New Agilent scopes

[hacklordsniper]

I ordered my DSOX3024A few days ago with few options (function generator, help system...). The delivery time is 8 weeks, when it arrives i can do any teardown or whatever needed to help community to crack it 

[Leo Bodnar]

I ordered my DSOX3024A few days ago with few options (function generator, help system...). The delivery time is 8 weeks, when it arrives i can do any teardown or whatever needed to help community to crack it 

What's "help system?"  Is this educational licence option?
I have basic MSOX3024A version and I am really happy with it.

[hacklordsniper]

Yes its help on the functions of scope and training signals. Its called education option

[mikeselectricstuff]

I ordered my DSOX3024A few days ago with few options (function generator, help system...). The delivery time is 8 weeks, when it arrives i can do any teardown or whatever needed to help community to crack it 

Do you really think they won't have plugged the hole in 8 weeks' time...?

[_Sin]

I'm interested to see what Agilent's response is. In some respects it might be better for them to quietly do nothing - having a security hole like this is unlikely to have much impact with any corporate buyers - they're not going to mess about with dodgy license keys. Meanwhile the unit is more attractive to hobbyists who are otherwise not going to splash out on the expensive options and without the existance of a hack would just buy a cheaper scope from another source. So in the current situation, they might shift more units.

On the other hand, no-one likes to look like an idiot... so maybe they'll fix it just to save face.

Plus I'm intruiged to see *how* they plan on plugging the hole. Seems like introducing a new key would mean a firmware update, and they don't look awfully well protected. So existing units might remain hackable, provided people aren't too trigger happy in updating them. Indeed unless there's a serious problem in the current firmware, or they enable some extra features, there's probably little point updating.

[mikeselectricstuff]

Plus I'm intruiged to see *how* they plan on plugging the hole. Seems like introducing a new key would mean a firmware update, and they don't look awfully well protected. So existing units might remain hackable, provided people aren't too trigger happy in updating them. Indeed unless there's a serious problem in the current firmware, or they enable some extra features, there's probably little point updating.

Yes but there probably aren't many scopes out there yet. If they plug the hole soon with a new update, which could completely change how future updates work, they limit any long-term damage. There is nothing they can do for units already out there, but they could also encourage updates of older units by offering some nice new features.

[hacklordsniper]

Do you really think they won't have plugged the hole in 8 weeks' time...?

Not sure, basically i bought all options i need. Except the MemUp option...

[Brataccas]

Check out this fully kitted DSO-X 3014A ugly duckling. 

[tnt]

I think they may not bother to "fix" previous version of the scope if the hack doesn't get "out of control" like the one for the Rigol did, hence "bragging" might not be the best option.

[Leo Bodnar]

I ordered my DSOX3024A few days ago with few options (function generator, help system...). The delivery time is 8 weeks...

I have also decided on the 200MHz 4 Channel version but MSO one as I am mostly designing digital stuff.
RS Components have a few of each models in stock but unfortunately they don't have any options to go with them.
So I decided to get one now (life is short!)

How much did you have to pay for the options when ordered preinstalled?

[bandtank]

I have spoken face to face with Agilent sales people and they've told me the upgrades do not have a premium if you do them later except bandwidth. If you upgrade bandwidth after the sale of the scope, you pay the cost of the upgrade + 20%.

Also, just to be clear, the lower end bandwidth is software upgradeable until you get to 350MHz or 500MHz. Those require a new board. Dave said this earlier so I'm just reiterating.

[tnt]

Yes, the options don't cost more afterwards. The bandwidth probably cost more because they ship you new probes to go with it I guess ?

And the 200 -> 350 MHz transition is pretty steep ... 3500 eur !!!

[bandtank]

I don't know if they send you new probes as I forgot to ask. The upgrade becomes far more expensive if you have to buy new probes as well.

The 20% is purely a fee. It is not meant to cover any part of the upgrade.

[implor]

Check out this fully kitted DSO-X 3014A ugly duckling. 

Did you do some magic or did you pay for it? if you paid, what was the price? (except half your soul) 

[_Sin]

Just a little bit of info - while there seems to be references to serial decode/trigger licenses for the 2k series in the firmware, it doesn't seem to work if you make a license. I guess they're disabled elsewhere.

No big deal for me, but worth bearing in mind if anyone is thinking of cutting corners and needs those features - either go for the 3000 series or wait and hope there's a new firmware at some stage.

[EEVblog]

I don't know if they send you new probes as I forgot to ask. The upgrade becomes far more expensive if you have to buy new probes as well.

Yes, they would almost certainly ship you new probes as well, that's one reason why the upgrade is so expensive.
Like the MSO option, they will ship you the probes if you buy the option.

Dave.

[tnt]

Yes looking at the code it's like that :

Code: [Select]

if (model == 2000) {
  if (checkLicense('feature 1')) {
    ... enable feature 1 ...
  }
  ...
  if (YYYY) {
    if (checkLicense('feature serial 232')) {
      ... enable feature serial 232  ...
    }
    if (checkLicense('feature serial i2s')) {
      ... enable feature serial i2s ...
    }
    ...
  }
} else if (mode == 3000) {
  if (checkLicense('feature 1')) {
    ... enable feature 1 ...
  }
  if (checkLicense('feature 2')) {
    ... enable feature 2 ...
  }
  if (checkLicense('feature serial 232')) {
    ... enable feature serial 232 ...
  }
  if (checkLicense('feature serial i2s')) {
    ... enable feature serial i2s  ...
  }
 ...
} else {
  /* WTF, error ? */
}

(note the extra condition if (YYY) for serial in the 2000 case)

I don't know what that YYY is for sure yet and if you can enable it somehow (else than forcing the if by modifying the code of course)

[_Sin]

Yes looking at the code it's like that :

...

(note the extra condition if (YYY) for serial in the 2000 case)

I don't know what that YYY is for sure yet and if you can enable it somehow (else than forcing the if by modifying the code of course)

Interesting. I haven't really poked into the code any more than to extract what was necessary and have a general look around.

I might have to have a deeper look at it, as it seems there's some more interesting things to find.

[mikeselectricstuff]

Check out this fully kitted DSO-X 3014A ugly duckling. 

Did you do some magic or did you pay for it? if you paid, what was the price? (except half your soul) 

Loan demo units usually have all the bells & whistles enabled so could have been one of those.

[Brataccas]

Loan demo units usually have all the bells & whistles enabled so could have been one of those.

It used to be just basic DSO-X 3014A.

[mikeselectricstuff]

Yes looking at the code it's like that :

Code: [Select]

if (model == 2000) {
  if (checkLicense('feature 1')) {
    ... enable feature 1 ...
  }
  ...
  if (YYYY) {
    if (checkLicense('feature serial 232')) {
      ... enable feature serial 232  ...
    }
    if (checkLicense('feature serial i2s')) {
      ... enable feature serial i2s ...
    }
    ...
  }
} else if (mode == 3000) {
  if (checkLicense('feature 1')) {
    ... enable feature 1 ...
  }
  if (checkLicense('feature 2')) {
    ... enable feature 2 ...
  }
  if (checkLicense('feature serial 232')) {
    ... enable feature serial 232 ...
  }
  if (checkLicense('feature serial i2s')) {
    ... enable feature serial i2s  ...
  }
 ...
} else {
  /* WTF, error ? */
}

(note the extra condition if (YYY) for serial in the 2000 case)

I don't know what that YYY is for sure yet and if you can enable it somehow (else than forcing the if by modifying the code of course)

Of course IF (very big IF!) you can make it run modified code, then the whole license key/encryption thing is pretty much irrelevant

[tnt]

Yes obviously, that's why tracing what that condition is exactly and if it can be enabled without code changes is relevant.
The fw files are all signed, so you can't just patch the fw update and upload that, the scope will (should) reject it as corrupted.

[_Sin]

Of course IF (very big IF!) you can make it run modified code, then the whole license key/encryption thing is pretty much irrelevant

I'm itching to try that, but I'm drawing the line at installing licenses until there's a known way of restoring a bricked scope...

[Leo Bodnar]

These Windows CE scopes actually worry me.  I don't understand them.  I want the same functionality but based around low integration logic ICs or at least FPGAs. 
There must be a Registry somewhere in there growing slowly.  And you don't get Win CE reinstall CDs with them!  

[bandtank]

I'm impressed with how quickly all of you figured out how to do this. I've PMed only a few of you and I appreciate the help, but I think this is just over my head. I've downloaded 7 programs between what was suggested in this thread and in PMs, but still haven't found the secure data tool or how to extract it. I'm starting to think you are all collaborating to confuse me.