Reverse engineering an oscilloscope circumvents vendor crippleware

oscope-reverse-engineering

The crew over at the Hungarian Autonomous Center for Knowledge (H.A.C.K.) say they aren’t the most well-funded organization out there, so they were stoked when they found they could afford to bring a slightly used UNI-T UT2025B digital oscilloscope into the shop. As they started to tinker with it, the scope revealed one major shortcoming – screenshots were only accessible via a USB connection to a Windows computer.

Since they didn’t have any Windows boxes in house, [András Veres-Szentkirályi] decided he would try reverse-engineering the protocol so they could get access to this useful feature.

He set up a Windows VM, and using Wireshark on the host Linux box, [András] sniffed the data passing over the scope’s USB interface. He was able to identify what looked like image packets being sent to the VM, which he was able to decode using a small Python script. The resultant images were monochrome and they didn’t look quite right, but it was a start. As he dug further [András] found that he was overlooking some of the color data packed into the images, and after a bit of fiddling he got the sharp, colorful image you see above.

It turns out that while the scope has a monochrome LCD, it sends 16-bit color images over the USB interface – images that the Windows’ client degrades before displaying them on the screen. So in the end, he was not only able to get the scope working on any OS with the ability to run Python, he was able to grab far better images than the manufacturer ever intended – A very nice hack if we do say so.

Be sure to swing by the H.A.C.K. wiki as well as the project’s github repository if you have one of these scopes and are looking to wring some better images out of the hardware.

Comments

  1. bootdsc says:

    Now that is a worthwhile hack. good job.

  2. gyro john says:

    Bravo, H.A.C.K.!!

  3. Kevin says:

    “the scope revealed one major shortcoming – screenshots were only accessible via a USB connection to a Windows computer.”

    Don’t get me wrong the word around is great but that line is just painful. That is like saying “We bought a bottle of coke but it had a major flaw, you need cups to drink it”

    • Bertho says:

      You don’t need cups for a bottle and you do certainly do not need a computer with one specific OS to drink.

      The problem with this kind of crippleware is that it is accepted. The producer’s mindset of “milk as much as possible” is the problem. Would you accept a computer where you only can utilize 25% or 50% of its performance?

      • Kevin says:

        Ok how about this one, it’s like saying “I bought a car but it was designed with a crippleware gas engine, now I have to hack it so it will run off vegy oil” …. point is that windows is the standard OS of computers in this word and it’s not a flaw for someone to make a product that uses such standard

      • Kiel says:

        I bought a phone but it won’t connect to my ham radio! Curse you Google!

      • matt says:

        Horrible analogy Kevin. Using the speed governor would be better, but still incorrect.

    • Marco says:

      Sure it started out as something to get geek cred (“I don’t need to *** Windows!!”) but in the end it revealed a useful feature.

  4. Kevin says:

    **workaround not word around lol

  5. clm1990 says:

    Time and time again things like this prove that the FOSS community is something that companies like this stand to benefit immensely from (its a shame more of them don’t realise this).

  6. dext3r says:

    Excellent hack. Crippleware is retarded.

  7. Galane says:

    Only providing software for Windows isn’t so bad.

    What’s incredibly stupid is not providing software that deliberately does not produce the highest quality data the scope is capable of delivering.

    That’d be like car manufacturers using a coarse rubbing compound to dull the paint on new cars.

    The scope company should license the Linux software from H.A.C.K. and un-fudge their Windows software to produce full quality captures.

    • waitwaittellme says:

      Ah a response worth replying to.

      The unfortunate truth is that the company will do no such thing unless the answer is yes:

      Will doing this make the company more money than it costs to implement?

    • qwerty says:

      That’s not different from processor manufacturers that deliberately disable cores or other parts to put the hardware into lower market segments, or cameras with raw image saving disabled because they would otherwise compete with higher models.
      In either example, manufacturers spend money and research time to produce inferior products with the goal of selling it now, then after some time making you buy the better one too.

      It’s consumerism, baby. The wrong side of capitalism Joe McCarthy conveniently never told about.

      • Eirinn says:

        Time spent -> Higher income.

        Is this generally applicable when making code compatible with more than windowx machines? No.

        This is why, nothing more, nothing less.

        Unfortunately.

  8. Truth says:

    It is sad but the computer industry does the same crippleware the whole time.

    e.g. with “Windows Vista Starter” you can only run 3 applications at once. You spend more money and they remove the additional code that is limiting the functionality.

    Or you buy a large end database software and it is limited to use a maximum number of CPU cores and RAM depending on the license bought.

    It is a way to charge less for less and more for more, personally I think that it is nuts.

    Anyhow, very cool hack.

  9. kounst says:

    This has been done befor. even with a proper interface which lets you control the scope. i will post a link later on..

  10. Mike says:

    Great work. I have to ask though, why did they limit the Windows app to monochrome? To not make the machine’s display look cheap by comparison, or is there a higher model (or paid upgrade) that lets you see the color image?

    • vsza says:

      Based on low-res photos and chinese webpages, there are models with color displays in this line — even the photo on the official page of this model has a photo of a device with color LCD. This leads me to believe that all they’re trying to do is market segmentation.

  11. macpod says:

    There is an open standard for communicating with devices like scopes.. I wonder if they decoded a subset of this protocol, but were unaware? It has science, measurement, international.. or at least some of those keywords in the name and is abbreviated as a three letter acronym as I recall.

    • vic says:

      The Test and Measurement class ? Or were you thinking about HID ?

    • vsza says:

      Of course there is, but what this device did on USB had nothing to do with any standards. It had its own kernel-mode Windows driver and used its own USB device class — see the lsusb output on the wiki page for more details.

  12. Steve-O-Rama says:

    Nice job, H.A.C.K. !!!

    I’m not sure whether I should be happy or jealous that I don’t have one of these UNI-T oscilloscopes. If this model can be further unlocked and de-crippled, maybe it’ll enjoy a larger following, similar to what the Rigol DS1052E has now. Good work, regardless. It’s always great to get more out of one’s tools with a bit of ingenuity.

    • vsza says:

      Thanks :$ I don’t know that (yet) either — the responsiveness of the “hardware UI” is not so great, but it seems that almost every aspect can be controlled via USB (and a big subset via RS-232), so maybe this can be fixed too. Also, the waveform is accessible as a set of numbers, so I see an opportunity there — getting screenshot was just the “most wanted” feature.

Speak Your Mind

*

Related Hacks in tool hacks

  • Designing a self-replicating milling machine
  • USB connectivity that is so very very small
  • Going from idea to schematic to printed PCB
  • Flying microscope build seems way too nice for a home lab
  • Upgrading a digital multimeter to tell the temperature