Tek 4 Series Hack

[ghida]

Hi there,

Anyone here working on/interested in unlocking options on the Tek 4 5 6 series ?

I started working on it but I need help. Also I do not currently have one of these scopes.

Any interest ?

G.

[darkstar49]

Very different beasts... series 3 & 4 are iMx6 based and run a derivate of the former MDO3K/4K firmware, I think series 5 & 6 are Intel-based, but just as you, I don’t have any of these... and they remain pretty expensive on the (2nd hand) market, somehow out of range, even for the ‘advanced’ hobbyists...

[ghida]

I would buy one right away... but only if it could be cracked.

I somehow got confused and thought the firmwares were the same, but you are right, not the same hardware.
My interest is in the series 4 and specifically the MSO44.

I have found how most of the licensing works...
It uses an RSA signature in the license file. There is a license database in the scope and the signature is verified in multiple modules.
So it is not really possible to do a keygen unless there is a flaw in the way the signature is verified.

However... just like the Rigol MSO5000 hack, the firmware could be cracked... I am 99% sure I found what to change.
But I would need someone with a MSO44 or MSO46 and some knowledge, to test it.

PS: If there are people with more reverse engineering experience around, you are welcome to join the effort.
Look for the tek::okdb namespace, InstrumentManager object, "verify" function...

[salviador]

have anyone ever tried on the tek4 series, news about it?

[P51256SL-07]

I'm intestered too, but probably the series 4 is too much expensive to make test on it and I didn't see any good opportunity on ebay.. 

[maxwelllls]

I have an MSO54 and win10 option. I have made a GHOST image of the system, which can run in VitrualBox VM, but cannot start ScopeApp. Dynamic debugging will try to read data from a specific memory address when the software is started, most likely the value of a hardware peripheral(probably  HostId). Since the VM has no associated hardware, return 0x0000000000000000 and the program crashes.
I grab full memory dump by triggering WIN10 blue screen, but don't know how to analyze it.
As for Tek :: OKDB Namespace ghida mentioned, I'm not a professional reverse engineer(just a EE guy), so I don't know how to do it.
Anyone interested please PM me

[skander36]

Hello!
Anyone knows about progress in hacking MSO Tek series? I'm interested about MSO44 also.

[coromonadalix]

3 years later ... i would say no  or loss of momentum ...  if you read earlier post  about licensing  ...

[skander36]

3 years later ... i would say no  or loss of momentum ...  if you read earlier post  about licensing  ...

I'm not sure that I understand the last part of your comment.
I'm expected a useful comment on this topic.

[coromonadalix]

have you observed ? ...   last comment was in 2021 ...   before your's and mine

that speak for itself   no ?

you're free to take on this project and continue decipher it / decode it / reverse it  ...

 

[skander36]

so ... searching for entire web(including web archive), searching all EEVBlog forum for hack of the Tek MSO44, reading all the info I have found on subject(not much), finding this post and reading it tenth times because the OP said that is 995 sure that he know how could change the scopeapp, parsing it in IDA many times (without results because my lack of skills),  and you come and ask me if I'm aware that the last post is from 2021 ... 
Yes, I know!!!    every post has a timestamp ...

Now seriously, I hope that someone has more knowledge about the subject as I will able to try if there is something to apply.

[coromonadalix]

you sound more like someone who want to get freebies out of others  ....   you should change your tone a bit ...   

unless you do it yourself,  wait for others if they do it or not, and be patient .... maybe some day ... you asked ...  wait for answers ...   

and don't pressurize people(s)  to do it for you   

i'm not picking on you, not starting a war      but that's how the forum works and people(s) contribute if they want to,  or not ... or keep it to themselves

maybe simply said :    this 4k series is simply not worth it  ...  that's all         you have TEK forums too ...

other series had good or very good success if you search here

bye

[skander36]

you sound more like someone who want to get freebies out of others  ....   you should change your tone a bit ...   

unless you do it yourself,  wait for others if they do it or not, and be patient .... maybe some day ... you asked ...  wait for answers ...   

and don't pressurize people(s)  to do it for you   

i'm not picking on you, not starting a war      but that's how the forum works and people(s) contribute if they want to,  or not ... or keep it to themselves

maybe simply said :    this 4k series is simply not worth it  ...  that's all         you have TEK forums too ...

other series had good or very good success if you search here

bye

Where to you see that I'm pressurize? This was my post: "Hello! Anyone knows about progress in hacking MSO Tek series? I'm interested about MSO44 also."
I'm just asking if someone knows about progress on this matter hoping that in 3 years someone know.
You come and suppose that I'm not reading the thread and I should change my tone ... no comment.

unless you do it yourself,  wait for others if they do it or not, and be patient .... maybe some day ... you asked ...  wait for answers ...   
and don't pressurize people(s)  to do it for you   

I was asked and wait until you come ...