DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?

[lowimpedance]

Ahh.......definitely used then .. .

Nothing a band saw can't fix  .

[KrudyZ]

On the plus side, they're very likely to be the genuine article.
Who would go through the trouble of putting a fake chip on a PCB and then cut it out with a band saw...

[Hydron]

Honestly I'm pretty glad someone is doing this and selling them. Assuming they work, it's much better someone is recycling and selling it for use in fixing stuff than having to toss out a scope because you can't buy one unobtanium chip from the manufacturer.

Just a shame that in the same market there's millions of fakes waiting to fuck up your project/product.

[Saa1206]

Sorry for newbe question, but do I get it right that telnet to XSO is only possible by LAN and not USB?
If so could someone be so kind as to point me at the cheapest and to some extent relaible way to get the DSOXLAN or it's clone?
Regards.

[Pinkus]

I purchased mine from user 'romantao'. This unit is good quality one and is working just fine. Just PM him to get one.

[NorcalNerd]

Thanks for asking SUKA_KRYSA,

I am continuing to research though Safar's recent reply indicates recover to factory-default 2.43 should be no problem.

Am I reading correctly that with the newer versions of the firmware, booting from "fixed" firmware on USB isn't possible; that 2.42 (or perhaps older) firmware could boot and run from USB -- but 2.43 cannot?  I may not have the correct firmware version where I recall this changed.

The longer boot time (for me) would not be a problem.

Thank you
NorcalNerd

To be honest, I'm completely confused about what you want to do. As far as I understand, you got perfectly working scope, you've succesfully updated it to the latest firmware (2.43 in our case) and everything is fine for now. And you want to hack it by the Safar's method with no troubles e.g. breaking the scope, am I right?

If so, you don't need to decompress and compress that Patched2.43 file, you simply drop it onto the USB stick, boot up, telnet and further on. The only files that must be on the stick is infiniivision.lnk and patched_nk.bin.comp. Note: you create them on your PC, not on the scope via Telnet!

Don't know about older versions, I'm personally flashed straight on 2.43 and evertythibg works just fine. Boot time is the same.

The only issue is a repair/cal process. The patched firmware have no differences with the original one as long Keysight's certified technics don't digs into the code. Don't think they will do it with no reason, too much wasting their precious time. So I believe you can telnet again and overwrite infiniivision.lnk file with empty one before the call process. And again after. Great scheme, huh?

To clarify, I was hoping to boot directly from USB where the USB stick would have Safar's patched_nk.bin.comp and the modified infinivision.lnk -- and then after the expected long "boot from USB" process, I would  evaluate the new features -- assuming all worked as I expected, I would then proceed to flash Safar's firmware overwriting the Keysight 2.43, replacing the original infinivision.lnk with the modified link.

Is "boot from USB" possible if the 3024A was upgraded to Keysight's latest 2.43 or am I misreading the blog?

Thanks kindly,
NorcalNerd

[Pinkus]

AFAIR it is not possible anymore. However, it is all buried in this thread many pages above. Hint: if you click on 'print' on the top or bottom of this thread, you will get the whole thread on one (though loooong) single page which makes it much easier to search the whole thread for specific terms.

[f14]

Hi Guys,
I just got Dsox3054a some days ago . the firmware version is 2.36 and after read a lot of page in this topic . I think need to downgrade to 2.35 ( USB ) take 2.35 file from this Reply #1511 ( many thanks Kada) . write it to USB and "downgrade" like the keysight

How to Install
To update your oscilloscope's firmware, do one of the following:
Place the file on a USB flash drive, connect it to the oscilloscope, press [Utility] > File Explorer, select the file; then, press Load File.
If your oscilloscope is on the network: you can place the file on your computer, access the oscilloscope's Web Interface (see the User's Guide for details), click Instrument Utilities, select Firmware Version, browse to select the file; then, click Install.

after some minutes waiting and  now my scope have 2.35 firmware . 
next I hack this scope like this

How to hack the firmware
1. Unpack the firmware *.cab by 7zip
2. Unpack infiniiVisionSetup.cab ( e.g. with WinCE CAB Manager 3.0)
    Find \Secure\infiniiVision\infiniiVisionCore.dll
3. Change at location 0x277e50 in infiniiVisionCore.dll
    byte sequence 04 00 a0 e1 to byte sequence 00 00 a0 e3
4. Enable startup Overide by creating USB flash with following structure in root of USB drive (copy structure from Secure folder from point 2)
    Edit in Startup folder file infiniivision.lnk to contains following sequence "62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"
    Replace in infiniiVision folder  infiniiVisionCore.dll with patched infiniiVisionCore.dll file
5. Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
6. Plug the USB drive to scope and turn it ON
7. There will be red  message in letf top corner "Unfinalized Software"  and "System Concerns detected: OS version is not correct. Please reload system firmware"

Applications needed:
 WinCE CAB Manager http://www.ocpsoftware.com/products.php
 7Zip http://www.7-zip.org/

but the link of WinCE CAB Manager is dead.  anybody have this software ?
and the step 4&5 I dont know how do it , Maybe use WinCE CAB software to do this step ?
Thank you very much for help!
edit: I found WinCE cab manager from russia website. and changed hex code
next step is root of usb. I mean the scope will boot from file in usb . not from internal scope firmware?

[SUKA_KRYSA]

Thanks for asking SUKA_KRYSA,

I am continuing to research though Safar's recent reply indicates recover to factory-default 2.43 should be no problem.

Am I reading correctly that with the newer versions of the firmware, booting from "fixed" firmware on USB isn't possible; that 2.42 (or perhaps older) firmware could boot and run from USB -- but 2.43 cannot?  I may not have the correct firmware version where I recall this changed.

The longer boot time (for me) would not be a problem.

Thank you
NorcalNerd

To be honest, I'm completely confused about what you want to do. As far as I understand, you got perfectly working scope, you've succesfully updated it to the latest firmware (2.43 in our case) and everything is fine for now. And you want to hack it by the Safar's method with no troubles e.g. breaking the scope, am I right?

If so, you don't need to decompress and compress that Patched2.43 file, you simply drop it onto the USB stick, boot up, telnet and further on. The only files that must be on the stick is infiniivision.lnk and patched_nk.bin.comp. Note: you create them on your PC, not on the scope via Telnet!

Don't know about older versions, I'm personally flashed straight on 2.43 and evertythibg works just fine. Boot time is the same.

The only issue is a repair/cal process. The patched firmware have no differences with the original one as long Keysight's certified technics don't digs into the code. Don't think they will do it with no reason, too much wasting their precious time. So I believe you can telnet again and overwrite infiniivision.lnk file with empty one before the call process. And again after. Great scheme, huh?

To clarify, I was hoping to boot directly from USB where the USB stick would have Safar's patched_nk.bin.comp and the modified infinivision.lnk -- and then after the expected long "boot from USB" process, I would  evaluate the new features -- assuming all worked as I expected, I would then proceed to flash Safar's firmware overwriting the Keysight 2.43, replacing the original infinivision.lnk with the modified link.

Is "boot from USB" possible if the 3024A was upgraded to Keysight's latest 2.43 or am I misreading the blog?

Thanks kindly,
NorcalNerd

You are not booting from USB. You just boot uoyr scope as is, telnet, disable some minor features and hacking it. In any case, your USB stick will perform nos as a booting drive you're booting from, bus as a simple external memory stick.

Anyway, the hack is possible on the latest firmware.

[TheSteve]

I finally managed to buy a 3000 series scope that looked to have the NAND corruption problem. In this case it was specifically a DSOX3024A. It gave the Agilent text splash screen, then the megazoom IV image and then a few seconds later would reboot and start the process over again. I've wanted one for quite a while to see what it would take to fix it.

I was able to fully recover the scope with nothing more then a flash drive. This process will likely work for any 2000a or 3000a series scope that has NAND corruption and has firmware 2.35 or below. I am not breaking any new ground here, just using the tools already provided in this thread a few years ago.

Firmware versions 2.35 and below allow the scope to partially boot from the USB drive if a properly constructed image is created for it. This was used quite nicely to hack the scope early on, I am pleased that the same process also works to recover from a NAND corruption failure.

Plesa describes how to create the USB image in this post:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg322242/#msg322242

To recover the scope though you don't need to patch the .dll file, just use it as it is as we're trying to recover the scope, not hack it.

For the USB drive to boot you need to have the same version of firmware on the flash drive as is already installed in the scope, or a very close version. So if you don't know what was installed you may need to try several versions. If you use the wrong version the scope will likely hang during the boot process at some point.
You can find an archive of older firmware versions in this thread and on xdevs.com. For a mostly complete list of firmware versions you can check the firmware release notes on the Keysight website.
You should also put a copy of version 2.35 firmware on the flash drive - we'll use this image to recover the scope once it has booted.

If you build the USB drive image correctly the scope should boot to the normal operating screen with the flash drive plugged into the front USB slot. It may give an error or two but at this point you can update the firmware from the 2.35 image you copied to the flash drive. I recommend version 2.35 in case something goes wrong and you encounter further errors. It is the newest version that allows booting from the flash drive. You will need to remove the flash drive when the scope reboots as part of the firmware update or it may want to try booting from it again. Once the scope is recovered and running version 2.35 with no errors you can then update it to the newest firmware(2.43 at this time) which will keep the corruption issue from reoccurring.

I don't know if the NAND corruption issue is identical for every scope so it is possible this won't work for all problems but it is certainly worth a try if you have the boot loop. If your scope has versions 2.36-2.39 then recovery will likely require a network card and the serial console connection. Keysight has so far also replaced/repaired scopes that have this problem for no charge even if out of warranty so that is certainly an option as well.

I did connect to the serial console while doing this, but again, it wasn't needed.
This is what the error looked like on the serial console before it rebooted:

Exception 'Data Abort' (4): Thread-Id=05d40002(pth=837d59e4), Proc-Id=03500006(pprc=837d17ac) 'infiniivisionLauncher.exe', VM-active=03500006(pprc=837d17ac) 'infiniivisionLauncher.exe'
PC=40d13c28(infiniivisioncore.dll+0x00003c28) RA=40d917bc(infiniivisioncore.dll+0x000817bc) SP=02a9fb08, BVA=00000000
The exception 0x80000002 occurred at address 0x40D13C28.


After loading version 2.43 I see this:

-----> InfiniiVision is running <-----
failed open \Secure\InfiniiVision\LudicrousSpeed.usb

So I guess my scope does not contain a Tesla

Now, to leave the scope stock at 200 MHz, or is the 500 MHz mod calling?

For anyone trying to fix a corruption issue by all means post any questions or PM, I'm always happy to help.

Pic of the happy patient attached.

[salvagedcircuitry]

Hello all,

5/ Save the original link and make the new startup link:

   save the original infiniivision.lnk renaming it to something like "orig.sav".
   
   NOTE: the \secure\startup folder should contain ONLY ONE .lnk file, named infiniivision.lnk, with the below command line (do not add quotes):
   
   "211#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC"

If anyone is stuck on this step, type "help" into the telnet command line interface. This will bring up all the commands that are available for use within the telnet session.

I tried using "mv" for move and "cp" for copy. Those commands are not windows CE commands and are not acceptable arguments for this telnet session. Simple miastake. Use "ren" for rename and "copy" for copy.

More information on how to use the ren and other telnet commands here:
https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/ren

Good luck everybody!

[f14]

I want to say thank you all guys
finally my dsox3052a had upgraded !

[gamalot]

Insert a USB stick with 2.35 firmware and try again. 

[TheSteve]

Bought another broken 3000 series scope. This one hardly booted at all. A few lights would turn on and that was it, no splash screen at all.

Here is the boot log from serial console:

Code: [Select]

U-Boot 2010.03 (Jan 26 2011 - 12:37:34)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2011-01-27  11:38:14 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    36703 Bytes = 35.8 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK

Microsoft Windows CE Bootloader Common Library Version 1.4 Built Jan 27 2011 02:04:15
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008


System ready!
Preparing for download...
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXOOOOXOOOOOOOOXOXXOOOOOOOOXOOXOXOOOOXXXOOOOOOOOOXOOOOXOXXOXXOXOOOXOXXXXXXOOXXOOOOOOXOOXXOXXOOOXOXXOOXXOXOOOXOOXOOXXOOOXOOOOXOXOOOOOXOOXOOOXOXXXXXOXOXOXOXXXXXXOXXXOOOXOOOOXXOOOOXOOOOXOXOXOOOOOOXOOOOXOXOOOOOXX
OOOOOXOOXOOXXOOOOOOOOOOXOOOXOOOOOOOXXOOOOOXXOOOOOOOXOOXXOOOXOOOOXOOOXOOXOOXOOXOXXOXOOXOXOXOXOOOXXOOXXXOOOOXXXXOXOOOXXOOOOOXOOOXOOOXOOXOOOXOOXOOXXXXXXXXXERROR: Checksum failure (expected=0x1ED617A  computed=0x1ED617B)
****** Checksum failure on record 134, ABORT!!! ******

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x12F9870  Name="" Target=RAM
 Loading image 1 failed, trying next one
 Loading image 2 from memory at 0xD1600000

BL_IMAGE_TYPE_UNKNOWN

 Loading image 2 failed, trying next one
 All images failed

Press r to reset


I was able to get into u-boot and platform builder no problem.
I used the info provided by FrankBuss(in reply #125) to boot version 2.30 via tftp.

The scope fully booted with only an unsealed error.
I then updated the firmware in the normal manor via USB stick.
With version 2.43 installed I could see that is did find a bad bit/block in the NAND flash. However it corrected it and all booting is now error free.
This is what it looks like when it sees a failed checksum:

Code: [Select]

U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  fsmc-ecc1 128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2015-05-07   8:18:27 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    37749 Bytes = 36.9 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK
RTC: 2018-8-22   16:29:21.79 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built May  7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008


System ready!
Preparing for download...
RTC: 2018-8-22   16:29:21.83 UTC
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXXOOOOOOOOOXOOOOXOXOXOXXOXOXOXOXXXXOOXXXOOOOOOXXOXXOXXXXXXOOOXXXOXXOOOXXXOXXOOOOXOOXXOOXOXOOORewrite recommended, internal ECC corrected data at 0x1184
OXOXOOOOOXOOOXOOXOXOXOXXXXXXOXXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOXOOOX
OOXOOOOXOOOOXOOXXOOXOOOOOOOOOXOXOOOXOOOOOOXOXXOOOOXOXOOOOOOOXXOOXOOXOXOOOXOOOXOOXXOXOXOOOXOXXXXOXOXXOXXXXXOXOXXOOOXXXOXXXXXXOXXXXXXOXXXXOXOXXOXOOOXXXXOXXXXOOOXOOOXXXOXXOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOX
XOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXXXOXORewrite recommended, internal ECC corrected data at 0x233a
OOXXOOOXOOXXXXXXXXXXXXXXrom_offset=0x0.
XOXImageStart = 0x80361000, ImageLength = 0x1AD2DB8, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x1AD2DB8  Name="" Target=RAM
 Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
RTC: 2018-8-22   16:29:25.19 UTC
Launching windows CE image by jumping at address 0x  362000

Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Feb  6 2018)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
ERROR: c:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 1460: RewriteEbootBlocks from 0x1184 to 0x233a
                                                             Rewriting Block at Sector Address 0x233a. 3346
Read Block SUCCEEDED 3375
Erased Block SUCCEEDED 3376
Completed rewriting Block SUCCEEDED 3418
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 00:30:D3:20:DA:0B
Phy found addr 31 (ticks=5178)
WaitForLink Start (ticks=5180)
Link Detected (ticks=5182)

 GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
Flushed Transmit Buffer
phyCfg->dwSpeed 0x64
phyCfg->bFullDuplex 0x1
<--EDeviceInitialize

GMAC DMA status register = 0x600004
GMAC Device enable interrupt
DriverStart
GMAC Device enable interrupt
LIN: Data Valid
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Autonegociation Start (ticks=7208)
Autonegociation End (ticks=9713)
WaitForLink Start (ticks=9714)
Link Detected (ticks=9717)

 GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
cable attached
Running infiniiVisionInstallHelper
Running launchNetworkServices
Starting Agilent LXI Services.
Device load time:
   NANDFLASH: 0 ms
   SNANDFLASH: 0 ms
   USB Hard Disk Drive: 0 ms
Summary of scan:

All FATs on volume agree

Percent Fragmentation: 0
Invalid Directories: 0
Invalid Files: 0
Invalid Clusters: 0
Lost Cluster Chains: 0

ScanVolume \Agilent Flash (NANDFLASH) 0.281000
Summary of scan:

All FATs on volume agree

Percent Fragmentation: 0
Invalid Directories: 0
Invalid Files: 0
Invalid Clusters: 0
Lost Cluster Chains: 0

ScanVolume \Secure (SNANDFLASH) 0.433000
SHIM DLL, LoadRealDll [PalIO.dll] for [AgilentPalIO.dll]
SHIM [AgilentPalIO.dll] Get Process Addresses
Our command line is
Performing Startup
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]
SHIM [AgilentPalSStorage.dll] Get Process Addresses

      creating \Secure\bin\Released build, Feb  6 2018, 19:47:18
Initializing FPGA...
****
FPGA Type: Wyoming
Ver: 2.011 Released
Build Time: Tue May 27 16:03:14 2014
Build Machine: TS2404M
****
Programming LAN option module...
Module option FPGA DONE bit should be LOW at this point
Keyboard firmware version 32... ok
Keyboard Info: Board id 1, Board rev 3
Startup sequence is complete.
SHIM DLL, LoadRealDll [PalSysManagement.dll] for [AgilentPalSysManagement.dll]
SHIM [AgilentPalSysManagement.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalCaps.dll] for [AgilentPalCaps.dll]
SHIM [AgilentPalCaps.dll] Get Process Addresses
System has been running 27.213392 seconds
Start Up Sequence 12.658394
Memory Load 59%
   System Physical Memory 42.645 / 73.230 MB
   Process Virtual Memory 49.188 / 1024.000 MB
-----> InfiniiVision is running <-----


It also appears the full boot image is now stored twice in flash, so if the first image fails it will move on the second and attempt to fix the first one.
From the platform builder menu you can select either image and both boot the same.

Now that the scope was working again I thought I'd experiment a little further with network booting.
There are no problems getting u-boot to tftp the nk.bb0 image however the scope will not fully boot anymore via the network image. It will hang at a splash screen. It also shows the Keysight splash instead of the Agilent splash so I know it is loading from flash, or perhaps both the ram image and flash.
When I performed the firmware update to version 2.43 u-boot was updated to a newer version.
Old version - U-Boot 2010.03 (Jan 26 2011 - 12:37:34)Agilent P500
New version - U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

Code: [Select]

Update UBOOT at address f8010000.
Date in resource is newer than date stored in NOR
DO NOT DISTURB.
Sector 1 Erasing Writing succeeded
Sector 2 Erasing Writing succeeded
Sector 3 Erasing Writing succeeded
Verifying boot loader in NOR
ERROR: C:\WINCE600\3RDPARTY\Agilent\HPP\Common\Drivers\MapMemoryIntoUserSpace\.\MapMemoryIntoUserSpace.cpp line 153: VirtualFreeEx() failed
Updating UBOOT complete
Update PBOOT at address f8050000.
Date in resource is newer than date stored in NOR
DO NOT DISTURB.
Sector 5 Erasing Writing succeeded
Verifying boot loader in NOR
ERROR: C:\WINCE600\3RDPARTY\Agilent\HPP\Common\Drivers\MapMemoryIntoUserSpace\.\MapMemoryIntoUserSpace.cpp line 153: VirtualFreeEx() failed
Updating PBOOT complete


It seems the updated u-boot version does not allow the scope to fully boot from an image transferred via network, it does get far enough to allow telnet access to the scope if some manual file system recovery is needed. However recovering a scope with a bad NAND block might not be possible. Or perhaps if NAND is totally corrupted it would still allow the full network boot.
While I still have the scope open and a terminal connected to the debug port I am happy to try some other commands etc to try to get a full network boot if anyone has any suggestions. The scope works 100% so this isn't needed but could be very useful for others going forward should someone experience a NAND corruption issue. It would be nice to have a solution that always works.
I can boot nk.nb0 via tftp or nk.bin via bootp/platform builder. Both get to the exact same place.
Thoughts/suggestions?

[PA0PBZ]

What happens if you use the nk.nb0 from 2.43, or did you already try that? Do you have the boot log when it fails?

[TheSteve]

With the NK.bin from 2.43 it will fully boot.

edit:

Perhaps it only completed the boot originally because I used version 2.30 which was the same or similar to what was on the flash to begin with. Even though it was corrupted it may have been able to access non corrupted portions to get what it needed to boot.

[PA0PBZ]

With the NK.bin from 2.43 it will fully boot.

Yes, that is what I was expecting.

[B0B45]

Hey everbody,

I did the USB-Hack v02.37 and the hardware mod to my MSO3014A to get the 500MHz a year ago. Everthing is working fine    I just wonder if the mod increases the noise of the input chanels. So I took a picture of all 4 chanels to compare with your scopes. Is the level of noise ok for a 500MHz scope or did the mod make it worse?

Kindly regards
B0B   

[Safar]

I did the USB-Hack v02.37 and the hardware mod to my MSO3014A to get the 500MHz a year ago. Everthing is working fine    I just wonder if the mod increases the noise of the input chanels. So I took a picture of all 4 chanels to compare with your scopes. Is the level of noise ok for a 500MHz scope or did the mod make it worse?

Firstly I recommend you flash newly FW as this old have some bug with lost FW image. If I understand newly FW doubled kernel image in memory.

I also was surpriced of this noise level for this scope family. But if you compared with your old config (100 MHz) it is not be so surprising since noise power usually proportional to the frequency band.

If I remember I have same level on 500 MHz.

Edit: and do not forget that at such sensitivity the scopre works like a wideband receiver! I perfectly observe the all spectrum of FM stations for example. I think that using 50Ohm terminator caps is the better way for "analyze noise".

[TheSteve]

More bandwidth does equal higher noise. I saw this as well going 100 to 500 MHz and 200 to 1000 MHz.

[Alanme]

Hello
In first i wan't to apologize for my poor english and because i'm a dummy in informatic because i program only in assembler.
I have buy a agilent dsox2024a from 2011, since 6 month, without warranty and i have try to update it with 2,41, i found the update somewhere in the thread.

I have read a lot off this thread, and i see somewhere that not be possible to brick it with update, so i do it, i brick it.
After update and reboot the buttons blink at boot and the logo agilent appear, but nothing else.
I try to do what i can do, i have do what is it in this tuto by Plesa:


How to hack the firmware
1. Unpack the firmware *.cab by 7zip
2. Unpack infiniiVisionSetup.cab ( e.g. with WinCE CAB Manager 3.0)
    Find \Secure\infiniiVision\infiniiVisionCore.dll
3. Change at location 0x277e50 in infiniiVisionCore.dll
    byte sequence 04 00 a0 e1 to byte sequence 00 00 a0 e3
4. Enable startup Overide by creating USB flash with following structure in root of USB drive (copy structure from Secure folder from point 2)
    Edit in Startup folder file infiniivision.lnk to contains following sequence "62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"
    Replace in infiniiVision folder  infiniiVisionCore.dll with patched infiniiVisionCore.dll file
5. Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
6. Plug the USB drive to scope and turn it ON
7. There will be red  message in letf top corner "Unfinalized Software"  and "System Concerns detected: OS version is not correct. Please reload system firmware"


 I have open the infiniiVisionSetup.cab with mcsinf because i can't find WinCE CAB Manager 3.0, i have modified the dll with hexedit, i have modified the inf with atmel studio, i have edited the txt, i have try this with version 2.35, 2.37, 2.39, 2.41and  2.43 have not the infiniiVisionCore.dll.
i try with fat and fat 32 format, nothing work.

i have try only with the contenu of secure folder and the txt file, the scope have the  red  message in letf top corner "Unfinalized Software"  WITHOUT "System Concerns,  detected: OS version is not correct. Please reload system firmware" .

after this message the scope reboot and display this message an infini loop
that work for 2.35, 2.37, 2.39.
other version make nothing.

i have try with:
"62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"
"48#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS" because that what it is in the origine

i have try the method of TheSteve but i can't make a bootable usb flash for recover my scope.
perhaps the version of my scope is too old, and 2.35 and  newers can't boot?
i have not find the older firmware in the web.Someone have them please?

 I'm very disapointed, and i hope somewone can help me, please help me, i don't know how can i do.

i have sell my old techtronix tds210 and i have spend all my money in this scope, i have it since six month, all was working and i brick it with update.
i have no possibility to buy another one, or send it for repair
i have contact keysight, and they said that i must send my scope to be repaired.

Thanks a lot for every help

[TheSteve]

Did the scope stop working after a normal firmware update or after you tried to hack the scope?

[Alanme]

When i try to update with 2.41

[TheSteve]

When i try to update with 2.41

What firmware did you have before you tried to update to 2.41?
Do you have a network card?

[Alanme]

I don't know between 1.0 to 2.10, it old (2011)