Agilent MSO 5000/6000/7000 - anyone hacked these scopes? - Page 1
Forum section: electronics / testgear

author: dfnr2
author_rank: Regular Contributor
timestamp: January 14, 2014, 09:16:11 pm
content: Update:This has been an amazing demonstration of skill and teamwork. Abyrvalg, without physical hardware in hand, had this nut cracked so quickly I scarcely had time to get coffee. Mike and Carrington supplied lots of useful info and insight.Full hack summary for v6.16 firmware:Mike has summarized neatly the procedure for the full hack, which allows fine-grained selection of licences using the license dialog, inthis post.v6.20 firmware address changesare listed inthis post.Service Menu hack summary for firmware v6.16Alex has written a nice summary of the service-menu hack, which enables multiple options and does not require a modified binary, but doesn't give the undocumented options or allow fine-grained control,in this thread.To to this on any firmware version:Instead of modifying a memory location, use the function call 'setServiceMode(1)' from the C shell, which works on all firmware versions. (link here).Removing the SEC option:The workings of the SEC option were elucidated by abyrvalg, the hero of this thread. The technique for removing the option is detailedhere.Original Post:I am aware that you can enable all the options and then set back the clock to keep these options enabled indefinitely. That's certainly livable. However, that's not a pretty solution, and it's nice to have the clock set properly for screen shots, etc. The recent thread on hacking the MSO-X-2000/3000 series scopes piqued my curiosity.Unlike the MSOX-3000 update packages, the MSO5000/6000/7000 packages appear to be packed using a proprietary ZIP-derived format.Another forum member found an emergency binary for the 5000, which indicates that this is running on VxWorks on a Power PC. He also pointed to some possible telnet login info embedded in the binary, but telnet service doesn't appear to be enabled.Poking around with a 7000 series scope, I found that FTP is enabled, and you can log in with "panther", "pictures". However, there doesn't seem to be much in the ftp directory--just a subdirectory labeled RAM0, apparently empty. (It would be cool if that were a running RAM image, but no hint that's the case.)If anyone has any ideas, it would be nice to post in this thread.

author: Carrington
author_rank: Super Contributor
timestamp: January 15, 2014, 08:53:38 am
content: I'm also interested in this topic.For the DSO6000 and 7000 series, the MSO is an option. But I think that the 5000 series does not have LA i.e. only DSO version.And for all of them no option to increase the BW. Moreover I'm not sure that the 100 and 300MHz versions have the same input stage.Other options are, memory and serial decoders. But I think that the versions with two analog channels don't have available the serial decoding.Hybrid chip at the DSO5054A and DSO6034A is 1NB7-8453.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: January 15, 2014, 09:44:17 am
content: That's all pretty much correct. I recall looking at an "Emergency" update file which was a lot less compressed/obscured than the normal updates, and appeared to have a service menu function to enable all licensesTrials only have an expiry time, 14 days after the license is issued, but there is no check on start time, and if it expires it can be reinstalled once the clock is set back before the expiry time.Although you can request trials for decodes on 2-analogue channel models, they don't work - decodes are only supported on models with 4 analogue channels.The scope runs VxWorks, so much less info around than for the WinCE used on more recent scopes.The only potential risk is that as these scopes get more obsolete, at some point the trials may disappear from theAgilentKeysight website.The actual license keys are quite short - don't recall the length exactly but most of it is the license name and the expiry date, so may be viable to reverse-engineer, or work out from a number of sample licenses & instrument IDs

author: dfnr2
author_rank: Regular Contributor
timestamp: January 20, 2014, 01:17:13 am
content: On my MSO7104a, telnet sits on port 5810, and spawns a standard VxWorks shell. Same login as ftp.This shell gives complete read/write access to memory, symbol tables, processes, filesystem, etc.

author: Carrington
author_rank: Super Contributor
timestamp: January 25, 2014, 05:10:27 pm
content: I found this:http://www.elitepvpers.com/forum/general-coding/103793-what-extension-does-jzp-go.htmlBut does not seem for Agilent oscilloscopes?Is this the "Emergency" update file?http://www.home.agilent.com/agilent/editorial.jspx?ckey=670496&id=670496&lc=eng&cc=USKey format:Format: OPT-XXXXXXXXXXXX-ExpiresPOWER MEASUREMENT APPLICATION -> License Key: PWR-55284189E48F-10FEB2006FPGA DYNAMIC PROBE FOR ALTERA -> License Key: ALT-4E46465F6684-10FEB2006

author: abyrvalg
author_rank: Frequent Contributor
timestamp: January 25, 2014, 10:31:54 pm
content: JZP is Agilent's implementation of LZSS compression. I have decompressor 99% ready (still have some problem with 3-5 last bytes of some kinds of files), will release it with sources next week.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: January 25, 2014, 10:55:05 pm
content: I have copy of an uncompressed update form 2005 - ISTR this was some sort of "emergency" update to recover a failed normal update.It appears to have an "enable all licenses" function in a service menu.Let me know if anyone wants a copy to investigate

author: Carrington
author_rank: Super Contributor
timestamp: January 25, 2014, 11:49:49 pm
content: ELF = Executable and Linkable Format.The first four bytes are always 0x7F followed by ELF in ASCII and constitute the magic number....From sys6000.bin:Source:http://en.wikipedia.org/wiki/Executable_and_Linkable_FormatThere is a lot of information on the web about ELF + VxWorks.And exactly is running on a Power PC (14). IDA can open it!

author: abyrvalg
author_rank: Frequent Contributor
timestamp: January 26, 2014, 12:52:00 am
content: Quote from: Carrington on January 25, 2014, 11:49:49 pmSure. It even has a symbol table inside (not normal ELF symbols, but some OS-specific table). Use this script to apply them:Code:def ApplyVxSymbol(ea):unk0 = Dword(ea)name_ea = Dword(ea+4)target_ea = Dword(ea+8)flags = Dword(ea+12)if flags==0x300: # external symbolreturnif isTail(GetFlags(target_ea)):MakeUnkn(ItemHead(target_ea), DOUNK_EXPAND)MakeName(target_ea, GetString(name_ea))if flags==0x500: # code symbolMakeFunction(target_ea)elif flags==0x700: # initialized datapasselif flags==0x900: # uninitialized datapasselse:print "%08X: unknown symbol type %08X" % (ea, flags)def ApplyVxSymbols(ea, count):for i in xrange(count):ApplyVxSymbol(ea+i*16)Look for "Adding %ld symbols" string ref to find table ea and count.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: January 26, 2014, 12:38:22 pm
content: Quote from: Carrington on January 25, 2014, 05:10:27 pmThe one I have is about 25% bigger - It was on the mso software updates page along with the first update, but disappeared a while later.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: January 26, 2014, 12:45:01 pm
content: Quote from: dfnr2 on January 20, 2014, 01:17:13 amNo response from my MSO6034a on that port.

author: Carrington
author_rank: Super Contributor
timestamp: January 26, 2014, 04:09:45 pm
content: This is the powerpc Mictor debug connector.

author: dfnr2
author_rank: Regular Contributor
timestamp: January 26, 2014, 04:18:43 pm
content: I am pretty sure that all the tools are there, if you can log into the VxWorks shell. Hopefully it's enabled on the 5000 and 6000 series, but at least we know that the 5000 and 6000 can be induced to boot from the USB by switching on and off once (per the web site), and perhaps the BIN can be modified to spawn the telnetd to listen, if it's not already (or perhaps the emergency binary has it enabled). Have you tried scanning the ports with NMAP for a telnet service?For the 7000 series, the boot order can be set from the shell; by default it's flash then USB, but this can be reversed, which will allow experimentation without having to modify the working system.

author: Carrington
author_rank: Super Contributor
timestamp: January 26, 2014, 05:26:47 pm
content: Quote from: dfnr2 on January 26, 2014, 04:18:43 pmYes, I think it's more than likely. But before we need the abyrvalg's LZSS decompressor, to extract the ELF.

author: dfnr2
author_rank: Regular Contributor
timestamp: January 26, 2014, 06:47:16 pm
content: A decompressor is available if you log into the scope. Abyrvalg gets credit for pointing that out.

author: abyrvalg
author_rank: Frequent Contributor
timestamp: January 26, 2014, 06:58:39 pm
content: mikeselectricstuff, 6k ports (as seen in "emergency" 6k bin): 5024 - telnet, 5025 - Sockets (), 5042 - WebSockets ().dfnr2, Agilent's troubleshooting page describes the same USB boot procedure for 7k (turn on for 4sec), the only difference is that 5k/6k's bootloader doesn't support decompression, so it requires a plain ELF (bin), but 7k boot can load JZP directly, so no emergency BIN for it. An interesting question is: does 7k strictly require JZP or can load BIN too? In this case it is possible to start experimenting directly with unpacked BINs (no need to make a compressor).

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: January 26, 2014, 07:24:13 pm
content: Quote from: abyrvalg on January 26, 2014, 06:58:39 pmThat seems to work I get a "Welcome to Agilent MSO6034A" and >> promptNow what...?Doesn't seem to respond to any obvious commands - just get the >> prompt back and "unidentified header" on the scope screen

author: dfnr2
author_rank: Regular Contributor
timestamp: January 27, 2014, 05:14:05 am
content: Mike,Could that be the LXI port? Do SCPI commands work? Do you get that just by connecting, or do you have to enter the login and password?Have you tried scanning the ports for another telnet protocol port?Once you have a VxWorks shell, you should get some info by typing "help", but this doesn't seem to behave like the shell.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: January 27, 2014, 03:16:23 pm
content: Quote from: dfnr2 on January 27, 2014, 05:14:05 amThat would make sense - didn't try any SCPI commands but the error message on the scope screen would tally with that - will try port scan when I get a chance

author: abyrvalg
author_rank: Frequent Contributor
timestamp: January 27, 2014, 03:32:18 pm
content: Mike,I've just looked into the newest 6k binary and telnet port is same there - 5024. Are you 100% sure you've tried 5024, not 5042 ocassionally?

author: abyrvalg
author_rank: Frequent Contributor
timestamp: January 27, 2014, 03:34:55 pm
content: JZP LZSS unpacker with sources

author: Carrington
author_rank: Super Contributor
timestamp: January 27, 2014, 05:50:34 pm
content: Quote from: dfnr2 on January 20, 2014, 01:17:13 amIs there something like this?/bin/license.lic

author: Carrington
author_rank: Super Contributor
timestamp: January 27, 2014, 05:53:46 pm
content: Quote from: abyrvalg on January 27, 2014, 03:34:55 pmGood job, the JZP LZSS unpacker works perfectly, thank you very much.

author: abyrvalg
author_rank: Frequent Contributor
timestamp: January 27, 2014, 06:29:26 pm
content: Latest experiments had shown that 7k doesn't accept raw BIN for boot, so JZP compressor is needed too, working...

author: dfnr2
author_rank: Regular Contributor
timestamp: January 27, 2014, 06:51:45 pm
content: Nice work, abyrvalg! The compressor works perfectly on the mso7000.bin file here. Of course it perfectly matches the .bin produced by the native uncompress routine.