EEVblog #978 - Keysight 1000X Hacking - Page 1
Forum section: electronics / general

author: EEVblog
author_rank: Unknown
timestamp: March 08, 2017, 09:07:26 pm
content: How to find and inspect hidden serial UART terminal ports inside equipment.Dave finds the uBoot Windows CE UART part in the new Keysight 1000 X-Series oscilloscope and uses the info to find some of the product mode configuration pins. A hardware hack shows that changing product configuration modes in hardware is possible.

author: EEVblog
author_rank: Unknown
timestamp: March 08, 2017, 10:02:04 pm
content: Dump from a production DSOX1102G unit:Code:U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500CPU: SPEAr600DRAM: 128 MiBFlash: 512 KiBNAND: internal ecc 128 MiBDebug serial initialized ........OKRTC: 2024-16-10 7:86:38.44 UTCMicrosoft Windows CE Bootloader Common Library Version 1.4 Built May 7 2015 01:38:03Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 boardAdaptation performed by Agilent Technologies (c) 2008PHY not found.System ready!Preparing for download...RTC: 2024-16-10 7:86:38.44 UTCLoading image 1 from memory at 0xD0600000OBL_IMAGE_TYPE_BINXXXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXOOOOOOOOOXOOOOXOXXOXOXXOXOXOXOXXXXOOXXXOOOOOOXXOXXOXXXXXXOOOXXXOXXOOOXXXOXXOOOOXOOXXOOOXOOOOXOXOOOOOXOOOXOOXOXXOXOXXXXXXOXXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOXXOOOXOOXOOOOXOOOOXOOXXOOXOOOOOOOOOXOOOOXOOOOOOXOXOOOOXOXOOOOOOOXXOOXOOXOXOOOXOOOXOOXXOXOXOOOXOXXXXXOXOXXXOXXXXOXOXXOOOXXXXOXXXXOXXXXXXXOXXXXXXOXXOXXOXXOOXXOXXXOXXXXOOOXXXOOOXXXOXXOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXXXXOOOXOXOOXOOXXXXXXXXXXXXXrom_offset=0x0.XXImageStart = 0x80361000, ImageLength = 0x1A80C40, LaunchAddr = 0x80362000Completed file(s):-------------------------------------------------------------------------------: Address=0x80361000 Length=0x1A80C40 Name="" Target=RAMLoading image 1 succeeded.ROMHDR at Address 80361044hPreparing launch...RTC: 2024-16-10 7:86:38.47 UTCLaunching windows CE image by jumping at address 0x 362000Windows CE Kernel for ARM (Thumb Enabled) Built on Mar 8 2013 at 17:05:33Setting up for a Cold RebootDone Setting up for a Cold RebootWindows CE Firmware InitBSP 1.0.0 for the SPEARHEAD600AB board (built Sep 28 2016)Adaptation performed by ADENEO (c) 2005+OALIntrInit-OALIntrInit(rc = 1)Initialize driver globals Zeros area...pDrvGlobalArea 0xa0060000 size 0x800 (0xa0060800 -0xa0060000)Initialize driver globals Zeros area...doneOALKitlStartFirmware Init Done.OALIoctlHalEnterI2cCriticalSection init i2c cs++SER_Init: context Drivers\Active\14SER_Init, dwIndex:2SER2 got sysintr:0x00000017SER2 Serial Port, new baud rate:0x1c200 (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)OHCI\system.c, GCFG_USBH1_SW_RSTOHCI\system.c, GCFG_USBH2_SW_RSTLAN PHY NOT detected.DeleteP500EnetRegistry:\Comm\GMAC 0x0\Comm\GMAC1 0x0\Comm\Tcpip\Linkage 0x0\Drivers\Virtual 0x0\Drivers\BuiltIn\LIN 0x5LIN: Data ValidBALDWIN_DDI: cBaldwinHwIf::Init: Initializing...BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.BALDWIN_DDI: cBaldwinHwIf::Init: Success!Device load time:NANDFLASH: 1 msSNANDFLASH: 1 msSHIM DLL, LoadRealDll [PalIO.dll] for [AgilentPalIO.dll]SHIM [AgilentPalIO.dll] Get Process AddressesLaunchInfiniiVision:=========================================BLT Product Config 24Bandwidth : 200MHz#Channel : 2Board Rev : FPRClk Gating : BaldwinSample Rate : 4GSaLAN PHY : NoBLT Module Config 02Rev : LP3Sample Rate : 5GSa/s=========================================BLT_PRODUCT_CONFIG_0, 1.251v, ID4BLT_PRODUCT_CONFIG_1, 0.692v, ID2BLT_MODULE_CONFIG_0, 0.687v, ID2BLT_MODULE_CONFIG_1, 0.005v, ID0CANINE_BOARD_REV, 0.002v, ID0CANINE_MODEL_NAME: MARSUPIAL, 1.738v, ID6, MARSUPIALCANINE_EXTMODULE, 2.488v, ID8, SWID8CANINE_MSO_REV, 0.628v, ID2, SWID2SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]SHIM [AgilentPalSStorage.dll] Get Process AddressesReleased build, Sep 28 2016, 00:17:51Initializing FPGA...************************************FPGA Type: MarsupialVer: 1.067 ReleasedBuild Time: Tue Jun 14 17:13:42 2016Build Machine: 2UA5461ZWH************************************cMarsupialCalMgr::cMarsupialUserCalFactors::cMarsupialUserCalFactors size 146412cMarsupialCalMgr::cMarsupialServiceCalFactors::cMarsupialServiceCalFactors size 704cMarsupialCalMgr::cMarsupialFactoryCalFactors::cMarsupialFactoryCalFactors size 896Calibration mode UserRecall \Secure\cal\FactoryCal2.dat - okRecall \Secure\cal\ServiceCal1.dat - okRecall \Secure\cal\UserCal8.dat - okCal Date Sun Sep 25 15:11:58 2016will do USB phy workaround: CheckCRCStartup sequence is complete.System has been running 16.841095 secondsStart Up Sequence 7.470958Memory Load 50%System Physical Memory 36.441 / 73.465 MBProcess Virtual Memory 46.938 / 1024.000 MB-----> InfiniiVision is running <-----

author: vaualbus
author_rank: Frequent Contributor
timestamp: March 08, 2017, 10:13:29 pm
content: Where we find the photo of the early non production model?

author: sasquatch
author_rank: Contributor
timestamp: March 08, 2017, 10:35:34 pm
content: Is this Keysight trying to do a Rigol? An unauthorised yet acceptable hack?

author: EEVblog
author_rank: Unknown
timestamp: March 08, 2017, 10:39:12 pm
content: I've found the other product set resistors, playing now...

author: SparkyBruce
author_rank: Contributor
timestamp: March 08, 2017, 10:47:46 pm
content: You just know that a letter from their legal team is inbound now...Well done

author: Keysight DanielBogdanoff
author_rank: Unknown
timestamp: March 08, 2017, 10:56:16 pm
content: Quote from: sasquatch on March 08, 2017, 10:35:34 pmThis wouldn't be the first time a Keysight InfiniiVision scope has been hacked. In the past it's been a "at your own risk" and "for your use only" activity, anyone trying to sell hacked units got a nice letter from the legal folks.In no way are we leaking info for or sponsoring a Keysight hackathon scenario.But

author: EEVblog
author_rank: Unknown
timestamp: March 08, 2017, 11:46:57 pm
content: Quote from: EEVblog on March 08, 2017, 10:39:12 pmHuge progress, stay tuned!

author: kenshironanto
author_rank: Newbie
timestamp: March 08, 2017, 11:55:13 pm
content: Wouuah so nice!As i see in video, changing resistor values change specification, seems a little dumb question but this kind of change can really have an impact on measuring values?Is hardware not define the specs like acquisition speed or anything?I really want to seeee mooreeee, can't waitCode:SER_Init, dwIndex:2SER2 got sysintr:0x00000017SER2 Serial Port, new baud rate:0x1c200 (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)Another stupid question concerning the pretending 2nd rs232, do you think that also define by values of resistors?like if scope load a generic image and adapt it in resistor's value?

author: EEVblog
author_rank: Unknown
timestamp: March 09, 2017, 12:03:14 am
content: Quote from: EEVblog on March 08, 2017, 11:46:57 pmThis ain't no 100MHz bandwidth scope

author: ProBang2
author_rank: Frequent Contributor
timestamp: March 09, 2017, 12:08:24 am
content: No review published yet, only a teardown.But seems to be hacked very soon...WOW! That was fast!

author: EEVblog
author_rank: Unknown
timestamp: March 09, 2017, 12:12:32 am
content: Quote from: ProBang2 on March 09, 2017, 12:08:24 amI've shot some review footage, but good reviews are a lot of work.I more excited about the hacking at present.I can currently change the bandwidth and max sample rate

author: EEVblog
author_rank: Unknown
timestamp: March 09, 2017, 12:20:55 am
content: I now have a 220MHz bandwidth scope

author: hauptbr09
author_rank: Contributor
timestamp: March 09, 2017, 12:32:35 am
content: Making quick work of itSent from my SM-G935V using Tapatalk

author: hauptbr09
author_rank: Contributor
timestamp: March 09, 2017, 12:36:36 am
content: It seem like the resistors will change the configuration, but if they sell upgrades there must be data in ROM that can override those settings. That said, they must only be able to upgrade via software, but not downgrade below the configuration set by the resistors or your resistor mod would have no affect.Sent from my SM-G935V using Tapatalk

author: amitchell
author_rank: Regular Contributor
timestamp: March 09, 2017, 12:40:15 am
content: Quote from: EEVblog on March 09, 2017, 12:20:55 amHow exciting, cant wait to get mine!What are you getting for sample rates?

author: Fungus
author_rank: Super Contributor
timestamp: March 09, 2017, 12:44:59 am
content: Quote from: hauptbr09 on March 09, 2017, 12:36:36 amIt seems weird that they would have both.How does software upgrade work? By entering a code like on Rigols?(ie. is there a menu to enter option codes?)

author: ProBang2
author_rank: Frequent Contributor
timestamp: March 09, 2017, 12:47:44 am
content: Quote from: EEVblog on March 09, 2017, 12:12:32 amSorry. Really: No offense intended. (English isn´t my first language...)QuoteWho isn´t?QuoteAgain: WOW! That was fast!

author: hauptbr09
author_rank: Contributor
timestamp: March 09, 2017, 12:49:30 am
content: Quote from: Fungus on March 09, 2017, 12:44:59 amThat's what it sounded like. Dave mentioned purchasing licenses, which keysight has done in the past for other scopesSent from my SM-G935V using Tapatalk

author: TheSteve
author_rank: Unknown
timestamp: March 09, 2017, 12:58:37 am
content: Quote from: EEVblog on March 09, 2017, 12:20:55 amTold ya!!!

author: jackenhack
author_rank: Contributor
timestamp: March 09, 2017, 01:21:57 am
content: Very cool! Might see a new oscilloscope on my desk soon...

author: bitseeker
author_rank: Super Contributor
timestamp: March 09, 2017, 01:50:36 am
content: Keysight oscilloscope dept.:"He's almost got it!""Really, so soon?""Yeah, pretty close. Get ready for sales numbers to shoot up on these babies."

author: HAL-42b
author_rank: Frequent Contributor
timestamp: March 09, 2017, 02:00:35 am
content: Quote from: bitseeker on March 09, 2017, 01:50:36 amTrue story.Unfortunately it is a Danaher. Even worse, it is a bottom of the barrel crippled Danaher running...Windows, so paying actual cash is for it is kinda...not very clever. Lucky for the guys who got it for free though.

author: TheSteve
author_rank: Unknown
timestamp: March 09, 2017, 02:17:54 am
content: Quote from: HAL-42b on March 09, 2017, 02:00:35 amUmm, no. Keysight is Keysight. Danaher owns Tektronix.

author: Fungus
author_rank: Super Contributor
timestamp: March 09, 2017, 02:24:33 am
content: Quote from: bitseeker on March 09, 2017, 01:50:36 amNot if you have to solder tiny resistors to do it.Sales will shoot up after the keygen appears.