DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?

[Luminax]

Like I've already mentioned, I used the link installer someone posted somewhere in this thread on my DSOX 2014A 2.41 Firmware and it's fine and dandy.
If anyone want, I can re-upload my known good configuration files and links from my usb pen-drive...

Disclaimer, of course, that any bricking that might occurs is out of my hands...

[TheSteve]

Like I've already mentioned, I used the link installer someone posted somewhere in this thread on my DSOX 2014A 2.41 Firmware and it's fine and dandy.
If anyone want, I can re-upload my known good configuration files and links from my usb pen-drive...

Disclaimer, of course, that any bricking that might occurs is out of my hands...

That's the thing - the known good file worked for several people, but then it also bricked a few scopes.

[yelong98]

you mentioned "bricked the scope" ,i'm not good at english ,does it mean this way may be harmful to scope  ,such as breaking the scope ?
DE BD7JAT

[yelong98]

Like I've already mentioned, I used the link installer someone posted somewhere in this thread on my DSOX 2014A 2.41 Firmware and it's fine and dandy.
If anyone want, I can re-upload my known good configuration files and links from my usb pen-drive...

Disclaimer, of course, that any bricking that might occurs is out of my hands...

could you pls upload the files here ?if you can paste some instructions about how to use ,it would be wonderful !

[Luminax]

you mentioned "bricked the scope" ,i'm not good at english ,does it mean this way may be harmful to scope  ,such as breaking the scope ?
DE BD7JAT

Yes, a wrong step or wrong link might lead to your scope being unusable, and you'd need to send it back to the factory for repair.
That being said... has anyone actually BRICKED their scope yet? I don't remember of one but eh... it's quite a long thread.

Also, I've attached the file all inside a zip. The steps are basically :

1) Extract all files (including the .lnk) to the root of your usb drive
2) From the scope's front panel, press Utility ->File Explorer -> Press to go to: <USB Drive label>(usually "usb")
3) From the drop down, scroll to the v241_link_install.cab to select
4) Press Load file

The scope will ask for your confirmation and then it will load/update and reboot.

FYI, my link file is :
160#\Secure\infiniiVision\infiniivisionLauncher.exe -l DIS -l MSO --perf -l MEMUP -l SCPIPS -l CABLE -l SGMC -l FLEXC -l TOM -l BW20 -l ADVMATH -l EMBD -l EDK -l VID

the other cab uninstall the link file and restores your previous setting.

Cheers

[yelong98]

you reply so quickly , thanks so much. I wanna make sure all i need to do is load the file"v241_link_install.cab" from USB  ? Do i need to modify any file first?

[Luminax]

The .lnk file is already included and gives you all options (I think I have them all covered) so it turns DSOX into MSOX, gives up to 200MHz bandwidth, etc etc.

Yes, all you have to do is just load the install .cab

[ben_r_]

you mentioned "bricked the scope" ,i'm not good at english ,does it mean this way may be harmful to scope  ,such as breaking the scope ?
DE BD7JAT

Yes, a wrong step or wrong link might lead to your scope being unusable, and you'd need to send it back to the factory for repair.
That being said... has anyone actually BRICKED their scope yet? I don't remember of one but eh... it's quite a long thread.

Also, I've attached the file all inside a zip. The steps are basically :

1) Extract all files (including the .lnk) to the root of your usb drive
2) From the scope's front panel, press Utility ->File Explorer -> Press to go to: <USB Drive label>(usually "usb")
3) From the drop down, scroll to the v241_link_install.cab to select
4) Press Load file

The scope will ask for your confirmation and then it will load/update and reboot.

FYI, my link file is :
160#\Secure\infiniiVision\infiniivisionLauncher.exe -l DIS -l MSO --perf -l MEMUP -l SCPIPS -l CABLE -l SGMC -l FLEXC -l TOM -l BW20 -l ADVMATH -l EMBD -l EDK -l VID

the other cab uninstall the link file and restores your previous setting.

Cheers

Wow, thats it now huh? From what I recall it was quite a bit more complicated years ago when I looked into it. So this will work with any version of the X2000 series? I have a stock Agilent MSOX2024A that has a few options I paid for.

[Luminax]

As mentioned way way way waaaaay back at the start of the thread, Agilent's flagship InfiniiVision scope is just a custom program running on WinCE and, as with any properly programmed windows executable, they can take startup arguments.
Previously some of the 'hackers' in this thread was hacking into the scope and uses the LAN module to replace the built-in .lnk with the modified version. As the scope is mainly all-features-included but firmware/program locked, the modified link can 'unlock' those.
Later on in the line, someone made some modifications to the firmware installer cab itself and modified the link INSIDE the cab, then used the scope's built-in USB boot feature to load the new firmware. This, as far as I've remembered, has been patched.
A little further down the line was the post that contains the cab files I linked, which is basically a way to load firmware from your USB drive, but the 'firmware' in question just copy the modified .lnk and renaming the original one in the scope to something else.

aaand I just went into rantmode again  I'm getting old...

[yelong98]

I really need to say thanks again. So another things is i wanna make sure does the ZIP file you uploaded here is suitable for all dsox2000 series ? or just for some specific one . my scope is dsox2002a ,does this file  fits for my scope ? Since you mentioned any mistake will brick the scope ,so i have to make all information clearly .

Have a good day !

[Luminax]

It should work as long as you have the 2.41 Firmware.
Not sure if there's any new firmware since then... hmmm

As far as I've remembered, someone with 3000X also tried this method some time back with success, and the command in the switches in the link are taken from the 3000X series with trial and error to see which options works for the 2000X series.

New 1000X series is another different can of worms but might work... who wants to be the sacrificial lamb and test it on their 1000X ? 

[tridentsx]

There is a 2.42 f/w now, would it work with this version ?

[Luminax]

Since the files inside the cabs are just fake and dummies, I'd be willing to bet it would work.
I'd try myself but I'm kind of afraid it'll take my 'features' and run with it... what's updated on 2.42? I might give it a miss altogether

[tridentsx]

Release note for 2.42
http://www.keysight.com/upload/cmc_upload/All/Keysight_2000A_3000A_X_Series_Oscilloscope_Release_Notes_02_42.pdf

[Windfall]

I updated my scope to the 2.42 Firmware this week, because they now allow a probe attenuation down to 0.001 which is quite useful.

Telnet Login an the "\Secure\infiniiVision\infiniivisionLauncher.exe -l DIS -l MSO -l memMax -l MEMUP -l ADVMATH -l SGM -l SGMC -l AUTO -l COMP -l TOM -l EMBD -l VID -l COMP -l SCPIPS -l WAVEGEN -l MASK -l BW20" Hack still works on my scope.

But you still needing to alter the hex info on dll file, or just add these options on the command line?

For the basic hack just add the options at the command line.

My DSOX2024A was delivered today (with LAN/VGA module, for the web interface, I love web interfaces on hardware). Updated firmware from 2.41 to 2.42.

Playing around with this telnet trick, but when I execute the quoted commandline, my screen goes black. Am I missing something ?

<never mind though, see next message !>

[Windfall]

Never mind, I realized pretty quickly I had to kill some old copy of the executable.

ProcessMgr.exe kill infiniivisionLauncher.exe

then

\Secure\infiniiVision\infiniivisionLauncher.exe -l DIS -l MSO -l memMax -l MEMUP -l ADVMATH -l SGM -l SGMC -l AUTO -l COMP -l TOM -l EMBD -l VID -l COMP -l SCPIPS -l WAVEGEN -l MASK -l BW20

works, although it gives me a warning :

'System concerns detected: OS version is not correct. Please reload system firmware.'

(I wonder who it's talking to, the developers or me ?  ).

[grenert]

Do you have to telnet in every time you boot to run that command line?

[Windfall]

Do you have to telnet in every time you boot to run that command line?

Of course. I kill some already running executable, then rerun it with other parameters (which enable licensed features). I gather from earlier messages that the firmware can be changed to make it start with those other parameters (probably by changing some embedded script somewhere), but, personally, I'd rather not do that.

[mlan]

When you have a 2000X don't forget to add the --perf parameter, but ADVMATH, TOM and all other 3000X specific licences will have no effect.

The following parameters will enable everything available on a 2000X with standard 2.4x firmware:
 -l MSO -l BW20 -l DIS --perf --forcemaxmem

[Luminax]

'System concerns detected: OS version is not correct. Please reload system firmware.'
This amounts to "you hax0r! go back to the crippled version!"

A bit of fiddling with the recipes and switches might make this message go away forever (as in, matching the OS version and firmware version check in software and hardware) but as it's not really hindering anything, why bother?

[Windfall]

When you have a 2000X don't forget to add the --perf parameter, but ADVMATH, TOM and all other 3000X specific licences will have no effect.

The following parameters will enable everything available on a 2000X with standard 2.4x firmware:
 -l MSO -l BW20 -l DIS --perf --forcemaxmem

Thanks.

Would be nice for us to, sometime, have an account somewhere of those parameters and what they relate to.

[Windfall]

'System concerns detected: OS version is not correct. Please reload system firmware.'
This amounts to "you hax0r! go back to the crippled version!"

Heh. Most likely just a cross-check, that the executable has been compiled for the right Windhoze.

A bit of fiddling with the recipes and switches might make this message go away forever (as in, matching the OS version and firmware version check in software and hardware) but as it's not really hindering anything, why bother?

Indeed. Although it would be nice to find out how the OS version is passed, and if there are any other executables that should be run before and after this one (you never know, there might be some order issues).

Ah well, I bought it with the options I actually use. I'm kind of a digital only man, and only the occasional brush with analog. The wavegen is probably nice to have, on occasion. The rest doesn't really interest me (although why they'd cripple memory use is beyond me ...).

[MarkL]

When you have a 2000X don't forget to add the --perf parameter, but ADVMATH, TOM and all other 3000X specific licences will have no effect.

The following parameters will enable everything available on a 2000X with standard 2.4x firmware:
 -l MSO -l BW20 -l DIS --perf --forcemaxmem

Thanks.

Would be nice for us to, sometime, have an account somewhere of those parameters and what they relate to.

Look back in this very thread; here's many of the options:

  https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg338246/#msg338246

An easy way to search this thread is to hit the PRINT button, which gives you all the posts, and then use your browser to search for specific text.

[RossS]

Is there any harm in going from 100 -> 200 MHz on a 3000T series via a strapping resistor change to make it think it's a 350/500 MHz board? Will this screw up accuracy or make user calibration fail? I'm wondering as there are no software hacks for the T series yet...

[grenert]

Do you have to telnet in every time you boot to run that command line?

Of course. I kill some already running executable, then rerun it with other parameters (which enable licensed features).

I see.  Thank you for the explanation.

Ah well, I bought it with the options I actually use. I'm kind of a digital only man, and only the occasional brush with analog. The wavegen is probably nice to have, on occasion. The rest doesn't really interest me (although why they'd cripple memory use is beyond me ...).

Yes, I also bought my scope with the features that are most useful for me (mostly analog ones like channels and bandwidth, and ponied up for the max memory  ; got the AWG as a free bonus as an early adopter).  I can see how this telnet method could be useful on the very rare occasion when I might need the various MSO/serial decode functions.