Author Topic: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?  (Read 490683 times)

maomi84 and 3 Guests are viewing this topic.

Offline Petter

  • Contributor
  • Posts: 9
infiniivisioncore.dll [snip] ** note:  in 2.42, the dll is no longer on disk, so you have to patch this directly in the nk.bin, and write to flash **

Where does one find the the dll in question?

All the best
 

Offline WVL_KsZeN

  • Regular Contributor
  • *
  • Posts: 92
  • Country: nl
I've always thought the 50,000 waveforms/s of the 2000 was an artificial limit vs the 3000 series. And now they raised it to 200,000 for new units to make them competitive again. I wonder how much they will ask for the dsox2plus option..

I also wonder about the memory, the 2000 now has 1mb vs the 4mb (?) of the 3000. Maybe they will raise this to 2mb in the future (that would be most welcome!)
 
The following users thanked this post: Andrew

Offline Andrew

  • Contributor
  • Posts: 9
  • Country: au
...I wonder how much they will ask for the dsox2plus option...

If it is still the case that 3000A owners who had already purchased the app bundle don't get the FRA option then I suspect 2000A owners who want 200,000 wfms/s will have to hand over more cash for DSOX2PLUS or keep a watch on this thread. :)
 

Offline gamalot

  • Frequent Contributor
  • **
  • Posts: 355
  • Country: au
  • Correct my English
    • GAMALOT
Upgraded to 2.43  :)
 
The following users thanked this post: Andrew

Offline Andrew

  • Contributor
  • Posts: 9
  • Country: au
Upgraded to 2.43  :)

That was quick  :D Are you able to confirm the increased update rate?

From http://www.datatec.de/Keysight-Upgrade-2000X-Oszilloskop-2018.htm

 

Offline gamalot

  • Frequent Contributor
  • **
  • Posts: 355
  • Country: au
  • Correct my English
    • GAMALOT
Upgraded to 2.43  :)

That was quick  :D Are you able to confirm the increased update rate?

From http://www.datatec.de/Keysight-Upgrade-2000X-Oszilloskop-2018.htm

Be honest, I don't know how.  :-[
 
The following users thanked this post: Andrew

Offline gamalot

  • Frequent Contributor
  • **
  • Posts: 355
  • Country: au
  • Correct my English
    • GAMALOT
Upgraded to 2.43  :)

That was quick  :D Are you able to confirm the increased update rate?

From http://www.datatec.de/Keysight-Upgrade-2000X-Oszilloskop-2018.htm

Be honest, I don't know how.  :-[

OK, I've watched Daniel's video, according to his instructions:

"You take the trigger out from your scope and you plug it into a frequency counter"

« Last Edit: March 06, 2018, 09:23:27 pm by gamalot »
 
The following users thanked this post: Andrew

Offline PhillyFlyers

  • Contributor
  • Posts: 27
  • Country: us
infiniivisioncore.dll [snip] ** note:  in 2.42, the dll is no longer on disk, so you have to patch this directly in the nk.bin, and write to flash **

Where does one find the the dll in question?

All the best

Hi,

so basically you need to unpack the firmware image, decompress the nk.bin, and then extract the files from it, so you can get to the DLL...then from there, you can disassemble the DLL  and find the patch point(s). 

I have't had a chance to look at 2.43 yet, so if no one else already knows the 2.43 patch points, I'll get to it this week...

but once you have the patch point (or points if you want to also disable that 'unfinalized software' nag message), you can just find that code by doing a hex search in the uncompressed 'nk.bin' file, and modify the code right in that file. **** note, you MUST fix the checksum for this .dll in the nk.bin uncompressed file after making this change ***

then re-compress it, and write/flash the compressed 'nk.bin' to 'ceimage1' & 'ceimage2'


ie follow these 2 posts by Safar, as he was the one that showed exactly how to do it, and I verified that what he did does indeed work perfect.

** you MUST follow his instructions and FIX that checksum after you patch the 'nk.bin', before you recompress it **


http://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1262075/#msg1262075

http://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1266429/#msg1266429

 
The following users thanked this post: Sparky, Andrew

Offline Andrew

  • Contributor
  • Posts: 9
  • Country: au
Test Equity is listing the new option "Keysight DSOX2PLUS Enhancement Suite" at USD 250.

"Increases waveform update rate to 200,000 wfm/s, includes DSOX2SGM (segmented memory) and DSOX2MEMUP (deep memory upgrade), math functions from DSOX3ADVMATH, and all the advanced triggers from the 3000A X-Series (not TX). Included on 2000 X-Series oscilloscopes shipped after March 5, 2018."

https://www.testequity.com/products/3763/
 
The following users thanked this post: grenert

Offline pamphonica

  • Contributor
  • Posts: 25
I'm trying to telnet into a new-ish MSOX4034A (f/w 7.11).  I'm having problems generating an acceptable telnet password.
(Web access works fine)
I tried multiple times (as per Read Me file in zip in previous thread) -  Post #1774 - but no good.
What format should the model number be in to get the correct password?
Anyone got any ideas?
And has anyone successfully liberated a DSOX/MSOX4000A?
thanks
Jeremy
« Last Edit: March 08, 2018, 03:41:55 am by pamphonica »
 

Offline PhillyFlyers

  • Contributor
  • Posts: 27
  • Country: us
I know someone back in this thread did it on a 4k series.....


are you sure the login/password is not just the basic ones as in the 3000A series?  (ie the password+hash was ONLY for the newer 3000T series)

also remember, when launching telnet, the first user/login attempt will always fail, just type in garbage for user/pass, let it fail, then login again...


ie this combo:

Code: [Select]
infiniivision
skywalker1977

 
The following users thanked this post: klaus11

Offline PhillyFlyers

  • Contributor
  • Posts: 27
  • Country: us
FYI:

The patch locations for firmware 2.43:



Code: [Select]
1) options patch:  0x280940:  change "04 00 A0 E1" -> "00 00 A0 E3"
2) nag patch:       0x2a9f38:   change "66 5A FF EB" -> "01 00 A0 E3"
 
The following users thanked this post: Sparky, corn11, klaus11, rhythmp, Safar

Offline klaus11

  • Supporter
  • ****
  • Posts: 144
  • Country: 00
FYI:

The patch locations for firmware 2.43:

But 4000 series never had a 2.43 firmware, it started from fw 3.00.
HP3458A, HP3245a, Keithley 2000, Fluke 87V, Rigol DP832, TEK TDS5052B, HP33120A
 

Offline georges80

  • Frequent Contributor
  • **
  • Posts: 735
  • Country: us
FYI:

The patch locations for firmware 2.43:

But 4000 series never had a 2.43 firmware, it started from fw 3.00.

This is a 2000/3000 thread and PhillyFlyers is providing patch details for 2.43 since he had just posted above that he had successfully installed it on his 2000 series. i.e. his patch info is not in the context of the 4000 question...

Thank PhillyFlyers for the details, I'll look to update/install on my 2000 this w/end.

cheers,
george.
 

Offline jasonbrent

  • Regular Contributor
  • *
  • Posts: 171
Those with a liberated 3000 series scope... to use the MSO portion, what cable are you using? Whats a reasonably priced alternative?
 

Offline PhillyFlyers

  • Contributor
  • Posts: 27
  • Country: us
I picked up one of these, for about $115.. I know people have been selling them from time to time on here as well, but this seems to be the cheapest route.. Agilent has a replacement model# for this part, basically same thing, but it's $600 from them I believe... good grief.
No active logic in them..


Hp/Agilent 54620-61601

https://www.ebay.com/itm/Agilent-54620-61601-Logic-Analyzer-Probe-Cable-54620-61801-54620-61601/152928938063?epid=1041904829&hash=item239b46684f:g:H7AAAOSwB09YEjxE


There was discussion somewhere back in this thread talking about these, and members verified they work fine, I haven't had a chance to actually use mine yet...

FYI, I actually have a DSOX-3024A for my scope...

 

Offline EE-digger

  • Regular Contributor
  • *
  • Posts: 87
  • Country: us
No active logic but the original HP (etc.) part has a 90k series resistance.  This give a good measure of protection against over-voltage, over-current and to some degree, ESD.

You could plug in anything that fits, including individual female 0.025" square connectors such as the ones on Chinese ribbon cables with male or female, or both, ends at real low prices.

Just use caution with any direct cable as it would hurt to blow the ASIC IF the connection from the front panel is not buffered  :bullshit:

I couldn't afford a new cable but also bought a like new on ebay.  The Agilent or KS $600 or $800 is a fair price.  The cable is US made (still was 2 years ago), has the woven ribbon construction as well as custom cable ends with precision female sockets.  They last for years without excessive abuse.  Sure, it would cost $75 or so if made in China and sold by XYZ scopes but then you wouldn't have KS anymore  :'(
 

Offline jasonbrent

  • Regular Contributor
  • *
  • Posts: 171
That price point isn't too far from the MSO option itself... It looks like the probes from my Tektronix TLA5202 might would work also... looks kind of like an IDE/40pin connector. I'm -> <- close to getting a DSOX3014T with their current "30% off" promotion trade in... they accepted something I didn't expect as a trade which makes it very very tempting. I figured it can be liberated and/or upgraded over time as the need arises.
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 2407
  • Country: ca
  • GHz or bust
Used MSO cables pop up for good deals all the time on ebay - it is totally worth buying the proper one.

Here are the various part numbers you're looking for for a 3000 series scope:

54620-68701 - original part #
N6450-60001 - newer part #
N2756A / N2756-60001 -  updated logic probe cable, newest version.
VE7FM
 
The following users thanked this post: jasonbrent

Offline jasonbrent

  • Regular Contributor
  • *
  • Posts: 171
Used MSO cables pop up for good deals all the time on ebay - it is totally worth buying the proper one.

Here are the various part numbers you're looking for for a 3000 series scope:

54620-68701 - original part #
N6450-60001 - newer part #
N2756A / N2756-60001 -  updated logic probe cable, newest version.

Awesome, thank you. I think I'm going to pick up the DSOX3014T+DSOXLAN then... and try to figure out how to explain it to my wife. :)

By the time I need >200Mhz analog, prices will magically have come down (ha) or I'll enjoy some SMD rework.
 

Offline MarkL

  • Supporter
  • ****
  • Posts: 1282
  • Country: us
No active logic but the original HP (etc.) part has a 90k series resistance.  This give a good measure of protection against over-voltage, over-current and to some degree, ESD.

You could plug in anything that fits, including individual female 0.025" square connectors such as the ones on Chinese ribbon cables with male or female, or both, ends at real low prices.

Just use caution with any direct cable as it would hurt to blow the ASIC IF the connection from the front panel is not buffered  :bullshit:
...

The 90k embedded in the logic probe tip makes a voltage divider with the 10k input impedance of the scope's logic inputs, so the combination makes a x10 probe.  And the woven ribbon is a lossy transmission line, similar to a regular analog probe cable, to maintain signal integrity.

A cheap straight-thru 40-pin ribbon connector will give you the wrong voltage levels, and also would degrade the signal integrity if you're dealing with high speed signals.  Not to mention expose the digital front end to more risk of damage, as you point out.

I would get the genuine cable and probes, even if it's somewhat pricey.  The 54620-61601 is what was supplied by Agilent/Keysight when I ordered a 3000X with the logic option several years ago.
 

Offline PhillyFlyers

  • Contributor
  • Posts: 27
  • Country: us
Quote
The 90k embedded in the logic probe tip makes a voltage divider with the 10k input impedance of the scope's logic inputs, so the combination makes a x10 probe.  And the woven ribbon is a lossy transmission line, similar to a regular analog probe cable, to maintain signal integrity.

A cheap straight-thru 40-pin ribbon connector will give you the wrong voltage levels, and also would degrade the signal integrity if you're dealing with high speed signals.  Not to mention expose the digital front end to more risk of damage, as you point out.

I would get the genuine cable and probes, even if it's somewhat pricey.  The 54620-61601 is what was supplied by Agilent/Keysight when I ordered a 3000X with the logic option several years ago.


Oh yeah, absolutely, I agree with you all 100%.  Definitely buy an official HP/Agilent probe set, don't buy some 3rd party knockoff.   For the cost of these scopes, it makes no sense to cheap out on the probe tips and wreck the input logic.

 But just shop around and find a used set or even new set on ebay or here, and pay 1/6 of the cost!  I just wanted to emphasize to NOT buy it direct from Agilent, and pay $600 or more.  No need for that nonsense.  You can buy an entire scope for $600!  (lol, NOT one of these scopes, but maybe a Rigol :)  )

I got the 54620-61601 MSO probe set for my 3024A from ebay, it was new still in package, for $120....


I'm just curious if anyone actually located where they have this probe resistance at, as someone already disassembled one of the pod modules, and there was nothing in it at all...maybe it's in the 40-pin IDE header, as I don't see any pics of anyone opening that up?

http://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg367778/#msg367778


Also, btw, the newer/replacement probe packages do not have that braided cable as the older ones did, it's just straight up wire...
« Last Edit: March 10, 2018, 04:09:22 am by PhillyFlyers »
 

Offline EE-digger

  • Regular Contributor
  • *
  • Posts: 87
  • Country: us
You can also keep your eyes open for a dirt cheap, parts only, older HP scope (green CRT, 54622D, many others).  You might find a scope with the logic probe included !

MarkL - all true.  Thanks
 

Offline EE-digger

  • Regular Contributor
  • *
  • Posts: 87
  • Country: us

I'm just curious if anyone actually located where they have this probe resistance at, as someone already disassembled one of the pod modules, and there was nothing in it at all...maybe it's in the 40-pin IDE header, as I don't see any pics of anyone opening that up?


You made me  do it ... measured the probe ends instead of going back to work.  The 90k is actually in each channel lead, measured from the female socket for the micro grabber clips, to the dual gold pin end which I unplugged from the body. 
 

Offline Neganur

  • Supporter
  • ****
  • Posts: 1068
  • Country: fi
I believe the equivalent circuit of the probes is in their manual (at least for the woven ones)
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf