Author Topic: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?  (Read 1106966 times)

0 Members and 2 Guests are viewing this topic.

Offline jasonbrent

  • Regular Contributor
  • *
  • Posts: 176
Ended up ordering a DSOX3014T+DSOXLAN and picked up a N6450-60001 from rebay, new. Now, I wait for Agilent^WKeysight to ship.. they estimate April(!@#!@#) currently. What's really insane is they let me trade in my dslogic/oscilloscope combo that I backed via kickstarter and never used to get 30% off. =)
 

Offline JonM

  • Supporter
  • ****
  • Posts: 158
  • Country: us
Ended up ordering a DSOX3014T+DSOXLAN and picked up a N6450-60001 from rebay, new. Now, I wait for Agilent^WKeysight to ship.. they estimate April(!@#!@#) currently. What's really insane is they let me trade in my dslogic/oscilloscope combo that I backed via kickstarter and never used to get 30% off. =)

That is a wonderful trade-in! I traded in a pristine Agilent scope for a DSOX3024T about 18 months ago. They asked a lot of questions about the scope and wanted to be sure that it was working. Supposedly someone was going to pick up the Agilent scope from me but then they asked me to ship it from New Jersey to California. Luckily I got the distributor to pay the $150 shipping cost, but I pad FedEx about $30 for the packing.

Of course I was worried that something would go wrong in shipping, so I took photos  of the scope running next to the the current day's New York Times front page. I did not want to get a bill from Keysight for $1400! Apparently it arrived OK, I never heard from them.

In any case, I 'm surprised that a "non-top tier" scope would get the 30% discount since the offer says "up to 30%". When I did my trade-in there was also a free MSO option but they would not allow the offers to be combined.
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3743
  • Country: ca
  • Living the Dream
Ended up ordering a DSOX3014T+DSOXLAN and picked up a N6450-60001 from rebay, new. Now, I wait for Agilent^WKeysight to ship.. they estimate April(!@#!@#) currently. What's really insane is they let me trade in my dslogic/oscilloscope combo that I backed via kickstarter and never used to get 30% off. =)

You will find it a joy to use!
VE7FM
 
The following users thanked this post: jasonbrent

Offline jasonbrent

  • Regular Contributor
  • *
  • Posts: 176

That is a wonderful trade-in! I traded in a pristine Agilent scope for a DSOX3024T about 18 months ago. They asked a lot of questions about the scope and wanted to be sure that it was working. Supposedly someone was going to pick up the Agilent scope from me but then they asked me to ship it from New Jersey to California. Luckily I got the distributor to pay the $150 shipping cost, but I pad FedEx about $30 for the packing.

Of course I was worried that something would go wrong in shipping, so I took photos  of the scope running next to the the current day's New York Times front page. I did not want to get a bill from Keysight for $1400! Apparently it arrived OK, I never heard from them.

In any case, I 'm surprised that a "non-top tier" scope would get the 30% discount since the offer says "up to 30%". When I did my trade-in there was also a free MSO option but they would not allow the offers to be combined.

Indeed, I was surprised and this may be a one-off! It took a few days for them to approve it... their T&Cs for the trade in didn't suggest there were any limits other than certain frequency for frequency bands. i.e., 0-100Mhz could get 0-100Mhz at 30%, but 0-100Mhz for 1Ghz would get 5%. I offered up 3 possible trades in preference of dslogic/rigol1052e/rigol1054z. Once I submitted, however, I was informed that none were on their list of scopes and would be handled as a "custom trade in". Took about 2 days to get an approved response and they'd accepted the dslogic; no further questions were asked about it.

Heck, if they had said the 1052e, I was going to just buy a new one to trade in since I don't have my old one anymore, lol!

Now, the wait. I'm hoping they beat the heck out of their 1+ month lead time estimate.

-j


 

Offline EE-digger

  • Frequent Contributor
  • **
  • Posts: 333
  • Country: us
I got sales order acknowledge just before Christmas week, shipped 10 days later (Fedex received in MY), arrived the next evening !   From MY to Northeast US.
 

Offline corn11

  • Regular Contributor
  • *
  • Posts: 69
  • Country: de
Hi,

concerning the hack for 2.42/2.43:
Does anyone knows if it's possible to use the modded nk.bin (modding just the specific locations through searching for a unique data string around the locs and identintifying them in the nk.bin) without changing the checksum of the infiniiVisionCore.dll contained in the nk.bin file ? I'm asking because I only have the binmod tool version with the known extraction bug so I can't get the modified dll back into the nk.bin file and I haven't managed to find the plattform builder tools eval version online so I can't fix binmod myself.

Thank you in advance ! :)
« Last Edit: March 13, 2018, 07:22:31 am by corn11 »
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3743
  • Country: ca
  • Living the Dream
Keysight just listed a DSOX3024T for 40% off on the ebay store(and you can make an offer) for anyone who might be looking for one.
VE7FM
 

Offline rhythmp

  • Newbie
  • Posts: 5
  • Country: us
Thanks for the info!
Could you also show us the checksum patch?

FYI:

The patch locations for firmware 2.43:



Code: [Select]
1) options patch:  0x280940:  change "04 00 A0 E1" -> "00 00 A0 E3"
2) nag patch:       0x2a9f38:   change "66 5A FF EB" -> "01 00 A0 E3"
 

Offline Vespian

  • Newbie
  • Posts: 3
  • Country: us
I assume that in order to telnet into my MSOX-2024A I have to have the LAN module? Is that correct, or can you get COM port functionality out of one of these USB ports?
 

Offline PhillyFlyers

  • Contributor
  • Posts: 31
  • Country: us
Thanks for the info!
Could you also show us the checksum patch?

FYI:

The patch locations for firmware 2.43:



Code: [Select]
1) options patch:  0x280940:  change "04 00 A0 E1" -> "00 00 A0 E3"
2) nag patch:       0x2a9f38:   change "66 5A FF EB" -> "01 00 A0 E3"


So, doing these patches for 2.42 and above, requires going through a bunch of steps, which you really just need to walk through yourself, to see how it all works, versus writing up an entire novel on here trying to explain it...

You need to follow the steps for unpacking the firmware file, de-compressing the 'nk.bin'  WindowsCE image, and locating the DLL within that image, you can just find it by using a hex editor, etc, and finding hex patterns...

As safar explained, the 'nk.bin' has checksums for blocks of data, so when you apply the patches into the DLL spots within the nk.bin (decompressed), you need to also fix the checksum for that block.  It's a standard 'checksum' algorithm, using single byte as input data (ie versus 16-bit, 32-bit etc 'symbols' for checksum), ie in Safar's post he called it 'UByte8Bit', as other programs tend to say that as well..


A trial one I found that makes it easy is the '010 Editor', it does that checksum calc, as well as many others..

If I were you, I'd download the 2.42 firmware, unpack it, and follow the info that Safar mention in his post... once you can understand what he did, and the locations he patched, you can do it to 2.43 as well....


Quote
Hi,

I maked patch for infiniiVisionCore.dll directly in nk.bin in v2.42 (2017032900) FW for DSOX3000A. There 4 bytes for patch "04 00 a0 e1" to "00 00 a0 e3" in start address FBC7FFh and checksum in address D40457h changed from "EB" to "E9". Actually checksum contain 4 bytes, but changed only this last byte (first in file as it's little endian). Checksum algorithm is UByte8bit.

infiniiVisionCore.dll placed in Record [164]: Start in memory = 81111000h, Length = 55D528h, Chksum  of original nk.bin = 2604E8EBh
In nk.bin file this block started in D4045Bh and ended in 129D982h

Then nk.bin compressed by bincompress
Code: [Select]

bincompress.exe /c patched_nk.bin patched_nk.bin.comp

And flash it by loadP500Flash via telnet in scope
Code: [Select]

\windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp


Think that replace nk.bin.comp in CAB file (with original name of course) should work also, but didn't try.

After this mod scope work normally and LAN also. I just make this start link in \secure\startup
Code: [Select]

211#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC


Don't included EDK and DVM as it is standard options in 2.42

Of course scope indicate that this FW is Ufinalized

Thanks laserK and Elik for advices.
 
The following users thanked this post: Sparky, corn11, rhythmp

Offline Safar

  • Regular Contributor
  • *
  • Posts: 119
  • Country: ru
I make patched.bin.comp with PhillyFlyers info and with corrected checksum:

Patched2.43

MD5 of file for check: 1CA34A1B837B075133BE53B379749BBB

You can flash it as usual by loadP500Flash via telnet in scope
Code: [Select]
\windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp

Checked on my DSOX3034A

FYI:

The patch locations for firmware 2.43:

Code: [Select]
1) options patch:  0x280940:  change "04 00 A0 E1" -> "00 00 A0 E3"
2) nag patch:       0x2a9f38:   change "66 5A FF EB" -> "01 00 A0 E3"
« Last Edit: March 16, 2018, 06:30:04 pm by Safar »
 
The following users thanked this post: Sparky, cyr, [IDC]Dragon, rhythmp, lzqing

Offline Safar

  • Regular Contributor
  • *
  • Posts: 119
  • Country: ru

So, doing these patches for 2.42 and above, requires going through a bunch of steps, which you really just need to walk through yourself, to see how it all works, versus writing up an entire novel on here trying to explain it...

You need to follow the steps for unpacking the firmware file, de-compressing the 'nk.bin'  WindowsCE image, and locating the DLL within that image, you can just find it by using a hex editor, etc, and finding hex patterns...

As safar explained, the 'nk.bin' has checksums for blocks of data, so when you apply the patches into the DLL spots within the nk.bin (decompressed), you need to also fix the checksum for that block.  It's a standard 'checksum' algorithm, using single byte as input data (ie versus 16-bit, 32-bit etc 'symbols' for checksum), ie in Safar's post he called it 'UByte8Bit', as other programs tend to say that as well..


A trial one I found that makes it easy is the '010 Editor', it does that checksum calc, as well as many others..

If I were you, I'd download the 2.42 firmware, unpack it, and follow the info that Safar mention in his post... once you can understand what he did, and the locations he patched, you can do it to 2.43 as well....


Hi, yes I use IDA for find code and 010 Editor for patch.

I try to explain algorithm (with all steps as it can used by somebody else):
1. Get nk.bin.comp from FW file (ksx = cab) - I use WinRAR, but many arc programs can extract files from CAB.
2. Decompress nk.bin.comp by "bincompress.exe /d nk.bin.comp nk.bin".
3. Extract infiniiVisionCore.dll with Remaker for WinCE5.
4. Open dll in IDA and find asm code for patch - Sorry, but I don't explain how as it need to write lot info here.
5. With sync screens in HexView of IDA I look for patch hex code and for nearest area "signature" code also for find it in nk.bin (12..20 bytes for unique found result).
6. (As I lazy for remember bin structure I just to) Make DataTable with "viewbin.exe -d nk.bin > data.txt" - beware output file is very big - about 113 MB for 2.43.
7. Open nk.bin in Hex Editor and use "signature" code for find patch place (actually I use "find all" and if here is more than 1 result I try to expand "signature" for search).
8. Make patch in this place.
9. Open data.txt and find same "signature" - you found it in some Record [  ] block ([160] for 2.43). Here we need start Record signature for find it in Hex Editor, Record Length And Checksum (checksum is backwards in file as it LittleEndian code). Of course you can look for bin structure and make it more smart.
10. Find Record start signature - 4 bytes before start position is Checksum - compare it with data.txt (remember for back order). Here I bookmarked position.
11. Select block in editor with start on start Record position and Length from data.txt.
12. Calc checksum UByte8Bit.
13. Turn back to bookmark and correct checksum (4 bytes before start, and remember for back order).
14. Save as patched_nk.bin.
15. Compress it to nk.bin.comp by "bincompress.exe /c nk.bin nk.bin.comp".
16. Flash scope, but kill infiniiVision process before.
17. Reboot scope.

I attach all tools here
« Last Edit: March 16, 2018, 03:23:41 pm by Safar »
 
The following users thanked this post: albertr, Sparky, daflory, corn11, JeffreyLatter, rhythmp, salvagedcircuitry, SUKA_KRYSA

Offline PhillyFlyers

  • Contributor
  • Posts: 31
  • Country: us

So, doing these patches for 2.42 and above, requires going through a bunch of steps, which you really just need to walk through yourself, to see how it all works, versus writing up an entire novel on here trying to explain it...

You need to follow the steps for unpacking the firmware file, de-compressing the 'nk.bin'  WindowsCE image, and locating the DLL within that image, you can just find it by using a hex editor, etc, and finding hex patterns...

As safar explained, the 'nk.bin' has checksums for blocks of data, so when you apply the patches into the DLL spots within the nk.bin (decompressed), you need to also fix the checksum for that block.  It's a standard 'checksum' algorithm, using single byte as input data (ie versus 16-bit, 32-bit etc 'symbols' for checksum), ie in Safar's post he called it 'UByte8Bit', as other programs tend to say that as well..


A trial one I found that makes it easy is the '010 Editor', it does that checksum calc, as well as many others..

If I were you, I'd download the 2.42 firmware, unpack it, and follow the info that Safar mention in his post... once you can understand what he did, and the locations he patched, you can do it to 2.43 as well....


Hi, yes I use IDA for find code and 010 Editor for patch.

I try to explain algorithm (with all steps as it can used by somebody else):
1. Get nk.bin.comp from FW files (ksx = cab) - I use WinRAR, but many arc programs can extract files from CAB
2. Decompress nk.bin.comp by "bincompress.exe /d nk.bin.comp nk.bin"
3. Extract infiniiVisionCore.dll with Remaker for WinCE5
4. Found code in IDA - Sorry, but I don't explain how as it need to write lot info here
5. With sync screens in IDA I look for patch hex code and for nearest area "signature" code also for find it in nk.bin (12..20 bytes for unique found result)
6. (As I lazy for remember bin structure I just to) Make DataTable with "viewbin.exe -d nk.bin > data.txt" - beware file is very big - about 113 MB for 2.43
7. Open nk.bin in Hex Editor and use "signature" code for found patch place (actually I use "find all" and if here is more than 1 result I try to expand "signature" for search)
8. Make patch in this place.
9. Open data.txt and find same "signature" - you found it in some Record [  ] block ([160] for 2.43). Here we need start Record signature for find it in Hex Editor, Record Length And Checksum (checksum is backwards in file as it LittleEndian code). Of course you can look for bin structure and make it more smart.
10. Find Record start signature - 4 bytes before start position is Checksum - compare it with data.txt. Here I bookmarked position.
11. Select block in editor with start on start Record position and Length from data.txt.
12. Calc checksum UByte8Bit
13. Turn back to bookmark and correct checksum (4 bytes before start, and remember for back order)
14. Save patched_nk.bin
15. Compress it to nk.bin.comp by "bincompress.exe /c nk.bin nk.bin.comp"
16. Flash scope, but kill process before

I attach all tools here

Nice Safar!  Great writeup, that's an awesome (and fast) writeup!
 

Offline PhillyFlyers

  • Contributor
  • Posts: 31
  • Country: us
Quote

I make patched.bin.comp with PhillyFlyers info and with corrected checksum:

Patched2.43

You can flash it as usual by loadP500Flash via telnet in scope
Code: [Select]

\windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp


Checked on my DSOX3034A


*** FYI ****

The file you posted is the 'uncompressed' and patched nk.bin, so make sure anyone, you do the

'bincompress /d patched_nk.bin patched_nk.bin.comp'  first!!  as you don't want to flash the uncompressed image, the scope will not boot...

************
 
The following users thanked this post: Safar

Offline Safar

  • Regular Contributor
  • *
  • Posts: 119
  • Country: ru
Quote

I make patched.bin.comp with PhillyFlyers info and with corrected checksum:

Patched2.43

You can flash it as usual by loadP500Flash via telnet in scope
Code: [Select]

\windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp


Checked on my DSOX3034A


*** FYI ****

The file you posted is the 'uncompressed' and patched nk.bin, so make sure anyone, you do the

'bincompress /d patched_nk.bin patched_nk.bin.comp'  first!!  as you don't want to flash the uncompressed image, the scope will not boot...

************

Ohhh, sorry, I will change it
 

Offline Safar

  • Regular Contributor
  • *
  • Posts: 119
  • Country: ru

Nice Safar!  Great writeup, that's an awesome (and fast) writeup!

U Welcome!

BTW, I try to find some points in IDA for patch message "LAN VGA option module fault", but it seems like one subroutine which select all "System concerns detected" error messages from different enter points. It difficult to understand source for me without real debugger.
 

Offline rstoer

  • Regular Contributor
  • *
  • Posts: 73
  • Country: us
This post is not about a hack so I hope this is the right thread but this is where I learned of the DSOX2PLUS option for the X2000 series scopes and I don’t see it mentioned elsewhere...
I recently installed the DSOX2PLUS upgrade on my Keysight MSOX2024A. I purchased it from Test Equity who as of this date are the only ones listing it on their website. I did get a 10% discount by asking for a quote so it wound up costing $225.00 + tax, which I have to say is quite a bargain (not as cheap as hacking but Keysight has treated me well in the past and I wanted to keep my scope legit).
 
Results: Unfortunately I didn’t check my waveform count before the upgrade but I’ll take them at their word that it topped out at about 50,000 wf/sec. It now tops out at about 250,000 wf/sec (even better than the claimed 200k). But the real reason I ordered it was for the extra trigger options as that’s what has bothered me the most about this scope since I’ve owned it. Five hundred dollar Chinese scopes had more extensive triggering options. That is now fixed! The menu options went from 5 to 12. Math options increased from 5 to 21! (see the  photos for details). The upgrade also is supposed to include the record memory upgrade (to 1 Meg) and the segmented memory option. I already had these but I don’t feel cheated as the features I got are well worth the money spent.
For me, this is like having a new scope. Thanks Keysight!
« Last Edit: March 16, 2018, 02:48:08 am by rstoer »
 

Offline rstoer

  • Regular Contributor
  • *
  • Posts: 73
  • Country: us
Here's the changes to the Math Menu after the DSOX2PLUS upgrade...
 

Offline Vespian

  • Newbie
  • Posts: 3
  • Country: us
Thanks for posting these photos about the upgrade. I learned about that PLUS upgrade from this thread as well. I saw references to it in the PDF manual, but I couldn't find it as an available option to upgrade on Keysight's website.  :wtf:

I was getting quite frustrated that I couldn't find the integration functionality in the math menu. The manual goes over how to use it, and I didn't see that it required an activated option to use.

 

Offline Safar

  • Regular Contributor
  • *
  • Posts: 119
  • Country: ru
For DSOX2PLUS use option -l PLUS.

List of all 2.43 keys in attachment.

Almost all of these was early documented in this topic (1, 2) but question for me is option FWD with lic name "F8AEAE82"
 

Offline Pinkus

  • Frequent Contributor
  • **
  • Posts: 768

Nice Safar!  Great writeup, that's an awesome (and fast) writeup!

U Welcome!

BTW, I try to find some points in IDA for patch message "LAN VGA option module fault", but it seems like one subroutine which select all "System concerns detected" error messages from different enter points. It difficult to understand source for me without real debugger.
I am wondering: if these files were patched wrong, will the scope still start up (at least to allow the telnet access)?`
 

Offline Safar

  • Regular Contributor
  • *
  • Posts: 119
  • Country: ru

I am wondering: if these files were patched wrong, will the scope still start up (at least to allow the telnet access)?`


I test it before on my scope, but on your question - think it depend of patch place. If patched wrong some OS kernel modules (it will possible by mistake as from 2.42 we need to patch in nk.bin directly) it will be problem, but this DLL patch not influenced on telnet functionality even if it wrong. Think infiniivision app just hung. Anyway you can use bootloader (you need RS232 terminal connection on PCB) for load correct NK.bin via TFTP.

But problem may be if scope will reboot immediately after App hung. Sometime ago I get this case. Even reflashing via uBoot do not fix problem. But fortunately infiniivision app loads last and network connection (telnet) appeared on several seconds and I wrote macros for TeraTerm for fix it.

But just in case MD5 of patched nk.bin.comp from 2.43: 1CA34A1B837B075133BE53B379749BBB
 

Offline corn11

  • Regular Contributor
  • *
  • Posts: 69
  • Country: de

So, doing these patches for 2.42 and above, requires going through a bunch of steps, which you really just need to walk through yourself, to see how it all works, versus writing up an entire novel on here trying to explain it...

You need to follow the steps for unpacking the firmware file, de-compressing the 'nk.bin'  WindowsCE image, and locating the DLL within that image, you can just find it by using a hex editor, etc, and finding hex patterns...

As safar explained, the 'nk.bin' has checksums for blocks of data, so when you apply the patches into the DLL spots within the nk.bin (decompressed), you need to also fix the checksum for that block.  It's a standard 'checksum' algorithm, using single byte as input data (ie versus 16-bit, 32-bit etc 'symbols' for checksum), ie in Safar's post he called it 'UByte8Bit', as other programs tend to say that as well..


A trial one I found that makes it easy is the '010 Editor', it does that checksum calc, as well as many others..

If I were you, I'd download the 2.42 firmware, unpack it, and follow the info that Safar mention in his post... once you can understand what he did, and the locations he patched, you can do it to 2.43 as well....


Hi, yes I use IDA for find code and 010 Editor for patch.

I try to explain algorithm (with all steps as it can used by somebody else):
1. Get nk.bin.comp from FW file (ksx = cab) - I use WinRAR, but many arc programs can extract files from CAB.
2. Decompress nk.bin.comp by "bincompress.exe /d nk.bin.comp nk.bin".
3. Extract infiniiVisionCore.dll with Remaker for WinCE5.
4. Open dll in IDA and find asm code for patch - Sorry, but I don't explain how as it need to write lot info here.
5. With sync screens in HexView of IDA I look for patch hex code and for nearest area "signature" code also for find it in nk.bin (12..20 bytes for unique found result).
6. (As I lazy for remember bin structure I just to) Make DataTable with "viewbin.exe -d nk.bin > data.txt" - beware output file is very big - about 113 MB for 2.43.
7. Open nk.bin in Hex Editor and use "signature" code for find patch place (actually I use "find all" and if here is more than 1 result I try to expand "signature" for search).
8. Make patch in this place.
9. Open data.txt and find same "signature" - you found it in some Record [  ] block ([160] for 2.43). Here we need start Record signature for find it in Hex Editor, Record Length And Checksum (checksum is backwards in file as it LittleEndian code). Of course you can look for bin structure and make it more smart.
10. Find Record start signature - 4 bytes before start position is Checksum - compare it with data.txt (remember for back order). Here I bookmarked position.
11. Select block in editor with start on start Record position and Length from data.txt.
12. Calc checksum UByte8Bit.
13. Turn back to bookmark and correct checksum (4 bytes before start, and remember for back order).
14. Save as patched_nk.bin.
15. Compress it to nk.bin.comp by "bincompress.exe /c nk.bin nk.bin.comp".
16. Flash scope, but kill infiniiVision process before.
17. Reboot scope.

I attach all tools here


Thank you very much @Safar and @PhillyFlyers for your awesome work!   :-+

I've went through the patch process myself according to your guide and got the same file (SHA1 hashed).

Flashed the ceimage1, adjusted the lnk-file and now it works on my DSOX2004A!   :)

Just in case someone is intrested my lnk-file for the DSOX2k :
Code: [Select]
88#infiniivisionLauncher.exe -l MSO -l BW20 -l DIS -l PLUS -l SCPIPS -l VID -l CABLE --perf
Based on the function names, which can be found in the .dll, those arguments should enable all options which currently work on the DSOX2k.

 
The following users thanked this post: daflory, 77Ribetts

Offline grenert

  • Frequent Contributor
  • **
  • Posts: 448
But the real reason I ordered it was for the extra trigger options as that’s what has bothered me the most about this scope since I’ve owned it. Five hundred dollar Chinese scopes had more extensive triggering options. That is now fixed! The menu options went from 5 to 12. Math options increased from 5 to 21! (see the  photos for details). The upgrade also is supposed to include the record memory upgrade (to 1 Meg) and the segmented memory option. I already had these but I don’t feel cheated as the features I got are well worth the money spent.
For me, this is like having a new scope. Thanks Keysight!


Yes, I totally agree.  For only $250 (didn't think to ask for a quote) I feel like I got what I most wanted from the 3000 series, which cost so much more when I bought my scope.  I also paid twice for the memory upgrade, but not too bad considering I had the extra benefit of it for a few years.  Pretty good deal without doing scope brain surgery!
 

Offline georges80

  • Frequent Contributor
  • **
  • Posts: 912
  • Country: us
Quote

I make patched.bin.comp with PhillyFlyers info and with corrected checksum:

Patched2.43

You can flash it as usual by loadP500Flash via telnet in scope
Code: [Select]

\windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp


Checked on my DSOX3034A


*** FYI ****

The file you posted is the 'uncompressed' and patched nk.bin, so make sure anyone, you do the

'bincompress /d patched_nk.bin patched_nk.bin.comp'  first!!  as you don't want to flash the uncompressed image, the scope will not boot...

************

Ohhh, sorry, I will change it

Ok, so I assume the minimal steps are:

0) Install correct Firmware version first (i.e. in this case 2.43)
1) Download Safar's patched_nk_bin.comp file and copy to a USB stick and plug in.
2) Telnet into the scope.
3) Login infiniivision / skywalker1977
4) processmgr kill infiniivisionlauncher.exe
5) \windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp
6) Create a file on the USB stick called infiniivision.lnk with contents (e.g.) "88#infiniivisionLauncher.exe -l MSO -l BW20 -l DIS -l PLUS -l SCPIPS -l VID -l CABLE --perf"
7a) delete (or rename) any other lnk in \secure\startup folder. Should be only one file with lnk extension here.
7b) copy \usb\infiniivision.lnk to \secure\startup
8 ) reboot and good to go

Do I have the basic steps correct or ???

tia,
george.

Edited as per Safar. Thanks!!


« Last Edit: March 20, 2018, 11:38:19 pm by georges80 »
 
The following users thanked this post: bigeblis


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf