Is there a bandwidth hack for the GW Instek GDS-2000A series? - Page 1
Forum section: electronics / testgear

author: toastedcrumpets
author_rank: Regular Contributor
timestamp: November 05, 2018, 02:57:32 pm
content: I know there's hacks for the GDS-1000 and GDS-2000E series scopes, but what about the GDS-2000A?https://www.eevblog.com/forum/testgear/possible-gw-instek-gds-1000b-hack/I couldn't see any info on there or via searching the forum. I've got a GDS-2074A and two GDS-2202A's via surplus auctions so I'm even willing to be a bit adventurous with one of them if someone has a suggestion?

author: tv84
author_rank: Super Contributor
timestamp: November 05, 2018, 10:15:55 pm
content: Are they similar to E versions??Do you have any FW versions that you can send?

author: toastedcrumpets
author_rank: Regular Contributor
timestamp: November 08, 2018, 03:44:22 pm
content: They are very similar looking externally to E versions, but E versions are a later design.https://www.gwinstek.com/en-global/products/detail/GDS-2000AThe firmware is linked here:https://www.gwinstek.com/en-global/products/downloadSeriesDownNew/795/94

author: toastedcrumpets
author_rank: Regular Contributor
timestamp: November 08, 2018, 03:54:35 pm
content: I just tried running the python script on the 1.30 firmware on the GDS-1000 hack but it doesn't find the magic bytes that its looking for. Did they re-encode the firmware to prevent this unpacking from working?

author: seronday
author_rank: Regular Contributor
timestamp: November 09, 2018, 11:21:45 am
content: toastedcrumpets.Have you tried following the step by step instructions in post 15 of this thread,https://www.eevblog.com/forum/testgear/possible-gw-instek-gds-1000b-hack/msg1474272/#msg1474272It is quite possible that this will also work on the GDS2000A series.

author: tv84
author_rank: Super Contributor
timestamp: November 10, 2018, 11:23:18 am
content: Without wasting much time, I looked into the A version that you referenced and one can easily extract several files. I think the most interesting to your quest would be the filesystem.In the FW_GDS-2000A_V1.30 firmware you can find the filesystem block at offset 0x1D9911 (with a size of 0xA40000 bytes). It's a JFFS2 image.If you extract all the contents of the JFFS2 image you'll see the "gds2000a" application inside the /bin directory.The .upg FW file format from GDS2000A is different from the GDS2000E, because the processors are completely different (one is Blackfin and the other is ARM).Example of a gds2000a .ELF file:Code:00000000 Magic: 7F454C46 ELF File OK00000004 Format: 32-bits00000005 Data: Little endian00000006 Version: 100000007 OS/ABI: System V (often set to this)00000008 ABI Version: 000000010 Object Type: Executable00000012 Instruction Set: AD Blackfin00000014 Version: 100000018 Entry Point: 000FB8500000001C Program Header Table: 0000003400000020 Section Header Table: 00A9822000000024 Flags: 0000000200000028 Header Size: 000000340000002A Program Headers Size: 000000200000002C # Program Headers: 70000002E Section Headers Size: 0000002800000030 # Section Headers: 2700000032 SH String Table Index: 26********** PROGRAM HEADERS:SegmType SegmOffs VirtAddr PhysAddr FilSegSz MemSegSz Flags Align00000034 PHDR 00000034 00000034 00000034 000000E0 000000E0 00000005 0000000400000054 INTERP 00000114 00000114 00000114 00000014 00000014 00000004 0000000100000114 [Requesting program interpreter: /lib/ld-uClibc.so.0 ]00000074 LOAD 00000000 00000000 00000000 0060B90C 0060B90C 00000005 0000100000000094 LOAD 0060B90C 0060C90C 0060C90C 0047EDF4 00EC0468 00000006 00001000000000B4 DYNAMIC 0073815C 0073915C 0073915C 000000D8 000000D8 00000006 00000004000000D4 6474E550 0060B8E8 0060B8E8 0060B8E8 00000024 00000024 00000004 00000004000000F4 6474E551 00000000 00000000 00000000 00000000 00020000 00000007 00000008********** SECTION HEADERS: Name Type VirtAddr Offset Size ES Flg Lk Inf Al00A98220 [ 0] NULL 00000000 0000000 0000000 00 000 0 0 0000A98248 [ 1] .interp PROGBITS 00000114 0000114 0000014 00 002 0 0 0100A98270 [ 2] .hash HASH 00000128 0000128 0025358 04 002 3 0 0400A98298 [ 3] .dynsym DYNSYM 00025480 0025480 0054B90 10 002 4 1 0400A982C0 [ 4] .dynstr STRTAB 0007A010 007A010 0057E9C 00 002 0 0 0100A982E8 [ 5] .gnu.version 0x6FFFFFFF 000D1EAC 00D1EAC 000A972 02 002 3 0 0200A98310 [ 6] .gnu.version_r 0x6FFFFFFE 000DC820 00DC820 0000020 00 002 4 1 0400A98338 [ 7] .rel.dyn REL 000DC840 00DC840 001D908 08 002 3 0 0400A98360 [ 8] .rel.plt REL 000FA148 00FA148 00007A0 08 002 3 10 0400A98388 [ 9] .init PROGBITS 000FA8E8 00FA8E8 000001A 00 006 0 0 0100A983B0  .plt PROGBITS 000FA904 00FA904 0000F4A 00 006 0 0 0400A983D8  .text PROGBITS 000FB850 00FB850 03B922C 00 006 0 0 0400A98400  .fini PROGBITS 004B4A7C 04B4A7C 0000014 00 006 0 0 0100A98428  .rodata PROGBITS 004B4AA0 04B4AA0 010B438 00 002 0 0 2000A98450  .rofixup PROGBITS 005BFED8 05BFED8 004BA10 00 002 0 0 0400A98478  .eh_frame_hdr PROGBITS 0060B8E8 060B8E8 0000024 00 002 0 0 0400A984A0  .eh_frame PROGBITS 0060C90C 060B90C 000008C 00 003 0 0 0400A984C8  .ctors PROGBITS 0060C998 060B998 0000008 00 003 0 0 0400A984F0  .dtors PROGBITS 0060C9A0 060B9A0 0000008 00 003 0 0 0400A98518  .jcr PROGBITS 0060C9A8 060B9A8 0000004 00 003 0 0 0400A98540  .data.rel.ro PROGBITS 0060C9AC 060B9AC 012C7B0 00 003 0 0 0400A98568  .dynamic DYNAMIC 0073915C 073815C 00000D8 08 003 4 0 0400A98590  .data PROGBITS 00739234 0738234 0346540 00 003 0 0 0400A985B8  .got PROGBITS 00A7F778 0A7E778 000BF88 00 003 0 0 0800A985E0  .bss NOBITS 00A8B700 0A8A700 0A41674 00 003 0 0 2000A98608  .comment PROGBITS 00000000 0A8A700 000DA49 00 000 0 0 0100A98630  .shstrtab STRTAB 00000000 0A98149 00000D4 00 000 0 0 01Example of a gds1000b .ELF file (same type as gds2000e):Code:00000000 Magic: 7F454C46 ELF File OK00000004 Format: 32-bits00000005 Data: Little endian00000006 Version: 100000007 OS/ABI: System V (often set to this)00000008 ABI Version: 000000010 Object Type: Executable00000012 Instruction Set: ARM00000014 Version: 100000018 Entry Point: 0000E5480000001C Program Header Table: 0000003400000020 Section Header Table: 0105796800000024 Flags: 0500000200000028 Header Size: 000000340000002A Program Headers Size: 000000200000002C # Program Headers: 80000002E Section Headers Size: 0000002800000030 # Section Headers: 2900000032 SH String Table Index: 28********** PROGRAM HEADERS:SegmType SegmOffs VirtAddr PhysAddr FilSegSz MemSegSz Flags Align00000034 70000001 00D37CD4 00D3FCD4 00D3FCD4 0000D488 0000D488 00000004 0000000400000054 PHDR 00000034 00008034 00008034 00000100 00000100 00000005 0000000400000074 INTERP 00000134 00008134 00008134 00000013 00000013 00000004 0000000100000134 [Requesting program interpreter: /lib/ld-linux.so.3 ]00000094 LOAD 00000000 00008000 00008000 00D45160 00D45160 00000005 00008000000000B4 LOAD 00D45160 00D55160 00D55160 00312614 02FBAE14 00000006 00008000000000D4 DYNAMIC 00D4520C 00D5520C 00D5520C 00000108 00000108 00000006 00000004000000F4 NOTE 00000148 00008148 00008148 00000020 00000020 00000004 0000000400000148 [Owner: GNU ] [OS: Linux 2.6.16]00000114 6474E551 00000000 00000000 00000000 00000000 00000000 00000007 00000004********** SECTION HEADERS: Name Type VirtAddr Offset Size ES Flg Lk Inf Al01057968 [ 0] NULL 00000000 0000000 0000000 00 000 0 0 0001057990 [ 1] .interp PROGBITS 00008134 0000134 0000013 00 002 0 0 01010579B8 [ 2] .note.ABI-tag NOTE 00008148 0000148 0000020 00 002 0 0 04010579E0 [ 3] .hash HASH 00008168 0000168 00008A8 04 002 4 0 0401057A08 [ 4] .dynsym DYNSYM 00008A10 0000A10 0001210 10 002 5 1 0401057A30 [ 5] .dynstr STRTAB 00009C20 0001C20 0000AAE 00 002 0 0 0101057A58 [ 6] .gnu.version 0x6FFFFFFF 0000A6CE 00026CE 0000242 02 002 4 0 0201057A80 [ 7] .gnu.version_r 0x6FFFFFFE 0000A910 0002910 00000C0 00 002 5 5 0401057AA8 [ 8] .rel.dyn REL 0000A9D0 00029D0 0000030 08 002 4 0 0401057AD0 [ 9] .rel.plt REL 0000AA00 0002A00 0000888 08 002 4 11 0401057AF8  .init PROGBITS 0000B288 0003288 000000C 00 006 0 0 0401057B20  .plt PROGBITS 0000B294 0003294 0000CE0 04 006 0 0 0401057B48  .text PROGBITS 0000BF80 0003F80 057E87C 00 006 0 0 1001057B70  .fini PROGBITS 0058A7FC 05827FC 0000008 00 006 0 0 0401057B98  .rodata PROGBITS 0058A808 0582808 07A3C93 00 002 0 0 0801057BC0  .ARM.extab PROGBITS 00D2E49C 0D2649C 0011838 00 002 0 0 0401057BE8  .ARM.exidx 0x70000001 00D3FCD4 0D37CD4 000D488 00 082 12 0 0401057C10  .eh_frame PROGBITS 00D4D15C 0D4515C 0000004 00 002 0 0 0401057C38  .init_array INIT_ARRAY 00D55160 0D45160 0000004 00 003 0 0 0401057C60  .fini_array FINI_ARRAY 00D55164 0D45164 0000004 00 003 0 0 0401057C88  .jcr PROGBITS 00D55168 0D45168 0000004 00 003 0 0 0401057CB0  .data.rel.ro PROGBITS 00D5516C 0D4516C 00000A0 00 003 0 0 0401057CD8  .dynamic DYNAMIC 00D5520C 0D4520C 0000108 08 003 5 0 0401057D00  .got PROGBITS 00D55314 0D45314 0000458 04 003 0 0 0401057D28  .data PROGBITS 00D55770 0D45770 0312004 00 003 0 0 0801057D50  .bss NOBITS 01067778 1057774 2CA87FC 00 003 0 0 0801057D78  .comment PROGBITS 00000000 1057774 00000C1 01 030 0 0 0101057DA0  .ARM.attributes 0x70000003 00000000 1057835 0000037 00 000 0 0 0101057DC8  .shstrtab STRTAB 00000000 105786C 00000FB 00 000 0 0 01

author: toastedcrumpets
author_rank: Regular Contributor
timestamp: November 10, 2018, 06:56:49 pm
content: Thanks for the replies! I'll try the licence generator on Monday when I'm back in the office with the scopes.tv84, how did you determine the location of the JFFS2 image, was there a magic byte you were looking for, or do you have knowledge of the processor to get this?is it easy to repack this stuff into a JFFS2 image, or are there checksums/signing to get around?

author: tv84
author_rank: Super Contributor
timestamp: November 10, 2018, 07:28:49 pm
content: The available KG will, most probably, not work.A more probable approach would be to get a new version of the KG that can handle the new 1000B and 2000E FWs and pray that it would be the same in the 2000A.I disassembled (only high-level) the major areas of the UPG and once I found out the one that was called ROOTFS you only have to understand what type of FS it is. But there are some strings in there that help. binwalk also confirms it.I think JFFS2, per se, doesn't include checksums. It's built of compressed blocks of the files and those are where the checsums/CRCs are. And, then one would have to deal with checksums at the .UPG level.Nonetheless, trying to patch a Blackfin .ELF is pro stuff since it's not easy to get them into IDA. This part would be the hardest.BTW, the KG program code is easily visible in the 1000B/2000E early FWs disassembly (that must have been how it was extracted). Not the same in the newer ones.

author: toastedcrumpets
author_rank: Regular Contributor
timestamp: November 12, 2018, 08:26:06 am
content: OK, just tried the licence generator and FW version 1.30 (on the 2074A) says it failed and I should "check the licence version", so no joy there.Also tried my v1.17 firmware scope (2202A) and it didn't work either, so a downgrade to there then install of the licence isn't possible. Is there any way to dump the firmware out the scope to take a look for a generator (i.e., internal serial port)?