After many hours I found where licences in Waverunner HRO 6Zi are stored. I have 2 types of these 12bit scopes - newer version of CPU board with some extension card and running with SSD (type WRHRO 66 Zi) and Win 10 and older version with win W7 (type WRHRO 64 Zi).
After change all parts between scopes I found licences are stored somewhere on CPU board - not depends on HDD or sampler board etc.
It is on Dallas chip - 1wire eeprom 28EC20. And there (although I hoped) are not only some switches if use or not the option - like in most of units, but there are stored a crypted keys
. For communicating with this is used SM bus driver (see HW settings in Windows).
Structure of data are:
- first block has ASCII licence codes for legacy keys.
- second block has ASCII licence codes for legacy keys with temporary activation (demo codes)
- 3rd - next block has new licence keys, but stored in 16bytes (not in 26bytes)
each block has info how many keys are in the block stored and if this is enabled (0x01) or disabled (0x00) key.
In the last bytes of memory is saved unique ID called "unspecified value" (see its datasheet). This ID is the same ID in the scope - called Scope ID. This value is in ROM section - not rewritable and by this are calculated licence keys.
Using this I was able to bring the licences from one unit to another and is possible to clone licences. Not possible direct copy of Dallas chip (has unique ID), not possible to use bigger memory chip (this Dallas is 20kbit and larger is not available
, but is possible to use emulator with some micro. Maybe should be easier when some chip with deeper memory will be produced or with the china "fake" with editable ROM section.
Interesting is that the keys are converted back to 16bytes format. I made a test: program new 16bytes key with programmer into Dallas - this key on the scope is visible as 26bytes key (is recalculated by SW).
Of coarse, the easiest way is to generate the licence code directly and use them , but I have not find this keygen yet, so for me is now better to build Dallas emulator and use a known combination of ID and keys.
Conversion unit 64Zi to 66Zi is done after unnamed option key.
I will add the dump of chips.
I found some diagnostic list glued under PC board, there are visible all voltages - useful for scope repair. It is on photo.
Next interesting is handy cut for USB-B connector on new scope. So Lecroy produces handy made scopes and improvizes in few pcs, this is crazy work..