DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?

[BFX]

Thank you for your explanations, which are quite satisfactory.
In my opinion, I still consider it would be very useful if it would be open a dedicated thread only to verified solutions, described in detail by each user who verified/applied that particular solution and is willing to present it nice, monitored and closed by a moderator. Only the moderator would be able to append new verified solutions, if are nice and clear described. Definitely would be shorter and easier to follow.
All the other threads, as the present one for example, can be considered main research work, or the others collateral threads and it should be a final closed thread only with verified solutions.
But maybe no one is willing to invest time to prepare and maintain such thread, which is also understandable when the users are satisfied because already found for themselves a working solution after hours of trial and error.

Hi,

there is also another reason for that, I think because also here is lot of gamblers which would like to reach lot of money for nothing, like hack some gear a sell for much more, but they are not usualy too much technicaly skilled and it's a litle barrier to do that. 

[Keysight DanielBogdanoff]

Thank you for your explanations, which are quite satisfactory.
In my opinion, I still consider it would be very useful if it would be open a dedicated thread only to verified solutions, described in detail by each user who verified/applied that particular solution and is willing to present it nice, monitored and closed by a moderator. Only the moderator would be able to append new verified solutions, if are nice and clear described. Definitely would be shorter and easier to follow.
All the other threads, as the present one for example, can be considered main research work, or the others collateral threads and it should be a final closed thread only with verified solutions.
But maybe no one is willing to invest time to prepare and maintain such thread, which is also understandable when the users are satisfied because already found for themselves a working solution after hours of trial and error.

Hi,

there is also another reason for that, I think because also here is lot of gamblers which would like to reach lot of money for nothing, like hack some gear a sell for much more, but they are not usualy too much technicaly skilled and it's a litle barrier to do that. 

It's been done, and we've stepped in. Hacking your scope is one thing, buying -> hacking -> reselling is another. Save yourself some legal fees and just don't do that.

[viki2000]

Daniel, could you please tell us and elaborate what is Keysight ready to do (legally) when you say "we've stepped in"?

I personally dislike the idea of making money out of hacks "buying -> hacking -> reselling".
But if I buy a device, no matter what is it, and own it, then is mine and I do what I want with it. If I want to hack it and reverse engineering it, then I do it and I see no legal reason why not as long as is for yourself and you do not make money out of it.
It is the same as iPhone and Jailbreak. Who has the biggest brain will win.
what will Keysight do if I decide to hack my own oscilloscope without selling it?
What will Keysight do if the guys from here decide to "upgrade" hardware their own oscilloscope by changing components, let's say to make it "better"? Is it anything illegal in that? If not, then why would it be for the software change/hack when smart guys change some bits around instead of components?
Of course I understand that Keysight is upset because some technical guys outside of the company found their "little secret"  of certain Agilent/ Keysight oscilloscopes, but you should see it different. Maybe you just found a better way to improve your scope firmware security and why not, you may recruit your future development engineers from here.
I think many people will be happy if you can provide some answers to the questions above.

[cgroen]

Daniel, could you please tell us and elaborate what is Keysight ready to do (legally) when you say "we've stepped in"?

I personally dislike the idea of making money out of hacks "buying -> hacking -> reselling".
But if I buy a device, no matter what is it, and own it, then is mine and I do what I want with it. If I want to hack it and reverse engineering it, then I do it and I see no legal reason why not as long as is for yourself and you do not make money out of it.
It is the same as iPhone and Jailbreak. Who has the biggest brain will win.
what will Keysight do if I decide to hack my own oscilloscope without selling it?
What will Keysight do if the guys from here decide to "upgrade" hardware their own oscilloscope by changing components, let's say to make it "better"? Is it anything illegal in that? If not, then why would it be for the software change/hack when smart guys change some bits around instead of components?
Of course I understand that Keysight is upset because some technical guys outside of the company found their "little secret"  of certain Agilent/ Keysight oscilloscopes, but you should see it different. Maybe you just found a better way to improve your scope firmware security and why not, you may recruit your future development engineers from here.
I think many people will be happy if you can provide some answers to the questions above.

Isn't that what Daniel answered with his previous post already? He says that if one hacks his own scope that's "one thing" but if you are buying->hacking->selling to earn money on it, they (Keysight) will come after you...

[mikeselectricstuff]

If it's purely a hardware mod, and you are not attempting to pass something off as something it's not, then there is nothing they can do ( though the might still try intimidation tactics).
However in most cases it will also involve software, which may have various legal issues due to specific legislation, depending on what country you are in.

However the long term effect is that if it's seen as a problem, a manufacturer is more likely to make things harder to hack.

Flir have tried it, both stopping sales of hacked E4s, and making them harder to hack,  and failed on both counts. One aspect in that case is that no changes to the software were required, just enabling existing functionality. I doubt they'd want to test it in court due to the risk of setting a precedent if they lost.

[Jay_Diddy_B]

Hi group,

Take a look at this eBay item 172559013145

http://www.ebay.ca/itm/KEYSIGHT-Infiniivision-MSOX3034T-Mixed-signal-Oscilloscope-350Mhz-MEGA-ZOOM-/172559013145?hash=item282d519519:g:GqYAAOSwhlZYuQIj


I have good reason to believe that it has been 'hacked'.

Regards,

Jay_Diddy_B

(It may have been an extreme teardown)

[jjoonathan]

Looks like it MEGA ZOOMed straight into a brick wall!

[viki2000]

Maybe Keysight stepped in, too fast and...with their boots.

[Howardlong]

Looks like it may be a divorce scope, with the wife coming home to find her husband entertaining himself with the new model that he's spent her housekeeping on.

[viki2000]

Then for sure was a new married couple after honeymoon.
She is waiting for him in bed and he, a Keysight engineer working overtime home,  says: honey I just need a bit more time to fix the firmware for this lovely oscilloscope and I am coming.
 After few minutes she says: I am coming! So she stepped in…
In the end it seems was not the Keysight engineer who “stepped in”, but his wife…

[Pinkus]

My MSOX3024A with lots of options but all original = (still) unhacked & unmodified just showed an error message after switching it on (and it does again after another off-on cycle):
OS version is not correct. Please reload system firmware
What? Where does this come from? Corrupted flash memory? Shall I be worried?

I did not reinstall the firmware (currently running 2.39) yet.
May I ask the experts: shall I do any precautions or may I just reinstall 2.39?
Thanks

[TheSteve]

That sounds like it may be the beginning of the known flash corruption problem. I believe 2.39 may have been the first version where Keysight changed the boot process to make it more resistant to not booting at all when it occurs(we don't have all the details on what exactly they did).
The obvious answer is to reload firmware - but then there is a chance it might fail during the install depending on how the flash is managed etc and brick itself.
Hopefully Daniel from Keysight can offer his guidance here.

[pieterc]

Greetings everyone,

Thanks for sharing so freely! I've got an MSO-X 3014A with 02.41 FW and spent the whole of yesterday unsuccessfully trying to get the scope to boot from a USB stick (using infiniivisionStartupOverride.txt, modified infiniivision.lnk, infiniiVision directory extracted from _setup.xml, etc.). FYI, I do not have the LAN extension card, so I can't telnet. Would telnet still be a possibility with 02.41 FW?

After scanning through the posts, it seems that it can't be done with 02.41 FW (correct?). I must downgrade to 02.35 FW (correct?). It also looks like my efforts were academic anyway, because 02.41 FW does not have an "infiniiVisionCore.dll" file. To make matters worse, I do not have the 02.35 FW, only 02.12 and 02.41.

Probably not right to ask publicly (in fear of the hole being fixed so feel free to ignore), but has anyone had any success with 02.41 FW?

Anyway, thanks and good luck!

Regards,
Pieter

[MrBungle]

Take a look at this eBay item 172559013145
...
I have good reason to believe that it has been 'hacked'.
...
(It may have been an extreme teardown)

That's been under a car.
Rubber rash on the front, gravel/concrete rash on the back.
Ouch.

[Howardlong]

Greetings everyone,

Thanks for sharing so freely! I've got an MSO-X 3014A with 02.41 FW and spent the whole of yesterday unsuccessfully trying to get the scope to boot from a USB stick (using infiniivisionStartupOverride.txt, modified infiniivision.lnk, infiniiVision directory extracted from _setup.xml, etc.). FYI, I do not have the LAN extension card, so I can't telnet. Would telnet still be a possibility with 02.41 FW?

After scanning through the posts, it seems that it can't be done with 02.41 FW (correct?). I must downgrade to 02.35 FW (correct?). It also looks like my efforts were academic anyway, because 02.41 FW does not have an "infiniiVisionCore.dll" file. To make matters worse, I do not have the 02.35 FW, only 02.12 and 02.41.

Probably not right to ask publicly (in fear of the hole being fixed so feel free to ignore), but has anyone had any success with 02.41 FW?

Anyway, thanks and good luck!

Regards,
Pieter

I can't remember ever having any luck booting my MSOX3054A from a USB stick which is just over a year old, but I did try many times with various different USB sticks. I believe I came to the conclusion that you needed to be on an earlier firmware version to begin with to support USB boot.

Telnet through the LAN works a treat though.

[viki2000]

@pieterc
I tell you what I understood so far.
My firmware is 2.37. The scope works fine now, but has no special licenses.
I have tried several hours during several days to read this forum. It is not easy. It just make me the impression that I understood few things, but is not clear how shall I hack the scope to unlock all its features.
Even with 2.37 is hard with USB stick boot. My understanding is this: 2.37 can be hacked and I can have it in scope using USB stick method, if the scope was previous flashed with 2.35. But as it is now, flashed with 2.37 from factory,I definitely cannot do it only with USB stick method. I need the LAN card first.
In your case, with 2.39, is the same or even worse. You need the LAN card for sure.
It seems the best way for 2.37 and above is to upgrade to 2.41 and then to use the LAN card to unlock all the features. So, it makes no sense to search more for a method using USB stick only and having the scope with 2.39. Anyway, I will not try the USB method with 2.37. I will upgrade to 2.41 and then I will try the LAN card method suggested here in forum.
A new LAN card from Keysight is over 400€ because has this VGA output and because is the brand, the name. I hope everyone understands that at manufacturer factory site, somewhere in Taiwan, the same card costs at least 10 times less.
Then, the smart guys from here found an alternative, a cheap LAN card, no VGA, only few components and mostly tracks and it works for the purpose of communicating with the scope and unlock its features using telnet protocol. You may find here on forum some users that can sell you that cheap card at that low price of less than 10 times the LAN card from Keysight, which is a reasonable price when you think what you can do with it. There are also technical files, diagrams and Gerber files in case you want to make by yourself that cheap card.
I do not know what telnet software others use, I think I have read somewhere PuTTY mentioned (http://www.putty.org/ ), but here is a list with such free software:
https://sourceforge.net/directory/terminals/telnet/os:windows/
I used in the past for different purpose and I liked it the RealTerm.
Besides the telnet software you need some other programs around, just in case, as WinCE CAB Manager, because the scope has Windows CE as operating system. You may still need a USB stick around.
WinCE CAB Manager was discontinued by the manufacturer (OCP Software) but you can still find it on internet.
Maybe some alternatives work too, but not tried yet:
https://msdn.microsoft.com/en-us/library/aa448616.aspx
http://www.mobilepackager.com/
http://www.softpedia.com/get/Programming/Other-Programming-Files/Cab-O-Matic.shtml
http://www.hjgode.de/wp/2010/02/26/pocketpc-and-windowsce-essential-tools/
A suggestion to help reading the forum: as it is now, you read on pages and sometimes the posts have links that makes you jump back and forth, but if you want a flat read with search within all the pages then you just go on Print at the bottom of the page and you “print” it as pdf file. Then you have the entire discussion on your PC for further readings as pdf and maybe it is even easier to follow and search, except the links which will point always online.
I did not try any hack up to now, but I ordered a cheap LAN card.

[FrankBuss]

I have tried several hours during several days to read this forum. It is not easy. It just make me the impression that I understood few things, but is not clear how shall I hack the scope to unlock all its features.

Depending on your usual hourly rate, might be cheaper just to buy the licences you want, but of course not as much fun

[viki2000]

Frank, the guys from here do not want to buy the license, because is way too expensive and that's why they opened the thread, let's don't hide behind the finger and try to say the fun part, because is not, it makes you gray hair.
The fun part is that broken oscilloscope discussion above... for us, not for the owner.

[FrankBuss]

try to say the fun part, because is not, it makes you gray hair.

I guess I did look too much at ARM disassembly of C++ code of DLLs in IDA Pro, just look at my hair

[JPortici]

Hi group,

Take a look at this eBay item 172559013145

http://www.ebay.ca/itm/KEYSIGHT-Infiniivision-MSOX3034T-Mixed-signal-Oscilloscope-350Mhz-MEGA-ZOOM-/172559013145?hash=item282d519519:g:GqYAAOSwhlZYuQIj


I have good reason to believe that it has been 'hacked'.

Regards,

Jay_Diddy_B

(It may have been an extreme teardown)

look out for the wave SUFFER http://www.ebay.ca/itm/LeCroy-waveSuffer-434-350Mhz-Oscilloscope-Not-working/112325885768

[FrankBuss]

BTW, is there the source code for u-boot for the scopes somewhere? It is GPL code, so any modification (like how to access the flash, or interesting test commands) has to be made public with a description how to compile it (e.g. all configure settings), if someone asks nicely.

[PA0PBZ]

BTW, is there the source code for u-boot for the scopes somewhere?

I have it, I think for the 2000/3000X series. No idea how I got it and it's 55MB so a bit hard to attach.

[PioB]

BTW, is there the source code for u-boot for the scopes somewhere?

I have it, I think for the 2000/3000X series. No idea how I got it and it's 55MB so a bit hard to attach.

Dropbox or Google drive and share the link, please?

Sent from my SM-N9005 using Tapatalk

[PA0PBZ]

Dropbox or Google drive and share the link, please?

Here: https://www.dropbox.com/s/9w565yk5jn1p0er/Uboot_Source_2.4.14526.11931.zip?dl=0

[dr.Bar-Mental]

Hi guys, thank you for the such interesting topic.
I have learned a lot about my MSOX3024 scope and it convinced me to move forward with some improvements (you can call it hacks  ) to this beautiful machine.
As I work primarily on switch mode power supplies and have PWR license already the rest of "bells and whistles" is not quite exiting for me but what I personally miss is a battery option which is not available for X3000 series.

Today I have teared my scope apart and found that the battery option can be relatively easily implemented with no modification to the original design (just addition of battery module connections). Proper battery module has to be built, of course, and it would be no software support but scope can be used on the field, cope with power outages and (what is practically important to me) can be isolated from Earth allowing you to do floating measurements on live equipment (if you are trained to do so, of course).

Does any one here tried it already?

And may be Daniel will explain why Keysight abandoned this option for X-series? It cost almost nothing (at least for electrical part) to implement that option to existing design.