Author Topic: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?  (Read 1106914 times)

dimmog and 10 Guests are viewing this topic.

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3743
  • Country: ca
  • Living the Dream
Version 2.41 can also have all features enabled without a lan card - details are in the last few pages.
VE7FM
 
The following users thanked this post: Andrew

Offline matthieu.e

  • Regular Contributor
  • *
  • Posts: 79
  • Country: 00
Hi,

Thanks for the upload. I successfully updated my scope to 2.35. I now have to modify the .dll.  :)
 
The following users thanked this post: Andrew

Offline millerni

  • Newbie
  • Posts: 2
  • Country: de
Hi,

I'm new in this Forum.
Found this Thread after I bought a DSO-X 2002 on Ebay.   ^-^
Now I'm looking for a DOSXLAN Adapter to access the Telnet interface...
Has anyone a PCB or even a stocked PCB left and would sell it to me?
 
The following users thanked this post: Andrew

Offline matthieu.e

  • Regular Contributor
  • *
  • Posts: 79
  • Country: 00
Hi,

I am looking for one too. I will perhaps launch a 5x batch. If it is the case I will tell you.
Send me a message if you find a way to have the PCB  ;)
 
The following users thanked this post: Andrew

Offline PA0PBZ

  • Super Contributor
  • ***
  • Posts: 5121
  • Country: nl
Keyboard error: Press F1 to continue.
 
The following users thanked this post: Andrew

Offline matthieu.e

  • Regular Contributor
  • *
  • Posts: 79
  • Country: 00
Hi,

I successfully upgrade my dsox2002A to 200MHz with 2.35 firmware. I order a lan card and will receive it next week normally.  :)
I have a question after reading the last few pages. Is the 500MHz mod from Memset is possible on the 2002A ? Thanks.
 
The following users thanked this post: Andrew

Offline Pinkus

  • Frequent Contributor
  • **
  • Posts: 768
at least you cannot purchase a 350 / 500 Mhz DSOX2000 series scope from Keysight.
So probably you need to open your scope and check the PCB if it will allow such modification.
 
The following users thanked this post: Andrew

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3743
  • Country: ca
  • Living the Dream
It is an interesting thought. I would think the front ends should be similar(but not the same, the 3000 series has a 50 ohm termination option). You would need to compare the strapping/jumper options and if they look similar enough try changing the jumpers to tell the scope it is 350/500 MHz. If it boots up and says the BW is 350 MHz then the software happens to support it and you will get the faster time base etc. Then you can look at the front end.
VE7FM
 
The following users thanked this post: Andrew

Offline matthieu.e

  • Regular Contributor
  • *
  • Posts: 79
  • Country: 00
Thanks for the answer  ;)
Yes, I should look at the RF front end. I just reassemble my scope yesterday after my repair on the generator output  :palm:
Is there any picture of the 2002A front end somewhere ?

Where is the strapping/jumper options area ? Inside the front end cover ?

Linked a photo of my scope.
« Last Edit: August 30, 2016, 05:39:49 pm by matthieu.e »
 
The following users thanked this post: Andrew

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3743
  • Country: ca
  • Living the Dream
I compared pics of the 2000 to the 3000 PCB(on the top side anyway) and the strapping resistors do look the same. So you you can trying swapping the same two parts as we did on the 3000 mod to switch the board to 350/500 MHz. Then boot the scope up and go to the about screen to see if it gives an error or says 350 MHz.
I haven't see any detailed pics of the 2000 front end as it is hidden under the cans - it will certainly be different then the 3000 front end but you never know what might be possible with some luck.
VE7FM
 
The following users thanked this post: Andrew

Offline PA0PBZ

  • Super Contributor
  • ***
  • Posts: 5121
  • Country: nl
How hard can it be?  :-//

I just tried memset's method of installing the lnk file from a USB dongle:

MSOX3034A - check
Firmware 2.41 - check
Link 63#\Secure\infiniiVision\infiniivisionLauncher.exe -l all -l bw50 - check
Load the cab from the scope menu - check
Scope reboots but hangs either on the splash screen or the next one with the software warning  :'( - no check

I understand what's going on in the recipe.xml file, it should work fine. Now I have to wait for my LAN kit to arrive  :(

What could be the problem? Caps? I've seen people posting their links with either bw50 or BW50 so that doesn't seem to be the problem. Also, there's no CR/LF at the end of the link text if I'm correct? To be continued after arriving of the kit and some soldering... I hate to wait!

Keyboard error: Press F1 to continue.
 
The following users thanked this post: Andrew

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3743
  • Country: ca
  • Living the Dream
Shouldn't the link file be:
62#\Secure\infiniiVision\infiniivisionLauncher.exe -l all -l bw50

edit: - just looked back at the last few pages of this thread and it looks like the link Howard said he was using is wrong. As I posted above the character count is off by one, it starts after the # sign.

Should be an easy fix once you have your lan card.
« Last Edit: August 30, 2016, 08:21:58 pm by TheSteve »
VE7FM
 
The following users thanked this post: Andrew

Offline PA0PBZ

  • Super Contributor
  • ***
  • Posts: 5121
  • Country: nl
Keyboard error: Press F1 to continue.
 
The following users thanked this post: Andrew

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3743
  • Country: ca
  • Living the Dream
Shouldn't the link file be:
62#\Secure\infiniiVision\infiniivisionLauncher.exe -l all -l bw50

I don't think so, see https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg989301/#msg989301

Howard's character count is wrong in that post unfortunately.
VE7FM
 
The following users thanked this post: Andrew

Offline PA0PBZ

  • Super Contributor
  • ***
  • Posts: 5121
  • Country: nl
N is 2-3 digits of length value of the following string, including '#' char.

63#\Secure\infiniiVision\infiniivisionLauncher.exe -l all -l bw50 is 65 bytes, so subtracting the first 2 gives 63... ?
Keyboard error: Press F1 to continue.
 
The following users thanked this post: Andrew

Offline PlainName

  • Super Contributor
  • ***
  • Posts: 6796
  • Country: va
Is it

"the following string, including '#' char"

or

" 2-3 digits of length value ...  including '#' char"

English is a bit more flexible than code :)
 
The following users thanked this post: Andrew

Offline PA0PBZ

  • Super Contributor
  • ***
  • Posts: 5121
  • Country: nl
I have no idea, but Howard's link seems to work and reading the posts I get the idea that the correct length does not really matter... anyway, hard to tell without the LAN adapter.
Keyboard error: Press F1 to continue.
 
The following users thanked this post: Andrew

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3743
  • Country: ca
  • Living the Dream
It is the number or characters *after* the # sign.

From the MS website:
[number of ASCII characters after pound sign allocated to
command-line arguments]#[command line] [optional parameters]

https://msdn.microsoft.com/en-us/library/ms861519.aspx

As to what happens exactly if the character count is wrong I can't say - but it seems quite likely it would lead to the problem you're having.
Perhaps Howard had some other character in his original file that wasn't carried over with a cut&paste.
VE7FM
 
The following users thanked this post: Andrew

Offline PlainName

  • Super Contributor
  • ***
  • Posts: 6796
  • Country: va
Quote
Perhaps Howard had some other character in his original file

A cr/lf perhaps. That could make up the extra character and be ignored to boot.
 
The following users thanked this post: Andrew

Offline bg8up

  • Contributor
  • Posts: 13
Looks like telnet password is changed too. It is generated from instrument id now (still possible to get it, but I don't have a 3000T to try anyway)

Telnet passwd is changed on 3000T.Creatuseraccount need invoking get-model&sernm,doesn't like 3000A or 4000A.Shall we try to replace 3000T's FW with 4000A?
 
The following users thanked this post: Andrew

Online Howardlong

  • Super Contributor
  • ***
  • Posts: 5315
  • Country: gb
It's the number of characters after the #:

https://blogs.msdn.microsoft.com/mikehall/2007/07/26/adding-applications-to-the-windows-ce-start-menu/

In the example, I think it should be 62. Whether it's a material difference or no I don't know, I do tend to add a CR/LF at the end of a file as a natural practice, from the days when some C compilers complained if you didn't!
« Last Edit: August 31, 2016, 05:14:14 am by Howardlong »
 
The following users thanked this post: Andrew

Offline memset

  • Regular Contributor
  • *
  • Posts: 137
  • Country: ru
Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #1096 on: September 01, 2016, 03:28:41 pm »
To be continued after arriving of the kit and some soldering... I hate to wait!
You can use any suitable cut of 0.8mm pitch PCB edge connector for urgent repair. Only one half of the connector is needed to get the LAN to work.

I've also put my scope to hang while working on the cab file. Without LAN adapter in hands I've cut a PCB edge connector line from crossfire connector of some old AMD videocard. It was the same pitch/thickness and almost the same width. All traces from edge fingers to the remaining part of PCB were carefully cut to make a clean connector. Next I've soldered short wires from connector to MagJack (only power and data lanes). It worked flawlessly and the scope was fixed via telnet.

Also you can attach 3.3V LVTTL RS232 port to scope's debug connecter (see the first pages of this thread for a pinout picture). By observing COM-port output you'll be able to find the exact problem with the lnk file. Probably you'll get an exception if your lnk file wasn't well-formatted.
 
The following users thanked this post: Andrew

Offline PA0PBZ

  • Super Contributor
  • ***
  • Posts: 5121
  • Country: nl
Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #1097 on: September 01, 2016, 07:09:02 pm »
Hi memset, thanks for joining in. I decided that I can wait a little longer (I have more scopes) but I indeed already looked into other options, including a temporary magjack connection.
I'm still wondering about the link, should the count include the # character or not? I included the # and the only reason I can think of why it went wrong is that it should not be included. However, the majority of the links other people posted include the # in the count, and even your 'empty'  link in the zip file includes the # in the count:

48#\Secure\infiniiVision\infiniivisionLauncher.exe

So... what should it be?  :-//
Keyboard error: Press F1 to continue.
 
The following users thanked this post: Andrew

Offline memset

  • Regular Contributor
  • *
  • Posts: 137
  • Country: ru
Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #1098 on: September 01, 2016, 07:46:49 pm »
So... what should it be?  :-//
Here is pin header pinout (wasn't found by me, check first pages for the source).
Find some 3.3V LVTTL level COM-port converter to connect to the board's TX and GND pins and take a look on the debug output (AFAIR its 115200 8N1).
DO NOT use conventional +/-12V COM/RS232 converters because you'll probably burn your CPU. The best choice is bare USB-RS converter like FT232R or PL2303H without companion level converter IC (NO MAX3232!)
 
The following users thanked this post: Andrew

Offline Wiljan

  • Regular Contributor
  • *
  • Posts: 225
  • Country: dk
Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #1099 on: September 02, 2016, 12:15:36 pm »
I did use 72#\Secure\infiniiVision\infiniivisionLauncher.exe -l all -l BW20 -l SCPIPS
no cr/lf and the count 72 does not include the # that did work

If you use eg. notpad++ and select after the # to the end of line you can see the numbers (length) of the selection in the buttom bar of notepad++
 
The following users thanked this post: Andrew


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf