It's been done: The Keysight 1000 X-Series DSOs run Doom! - Page 1
Forum section: electronics / testgear

author: ginbot86
author_rank: Contributor
timestamp: October 16, 2018, 05:19:41 am
content: I'm really proud of myself with this hack. It took alotof work to eventually gain access to the Windows CE desktop on my DSOX1102G. After successfully doing so, I decided to do what needed to be done, making my scope run Doom.Check out the blog post here:https://ripitapart.com/2018/10/15/gaining-access-to-the-windows-ce-desktop-and-doom-on-the-keysight-dsox1102g-oscilloscope/

author: Berni
author_rank: Super Contributor
timestamp: October 16, 2018, 05:38:01 am
content: Nice work!Not sure what useful things could be done from this but it is cool to see. Perhaps we could run some extra software in the background of the main scope app to add some new functionality. Win CE has .net framework so its easy to write software for it in C# and remotely debug it too.

author: ginbot86
author_rank: Contributor
timestamp: October 16, 2018, 05:41:28 am
content: So far it seems applications are kind of limited. Launching the oscilloscope software results in the WinCE window elements being drawn on top of the InfiniiVision software, and it's rather unstable in this mode. However, with local command-line access, firmware operations could be a bit easier to do without blindly mucking around since we now have an interactive in-system environment to work with.

author: HighVoltage
author_rank: Super Contributor
timestamp: October 16, 2018, 07:51:11 am
content: Very impressive hack

author: Keysight DanielBogdanoff
author_rank: Unknown
timestamp: October 16, 2018, 07:48:35 pm
content: Wow! Nice hack, that looks like it was quite the project!

author: T3sl4co1l
author_rank: Super Contributor
timestamp: October 16, 2018, 09:16:22 pm
content: What's the CPU on that thing, anyway? x86? Do you need anything special to run that, or is it literally DOOM2.EXE (or chocolate-doom.exe and related files, or..)?Tim

author: ginbot86
author_rank: Contributor
timestamp: October 16, 2018, 10:08:40 pm
content: It's running on an ARM-based SPEAr600 SoC. All you need is an ARMv4i WinCE or .NET binary.I'm using the ARM build of Chocolate Doom for WinCE.

author: thm_w
author_rank: Super Contributor
timestamp: October 16, 2018, 10:23:24 pm
content: Quote from: T3sl4co1l on October 16, 2018, 09:16:22 pmhttps://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/https://www.st.com/en/microcontrollers/spear600.htmlQuote from: ginbot86 on October 16, 2018, 10:08:40 pmlink?I didn't see it here:https://github.com/chocolate-doom/chocolate-doom/releasesedit: extracted cab is attached from OPs link below. You need to copy these files to the device, copy the wad file, then run setup to choose resolution, etc. then run chocolate-doom.exe -iwad "/location/doom.wad"Shareware version of wad file is here:ftp://ftp.fu-berlin.de/pc/msdos/games/idgames/idstuff/doom/win95/doom95.zip

author: ginbot86
author_rank: Contributor
timestamp: October 16, 2018, 10:31:08 pm
content: It's available in their v1.3.0 archive:http://www.chocolate-doom.org/downloads/1.3.0/chocolate-doom-1.3.0-wince.cabI don't remember if it actually was able to extract itself on the scope. If not it can be manually extracted (or I could just share a link to it on Dropbox or something).

author: rsjsouza
author_rank: Super Contributor
timestamp: October 16, 2018, 10:37:48 pm
content: That is quite a nice hack. Very impressive.

author: FERCSA
author_rank: Contributor
timestamp: October 16, 2018, 11:50:57 pm
content: Nice! I waited for a write up for a while, since I saw your first posts in the 1000X thread. You're the guy who hacked the iphone's battery (HDQ) too, right? (after a quick search on your site, yes)I still have my ev2300 somewhereDo you have any intention to tap onto the SPEAr600's jtag port? Or look into the infiniiVisionLauncher.exe with some r.e. tool?

author: ginbot86
author_rank: Contributor
timestamp: October 17, 2018, 12:00:22 am
content: Yep, that's me! Admittedly I've stalled out mostly on the battery fuel gauge front ever since TI stopped their sample program for hobbyists and students. I intend to clean up my program and release the source (including experimental Data Flash code) but it's faaaaar on the back burner.I probably won't open my scope until after the warranty's expired on it, but at least the application binaries are extractable from the .ksx firmware update file. The furthest I've done with reverse-engineering the programs on the scope is just searching for text strings.