Author Topic: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?  (Read 1106855 times)

dimmog and 2 Guests are viewing this topic.

Offline tridentsx

  • Regular Contributor
  • *
  • Posts: 97
  • Country: us

Has anyone tested the hack with 2.42 f/w version ? I just got a DSO-X 2012A from Frys for a low cost. Would like to enhance its capabilities.
 
The following users thanked this post: Andrew

Offline kilobyte

  • Regular Contributor
  • *
  • Posts: 73
  • Country: de
    • My Website
I updated my scope to the 2.42 Firmware this week, because they now allow a probe attenuation down to 0.001 which is quite useful.

Telnet Login an the "\Secure\infiniiVision\infiniivisionLauncher.exe -l DIS -l MSO -l memMax -l MEMUP -l ADVMATH -l SGM -l SGMC -l AUTO -l COMP -l TOM -l EMBD -l VID -l COMP -l SCPIPS -l WAVEGEN -l MASK -l BW20" Hack still works on my scope.
 
The following users thanked this post: plesa, [IDC]Dragon, Andrew

Offline Neganur

  • Supporter
  • ****
  • Posts: 1138
  • Country: fi
Oh finally a lower multiplier, useful for items like amplifiers (think uCurrent). I still wish it would be arbitrary for odd divisions.
 
The following users thanked this post: Andrew

Offline MarkL

  • Supporter
  • ****
  • Posts: 2120
  • Country: us
Oh finally a lower multiplier, useful for items like amplifiers (think uCurrent). I still wish it would be arbitrary for odd divisions.
I think the range still needs to be larger in both directions.  0.001 seems arbitrary since all the scope is doing is helping with the math.  A Tek AM502 amplifier, for example, ranges up to x100k and would need 0.00001.

If it helps, non-decade values can be entered by switching the Probe Ratio units to Decibels and adjusting the dB.  You can probably get close to the ratio you want, and it nicely displays the ratio as you change the dB.

You can also enter an exact number via the SCPI command:

  CHANnel<n>:PROBe <ratio>

but the ratio is still limited to 0.001 - 10000.


In the same vein as an arbitrary ratio from the front panel, I've been asking for an error offset adjustment.  An error offset would be almost the same as the regular offset but it would not be included in the display offset, measurements, or math calculations.  It's primary use would be to zero out small offset errors at the input, such as from external active probes.

The uCurrent is a good example of where this would be used.  You could zero out any drift or offset right before you take a measurement.  Another use of this is to zero out short-term front end errors before making a particularly sensitive measurement, without having to sit through a full self-cal.

In general, a way to adjust the slope and intercept of inputs before any processing has been on my request list for a long time.  It's not rocket science for any DSO/MSO manufacturer.  I don't know why it's not standard.

EDIT: That last statement was a little ambiguous.  What I'm saying is that I think there needs to be a way to define: 1) an arbitrary input multiplication factor and, 2) what input voltage level that scope should use as zero.

« Last Edit: April 08, 2017, 02:18:41 pm by MarkL »
 
The following users thanked this post: Andrew

Offline Sbampato12

  • Regular Contributor
  • *
  • Posts: 221
  • Country: it
I updated my scope to the 2.42 Firmware this week, because they now allow a probe attenuation down to 0.001 which is quite useful.

Telnet Login an the "\Secure\infiniiVision\infiniivisionLauncher.exe -l DIS -l MSO -l memMax -l MEMUP -l ADVMATH -l SGM -l SGMC -l AUTO -l COMP -l TOM -l EMBD -l VID -l COMP -l SCPIPS -l WAVEGEN -l MASK -l BW20" Hack still works on my scope.

But you still needing to alter the hex info on dll file, or just add these options on the command line?
 
The following users thanked this post: Andrew

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3743
  • Country: ca
  • Living the Dream
I updated my scope to the 2.42 Firmware this week, because they now allow a probe attenuation down to 0.001 which is quite useful.

Telnet Login an the "\Secure\infiniiVision\infiniivisionLauncher.exe -l DIS -l MSO -l memMax -l MEMUP -l ADVMATH -l SGM -l SGMC -l AUTO -l COMP -l TOM -l EMBD -l VID -l COMP -l SCPIPS -l WAVEGEN -l MASK -l BW20" Hack still works on my scope.

But you still needing to alter the hex info on dll file, or just add these options on the command line?

For the basic hack just add the options at the command line.
VE7FM
 
The following users thanked this post: Andrew

Offline Sbampato12

  • Regular Contributor
  • *
  • Posts: 221
  • Country: it
I've missed that info somewhere.

I thought it was necessary to change the dll file on every case.

Will try it this week.  :-+
 
The following users thanked this post: Andrew

Offline TopLoser

  • Supporter
  • ****
  • Posts: 1922
  • Country: fr
Won't work on T series though
 
The following users thanked this post: Andrew

Offline Sbampato12

  • Regular Contributor
  • *
  • Posts: 221
  • Country: it
Won't work on T series though
Mine is an A model (I have an 2002A and a 3014A), but the 3014 have the bundle... And I've been using the 2002A just a little, but this weekend It showed when booting, that the firmware has some kind of problem.... Maybe I finally will discover how is the warranties service around here...

(PS: it was not changed firmware, I occasionally boot with a usb stick, so this problem is not correlated)
 
The following users thanked this post: Andrew

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3743
  • Country: ca
  • Living the Dream
Won't work on T series though
Mine is an A model (I have an 2002A and a 3014A), but the 3014 have the bundle... And I've been using the 2002A just a little, but this weekend It showed when booting, that the firmware has some kind of problem.... Maybe I finally will discover how is the warranties service around here...

(PS: it was not changed firmware, I occasionally boot with a usb stick, so this problem is not correlated)

Well if you're booting with a USB drive that means you have older firmware(probably 2.35). Staying with the older firmware increases the odds of having a flash problem. I believe it is firmware 2.40 and newer that helps prevent/recover from the flash corruption issue so hack or not I recommend updating all scopes.
VE7FM
 
The following users thanked this post: Andrew

Offline dotto

  • Newbie
  • Posts: 8
  • Country: br
I have a DSOX3024A and I'm looking for links to download firmware v2.35 from DSOX3000 series but most of them don't work.... Anybody  has a valid link to download old firmware (2.35) from DSOX3000 series?? On the website from Keysight the current version is 2.42... Could I do downgrade from 2.42 to 2.35 and hack the firmware like 2.37, 2.38 and 2.39 version? Does it works?
Sorry for my English...
 
The following users thanked this post: adranp, Andrew

Offline kada

  • Contributor
  • Posts: 31
  • Country: ie
« Last Edit: October 25, 2022, 10:16:19 pm by kada »
 
The following users thanked this post: albertr, Andrew, salvagedcircuitry, f14

Offline Luminax

  • Regular Contributor
  • *
  • Posts: 159
  • Country: my
    • Electronesk
I'm on 2.41 with 'hacked' firmware, meaning I have MSOX capabilities, and the lots (EMBD, AUTO, COMP, SGM, MASK etc etc).
Curious as to what's considered 'hacked' since I was just using someone's shortcut loader with modified startup parameter...
Haven't been reading this thread in a while, anyone keeping tracks of all the goodies?
Jack of all trade - Master of some... I hope...
 
The following users thanked this post: Andrew

Offline ogoun

  • Contributor
  • Posts: 25
Now if only someone would do that for the 4000 series :)

Untouched firmwares:
2.35
2.37
2.39
2.41
2.42
 
The following users thanked this post: Andrew

Offline Sany1984

  • Newbie
  • Posts: 8
  • Country: de
Hello Volks,

I want to use the USB Method with the USB.zip with my EDUX1002A.
My Problem is ( USB Stick 4 GB) when the Osci is Starting up with Stick, he hangs up:

Code: [Select]
U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  internal ecc 128 MiB

Debug serial initialized ........OK
RTC: 2024-17-4   5:84:14.2 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built May  7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008

PHY not found.

System ready!
Preparing for download...
RTC: 2024-17-4   5:84:14.2 UTC
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXOOOOOOOOOXOOOOXOXXOXOXXOXOXOXOXXXXOOXXXOOOOOOXXOXXOXXXXXXOOOXXXOXXOOOXXXOXXOOOOXOOXXOOOXOOOOXOXOOOOOXOOOXOOXOXXOXOXXXXXXOXXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOXX
OOOXOOXOOOOXOOOOXOOXXOOXOOOOOOOOOXOOOOXOOOOOOXOXOOOOXOXOOOOOOOXXOOXOOXOXOOOXOOOXOOXXOXOXOOOXOXXXXXOXOXXXOXXXXOXOXXOOOXXXXOXXXXOXXXXXXXOXXXXXXOXXOXXOXXOOXXOXXXOXXXXOOOXXX
OOOXXXOXXOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXXXXOOOXOXOOXOOXXXXXXXXXXXXXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x1A80C40, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x1A80C40  Name="" Target=RAM
 Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
RTC: 2024-17-4   5:84:14.5 UTC
Launching windows CE image by jumping at address 0x  362000

Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Sep 28 2016)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
LAN PHY NOT detected.
DeleteP500EnetRegistry:
   \Comm\GMAC 0x0
   \Comm\GMAC1 0x0
   \Comm\Tcpip\Linkage 0x0
   \Drivers\Virtual 0x0
   \Drivers\BuiltIn\LIN 0x5
LIN: Data Valid
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Device load time:
   NANDFLASH: 0 ms
   SNANDFLASH: 0 ms
   USB Hard Disk Drive: 0 ms

i wait for 60 seconds, and the device is rebooting again....
my cmd file:

Code: [Select]
dir \ > \usb\root.txt

can any one help me?
 
The following users thanked this post: Andrew

Offline TK

  • Super Contributor
  • ***
  • Posts: 1722
  • Country: us
  • I am a Systems Analyst who plays with Electronics
I am not sure if current EDUX firmware supports booting from USB
 
The following users thanked this post: Andrew

Offline Luminax

  • Regular Contributor
  • *
  • Posts: 159
  • Country: my
    • Electronesk
Does the 2000-X method of Firmware overload not working on EDUX1002A? hmmm...
My method, courtesy of someone whose name I can't remember right now from quite some post back, is to copy :

v241_link_install.cab
v241_link_uninstall.cab
infiniivision.lnk

to my USB drive after modifying infiniivision.lnk to suit my purpose.
On the scope after it loads, I go to Utility->File Explorer and browse to the USB stick then load the install cab.
Jack of all trade - Master of some... I hope...
 
The following users thanked this post: Andrew

Offline TK

  • Super Contributor
  • ***
  • Posts: 1722
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Does the 2000-X method of Firmware overload not working on EDUX1002A? hmmm...
My method, courtesy of someone whose name I can't remember right now from quite some post back, is to copy :

v241_link_install.cab
v241_link_uninstall.cab
infiniivision.lnk

to my USB drive after modifying infiniivision.lnk to suit my purpose.
On the scope after it loads, I go to Utility->File Explorer and browse to the USB stick then load the install cab.
This method can brick the scope if it does not like the content of infiniivision.lnk and it has no LAN port to bring it back to life.  Has anyone tried it?
« Last Edit: April 13, 2017, 01:50:38 pm by TK »
 
The following users thanked this post: Andrew

Offline Sany1984

  • Newbie
  • Posts: 8
  • Country: de
Hello,

The EDUX1002A has the Same Firmware as the DSOX1102A/DSOX1102G...

Daves Firmware has the Version 01.01.2016092800, with Licenses: All, EMBD*, AUTO*,SGM,MASK,BW10,EDK,WAVEGEN,DiS*,DVM*,RML.

My EDUX1002A has the Same Firmware: 01.01.2016092800 with Licenses: EDK, RML.
The Mainboard and BT Module is originally the Same...
And the Boot Procedure is only the Same, with the DSOX, only the Product Configuration is different, and the installed licenses....
 
The following users thanked this post: Andrew

Offline TK

  • Super Contributor
  • ***
  • Posts: 1722
  • Country: us
  • I am a Systems Analyst who plays with Electronics
The Mainboard and BT Module is originally the Same...
The EDUX and DSOX mainboards are different (same PCB, but different/missing/additional components)
 
The following users thanked this post: Andrew

Offline TK

  • Super Contributor
  • ***
  • Posts: 1722
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Hello,

The EDUX1002A has the Same Firmware as the DSOX1102A/DSOX1102G...

Daves Firmware has the Version 01.01.2016092800, with Licenses: All, EMBD*, AUTO*,SGM,MASK,BW10,EDK,WAVEGEN,DiS*,DVM*,RML.

My EDUX1002A has the Same Firmware: 01.01.2016092800 with Licenses: EDK, RML.
The Mainboard and BT Module is originally the Same...
And the Boot Procedure is only the Same, with the DSOX, only the Product Configuration is different, and the installed licenses....
I suggest moving this discussion about 1000X series here: https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/
 
The following users thanked this post: Andrew

Offline bitbanger

  • Regular Contributor
  • *
  • Posts: 161
Anyone in need of a DSOXLAN module? I spun off some PCBs but no need for the extra two (and only two) from the min 3 order. Fully assembled/tested/with mounting hardware. PM if interested.

Thank you to all the contributors - 2.41 via telnet works well.
 
The following users thanked this post: Andrew

Offline yelong98

  • Newbie
  • Posts: 6
  • Country: cn
can anyone hack DSOX2002A V2.41 without LAN card ? i took a lot time to find the clue but you know this thread is so long
BD7JAT This's alway something worth for fightting!
DS1054Z DSOX2002A TO1074
 
The following users thanked this post: Andrew

Offline yelong98

  • Newbie
  • Posts: 6
  • Country: cn
Thanks to all the contributors ,at lest we can hack high version with a LAN card
BD7JAT This's alway something worth for fightting!
DS1054Z DSOX2002A TO1074
 
The following users thanked this post: Andrew

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3743
  • Country: ca
  • Living the Dream
Version 2.4x can be hacked without a lan card - but it has bricked several scopes. It was possible to recover them but it is quite the process. If people are going to hack their version 2.4x scope please only do it via a lan card.
VE7FM
 
The following users thanked this post: Andrew


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf