Author Topic: EEVblog #978 - Keysight 1000X Hacking  (Read 534706 times)

0 Members and 3 Guests are viewing this topic.

Offline Palmer

  • Newbie
  • Posts: 6
  • Country: pl
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #1050 on: March 15, 2024, 02:09:09 pm »
In memory, I changed pbootdelay and bootdelay to 3, along with CRC correction.
I attach the logs and the memory file.

Try replacing usbtty -> serial 
Recalculate the checksum then.

Thanks !
Now pboot is working.
I tried to upload the soft like the x3000 series and the method described in another thread. Uploading via loady the nk.nb0 file previously prepared and firing from infinivision flash drive.
Unfortunately I only showed the logo on the oscilloscope and a reset occurred :-/.

log_3 - boot procedure
log_4 - printenv
 

Online Bud

  • Super Contributor
  • ***
  • Posts: 7269
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #1051 on: March 15, 2024, 07:08:17 pm »
You cant use 3000x USB based procedure for 1000x, it is not working on 1000x., forget it.
Something maybe missing in your printenv output, i will look later today.
Facebook-free life and Rigol-free shack.
 

Online Bud

  • Super Contributor
  • ***
  • Posts: 7269
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #1052 on: March 16, 2024, 11:35:11 pm »
Before doing the 'go' command try 'run preboot'

Edit: ...unplug the USB drive before attempting to boot.
« Last Edit: March 17, 2024, 01:20:09 am by Bud »
Facebook-free life and Rigol-free shack.
 
The following users thanked this post: Palmer

Offline Palmer

  • Newbie
  • Posts: 6
  • Country: pl
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #1053 on: March 18, 2024, 11:35:18 am »
Before doing the 'go' command try 'run preboot'

Edit: ...unplug the USB drive before attempting to boot.

When I tried to use "run preboot" (between loady and go) then after using the "go" command no action occurred.

I initially tried on firmware version 1.2 from the manufacturer's website and 1.1 patch from the forum. In both cases booting stops at the same point. (The original firmware is 1.1)

What do you mean by "...unplug the USB drive before attempting to boot." ?
After all, the procedure is to upload the nk.nb0 file to memory (it's basically a windows CE image) and have the system fire the application from the flash drive. Am I wrong ?

TT-392 went through a similar procedure so I hope that I will also succeed.
 

Online Bud

  • Super Contributor
  • ***
  • Posts: 7269
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #1054 on: March 18, 2024, 01:11:29 pm »
Can you point me to  a TT-392's post where he said he started the application from a USB drive ?
Facebook-free life and Rigol-free shack.
 

Offline Palmer

  • Newbie
  • Posts: 6
  • Country: pl
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #1055 on: March 19, 2024, 10:48:42 am »
eh you are right without a flash drive the application started by itself and could be updated from the flash drive then.

As a thank you, I am preparing a description of the procedure should someone look here in the future with an identical problem and not have to ask questions.

I think that I will finish the description later today max. tomorrow.
 

Offline Palmer

  • Newbie
  • Posts: 6
  • Country: pl
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #1056 on: March 19, 2024, 11:34:57 am »
If your oscilloscope has a black screen and only the buttons light up probably this tutorial should fix it.

- unscrew the oscilloscope to get at the small board mounted in the motherboard.
- solder out u701 chip  (on back of plate)
- rip the x.bin file with the programmer
- open the file in hexeditor
- edit bootdelay=3 and pbootdelay=3 positions (look for 000402E0 and 00040380)
- change usbtty to serial (00040280 and following)
- calculate (in hexeditor) from addresses (0x00040004 - 0x00043FFF) the value of crc32. Change on the first 4 bytes(0x00040000-0x00040003).
 Remember the reverse order of entry! If the calculated value is 75 4D 12 8E then we type 8E 12 4D 75.
- we save the file, upload to memory, solder.
- solder the wires to the serial port as in the attached video in the 1st post (I also include a photo before cleaning the excess flux ;-)).
 We connect to the computer via usb-uart converter. We install TeraTerm. It will be needed to handle the serial port and the YModem protocol.
From the default settings of the serial port, we change the speed to 115200.
- Now we have access to pboot (prompt p500) on the serial. (If we abort the boot)

Prepare the necessary file.
Download the firmware from the manufacturer's website. Open in totalcommander or change the extension to x.cab then it should open as an archive also in windows.

We proceed to:

X:\yourfolder>bincompress /d nk.bin.comp nk.bin

Check the length of the file.

X:yourfolder>viewbin nk.bin

Image Start = 0x80361000, length = 0x01A857C0
                Start address = 0x80362000
Checking record #45 for potential TOC (ROMOFFSET = 0xFE992E44)
Checking record #50 for potential TOC (ROMOFFSET = 0xFE9C3E44)
Checking record #126 for potential TOC (ROMOFFSET = 0xFF1F0E3C)
Checking record #189 for potential TOC (ROMOFFSET = 0x00000000)
NOTICE! Record 189 looked like a TOC except DLL first = 0x4001C001, and DLL last = 0x4192C095.
Done.

X:yourfolder>cvrtbin.exe -r -a 0x80361000 -w 32 -l 0x01A857C0 nk.bin

This will result in a nk.nb0 in the same folder.

- Now we can upload the prepared file to memory.
p500> loady 0x00361000 115200

In Tera Term go to File->Transfer->YMODEM->Send.... and open the nk.nb0 that you have prepared before.

The uploading process will take about 50 minutes.

# Ready for binary (ymodem) download to 0x00361000 at 115200 bps....
CCCxyzModem - CRC mode, 1(SOH)/27158(STX)/0(CAN) packets, 10 retries
## Total Size = 0x01a857c0 = 27809728 Bytes

-Now we can boot the system. You need to remember that nothing is inserted in the USB port.
p500> go 0x00362000

## Starting application at 0x00362000 ...
Windows CE Kernel for ARM (Thumb Enabled) Built on Mar 8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Jun 10 2019)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area....
pDrvGlobalArea 0xa0060000 size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
++SER_Init: context Drivers.
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200 (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
LAN PHY NOT detected.
DeleteP500EnetRegistry:
   \_CommGMAC 0x0.
   \_CommGMAC1 0x0.
   \_CommTcpipLinkage 0x0.
   \n-Virtual 0x0.
   \■DriversBuiltInLIN 0x5
LIN: Data Valid
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
ERROR: c:WINCE600PLATFORMCOMMONDIVERS.c line 656: Rewrite recommended, internal ECC corrected data at 0xbe15.
Rewrite Block at Sector Address 0xbe15. 4541
Read Block SUCCEEDED 4572
Erased Block SUCCEEDED 4574
Completed rewriting Block SUCCEEDED 4623
Device load time:
   NANDFLASH: 0 ms
   SNANDFLASH: 0 ms
ERROR: OALIoCtlHalGetDeviceInfo: Device doesn't support IOCTL_HAL_GET_DEVICE_INFO::SPI_GETBOOTMENAME
SHIM DLL, LoadRealDll [PalIO.dll] for [AgilentPalIO.dll].
SHIM [AgilentPalIO.dll] Get Process Addresses
LaunchInfiniiVision:
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll].
SHIM [AgilentPalSStorage.dll] Get Process Addresses

    invalid clock reading: Sat Jan 01 01:00:00 2000
Released build, Jun 10 2019, 21:13:39
Initializing FPGA...
************************************
Ver: 1.067 Released
************************************
ERROR: c:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 656: Rewrite recommended, internal ECC corrected data at 0xbfc8
Rewriting Block at Sector Address 0xbfc8. 11622
ERROR: c:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 656: Rewrite recommended, internal ECC corrected data at 0xbfc8
Read Block SUCCEEDED 11667
Erased Block SUCCEEDED 11668
Completed rewriting Block SUCCEEDED 11703
Calibration mode User
Cal Date Mon Apr 08 13:10:31 2019
Startup sequence is complete.
Saved configuration invalid
System has been running 16.266155 seconds
Start Up Sequence 6.680450
Memory Load 52%
   System Physical Memory 37.832 / 73.465 MB
   Process Virtual Memory 46.688 / 1024.000 MB
-----> InfiniiVision is running <-----

- Now on the flash drive (FAT32) place the firmware from the manufacturer's website and run the update procedure.
It is important to remove the flash drive after restarting, otherwise the system will not boot.

Thanks again Bud for the information ! With your help and information about the repair procedure for the x2000 and x3000 oscilloscopes, I was able to repair this model as well.

 
The following users thanked this post: sprit

Online Bud

  • Super Contributor
  • ***
  • Posts: 7269
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #1057 on: March 19, 2024, 01:21:32 pm »
 :-+
Facebook-free life and Rigol-free shack.
 
The following users thanked this post: sprit

Offline Anthocyanina

  • Frequent Contributor
  • **
  • Posts: 395
  • Country: 00
  • The Sara
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #1058 on: March 24, 2024, 09:32:53 am »
ok! i checked every solder joint on the BLT connectors and the components with visible solder joints, nothing looked suspect, but as a just in case, i used the hot air station on the spear600 and the memory ICs. i noticed some flux residue was left near the damaged connector, so i just basically bathed that side of the BLT in isopropyl, making sure tehre was no residue at all, then i placed the BLT back where it belongs, but i didn't fully press it in, just enough that there would be contact, and to my surprise, i got a full boot! still don't have a proper USB adapter, but i captured the data with an analog discovery 2, which was a lot easier to read than scrolling the rigol capture. there were a couple of differences on the log between what i got and one log someone posted years ago on this thread, but i read it all and there were no errors this time.

i then fully seated the BLT and turned it back on, and i got a few more full boot sequences. it boots up much more consistently than before, but it some times takes significantly more time for a full boot, and sometimes it does boot at its regular speed, and sometimes it doesn't boot at all.

 

Offline is9582

  • Newbie
  • Posts: 3
  • Country: us
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #1059 on: May 01, 2024, 05:33:39 am »
I just received a used DSOX1102G today (eBay purchase) and unknowingly crapped all over it. I saw it was running FW 1.10, and there was a nice shiny new FW 1.20, just calling out my name.  |O I snapped a shot of the "About This Oscilloscope" page, prior to engaging my stupidity, which displayed a whole host of installed licenses, and displayed the BW as 200MHz. I just thought the seller had purchased licenses and upgrades (MSO, FPG, memMax, EMBD, AUTO, ALT, FLEX, PWR, SGM, MASK, TEL, BW50, BW20, BW10, BW7, FRC, AUDIO, DIS, EDK, WAVEGEN, AERO, VID, ADVMATH, FLEXC, DIS, DIS, VID, DVM, ASV, CABLE, SCPIPS, RML, SGMC, TOM, FWD), not knowing 200MHz wasn't even an offered BW for this scope.  :-//

So, as I'm quite sure, everyone that has been on this ride for any time at all, already knows that my new shiny gem is now just a kinda dull penny. 70MHz with four or five items listed in licenses! Doh! Any guidance that might help me get back to whence my scope once was??

I guess I'm so used to snagging and loading the newest FW onto my Fractal Audio AF3, on the regular, that the other scenarios never even crossed my older brain.

Hell of an introduction, huh??
Cheers,
Lee
 

Offline Anthocyanina

  • Frequent Contributor
  • **
  • Posts: 395
  • Country: 00
  • The Sara
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #1060 on: May 01, 2024, 07:53:54 am »
I just received a used DSOX1102G today (eBay purchase) and unknowingly crapped all over it. I saw it was running FW 1.10, and there was a nice shiny new FW 1.20, just calling out my name.  |O I snapped a shot of the "About This Oscilloscope" page, prior to engaging my stupidity, which displayed a whole host of installed licenses, and displayed the BW as 200MHz. I just thought the seller had purchased licenses and upgrades (MSO, FPG, memMax, EMBD, AUTO, ALT, FLEX, PWR, SGM, MASK, TEL, BW50, BW20, BW10, BW7, FRC, AUDIO, DIS, EDK, WAVEGEN, AERO, VID, ADVMATH, FLEXC, DIS, DIS, VID, DVM, ASV, CABLE, SCPIPS, RML, SGMC, TOM, FWD), not knowing 200MHz wasn't even an offered BW for this scope.  :-//

So, as I'm quite sure, everyone that has been on this ride for any time at all, already knows that my new shiny gem is now just a kinda dull penny. 70MHz with four or five items listed in licenses! Doh! Any guidance that might help me get back to whence my scope once was??

I guess I'm so used to snagging and loading the newest FW onto my Fractal Audio AF3, on the regular, that the other scenarios never even crossed my older brain.

Hell of an introduction, huh??
Cheers,
Lee

it's been a lot of pages since then, but maybe that scope has FERCSA's firmware installed? had? (it's not clear in your post what's wrong with the scope)

does the scope work fine? by the title of the thread you might already be aware that this scope does support 200MHz bandwidth but not through official means. those unofficial means include FERCSA's firmware, Bud's firmware, resistors setting the hardware configuration, and who knows if anyone else hacked their own firmware to unlock the options.

if the firmware you installed was from keysight's website, it could be that the previous firmware installed was FERCSA's. you could try installing Bud's 1.20 unlocked firmware and get all the working options back. if it was another custom firmware+hardware modifications, maybe ask the seller to send you the modified firmware and install it again?
 

Offline is9582

  • Newbie
  • Posts: 3
  • Country: us
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #1061 on: May 01, 2024, 11:54:15 am »
@anthocyanina

The scope does work presently, at a slower bandwidth, and less features. I didn’t explain well, but do believe it was hacked prior to me purchasing. I don’t know if the person that sold this scope, bought it new, or second-hand (like me). I’ll reach out to the seller first, and if unsuccessful, try Bud’s 1.20 unlocked firmware. Fingers crossed! I appreciate your input and assistance.

Cheers,

Lee
 

Offline is9582

  • Newbie
  • Posts: 3
  • Country: us
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #1062 on: May 01, 2024, 08:32:12 pm »
Just wanted to share that I was successful obtaining a previous backup of my scope from the seller. Whew, a learning event.  :phew: Let’s see if I can keep my goof-ups to a minimum from this point forward!  :-[  :-+

Lee
 

Offline Anthocyanina

  • Frequent Contributor
  • **
  • Posts: 395
  • Country: 00
  • The Sara
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #1063 on: May 03, 2024, 01:56:01 am »
Just wanted to share that I was successful obtaining a previous backup of my scope from the seller. Whew, a learning event.  :phew: Let’s see if I can keep my goof-ups to a minimum from this point forward!  :-[  :-+

Lee

great! do you know if it was FERCSA's firmware? or another custom one?
 

Offline salomonander

  • Contributor
  • Posts: 46
  • Country: de
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #1064 on: October 08, 2024, 11:13:14 am »
After reading through the thread im still not certain…. Stupid me i guess. Is it possible to hack the EDUX1002G without killing its capability to self diagnose and have other features not working correctly?

Thanks
 

Online Bud

  • Super Contributor
  • ***
  • Posts: 7269
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #1065 on: October 09, 2024, 02:37:59 am »
Yes. But for some features to work it is required to perform hardware update by soldering unpopulated components.
Facebook-free life and Rigol-free shack.
 

Offline luisprata

  • Regular Contributor
  • *
  • Posts: 61
  • Country: br
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #1066 on: November 03, 2024, 06:14:32 pm »
Hi Folks,

I've tried to update my EDUX firmware to BUD and FERCSA without sucess. The scope shows "invalid file" message. My current version is 2.12 2021.

Is it possible to update from 2.12.2021 stock version?

Thank you. 
 

Offline ttelectronic

  • Regular Contributor
  • *
  • Posts: 66
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #1067 on: November 06, 2024, 02:46:46 am »
The StupidBear LAN board for the EDUX provides 100Mbit/s full duplex network Ethernet connectivity. It also has a USB-to-UART bridge and a second USB Host port, which  were used for debugging and to connect a keyboard or mouse. They are not needed if only LAN is required. The board gets power from the main board. Refer to the PDF attachment for the schematic.





Also attached is the BOM that has DigiKey part numbers for the critical components, and the Gerber files to order a PCB if you want to build a StupidBear LAN board for your Keysight 1000X including the EDUX model and have some fun.
Important: The LAN PCB thickness must be 1mm in order to have some clearance above the components under it on the scope's main PCB.

I've had the boards sitting around and have most everything added to my digikey BOM list, I am of course a little hesitant due to the Murphy factor. And my apologies if I have missed it, I looked at the schematic and the notes in the post.

I understand the wires hooking up the main board +5V to the Lan board for usb power. What is the black section of the wire there? (between J5 and the mainboard) Thank you for the time and effort into this and the firmware.  :-+
 

Offline Anthocyanina

  • Frequent Contributor
  • **
  • Posts: 395
  • Country: 00
  • The Sara
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #1068 on: November 06, 2024, 06:21:16 am »
Hi Folks,

I've tried to update my EDUX firmware to BUD and FERCSA without sucess. The scope shows "invalid file" message. My current version is 2.12 2021.

Is it possible to update from 2.12.2021 stock version?

Thank you.

The latest official firmware was released in 2019, so it sounds like you have the black version of the oscilloscope which runs on linux and isn't compatible with Bud's or FERCSA's firmwares
 
The following users thanked this post: luisprata

Online Bud

  • Super Contributor
  • ***
  • Posts: 7269
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #1069 on: November 08, 2024, 05:59:47 am »
I understand the wires hooking up the main board +5V to the Lan board for usb power. What is the black section of the wire there? (between J5 and the mainboard)
You mean the black wires between J3 and the mainboard? This is a connection to the USB hub IC on the mainboard bottom. U1 is the USB to Serial bridge IC, the Serial side is connected to Spear600 serial debug port. The idea was to allow access to the Serial debug port using the scope's USB connector at the back of the scope, with the scope back cover in place.
That part of the circuit is not required for Ethernet LAN functionality.
Facebook-free life and Rigol-free shack.
 
The following users thanked this post: ttelectronic

Offline ttelectronic

  • Regular Contributor
  • *
  • Posts: 66
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #1070 on: November 08, 2024, 10:57:12 am »
You mean the black wires between J3 and the mainboard? This is a connection to the USB hub IC on the mainboard bottom. U1 is the USB to Serial bridge IC, the Serial side is connected to Spear600 serial debug port. The idea was to allow access to the Serial debug port using the scope's USB connector at the back of the scope, with the scope back cover in place.
That part of the circuit is not required for Ethernet LAN functionality.

Apologies that is still very useful info for me!  I'm thinking I am halfway there so I may as well populate the whole board just in case and connect it if ever needed or desired.

I don't think I described it well. I have circled it below. I can't really make it out whether it's a wire holder or maybe an inline fuse?
Thank you.  :)

 

Online Bud

  • Super Contributor
  • ***
  • Posts: 7269
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #1071 on: November 08, 2024, 01:04:38 pm »
It is a connector. I was still experimenting with the board and put a 2-pin connector so i did not have to unsolder/solder the wires every time.
Facebook-free life and Rigol-free shack.
 
The following users thanked this post: ttelectronic

Offline ttelectronic

  • Regular Contributor
  • *
  • Posts: 66
  • Country: ca
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #1072 on: November 08, 2024, 09:36:29 pm »
Ah, thanks I couldn't tell with the colour of it. That's really not a bad idea anyways. Kind of noodling through all the possibilities.

Thank you.  :-+
 

Offline sprit

  • Regular Contributor
  • *
  • Posts: 100
  • Country: vn
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #1073 on: December 10, 2024, 01:33:34 pm »
Hello, I have this problem and hope you can help me.

I have an EDUX1002G that is failing, after checking with UART I realized it is having nand memory problems. (Screen is black and keys stay lit). I extracted the old bin file from ST's U701(25VP40 with programer) and then edited it with Hex Editor.
Currently, after setting the menu pbootdelay=3 and bootdelay=3, I can access the pboot menu, but when downloading the nk.b0 file via Teraterm successfully, the command line go 0x00362000 will boot but stuck at BALDWIN_DDI: cBaldwinHwIf ::Init: Scope successfully identified. Nothing happens next after that command line. Do you know what's going on?

I don't understand this clearly
- calculate (in hexeditor) from addresses (0x00040004 - 0x00043FFF) the value of crc32. Change on the first 4 bytes(0x00040000-0x00040003).
 Remember the reverse order of entry! If the calculated value is 75 4D 12 8E then we type 8E 12 4D 75.

Could that be the cause of the error? In the file that I loaded into the U701, I just edited pbootdelay, bootdelay, "usb" to "serial" without calculating CRC32 something, sorry I don't know how to do that.
Below is the full log that I copied from TeraTearm.
Code: [Select]

U-Boot 2010.03 (May 18 2017 - 11:28:22)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  fsmc-ecc1 128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   unknown
BMP data is not valid. Use splash bmp
failed: 355 0
Could not copy from NAND offset 0x60000. Error -74 With ECC
failed: 710 355
Could not copy from NAND offset 0x60000. Error -74 NO ECC
FPGA programming FAILED!
Press space to stop autoboot: 0
p500> loady 0x00361000 115200
## Ready for binary (ymodem) download to 0x00361000 at 115200 bps...
CCancelled
xyzModem - Cksum mode, 3(SOH)/0(STX)/3(CAN) packets, 13 retries
## Total Size      = 0x00000000 = 0 Bytes
p500> loady 0x00361000 115200
## Ready for binary (ymodem) download to 0x00361000 at 115200 bps...
CCxyzModem - CRC mode, 1(SOH)/27155(STX)/0(CAN) packets, 3 retries
## Total Size      = 0x01a84978 = 27806072 Bytes
p500> go 0x00362000
## Starting application at 0x00362000 ...
Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Jan 28 2018)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
Incorrect Data 0 EccResult: cf3f EccError: 401d EccRead: 8f22
Incorrect Data 1 EccResult: 999655 EccError: 9615 EccRead: 990040
Incorrect Data 0 EccResult: 655566 EccError: 441444 EccRead: 214122
Incorrect Data 1 EccResult: fc00 EccError: fc00 EccRead: 0
Incorrect Data 0 EccResult: 565565 EccError: 444145 EccRead: 121420
Incorrect Data 1 EccResult: 6aaa99 EccError: aa19 EccRead: 6a0080
Incorrect Data 0 EccResult: f3330f EccError: 110105 EccRead: e2320a
Incorrect Data 1 EccResult: ff0033 EccError: 11 EccRead: ff0022
Incorrect Data 1 EccResult: c0f0cf EccError: f04b EccRead: c00084
Incorrect Data 0 EccResult: 3cc3c0 EccError: 1c4340 EccRead: 208080
Incorrect Data 1 EccResult: 6a5a55 EccError: 5a01 EccRead: 6a0054
Incorrect Data 0 EccResult: c03cf EccError: 2c4 EccRead: c010b
Incorrect Data 1 EccResult: 956696 EccError: 6690 EccRead: 950006
Incorrect Data 0 EccResult: a95655 EccError: 94054 EccRead: a01601
Incorrect Data 0 EccResult: 6996a9 EccError: 298621 EccRead: 401088
Incorrect Data 1 EccResult: c33cfc EccError: 3c94 EccRead: c30068
Incorrect Data 0 EccResult: f0fcc EccError: b0c88 EccRead: 40344
Incorrect Data 1 EccResult: ff03f0 EccError: 2a0 EccRead: ff0150
Incorrect Data 1 EccResult: 96599a EccError: 5812 EccRead: 960188
Incorrect Data 0 EccResult: c3cf3f EccError: 410410 EccRead: 82cb2f
Incorrect Data 1 EccResult: c0c3cf EccError: c243 EccRead: c0018c
Incorrect Data 1 EccResult: a95995 EccError: 5884 EccRead: a90111
Incorrect Data 0 EccResult: ffc0fc EccError: 1480a8 EccRead: eb4054
Incorrect Data 1 EccResult: fcc3c EccError: cc18 EccRead: f0024
Incorrect Data 0 EccResult: cf333f EccError: 4b2228 EccRead: 841117
Incorrect Data 1 EccResult: 96a966 EccError: a820 EccRead: 960146
Incorrect Data 0 EccResult: fff3cf EccError: 111044 EccRead: eee38b
Incorrect Data 1 EccResult: a5a665 EccError: a644 EccRead: a50021
Incorrect Data 0 EccResult: a99596 EccError: a19084 EccRead: 80512
Incorrect Data 1 EccResult: 6a6599 EccError: 6500 EccRead: 6a0099
Incorrect Data 0 EccResult: a566aa EccError: 52002 EccRead: a046a8
Incorrect Data 1 EccResult: a99666 EccError: 9622 EccRead: a90044
Incorrect Data 0 EccResult: f3f033 EccError: 31e020 EccRead: c21013
Incorrect Data 1 EccResult: 965a65 EccError: 5a04 EccRead: 960061
Incorrect Data 0 EccResult: 696695 EccError: 400681 EccRead: 296014
Incorrect Data 0 EccResult: 6aaa5a EccError: 82210 EccRead: 62884a
Incorrect Data 1 EccResult: 33cf30 EccError: cf20 EccRead: 330010
Incorrect Data 0 EccResult: 655695 EccError: 211211 EccRead: 444484
Incorrect Data 1 EccResult: 303cf0 EccError: 3cb0 EccRead: 300040
Incorrect Data 0 EccResult: f0ffc3 EccError: c0dc80 EccRead: 302343
Incorrect Data 1 EccResult: f30c3c EccError: c1c EccRead: f30020
Incorrect Data 0 EccResult: 565965 EccError: 504045 EccRead: 61920
Incorrect Data 1 EccResult: a6a9a9 EccError: a880 EccRead: a60129
Incorrect Data 0 EccResult: 30cfc0 EccError: 300c80 EccRead: c340
Incorrect Data 1 EccResult: fc0c0f EccError: c02 EccRead: fc000d
Incorrect Data 0 EccResult: 33033 EccError: 1010 EccRead: 32023
Incorrect Data 1 EccResult: 3c030f EccError: 209 EccRead: 3c0106
Incorrect Data 0 EccResult: aa5669 EccError: 824060 EccRead: 281609
Incorrect Data 1 EccResult: ff0330 EccError: 210 EccRead: ff0120
Incorrect Data 0 EccResult: 56a599 EccError: 522499 EccRead: 48100
Incorrect Data 1 EccResult: aa5966 EccError: 5904 EccRead: aa0062
Incorrect Data 0 EccResult: 6565a9 EccError: 6121a9 EccRead: 44400
Incorrect Data 1 EccResult: fcf0c EccError: cf0c EccRead: f0000
Incorrect Data 0 EccResult: 9a9999 EccError: 101100 EccRead: 8a8899
Incorrect Data 1 EccResult: a95aa6 EccError: 5aa2 EccRead: a90004
Incorrect Data 0 EccResult: fffc0c EccError: 41400 EccRead: fbe80c
Incorrect Data 1 EccResult: ff003f EccError: 15 EccRead: ff002a
Incorrect Data 0 EccResult: 569a65 EccError: 108040 EccRead: 461a25
Incorrect Data 1 EccResult: ff00cf EccError: 44 EccRead: ff008b
Incorrect Data 0 EccResult: aaa55a EccError: a82508 EccRead: 28052
Incorrect Data 1 EccResult: 30303 EccError: 301 EccRead: 30002
Incorrect Data 0 EccResult: fccc3c EccError: 680c04 EccRead: 94c038
Incorrect Data 1 EccResult: aa559a EccError: 5500 EccRead: aa009a
Incorrect Data 0 EccResult: ccf3cf EccError: 4141 EccRead: ccb28e
Incorrect Data 1 EccResult: 3ccf0 EccError: cc80 EccRead: 30070
Incorrect Data 0 EccResult: f30cf EccError: d0004 EccRead: 230cb
Incorrect Data 1 EccResult: a99a6a EccError: 9a68 EccRead: a90002
Incorrect Data 0 EccResult: 330000 EccError: 220000 EccRead: 110000
Incorrect Data 1 EccResult: 55a65a EccError: a640 EccRead: 55001a
Incorrect Data 0 EccResult: c0ffcc EccError: 805c88 EccRead: 40a344
Incorrect Data 1 EccResult: a599aa EccError: 99aa EccRead: a50000
Incorrect Data 0 EccResult: 9aa959 EccError: 9a8011 EccRead: 2948
Incorrect Data 1 EccResult: 6a96aa EccError: 96a0 EccRead: 6a000a
Incorrect Data 0 EccResult: a56995 EccError: 2800 EccRead: a54195
Incorrect Data 1 EccResult: ccffcf EccError: fe8a EccRead: cc0145
Incorrect Data 0 EccResult: c0fc EccError: c030 EccRead: cc
Incorrect Data 1 EccResult: 6a666a EccError: 6662 EccRead: 6a0008
Incorrect Data 0 EccResult: f330 EccError: 4010 EccRead: b320
Incorrect Data 1 EccResult: f3f0c3 EccError: f001 EccRead: f300c2
Incorrect Data 0 EccResult: fcc EccError: f84 EccRead: 48
Incorrect Data 0 EccResult: 5569a9 EccError: 1428a0 EccRead: 414109
Incorrect Data 0 EccResult: a95aa5 EccError: 852a5 EccRead: a10800
Incorrect Data 1 EccResult: f3f33f EccError: f30c EccRead: f30033
Incorrect Data 0 EccResult: c0fcf0 EccError: 405450 EccRead: 80a8a0
Incorrect Data 1 EccResult: ff00cc EccError: 44 EccRead: ff0088
Incorrect Data 0 EccResult: f033cf EccError: 601349 EccRead: 902086
Incorrect Data 1 EccResult: 3c0c0c EccError: c08 EccRead: 3c0004
Incorrect Data 0 EccResult: f3c0fc EccError: 6240e0 EccRead: 91801c
Incorrect Data 1 EccResult: 33f300 EccError: f300 EccRead: 330000
Incorrect Data 0 EccResult: 65669a EccError: 654498 EccRead: 2202
Incorrect Data 1 EccResult: aa55aa EccError: 5400 EccRead: aa01aa
Incorrect Data 0 EccResult: 69a65a EccError: 408010 EccRead: 29264a
Incorrect Data 1 EccResult: fc00f EccError: c002 EccRead: f000d
Incorrect Data 0 EccResult: 56a959 EccError: 12a818 EccRead: 440141
Incorrect Data 1 EccResult: 3c33c EccError: c328 EccRead: 30014
Incorrect Data 0 EccResult: f0cc00 EccError: 300400 EccRead: c0c800
Incorrect Data 0 EccResult: c3f33c EccError: c01308 EccRead: 3e034
Incorrect Data 1 EccResult: a9aa5a EccError: aa00 EccRead: a9005a
Incorrect Data 0 EccResult: f030c EccError: 10300 EccRead: e000c
Incorrect Data 1 EccResult: c30fc0 EccError: f00 EccRead: c300c0
Incorrect Data 0 EccResult: 99aa66 EccError: 980a02 EccRead: 1a064
Incorrect Data 1 EccResult: f0c0f3 EccError: c0e0 EccRead: f00013
Incorrect Data 0 EccResult: fc0 EccError: d00 EccRead: 2c0
Incorrect Data 1 EccResult: 3ffc33 EccError: fc21 EccRead: 3f0012
Incorrect Data 0 EccResult: 6a5659 EccError: 6a4408 EccRead: 1251
Incorrect Data 1 EccResult: 9955aa EccError: 54a8 EccRead: 990102
Incorrect Data 0 EccResult: 3cffc EccError: 30b40 EccRead: c4bc
Incorrect Data 1 EccResult: 30cc0f EccError: cc01 EccRead: 30000e
Incorrect Data 0 EccResult: cccc EccError: 4c00 EccRead: 80cc
Incorrect Data 1 EccResult: c30f EccError: c20a EccRead: 105
Incorrect Data 0 EccResult: 696a56 EccError: 682a46 EccRead: 14010
Incorrect Data 1 EccResult: a5a956 EccError: a816 EccRead: a50140
Incorrect Data 0 EccResult: 3ffcfc EccError: 17c45c EccRead: 2838a0
Incorrect Data 1 EccResult: 96666a EccError: 6668 EccRead: 960002
Incorrect Data 1 EccResult: 33f0f3 EccError: f0d1 EccRead: 330022
Incorrect Data 0 EccResult: ff3c0c EccError: b61808 EccRead: 492404
Incorrect Data 1 EccResult: 3ccff EccError: cc4e EccRead: 300b1
Incorrect Data 1 EccResult: 3f300f EccError: 3006 EccRead: 3f0009
Incorrect Data 0 EccResult: c30300 EccError: 800300 EccRead: 430000
Incorrect Data 1 EccResult: 3ff0fc EccError: f064 EccRead: 3f0098
Incorrect Data 0 EccResult: 9a659a EccError: 8a2592 EccRead: 104008
Incorrect Data 1 EccResult: 9a955a EccError: 9518 EccRead: 9a0042
Incorrect Data 0 EccResult: aa59a6 EccError: 81982 EccRead: a24024
Incorrect Data 1 EccResult: 3cff EccError: 3cd2 EccRead: 2d
Incorrect Data 0 EccResult: c3ff EccError: c1af EccRead: 250
Incorrect Data 1 EccResult: 30cfcf EccError: ce86 EccRead: 300149
Incorrect Data 0 EccResult: a95aa5 EccError: a85a04 EccRead: 100a1
Incorrect Data 1 EccResult: a56955 EccError: 6844 EccRead: a50111
Incorrect Data 0 EccResult: 6a56a6 EccError: 204420 EccRead: 4a1286
Incorrect Data 1 EccResult: 99a556 EccError: a410 EccRead: 990146
Incorrect Data 0 EccResult: c03cf3 EccError: 800c71 EccRead: 403082
Incorrect Data 1 EccResult: 969a5a EccError: 9a42 EccRead: 960018
Incorrect Data 0 EccResult: 55955a EccError: 45815a EccRead: 101400
Incorrect Data 1 EccResult: cf0cc EccError: f04c EccRead: c0080
Incorrect Data 0 EccResult: 9a6969 EccError: 100141 EccRead: 8a6828
Incorrect Data 1 EccResult: f03f00 EccError: 3e00 EccRead: f00100
Incorrect Data 0 EccResult: 966955 EccError: 964901 EccRead: 2054
Incorrect Data 1 EccResult: 959a9a EccError: 9a82 EccRead: 950018
Incorrect Data 0 EccResult: 9a5696 EccError: 25696 EccRead: 980000
Incorrect Data 1 EccResult: f3303f EccError: 3025 EccRead: f3001a
Incorrect Data 0 EccResult: c303 EccError: c200 EccRead: 103
Incorrect Data 1 EccResult: c330c0 EccError: 3000 EccRead: c300c0
Incorrect Data 0 EccResult: 6a6555 EccError: 482100 EccRead: 224455
Incorrect Data 0 EccResult: c03f30 EccError: 400310 EccRead: 803c20
Incorrect Data 1 EccResult: 996559 EccError: 6549 EccRead: 990010
Incorrect Data 1 EccResult: c3c03c EccError: c028 EccRead: c30014
Incorrect Data 0 EccResult: 9a96a6 EccError: 9204a4 EccRead: 89202
Incorrect Data 1 EccResult: f0f000 EccError: f000 EccRead: f00000
Incorrect Data 0 EccResult: 999566 EccError: 981420 EccRead: 18146
Incorrect Data 1 EccResult: f33fcf EccError: 3ec2 EccRead: f3010d
Incorrect Data 0 EccResult: fc3c33 EccError: dc0c30 EccRead: 203003
Incorrect Data 1 EccResult: c00330 EccError: 300 EccRead: c00030
Incorrect Data 0 EccResult: f0300 EccError: 90000 EccRead: 60300
Incorrect Data 1 EccResult: f33030 EccError: 3030 EccRead: f30000
Incorrect Data 0 EccResult: f3033 EccError: c2012 EccRead: 31021
Incorrect Data 1 EccResult: 9a5695 EccError: 5691 EccRead: 9a0004
Incorrect Data 0 EccResult: 55996a EccError: 441822 EccRead: 118148
Incorrect Data 1 EccResult: c3fffc EccError: ff44 EccRead: c300b8
Incorrect Data 0 EccResult: a69955 EccError: 801 EccRead: a69154
Incorrect Data 1 EccResult: aa5a66 EccError: 5a62 EccRead: aa0004
Incorrect Data 0 EccResult: 66a599 EccError: 20a009 EccRead: 460590
Incorrect Data 1 EccResult: f3ff33 EccError: fe10 EccRead: f30123
Incorrect Data 0 EccResult: 6aa965 EccError: 402060 EccRead: 2a8905
Incorrect Data 1 EccResult: c3cc3 EccError: 3cc3 EccRead: c0000
Incorrect Data 0 EccResult: 566aa9 EccError: 440088 EccRead: 126a21
Incorrect Data 0 EccResult: ffc0fc EccError: b140d8 EccRead: 4e8024
Incorrect Data 1 EccResult: 59956a EccError: 9500 EccRead: 59006a
Incorrect Data 0 EccResult: 96965a EccError: 4121a EccRead: 928440
Incorrect Data 1 EccResult: a99995 EccError: 9900 EccRead: a90095
Incorrect Data 0 EccResult: 5995a6 EccError: 88084 EccRead: 511522
Incorrect Data 1 EccResult: cc33cc EccError: 3248 EccRead: cc0184
Incorrect Data 0 EccResult: f300c3 EccError: d20042 EccRead: 210081
Incorrect Data 1 EccResult: aaa9a9 EccError: a808 EccRead: aa01a1
Incorrect Data 0 EccResult: 33cc00 EccError: 134000 EccRead: 208c00
Incorrect Data 0 EccResult: 556a6a EccError: 10402a EccRead: 452a40
Incorrect Data 1 EccResult: a59996 EccError: 9812 EccRead: a50184
Incorrect Data 0 EccResult: 303c EccError: 2024 EccRead: 1018
Incorrect Data 1 EccResult: 3003cc EccError: 208 EccRead: 3001c4
Incorrect Data 0 EccResult: 3cccf3 EccError: 140400 EccRead: 28c8f3
Incorrect Data 1 EccResult: c0ffcf EccError: ffc2 EccRead: c0000d
Incorrect Data 0 EccResult: ccfc00 EccError: 8f000 EccRead: c40c00
Incorrect Data 1 EccResult: 3f30f EccError: f30a EccRead: 30005
Incorrect Data 0 EccResult: 6996a9 EccError: 1001 EccRead: 6986a8
Incorrect Data 0 EccResult: f033ff EccError: 801324 EccRead: 7020db
Incorrect Data 1 EccResult: a5559a EccError: 5580 EccRead: a5001a
Incorrect Data 0 EccResult: cc3f0 EccError: 40120 EccRead: 8c2d0
Incorrect Data 0 EccResult: 30003 EccError: 30002 EccRead: 1
Incorrect Data 1 EccResult: fc0f3 EccError: c013 EccRead: f00e0
Incorrect Data 0 EccResult: 3c0c0 EccError: 2c0c0 EccRead: 10000
Incorrect Data 0 EccResult: fc3333 EccError: b82233 EccRead: 441100
Incorrect Data 1 EccResult: c3cf0 EccError: 3c00 EccRead: c00f0
Incorrect Data 0 EccResult: 3fcfc EccError: 3e400 EccRead: 18fc
Incorrect Data 1 EccResult: a9aaa9 EccError: aa21 EccRead: a90088
Incorrect Data 0 EccResult: 99a995 EccError: 92885 EccRead: 908110
Incorrect Data 1 EccResult: 33ffff EccError: fedf EccRead: 330120
Incorrect Data 0 EccResult: fff0fc EccError: 8f408c EccRead: 70b070
Incorrect Data 1 EccResult: 300fc0 EccError: ec0 EccRead: 300100
Incorrect Data 0 EccResult: cc3f0c EccError: c0508 EccRead: c03a04
Incorrect Data 1 EccResult: fffc0 EccError: fe40 EccRead: f0180
Incorrect Data 0 EccResult: 59999a EccError: 19880a EccRead: 401190
Incorrect Data 1 EccResult: 565aa6 EccError: 5a22 EccRead: 560084
Incorrect Data 0 EccResult: 565999 EccError: 465099 EccRead: 100900
Incorrect Data 0 EccResult: c3fcc0 EccError: 8288c0 EccRead: 417400
Incorrect Data 1 EccResult: a96aa6 EccError: 6a24 EccRead: a90082
Incorrect Data 0 EccResult: 5555a5 EccError: 541004 EccRead: 145a1
Incorrect Data 1 EccResult: 9655a6 EccError: 5506 EccRead: 9600a0
Incorrect Data 0 EccResult: ffffff EccError: b4a210 EccRead: 4b5def
Incorrect Data 1 EccResult: ffffff EccError: ff5e EccRead: ff00a1
Incorrect Data 0 EccResult: ffffff EccError: b4a210 EccRead: 4b5def
Incorrect Data 1 EccResult: ffffff EccError: ff5e EccRead: ff00a1
Incorrect Data 0 EccResult: ffffff EccError: b4a210 EccRead: 4b5def
Incorrect Data 1 EccResult: ffffff EccError: ff5e EccRead: ff00a1
Incorrect Data 0 EccResult: ffffff EccError: b4a210 EccRead: 4b5def
Incorrect Data 1 EccResult: ffffff EccError: ff5e EccRead: ff00a1
Incorrect Data 0 EccResult: 5656a9 EccError: 1444a9 EccRead: 421200
Incorrect Data 1 EccResult: ccc33f EccError: c33e EccRead: cc0001
Incorrect Data 0 EccResult: 303c00 EccError: 203400 EccRead: 100800
Incorrect Data 1 EccResult: ff3ff EccError: f346 EccRead: f00b9
Incorrect Data 0 EccResult: 3f03 EccError: 901 EccRead: 3602
Incorrect Data 1 EccResult: f3cf30 EccError: ce00 EccRead: f30130
Incorrect Data 1 EccResult: 5a6669 EccError: 6628 EccRead: 5a0041
Incorrect Data 0 EccResult: 3c3cc EccError: 10040 EccRead: 2c38c
Incorrect Data 1 EccResult: f3c3f3 EccError: c301 EccRead: f300f2
Incorrect Data 0 EccResult: 555969 EccError: 141129 EccRead: 414840
Incorrect Data 1 EccResult: 699a95 EccError: 9a01 EccRead: 690094
Incorrect Data 0 EccResult: c03c EccError: 401c EccRead: 8020
Incorrect Data 1 EccResult: 5a5695 EccError: 5600 EccRead: 5a0095
Incorrect Data 0 EccResult: 3f30c EccError: f00c EccRead: 30300
Incorrect Data 1 EccResult: fcc00c EccError: c00c EccRead: fc0000
Incorrect Data 0 EccResult: 3ff3ff EccError: 225094 EccRead: 1da36b
Incorrect Data 1 EccResult: aa55a9 EccError: 5400 EccRead: aa01a9
Incorrect Data 0 EccResult: 303ff3 EccError: 29b3 EccRead: 301640
Incorrect Data 1 EccResult: 65a696 EccError: a616 EccRead: 650080
Incorrect Data 0 EccResult: 66a655 EccError: 440044 EccRead: 22a611
Incorrect Data 1 EccResult: 965a56 EccError: 5a50 EccRead: 960006
Incorrect Data 0 EccResult: ffffff EccError: b4a210 EccRead: 4b5def
Incorrect Data 1 EccResult: ffffff EccError: ff5e EccRead: ff00a1
Incorrect Data 0 EccResult: ffffff EccError: b4a210 EccRead: 4b5def
Incorrect Data 1 EccResult: ffffff EccError: ff5e EccRead: ff00a1
Incorrect Data 0 EccResult: ffffff EccError: b4a210 EccRead: 4b5def
Incorrect Data 1 EccResult: ffffff EccError: ff5e EccRead: ff00a1
Incorrect Data 0 EccResult: 65a6a6 EccError: 2526a0 EccRead: 408006
Incorrect Data 1 EccResult: 666a5a EccError: 6a52 EccRead: 660008
Incorrect Data 0 EccResult: 6a55a5 EccError: 841a5 EccRead: 621400
Incorrect Data 1 EccResult: 3cc3fc EccError: c274 EccRead: 3c0188
Incorrect Data 0 EccResult: 300033 EccError: 300033 EccRead: 0
Incorrect Data 1 EccResult: ccc3ff EccError: c3fd EccRead: cc0002
Incorrect Data 0 EccResult: a966aa EccError: 10082 EccRead: a86628
Incorrect Data 0 EccResult: ff3ff EccError: f2216 EccRead: d1e9
Incorrect Data 1 EccResult: c3 EccError: 43 EccRead: 80
Incorrect Data 0 EccResult: 3cfc0f EccError: 148c0f EccRead: 287000
Incorrect Data 1 EccResult: 999aa6 EccError: 9a86 EccRead: 990020
Incorrect Data 0 EccResult: 695a65 EccError: 214a45 EccRead: 481020
Incorrect Data 1 EccResult: 6a99a6 EccError: 9902 EccRead: 6a00a4
Incorrect Data 0 EccResult: a96a9a EccError: 292800 EccRead: 80429a
Incorrect Data 1 EccResult: 5a5a59 EccError: 5a19 EccRead: 5a0040
Incorrect Data 1 EccResult: aaaa95 EccError: aa81 EccRead: aa0014
Incorrect Data 0 EccResult: f03f30 EccError: 502410 EccRead: a01b20
Incorrect Data 1 EccResult: 656696 EccError: 6616 EccRead: 650080
Incorrect Data 0 EccResult: a995a5 EccError: 10001 EccRead: a895a4
Incorrect Data 1 EccResult: f303fc EccError: 394 EccRead: f30068
Incorrect Data 0 EccResult: 956659 EccError: 44441 EccRead: 912218
Incorrect Data 1 EccResult: 3303c0 EccError: 2c0 EccRead: 330100
Incorrect Data 0 EccResult: cffc3f EccError: cc8801 EccRead: 3743e
Incorrect Data 1 EccResult: 3330f0 EccError: 3040 EccRead: 3300b0
Incorrect Data 0 EccResult: 30f33f EccError: 20821c EccRead: 107123
Incorrect Data 1 EccResult: 595655 EccError: 5651 EccRead: 590004
Incorrect Data 0 EccResult: f0fcc0 EccError: 907080 EccRead: 608c40
Incorrect Data 1 EccResult: 65a565 EccError: a404 EccRead: 650161
Incorrect Data 0 EccResult: 33cfff EccError: 304816 EccRead: 387e9
Incorrect Data 1 EccResult: 5565a9 EccError: 6480 EccRead: 550129
Incorrect Data 0 EccResult: 999695 EccError: 198400 EccRead: 801295
Incorrect Data 1 EccResult: ccf30 EccError: ce30 EccRead: c0100
Incorrect Data 0 EccResult: 3ff030 EccError: 8c030 EccRead: 373000
Incorrect Data 1 EccResult: 3cccc EccError: cc8c EccRead: 30040
Incorrect Data 0 EccResult: 695995 EccError: 14891 EccRead: 681104
Incorrect Data 1 EccResult: 59aaa9 EccError: aaa0 EccRead: 590009
Incorrect Data 0 EccResult: 30ff0f EccError: 20f80f EccRead: 100700
Incorrect Data 1 EccResult: 996a55 EccError: 6a15 EccRead: 990040
Incorrect Data 0 EccResult: 999a69 EccError: 188861 EccRead: 811208
Incorrect Data 1 EccResult: aa55a9 EccError: 5401 EccRead: aa01a8
Incorrect Data 0 EccResult: a66699 EccError: 206089 EccRead: 860610
Incorrect Data 1 EccResult: aa9a69 EccError: 9a68 EccRead: aa0001
Incorrect Data 0 EccResult: 6aa959 EccError: 2a100 EccRead: 680859
Incorrect Data 1 EccResult: cc00 EccError: cc00 EccRead: 0
Incorrect Data 0 EccResult: aa5595 EccError: 4005 EccRead: aa1590
Incorrect Data 1 EccResult: 669665 EccError: 9661 EccRead: 660004
Incorrect Data 0 EccResult: 655996 EccError: 205996 EccRead: 450000
Incorrect Data 0 EccResult: aa6959 EccError: 140 EccRead: aa6819
Incorrect Data 1 EccResult: 30ffff EccError: fea1 EccRead: 30015e
Incorrect Data 0 EccResult: c33f00 EccError: 432f00 EccRead: 801000
Incorrect Data 1 EccResult: a6a996 EccError: a886 EccRead: a60110
Incorrect Data 0 EccResult: 966aa9 EccError: 964221 EccRead: 2888
Incorrect Data 1 EccResult: ff00f3 EccError: 50 EccRead: ff00a3
Incorrect Data 0 EccResult: 55a56a EccError: 11a502 EccRead: 440068
Incorrect Data 1 EccResult: c33f0f EccError: 3e0d EccRead: c30102
Incorrect Data 0 EccResult: 3f0333 EccError: 2d0302 EccRead: 120031
Incorrect Data 1 EccResult: f0c33c EccError: c318 EccRead: f00024
Incorrect Data 0 EccResult: f0330c EccError: 101100 EccRead: e0220c
Incorrect Data 1 EccResult: aa9aa6 EccError: 9a04 EccRead: aa00a2
Incorrect Data 0 EccResult: 955569 EccError: 45500 EccRead: 910069
Incorrect Data 0 EccResult: f33fcf EccError: 23c8c EccRead: f10343
Incorrect Data 1 EccResult: 56569a EccError: 5618 EccRead: 560082
Incorrect Data 0 EccResult: 3c30c EccError: 2c20c EccRead: 10100
Incorrect Data 1 EccResult: 9a599a EccError: 5882 EccRead: 9a0118
Incorrect Data 0 EccResult: c000fc EccError: 50 EccRead: c000ac
Incorrect Data 1 EccResult: 95aa6a EccError: aa0a EccRead: 950060
Incorrect Data 0 EccResult: ccfc EccError: 844 EccRead: c4b8
Incorrect Data 1 EccResult: 5a6955 EccError: 6901 EccRead: 5a0054
Incorrect Data 0 EccResult: 5556a5 EccError: 45025 EccRead: 510680
Incorrect Data 1 EccResult: ccfcc3 EccError: fc81 EccRead: cc0042
Incorrect Data 0 EccResult: cf3f0 EccError: 4b3f0 EccRead: 84000
Incorrect Data 1 EccResult: f3f0cf EccError: f08d EccRead: f30042
Incorrect Data 0 EccResult: 5669a6 EccError: 140104 EccRead: 4268a2
Incorrect Data 1 EccResult: cc3c33 EccError: 3c23 EccRead: cc0010
Incorrect Data 0 EccResult: aa6555 EccError: 140 EccRead: aa6415
Incorrect Data 1 EccResult: 655aa9 EccError: 5a80 EccRead: 650029
Incorrect Data 0 EccResult: ff0 EccError: 150 EccRead: ea0
Incorrect Data 1 EccResult: aa666a EccError: 662a EccRead: aa0040
Incorrect Data 0 EccResult: 333303 EccError: 111100 EccRead: 222203
Incorrect Data 1 EccResult: 6a9696 EccError: 9690 EccRead: 6a0006
Incorrect Data 0 EccResult: fcfc00 EccError: 505400 EccRead: aca800
Incorrect Data 1 EccResult: 6a6656 EccError: 6654 EccRead: 6a0002
Incorrect Data 0 EccResult: 599aaa EccError: 588228 EccRead: 11882
Incorrect Data 0 EccResult: c0cf EccError: 80cc EccRead: 4003
Incorrect Data 1 EccResult: cfcc30 EccError: cc00 EccRead: cf0030
Incorrect Data 0 EccResult: a5a956 EccError: 2954 EccRead: a58002
Incorrect Data 1 EccResult: 300f3f EccError: f34 EccRead: 30000b
Incorrect Data 0 EccResult: f0ff30 EccError: 805630 EccRead: 70a900
Incorrect Data 1 EccResult: cff30 EccError: ff30 EccRead: c0000
Incorrect Data 0 EccResult: 55a65a EccError: 550050 EccRead: a60a
Incorrect Data 1 EccResult: ff00f3 EccError: 41 EccRead: ff00b2
Incorrect Data 0 EccResult: 6a59a6 EccError: 21902 EccRead: 6840a4
Incorrect Data 1 EccResult: 3ff0f3 EccError: f022 EccRead: 3f00d1
Incorrect Data 0 EccResult: 3f EccError: 3d EccRead: 2
Incorrect Data 1 EccResult: 566595 EccError: 6490 EccRead: 560105
Incorrect Data 0 EccResult: aa9995 EccError: a20915 EccRead: 89080
Incorrect Data 1 EccResult: a66959 EccError: 6958 EccRead: a60001
Incorrect Data 0 EccResult: f00c3f EccError: 35 EccRead: f00c0a
Incorrect Data 0 EccResult: 55965a EccError: 551052 EccRead: 8608
Incorrect Data 1 EccResult: ff00f3 EccError: 50 EccRead: ff00a3
Incorrect Data 0 EccResult: 3f00cc EccError: 150000 EccRead: 2a00cc
Incorrect Data 1 EccResult: 3cc3c0 EccError: c380 EccRead: 3c0040
Incorrect Data 0 EccResult: 5a5699 EccError: 521200 EccRead: 84499
Incorrect Data 1 EccResult: 9569a9 EccError: 68a9 EccRead: 950100
Incorrect Data 0 EccResult: 3c0030 EccError: 40020 EccRead: 380010
Incorrect Data 1 EccResult: aa55aa EccError: 5400 EccRead: aa01aa
Incorrect Data 0 EccResult: 3fccf0 EccError: f0ce0 EccRead: 30c010
Incorrect Data 1 EccResult: 30f3f3 EccError: f2b1 EccRead: 300142
Incorrect Data 0 EccResult: 955aa5 EccError: 11005 EccRead: 944aa0
Incorrect Data 1 EccResult: 699659 EccError: 9611 EccRead: 690048
Incorrect Data 0 EccResult: 69559a EccError: 285592 EccRead: 410008
Incorrect Data 1 EccResult: ff003f EccError: 5 EccRead: ff003a
Incorrect Data 0 EccResult: 3fffcc EccError: 101504 EccRead: 2feac8
Incorrect Data 1 EccResult: 699656 EccError: 9602 EccRead: 690054
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
LAN PHY NOT detected.
DeleteP500EnetRegistry:
   \Comm\GMAC 0x0
   \Comm\GMAC1 0x0
   \Comm\Tcpip\Linkage 0x0
   \Drivers\Virtual 0x0
   \Drivers\BuiltIn\LIN 0x5
LIN: Data Valid
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.


It gets stuck here:
Quote
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.


The thing is, when I extracted the nk.nb0 file from nk.bin.comp, the same error appeared regardless of whether the .comp file originated from DSO2000 or 1000x firmware, I was quite surprised about this. there. Currently I am using the nk.bin.comp file taken from firmware 1.2 from the Keysight homepage. I don't have a StupidBear board so uploading nk.bn0 via serial makes me sad when after nearly an hour of waiting it still fails. I have attached the original extracted bin file from the device and the version I edited below
Hope to receive your help.

Sincerely,

Feng
 

Offline cercelynn

  • Newbie
  • Posts: 2
  • Country: ro
Re: EEVblog #978 - Keysight 1000X Hacking
« Reply #1074 on: December 10, 2024, 09:42:50 pm »
Hello there, i do have the exactly same problem, about checksum, you need to compute a checksum without the bytes where you will write the checksum, you need a standard crc32, you can do it in neo hex editor, and just follow the tutorial steps. I will upload there a good modified 1002A.bin and another X1000.bin, that does in fact contains a very similar uBoot image. Those images does have serial opened and 3 seconds delay, so you need to solder those rx/tx and gnd wires.

I had your ECC error. Even after i flashed with doing the exact steps from tutorial, i could succesfully flash after some retries, sometimes YMODEM fails, just try again, I was testing the most common serial interfaces, ch341, and other cheap serials, so i know for sure there isn't a problem about the programmer.

My solution for ECC error was to "scrub" the memory, and do a clean firmware flash. just don't type "erase" because you will need to reflash again the uBoot image, nothing dangerous but not really funny. And now you have an ECC errorless memory.

Right now, i am facing FPGA Programming failed, when i type fpga info, i still receive the same error, FPGA Programming failed, i don't know what other commands to write, just to querry some fpga information, like to be sure he isn't dead. I Don't have a good way to tell this, neither i do know some flashing ports for this chip on the board, so i may come with xilinx tools to see what's wrong with him.

 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf