Pamela Anderson Hidden in Lecroy Wavepro Oscilloscope Firmware - Page 1
Forum section: electronics / testgear

author: ezalys
author_rank: Frequent Contributor
timestamp: December 26, 2017, 09:38:15 pm
content: I was just poking around in the firmware image and found an easter egg. Here's how you reproduce it.If you have the following firmware image... say from the Lecroy yahoo group. It's titled "Wavepro 9XX and DDA260 Firmwave V9.3.0 (Latest)"Code:$ md5 ./vxfusion.flaMD5 (./vxfusion.fla) = c6bdcdc72ee55bc5d1ae725c657ced51At an offset of 48465 there's a compressed image.Code:dd if=vxfusion.fla skip=1 bs=48465 of=data.zNow you can unzip this any way you like... I used gzip with a prepended gzip headerCode:$ printf "\x1f\x8b\x08\x00\x00\x00\x00\x00" |cat - ./data.z |gzip -dc > data.rawgzip: invalid compressed data--crc errorCRC fails, but whatever. Now, at offset 4318044 there's a jpeg header. Curious!Code:dd if=data.raw skip=1 bs=4318044 of=pic.jpg0+1 records in0+1 records out1069348 bytes transferred in 0.001037 secs (1031310783 bytes/sec)and you get the following image:https://imgur.com/a/LOnOO(NSFW)

author: Fungus
author_rank: Super Contributor
timestamp: December 26, 2017, 10:30:23 pm
content: Now you have to figure out the correct sequence of button presses to make her appear on screen.

author: ezalys
author_rank: Frequent Contributor
timestamp: December 26, 2017, 10:32:58 pm
content: That's a bit harder

author: Kjelt
author_rank: Super Contributor
timestamp: December 27, 2017, 12:43:53 am
content: That is an old scope it was decades ago she looked like that

author: Russ
author_rank: Regular Contributor
timestamp: December 27, 2017, 12:54:49 am
content: Haven’t heard that name in awhile. Is she still around?

author: EEVblog
author_rank: Unknown
timestamp: December 27, 2017, 02:10:37 am
content: Quote from: Russ on December 27, 2017, 12:54:49 amYes, and she's dating Julian Assange last I heard, because, you know, the EEVblog forum is obviously gossip central.LOL @ Lecroy, busted!Well, one firmware engineer in charge of linking the firmware anyway.

author: xrunner
author_rank: Super Contributor
timestamp: December 27, 2017, 02:12:14 am
content: Quote from: Kjelt on December 27, 2017, 12:43:53 amWow really, doesn't even look like her to me.

author: Lightages
author_rank: Unknown
timestamp: December 27, 2017, 02:51:16 am
content: I am sure that the woman in the image isn't Pamela Anderson. A google image search shows no result.

author: Asuka
author_rank: Regular Contributor
timestamp: December 27, 2017, 02:58:28 am
content: Quote from: Lightages on December 27, 2017, 02:51:16 amTineye gives this:https://tineye.com/search/5b39f6df16acdf076d827eb92e7f7b70020e8c44/Apparently it comes from a 1996 PlayBoy:http://www.ebay.it/itm/GCG-PAM-ANDERSON-Cards-Sports-Time-PlayBoy-1996-CARD-n-13-/171149797227?hash=item27d952a76b

author: Bud
author_rank: Super Contributor
timestamp: December 27, 2017, 04:01:14 am
content: Quite embarrassing to Lecroy. Guess it was found too quick.

author: EEVblog
author_rank: Unknown
timestamp: December 27, 2017, 04:53:01 am
content: Quote from: Bud on December 27, 2017, 04:01:14 amI've let them know on TwitterWill be interested to see if they:a) Not say a wordb) Have a laughc) Go into full PR crisis mode and disavow all ownership of this and how it is not inline with their corporate culture blah blah

author: GK
author_rank: Super Contributor
timestamp: December 27, 2017, 05:01:15 am
content: Oh dear, this reminds me of the novelty of turning 18 and finally being able to walk out of a newsagent with a girly mag. Jezus, I just rummaged through my box of old school books and stuff and I've still got this Pamela Anderson poster stashed away. I vaguely recall settling a bet with a mate with this poster who was convinced up until that point that her "platinum" blonde hair was totally natural, LOL (there wasn't any argument over the boobs).

author: james_s
author_rank: Super Contributor
timestamp: December 27, 2017, 05:23:29 am
content: Quote from: GK on December 27, 2017, 05:01:15 amFunny, for some reason once I turned 18, those magazines suddenly lost most of their appeal and I never actually bought one. The attraction was all in the forbidden aspect when we relied on someone finding his dad's stash.Also the internet came along, it's hard *not* to find girly pictures when looking around online.

author: Bud
author_rank: Super Contributor
timestamp: December 27, 2017, 06:30:28 am
content: Guess Lecroy is experimenting with subconscious methods to add sex appeal to their products.

author: Russ
author_rank: Regular Contributor
timestamp: December 27, 2017, 06:34:57 am
content: Quote from: Bud on December 27, 2017, 06:30:28 amCompetitive market. Just another marketing ploy. 👍

author: MWisBest
author_rank: Contributor
timestamp: December 27, 2017, 08:30:30 am
content: Quote from: james_s on December 27, 2017, 05:23:29 amAs evidenced by this very thread.

author: darkstar49
author_rank: Frequent Contributor
timestamp: December 27, 2017, 08:43:34 am
content: This came out already a while ago...But there's no 100% evidence whether this is to be put to Lecroy's or Wind River's credit... ??

author: sstepane
author_rank: Regular Contributor
timestamp: December 27, 2017, 09:37:39 am
content: Funny enough it requires some hand job to open the picture of Pamela

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: December 27, 2017, 10:08:18 am
content: If the image is in there, maybe there is some obscure way to make it appear onscreen - seems a bit too obscure for it to have been left for someone to find in the firmware file.Is there unzip and jpeg display functionality in the code? Any pointers to the image data ?

author: Kjelt
author_rank: Super Contributor
timestamp: December 27, 2017, 10:27:09 am
content: One sw engineer that was inspired by the Apple team that hid their team picture in the code.I did not know that Pamela worked for LeCroyWe had also an incident with one of our products.Some debug info that should never be seen popped up at a customer.It was not offensive but still quite embarrassing.The sw engineer was fired for this, in the code review it was not found because he put it after a comment line on the same line behind the 120th column and he made a small change in the comment.The code reviewers only see the first 120 characters and thought the change was the comment change.So it was a deliberate act of hiding which cost him his job.Warning for young players: management usually does not think eastereggs are funny

author: Fungus
author_rank: Super Contributor
timestamp: December 27, 2017, 11:49:36 am
content: Quote from: Kjelt on December 27, 2017, 10:27:09 amYes, she was an Intern there before she got into modelling.See:https://en.wikipedia.org/wiki/Pamela_Anderson#Intern_Lecroy

author: wraper
author_rank: Unknown
timestamp: December 27, 2017, 01:23:03 pm
content: Quote from: Fungus on December 27, 2017, 11:49:36 amI'd don't see anything about Lecroy or any internship.

author: tszaboo
author_rank: Super Contributor
timestamp: December 27, 2017, 01:55:06 pm
content: Quote from: wraper on December 27, 2017, 01:23:03 pmIt is Wikipedia, feel free to add the missing info.

author: SeanB
author_rank: Super Contributor
timestamp: December 27, 2017, 02:14:36 pm
content: Plenty of the free service manuals also have a rather 'interesting" background image on them as well. When printing them I just unselect the printing of the background, as a mono version of the translucent colour watermark is not exactly usable and obscures the info you want.Some of the images in some countries could land you in trouble with the secular police though, seeing as there is a lot more than ankles exposed.

author: nctnico
author_rank: Super Contributor
timestamp: December 27, 2017, 02:44:01 pm
content: Quote from: NANDBlog on December 27, 2017, 01:55:06 pmBut what would that section say? Some men adore her so much that they hid pictures of her in the firmware of test equipment?

author: wkb
author_rank: Super Contributor
timestamp: December 27, 2017, 07:59:30 pm
content: Quote from: SeanB on December 27, 2017, 02:14:36 pmSome countries you would not want yourself found IMO.

author: GK
author_rank: Super Contributor
timestamp: December 28, 2017, 04:23:52 am
content: Quote from: james_s on December 27, 2017, 05:23:29 amI never bought all that many, but I have acquired quite an assorted stack the same way I acquired almost every Electronics Australia and Radio, TV & Hobbies magazine - via an intermediary who was/is friends with a hoarder, who was apparently doing a clean-out or something, who's family allegedly own(ed) a Newsagent. Whatever stock didn't sell over the decades they apparently hoarded. Whenever I visited for a period I was commanded to open my boot (trunk) to be gifted several boxes of assorted girly and electronics mags.Risque Pam Anderson and Sam Fox photo were the mainstay of SSTV enthusiasts back in the day. I even recall once reading a feminist treatise on the dominant ideology of patriarchy or some such in the computer science fields citing all of the historically embedded girly pictures as evidence.

author: darkstar49
author_rank: Frequent Contributor
timestamp: December 28, 2017, 01:20:33 pm
content: just checked... (in the FW)Looks like the sinner is (/was ?) most probably at Lecroy...While I didn't spend hours on this, it looks like there's a little http daemon implemented in the FW (9.3.0), and that's where the image data is being referenced, in a section that contains (other) functions that are definitely Lecroy-related... but I've never owned nor used such a scope, so don't ask what this daemon is good for and/or what parameter(s) it expects...Maybe some 'HTTP 404' error message, just a bit sexier ... :-P

author: Mr. Scram
author_rank: Super Contributor
timestamp: December 28, 2017, 01:59:29 pm
content: Quote from: Kjelt on December 27, 2017, 10:27:09 amI can't imagine just that being enough to fire someone, unless it happened in the US or something. There was probably a history there.

author: timb
author_rank: Super Contributor
timestamp: December 28, 2017, 03:33:43 pm
content: Man, that particular LeCroy scope must have some enormous knobs on it!

author: MT
author_rank: Super Contributor
timestamp: December 28, 2017, 05:49:59 pm
content: Hohum not really, but it seams to be a nice scope!

author: timb
author_rank: Super Contributor
timestamp: December 28, 2017, 09:36:44 pm
content: Quote from: MT on December 28, 2017, 05:49:59 pm*Palm*No, you see “knobs” is slang for breasts. Pamela Anderson is famous for her large breasts. Get it?

author: Fungus
author_rank: Super Contributor
timestamp: December 28, 2017, 09:50:58 pm
content: I thought "knob" was slang for penis.

author: Mr. Scram
author_rank: Super Contributor
timestamp: December 28, 2017, 09:52:11 pm
content: I do see one or two knobs in this thread though

author: blacksheeplogic
author_rank: Frequent Contributor
timestamp: December 28, 2017, 11:46:46 pm
content: Quote from: Mr. Scram on December 28, 2017, 01:59:29 pmThere's a difference between knowing & intentionally introducing unauthorized changes into the code base, verse a unintentional change.This would be considered a serious breach of trust based on the companies I have work at, I would be very surprised if they had retained their job.

author: Mr. Scram
author_rank: Super Contributor
timestamp: December 29, 2017, 12:02:21 am
content: Quote from: blacksheeplogic on December 28, 2017, 11:46:46 pmThere was a code review. Either they dropped the ball or the procedure wasn't functioning properly. I can't imagine a programmer not being authorized to change code.

author: EEVblog
author_rank: Unknown
timestamp: December 29, 2017, 12:06:10 am
content: Quote from: Mr. Scram on December 29, 2017, 12:02:21 amIt could easily pass a code review, because the image is likely not to be in the code, but simply linked into a some unused memory space with the linker.The product is then handed over to the test group who test it it without incident.

author: Kjelt
author_rank: Super Contributor
timestamp: December 29, 2017, 08:23:20 am
content: Quote from: Mr. Scram on December 28, 2017, 01:59:29 pmAn angry customer complaiining to top managemnt leaving our manager with his "pants down" was probably the biggest factor, but as blacksheeplogic stated it was hidden with intent which was against all policies.That and the content of the debug message which was very unproffesionall was the last straw.I can imagine that if this scope would show this nude picture on some error and there was a complaint to LeCroy the consequences would be the same.

author: Mr. Scram
author_rank: Super Contributor
timestamp: December 29, 2017, 08:33:59 am
content: Quote from: Kjelt on December 29, 2017, 08:23:20 amAgain, I guess it depends on the county and the specific contract involved. Not all countries allow for firing someone on the spot over being embarrassed, though you might be allowed not to renew the contract later.

author: Neomys Sapiens
author_rank: Super Contributor
timestamp: December 29, 2017, 06:22:31 pm
content: Who said that it must be a button sequence that makes it appear? Maybe it is triggered by recording a sufficiently descriptive waveform?

author: taydin
author_rank: Frequent Contributor
timestamp: December 29, 2017, 07:30:04 pm
content: Quote from: Neomys Sapiens on December 29, 2017, 06:22:31 pmMaybe an FFT display of a signal with two prominent sidelobes

author: MT
author_rank: Super Contributor
timestamp: December 29, 2017, 10:25:25 pm
content: Quote from: timb on December 28, 2017, 09:36:44 pmIt's you who didn't got it! You see it was a joke, her breasts are of silicone!

author: Fungus
author_rank: Super Contributor
timestamp: December 29, 2017, 10:44:52 pm
content: Quote from: MT on December 29, 2017, 10:25:25 pmI don't think they were in that particular picture;

author: mc172
author_rank: Frequent Contributor
timestamp: December 29, 2017, 11:09:31 pm
content: Knobs slang for breasts?The floppy drive makes me laugh. Did they really ever use it when it was even being developed? One of the blokes I work with has an Agilent E5062A network analyser on his desk. It's got a floppy drive whereas the one I've got is the newer 5061B and hasn't. Every now and then the floppy drive seems to check whether there's a disk in the drive and causes the entire system to hold for about 5 seconds. Drives him nuts.

author: Neomys Sapiens
author_rank: Super Contributor
timestamp: December 29, 2017, 11:20:58 pm
content: Quote from: taydin on December 29, 2017, 07:30:04 pmYep. Or a nice profile that could be surely conjured out of a decent AFG.

author: bson
author_rank: Unknown
timestamp: December 30, 2017, 01:06:45 am
content: On a related note, did you find out anything about the structure of the .fla in general?

author: KE5FX
author_rank: Super Contributor
timestamp: December 30, 2017, 01:27:51 am
content: Quote from: GK on December 28, 2017, 04:23:52 amEveryone who has done any sort of work with image processing has made the acquaintance of Miss November 1972:And yes, unsurprisingly, 'Lena' has her fans in the virtue-signaling community. The image is a terrible one for R&D work due to its poor color balance, so I think the only reason it's still popular is to kick sand in those peoples' righteously-offended faces.Ms. Sjöblom (now a grandmother) was reportedly amused when informed of the act of cultural appropriation committed by graphics researchers, whilePlayboy reportedly wasn't.(NSFW if you work in a monastery)

author: rrinker
author_rank: Super Contributor
timestamp: December 30, 2017, 03:46:38 am
content: Quote from: Fungus on December 29, 2017, 10:44:52 pmYeah that pic dates from before she had her first of two enhancements. IE, when she looked normal.Hmm, an HTTP daemon - does that model have an ethernet port on it?

author: Alex Eisenhut
author_rank: Super Contributor
timestamp: December 30, 2017, 04:30:28 am
content: Wow does that mean Donna Michelle is hidden inside my Tektronix 547?(I wasn't even alive when Donna was at her peak but for me, her and Marianna Hill are some of the most beautiful women from the 1960s)

author: darkstar49
author_rank: Frequent Contributor
timestamp: December 30, 2017, 05:14:22 am
content: not all WP9xx models had ethernet, but some did...As stated, didn't put much effort in checking, but could only find references in that http part... that doesn't mean there isn't a magic keys/knobs combination, although it's less probable, as this would mean the reference to the image would use another 'base address' and use some offset to the image... not impossible, but rather unusual... (why would the http part reference it directly, while other code pieces would play around with a base address and some offset...)

author: james_s
author_rank: Super Contributor
timestamp: December 30, 2017, 06:20:38 am
content: Quote from: mc172 on December 29, 2017, 11:09:31 pmWe have a couple TDS5000 scopes at work that have floppy drives, I use the drive somewhat regularly, it works fine. It's not as convenient as an SD card but at the time the scope was made floppy drives were still in widespread use. That LeCroy looks about the same age.

author: ivaylo
author_rank: Frequent Contributor
timestamp: December 30, 2017, 08:19:52 am
content: Why not let @azalys let them know at twitter?

author: ezalys
author_rank: Frequent Contributor
timestamp: December 30, 2017, 08:25:30 am
content: The fla file is a loader with zlib compressed firmware. It appears to set up the caches and mmu and other things and then it decompresses the image and jumps into it... nothing too fancy.

author: Fungus
author_rank: Super Contributor
timestamp: December 30, 2017, 06:21:28 pm
content: Quote from: mc172 on December 29, 2017, 11:09:31 pmDoesn't it occur to him to, ummm, leave a diskette in the drive?

author: mc172
author_rank: Frequent Contributor
timestamp: December 30, 2017, 10:24:38 pm
content: It makes it worse. It tries to read what's on the disk.

author: shteii01
author_rank: Frequent Contributor
timestamp: December 31, 2017, 08:42:02 am
content: Replace floppy drive with usb floppy drive emulator and use usb sticks:https://www.ebay.com/itm/5V-DC-SFR1M44-U-USB-Floppy-Drive-Emulator-w-1-44MB-Floppy-Drive-Easy-Install/162632652259?hash=item25dda955e3:g:aukAAOSwSutaHXgj

author: martinator
author_rank: Contributor
timestamp: December 31, 2017, 09:26:51 am
content: Maybe there is a problem with the autorec.sta file? It could be looking for a machine state that was originally on drive a:

author: darkstar49
author_rank: Frequent Contributor
timestamp: December 31, 2017, 10:09:44 am
content: I'm pretty sure the mentioned emulator model doesn't fit, as Lecroy only used slim line floppies... but anyway, should be discussed in another thread, if needed... as not much related to this one... ;-

author: timb
author_rank: Super Contributor
timestamp: January 01, 2018, 12:58:06 am
content: Quote from: darkstar49 on December 31, 2017, 10:09:44 amYou’re right. Based on some of Pamela Anderson’s own home movies, it’s clear she much prefers hard disks over floppy disks. Very, very large hard disks. *Rimshot*

author: tv84
author_rank: Super Contributor
timestamp: January 01, 2018, 11:26:36 pm
content: Quote from: ezalys on December 26, 2017, 09:38:15 pmThe compressed image is a complete ZLIB block from [0000BD51-001D0EDA] and, as such, has no CRC32. It has an ADLER32 checksum (in this case: 6E569D7E).Nice find!

author: CJay
author_rank: Super Contributor
timestamp: January 02, 2018, 07:34:55 pm
content: Quote from: rrinker on December 30, 2017, 03:46:38 amI'm not sure you should try poking an ethernet cable into models, they probably won't like it

author: The Soulman
author_rank: Super Contributor
timestamp: January 02, 2018, 08:55:47 pm
content: Quote from: CJay on January 02, 2018, 07:34:55 pmAs long as they don't encounterPoE.

author: darkstar49
author_rank: Frequent Contributor
timestamp: January 02, 2018, 09:38:19 pm
content: as already said, not too sure about the http daemon, but if someone has a better explanation, he/she's welcome... ;-)here the (most probably only) function where the image is referenced, no need to be an assembler, nor a web expert to recognise some known stuff...

author: blacksheeplogic
author_rank: Frequent Contributor
timestamp: January 02, 2018, 10:13:45 pm
content: Quote from: darkstar49 on January 02, 2018, 09:38:19 pmNot well hand written Power assembler. Either the person who wrote this was inexperienced in Power assembler (new to the team at the time).

author: darkstar49
author_rank: Frequent Contributor
timestamp: January 03, 2018, 12:12:13 am
content: Quote from: blacksheeplogic on January 02, 2018, 10:13:45 pmFrom (that and) other functions around that one, I’d tend to suspect a C compiler... the way registers are used is everything but ‘intuitive’ or ´natural’... and there are often unnecessary register saving ops, which would be rather unusual for hand-written assembler...

author: blacksheeplogic
author_rank: Frequent Contributor
timestamp: January 03, 2018, 12:49:03 am
content: Quote from: darkstar49 on January 03, 2018, 12:12:13 amFor a non-leaf function the stack frame has not followed convention, it's also be grabbed early creating an unnecessary dependency (not typical of a compiler), the use of r29 & r3 is peculiar even for non-optimized output.

author: macboy
author_rank: Super Contributor
timestamp: January 03, 2018, 03:18:22 pm
content: This is hilarious. I have one of these scopes (WavePro 960) with the LAN card. I'll have to check the firmware version and try to figure out how to get the http daemon to serve this.

author: darkstar49
author_rank: Frequent Contributor
timestamp: January 03, 2018, 05:09:35 pm
content: Keep us posted !!!If it doesn’t reply on standard ports, try to perform a portscan to see what ports are active...

author: JustSquareEnough
author_rank: Unknown
timestamp: January 04, 2018, 12:10:43 am
content: No response to Dave's lecroy tweet ? I couldn't find it when I searched but saw it come out when he tweeted it...

author: videobruce
author_rank: Frequent Contributor
timestamp: January 15, 2018, 10:24:43 pm
content: You guys have way too much spare time...........................

author: NiHaoMike
author_rank: Super Contributor
timestamp: January 16, 2018, 05:06:19 am
content: Quote from: CJay on January 02, 2018, 07:34:55 pmI can name a model who really likes Ethernet - Joanne Chiang. Of course, that's because she's a gamer and everyone knows gamers like Ethernet way better than Wifi.Somewhat back on topic, I once embedded a picture of my friend Allie Moore into an OpenWRT image I created for another friend's WRT54G, accessible by opening "eegg.html" on the router IP. I don't think he ever found it.

author: Berni
author_rank: Super Contributor
timestamp: January 16, 2018, 06:08:43 am
content: Inside the software for Keysight Infiniium scopes i found a picture of Jesus.It is hidden inside the main application exe file as a .NET resource. No idea if the software can be made to actually show the photo but the image file is certainly in there.

author: darkstar49
author_rank: Frequent Contributor
timestamp: January 16, 2018, 06:38:29 am
content: Quote from: videobruce on January 15, 2018, 10:24:43 pm...'not too sure those who found it were looking for that sort of info...

author: Berni
author_rank: Super Contributor
timestamp: January 16, 2018, 07:24:22 am
content: Quote from: darkstar49 on January 16, 2018, 06:38:29 amWell i did have a good reason for it. My scope lost some sample memory size after updating the software from the ancient version that came on it to the latest one.Oh and Keysight also seams to be internally naming all the Infiniium scopes after dinosaur species, apart from one that's codenamed Toaster.

author: darkstar49
author_rank: Frequent Contributor
timestamp: January 16, 2018, 07:52:02 am
content: Quote from: Berni on January 16, 2018, 07:24:22 am...'didn't have any problem with that... just saying that those who tear firmware images apart are typically not looking for sexy images, and that the whole story is thus not about having too much 'spare' time...

author: Zucca
author_rank: Unknown
timestamp: January 16, 2018, 09:10:34 am
content: Temped to hide an Elisabetta_Canalis.mp4 in my new product and see when/how you dragons discover it.Seriosly, it could be a market move: just annouce there are 2 easter eggs and let them go into the wild. The nerdy people could be attracted.

author: xrunner
author_rank: Super Contributor
timestamp: January 16, 2018, 01:44:21 pm
content: Quote from: Berni on January 16, 2018, 06:08:43 amSince no one knew what the guy looked like then how do you know it's a picture of him LOL?

author: timb
author_rank: Super Contributor
timestamp: January 16, 2018, 03:53:57 pm
content: Quote from: zucca on January 16, 2018, 09:10:34 amJust as long as it’s notswap.avior2g1c.mp4. Those are a couple of surprises no one wants to find in the middle of a late night reverse engineering session.

author: blaze1024
author_rank: Newbie
timestamp: January 16, 2018, 03:57:33 pm
content: Quote from: zucca on January 16, 2018, 09:10:34 am

author: CRTbrain
author_rank: Contributor
timestamp: January 16, 2018, 09:45:40 pm
content: the graphic does have the nice LeCroy black background. Looks official.

author: darkstar49
author_rank: Frequent Contributor
timestamp: January 17, 2018, 01:54:34 pm
content: Quote from: CRTbrain on January 16, 2018, 09:45:40 pmwhere the heck did you see some official Lecroy pics with a black satin background?Have you been invited at some 'special' party at their factory(during which the photo was shot, maybe)