EEVblog #978 - Keysight 1000X Hacking

[Palmer]

In memory, I changed pbootdelay and bootdelay to 3, along with CRC correction.
I attach the logs and the memory file.

Try replacing usbtty -> serial 
Recalculate the checksum then.

Thanks !
Now pboot is working.
I tried to upload the soft like the x3000 series and the method described in another thread. Uploading via loady the nk.nb0 file previously prepared and firing from infinivision flash drive.
Unfortunately I only showed the logo on the oscilloscope and a reset occurred :-/.

log_3 - boot procedure
log_4 - printenv

[Bud]

You cant use 3000x USB based procedure for 1000x, it is not working on 1000x., forget it.
Something maybe missing in your printenv output, i will look later today.

[Bud]

Before doing the 'go' command try 'run preboot'

Edit: ...unplug the USB drive before attempting to boot.

[Palmer]

Before doing the 'go' command try 'run preboot'

Edit: ...unplug the USB drive before attempting to boot.

When I tried to use "run preboot" (between loady and go) then after using the "go" command no action occurred.

I initially tried on firmware version 1.2 from the manufacturer's website and 1.1 patch from the forum. In both cases booting stops at the same point. (The original firmware is 1.1)

What do you mean by "...unplug the USB drive before attempting to boot." ?
After all, the procedure is to upload the nk.nb0 file to memory (it's basically a windows CE image) and have the system fire the application from the flash drive. Am I wrong ?

TT-392 went through a similar procedure so I hope that I will also succeed.

[Bud]

Can you point me to  a TT-392's post where he said he started the application from a USB drive ?

[Palmer]

eh you are right without a flash drive the application started by itself and could be updated from the flash drive then.

As a thank you, I am preparing a description of the procedure should someone look here in the future with an identical problem and not have to ask questions.

I think that I will finish the description later today max. tomorrow.

[Palmer]

If your oscilloscope has a black screen and only the buttons light up probably this tutorial should fix it.

- unscrew the oscilloscope to get at the small board mounted in the motherboard.
- solder out u701 chip  (on back of plate)
- rip the x.bin file with the programmer
- open the file in hexeditor
- edit bootdelay=3 and pbootdelay=3 positions (look for 000402E0 and 00040380)
- change usbtty to serial (00040280 and following)
- calculate (in hexeditor) from addresses (0x00040004 - 0x00043FFF) the value of crc32. Change on the first 4 bytes(0x00040000-0x00040003).
 Remember the reverse order of entry! If the calculated value is 75 4D 12 8E then we type 8E 12 4D 75.
- we save the file, upload to memory, solder.
- solder the wires to the serial port as in the attached video in the 1st post (I also include a photo before cleaning the excess flux ;-)).
 We connect to the computer via usb-uart converter. We install TeraTerm. It will be needed to handle the serial port and the YModem protocol.
From the default settings of the serial port, we change the speed to 115200.
- Now we have access to pboot (prompt p500) on the serial. (If we abort the boot)

Prepare the necessary file.
Download the firmware from the manufacturer's website. Open in totalcommander or change the extension to x.cab then it should open as an archive also in windows.

We proceed to:

X:\yourfolder>bincompress /d nk.bin.comp nk.bin

Check the length of the file.

X:yourfolder>viewbin nk.bin

Image Start = 0x80361000, length = 0x01A857C0
                Start address = 0x80362000
Checking record #45 for potential TOC (ROMOFFSET = 0xFE992E44)
Checking record #50 for potential TOC (ROMOFFSET = 0xFE9C3E44)
Checking record #126 for potential TOC (ROMOFFSET = 0xFF1F0E3C)
Checking record #189 for potential TOC (ROMOFFSET = 0x00000000)
NOTICE! Record 189 looked like a TOC except DLL first = 0x4001C001, and DLL last = 0x4192C095.
Done.

X:yourfolder>cvrtbin.exe -r -a 0x80361000 -w 32 -l 0x01A857C0 nk.bin

This will result in a nk.nb0 in the same folder.

- Now we can upload the prepared file to memory.
p500> loady 0x00361000 115200

In Tera Term go to File->Transfer->YMODEM->Send.... and open the nk.nb0 that you have prepared before.

The uploading process will take about 50 minutes.

# Ready for binary (ymodem) download to 0x00361000 at 115200 bps....
CCCxyzModem - CRC mode, 1(SOH)/27158(STX)/0(CAN) packets, 10 retries
## Total Size = 0x01a857c0 = 27809728 Bytes

-Now we can boot the system. You need to remember that nothing is inserted in the USB port.
p500> go 0x00362000

## Starting application at 0x00362000 ...
Windows CE Kernel for ARM (Thumb Enabled) Built on Mar 8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Jun 10 2019)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area....
pDrvGlobalArea 0xa0060000 size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
++SER_Init: context Drivers.
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200 (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
LAN PHY NOT detected.
DeleteP500EnetRegistry:
   \_CommGMAC 0x0.
   \_CommGMAC1 0x0.
   \_CommTcpipLinkage 0x0.
   \n-Virtual 0x0.
   \■DriversBuiltInLIN 0x5
LIN: Data Valid
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
ERROR: c:WINCE600PLATFORMCOMMONDIVERS.c line 656: Rewrite recommended, internal ECC corrected data at 0xbe15.
Rewrite Block at Sector Address 0xbe15. 4541
Read Block SUCCEEDED 4572
Erased Block SUCCEEDED 4574
Completed rewriting Block SUCCEEDED 4623
Device load time:
   NANDFLASH: 0 ms
   SNANDFLASH: 0 ms
ERROR: OALIoCtlHalGetDeviceInfo: Device doesn't support IOCTL_HAL_GET_DEVICE_INFO::SPI_GETBOOTMENAME
SHIM DLL, LoadRealDll [PalIO.dll] for [AgilentPalIO.dll].
SHIM [AgilentPalIO.dll] Get Process Addresses
LaunchInfiniiVision:
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll].
SHIM [AgilentPalSStorage.dll] Get Process Addresses

    invalid clock reading: Sat Jan 01 01:00:00 2000
Released build, Jun 10 2019, 21:13:39
Initializing FPGA...
************************************
Ver: 1.067 Released
************************************
ERROR: c:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 656: Rewrite recommended, internal ECC corrected data at 0xbfc8
Rewriting Block at Sector Address 0xbfc8. 11622
ERROR: c:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 656: Rewrite recommended, internal ECC corrected data at 0xbfc8
Read Block SUCCEEDED 11667
Erased Block SUCCEEDED 11668
Completed rewriting Block SUCCEEDED 11703
Calibration mode User
Cal Date Mon Apr 08 13:10:31 2019
Startup sequence is complete.
Saved configuration invalid
System has been running 16.266155 seconds
Start Up Sequence 6.680450
Memory Load 52%
   System Physical Memory 37.832 / 73.465 MB
   Process Virtual Memory 46.688 / 1024.000 MB
-----> InfiniiVision is running <-----

- Now on the flash drive (FAT32) place the firmware from the manufacturer's website and run the update procedure.
It is important to remove the flash drive after restarting, otherwise the system will not boot.

Thanks again Bud for the information ! With your help and information about the repair procedure for the x2000 and x3000 oscilloscopes, I was able to repair this model as well.

[Bud]

 

[Anthocyanina]

ok! i checked every solder joint on the BLT connectors and the components with visible solder joints, nothing looked suspect, but as a just in case, i used the hot air station on the spear600 and the memory ICs. i noticed some flux residue was left near the damaged connector, so i just basically bathed that side of the BLT in isopropyl, making sure tehre was no residue at all, then i placed the BLT back where it belongs, but i didn't fully press it in, just enough that there would be contact, and to my surprise, i got a full boot! still don't have a proper USB adapter, but i captured the data with an analog discovery 2, which was a lot easier to read than scrolling the rigol capture. there were a couple of differences on the log between what i got and one log someone posted years ago on this thread, but i read it all and there were no errors this time.

i then fully seated the BLT and turned it back on, and i got a few more full boot sequences. it boots up much more consistently than before, but it some times takes significantly more time for a full boot, and sometimes it does boot at its regular speed, and sometimes it doesn't boot at all.