank: Newbie
timestamp: February 06, 2022, 10:01:01 am
content: Has anyone had succes ?

author: Bud
author_rank: Super Contributor
timestamp: February 23, 2024, 04:08:00 pm
content: SeeThis topic.