DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?

[TheSteve]

What does it really add over the 3000T, though?

Bigger screen, builtin VGA and network, second waveform gen and 10 MHz ref in. Nothing I really need, the bigger screen is always nice of course. I'd just like to mod another scope and it would be fun to livestream the entire process.

Well, if it's just for fun, then by all means get it!

Selling a modded scope isn't always an easy process, anyone looking for a MSOX3024t with full properly licensed app bundle that's been modded to 1 GHz?

[TopLoser]

https://www.ebay.com/itm/192545547880

"This item does not ship to Netherlands " 
That's why it didn't show up for me.

They will ship to the EU but you'll have to pay them some VAT on top of the listed price.

[PA0PBZ]

https://www.ebay.com/itm/192545547880

"This item does not ship to Netherlands " 
That's why it didn't show up for me.

They will ship to the EU but you'll have to pay them some VAT on top of the listed price.

Funny, now the (ended) listing says: "Shipping: Will ship to Netherlands" while yesterday it clearly said it would not. Anyway, I only mentioned it to explain why it didn't show up for me in a search.

[Pinkus]

sold again for exactly $3200. Probably somebody asked them about the shipping and they changed it back. I was wondering too about the excluded shipping. Beside some African and some other obscure countries, Europe was completely excluded. Strange.
@Toploser: why should they add VAT for European countries when they ship from Malaysia (the auctions says: Item location: Keysight Factory, Penang, Malaysia)? (the only reason I can think of is, that the unit is already in an European Keysight facility).

[Pinkus]

Message for SUKA_KRYSA:
FYI: your mailbox is now quoted "full" if anybody tries to send you a PM. As a new user you will now need at least 5 posts before anybody will be able to send you a PM again.
I am writing this, as this security precaution from the admin is pretty unknown (I ran into this before with another new user).

[TopLoser]

sold again for exactly $3200. Probably somebody asked them about the shipping and they changed it back. I was wondering too about the excluded shipping. Beside some African and some other obscure countries, Europe was completely excluded. Strange.
@Toploser: why should they add VAT for European countries when they ship from Malaysia (the auctions says: Item location: Keysight Factory, Penang, Malaysia)? (the only reason I can think of is, that the unit is already in an European Keysight facility).

I presume they collect the VAT that would be due when the scope was imported on behalf of DPD or whoever they use for shipping, so it can be delivered direct to the buyers door without being delayed while the shipper tries to get the VAT out of the buyers reluctant fingers...

[PhillyFlyers]

Yeah, it was quite tempting, but same here, I already got a 3k recently and did all the mods for 500Mhz.    I was intrigued by the 12" screen, but it seems like they made this the 'cadillac variant'  of the 2k/3k series.  LOL

Having that extra real estate sure would be nice, but why do they leave that stupid menu bar on the right of the screen that you can't hide?  At least maybe they can improve this in future software if they care too.. but just seems like a pure waste of screen space..

Dave's writeup/teardown was a nice synopsis of what you are really getting, which ended up being a larger screen that should really be more than 800x600, and a built-in vga/lan port, plus some extra trigger/zoom options.  What you really get is a nice sticker shock!  LOL

(and the MSO port on the back top is kind of a PITA)

At least this used one above sold for somewhat of a decent price, but still, 3kT series seems the better deal.


Dave's summary in case anyone missed it:

[NorcalNerd]

Hello all,

Please advise if my re-hashed steps below are good (or not) -- I've read through this blog, combined Safar's, PhillyFlyers (thanks!) and others posts into a guide I hope I can follow but if anyone with experience can please "sanity check" it I would appreciate it.

I probably paid too much for a (very clean) DSOX3024A, so I'm hoping to avoid bricking it (at my age I may never be able to replace it) -- no worries, I accept any/all responsibility for bricking my scope, but I'm thinking it should go fine, I'm just not 100% certain I have all of the steps right...

Can I ever recover if the flash doesn't work -- and can I get back to "official" 2.43 if I need to send it in for repair or cal?

This is NOT for a commercial application, I'm an electronic tech, reasonably confident I won't make a major mistake.....

Thanks in advance for your review of the below!   I am hoping the latest 2.43 image attached to #msg1453247 has already been "liberated", as I'm not sure I would undertake the entire process "end to end".

Starting with an DSOX3024A I recently updated to Agilent 2.43 -- it has an Agilent DSOXLAN.

Using Patched2.43 attached here https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1453247/#msg1453247:

0/ Telnet to DSOX3024A.  Do the following in WindowsCE:

1/ Copy the uncompressed 2.43 patched.bin.comp attached to #msg1453247 from Windows PC to the scope

2/ Compress the uncompressed posted 2.43 patched.bin.comp:

   compress  bincompress /d patched_nk.bin patched_nk.bin.comp

3/   Kill infiniivisionLauncher.exe process:

   processmgr kill infiniivisionlauncher.exe

4/ Flash: 

   \windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp
   
5/ Save the original link and make the new startup link:

   save the original infiniivision.lnk renaming it to something like "orig.sav".
   
   NOTE: the \secure\startup folder should contain ONLY ONE .lnk file, named infiniivision.lnk, with the below command line (do not add quotes):
   
   "211#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC"
   
   Note: the above link file is 215 bytes in length (thanks to utmba95 and Safar https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1479144/#msg1479144).
   
6/   Reboot the Scope (and pray).

What else am I forgetting?

Is this a "one way" flash or is there any way I can get back to "vanilla" 2.43 in case I need to send it in for repair/cal?  I'm seriously intrigued that it appears the patched 2.43 in #msg1453247 is already "fixed", as if this is the case, the steps I need to perform are far fewer, much less to go wrong...

Thank you kindly,

NorcalNerd

[EE-digger]

Hello all, ...

(at my age I may never be able to replace it)

Too young or too old to replace it ?   

Too young:  forego house, marriage, kids
Too old: forego maintenance on house, marriage kids

Since it's for your own use anyway, I'd suggest one of the less invasive and reversible approaches.  The last 20% of this thread should cover it.

[Safar]

Hello all,

You don't need 2 action, as it already compressed, iir

All another looks good (if you know that you doing of course)

And yes you can flash factory fw for wipe all "crimes"

Edit: and BW50 option do not work on DSOX3024A, this code for 350 Mhz version.

[SUKA_KRYSA]

My bad.
I was very busy recently, and did not have the opportunity to check the forum.

So, did you manage to successfully hack your scope?

[NorcalNerd]

Thanks for asking SUKA_KRYSA,

I am continuing to research though Safar's recent reply indicates recover to factory-default 2.43 should be no problem.

Am I reading correctly that with the newer versions of the firmware, booting from "fixed" firmware on USB isn't possible; that 2.42 (or perhaps older) firmware could boot and run from USB -- but 2.43 cannot?  I may not have the correct firmware version where I recall this changed.

The longer boot time (for me) would not be a problem.

Thank you
NorcalNerd

[SUKA_KRYSA]

Thanks for asking SUKA_KRYSA,

I am continuing to research though Safar's recent reply indicates recover to factory-default 2.43 should be no problem.

Am I reading correctly that with the newer versions of the firmware, booting from "fixed" firmware on USB isn't possible; that 2.42 (or perhaps older) firmware could boot and run from USB -- but 2.43 cannot?  I may not have the correct firmware version where I recall this changed.

The longer boot time (for me) would not be a problem.

Thank you
NorcalNerd

To be honest, I'm completely confused about what you want to do. As far as I understand, you got perfectly working scope, you've succesfully updated it to the latest firmware (2.43 in our case) and everything is fine for now. And you want to hack it by the Safar's method with no troubles e.g. breaking the scope, am I right?

If so, you don't need to decompress and compress that Patched2.43 file, you simply drop it onto the USB stick, boot up, telnet and further on. The only files that must be on the stick is infiniivision.lnk and patched_nk.bin.comp. Note: you create them on your PC, not on the scope via Telnet!

Don't know about older versions, I'm personally flashed straight on 2.43 and evertythibg works just fine. Boot time is the same.

The only issue is a repair/cal process. The patched firmware have no differences with the original one as long Keysight's certified technics don't digs into the code. Don't think they will do it with no reason, too much wasting their precious time. So I believe you can telnet again and overwrite infiniivision.lnk file with empty one before the call process. And again after. Great scheme, huh?

[edyno]

Work on my DSOX2002A continues. The front panel was able to operate. Remaining add main PCB components ...

[Pinkus]

Work on my DSOX2002A continues. The front panel was able to operate. Remaining add main PCB components ...

Cool! I assume you are the first who upgrades from 2 to 4 channels (at least I know nobody else).
If you dare to move to 500 Mhz for all channels, then some of the capacitors are already known. You may also PM Steve or Memset, they might have measured all capacitors and inductors from the input stage.
Where did you get the original knobs from? Are these spare parts which can be ordered?

[edyno]

Hi Pinkus, Yes, knobs are from keysight. Today I received shipment.

Small knob::  OrderNr. = 75019-47402
Big knob:: OrderNr. = 75019-47401
Keyboard keypad:: OrderNr. = 75019-41901

Other parts are from mouser.com
(Rotary encoders, color leds, resistors, diodes, transistors ..)

As far as the main PCB is concerned, I have already measured almost the capacitors from the channels. I will continue when all parts come to me.

But I have trouble getting a twin BNC connector from the main PCB
Do you have an idea where is possible this twin BNC connector obtain?

[Dubbie]

Having that extra real estate sure would be nice, but why do they leave that stupid menu bar on the right of the screen that you can't hide?  At least maybe they can improve this in future software if they care too.. but just seems like a pure waste of screen space..

I'm pretty sure that this is a limitation of the ASIC. I think it draws the pixels directly, so there is pretty much no chance that the screen will ever get any bigger.

[Howardlong]

Having that extra real estate sure would be nice, but why do they leave that stupid menu bar on the right of the screen that you can't hide?  At least maybe they can improve this in future software if they care too.. but just seems like a pure waste of screen space..

I'm pretty sure that this is a limitation of the ASIC. I think it draws the pixels directly, so there is pretty much no chance that the screen will ever get any bigger.

That’s my reading of it too, the space for the waveform display is baked in. Before I became the owner of the 3000, I too was sceptical about the apparent waste of screen real estate, but to be honest I’ve not really found it a big deal. The alternative is the way the Tek MDO3000 does it where you get all sorts of nonsense invading your waveform display, which I find more irritating, having to continually clear the clutter off manually to be able to see the waveforms.

This is a side effect of using 16:9 displays, the 4:3 aspect ratio displays seem a better solution for a scope UI in my experience.

[Pinkus]

But I have trouble getting a twin BNC connector from the main PCB
Do you have an idea where is possible this twin BNC connector obtain?

These connectors are probably a custom Keysight part = unobtainium. But as you can see, these connectors does have unusual long connection wires (> 1 cm), you probably can use regular single BNC connectors (e.g. Amphenol 162109) and a peace of metal you need to mill and drill, where you then screw the mentioned Amphenol connectors to (such as the other photo shows).
(Photos taken from Daves teardown of a 4000 series scope)

[edyno]

Yes, I agree with you. I will have to improvise somewhat with the connectors.

[Hydron]

From the earlier pics it seems there is a custom Keysight front-end chip - how did you go about getting these? Just asking out of interest (don't own a Keysight scope), but am impressed with your ambitious product hacking project!

[edyno]

If you mean the chip: 2AD2-0001?
I bought 2pcs on aliexpress.

[EE-digger]

Where on earth did they get the chips from?  Are they bootleg from the foundry which Agilent used?

[edyno]

Good question, but I hope it's not fake and that the chips will work

[gamalot]

Where on earth did they get the chips from?  Are they bootleg from the foundry which Agilent used?

In China, we try to find everything on Taobao.