Author Topic: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?  (Read 1106838 times)

0 Members and 3 Guests are viewing this topic.

Offline dianzimi

  • Contributor
  • Posts: 28
Wooo well done Mr Kilobyte!!

From the Agilent 2.35 upgrade CAB I extracted the files you said:
infiniiVisionLauncher.exe
infiniiVisionCore.dll

Put them on a USB stick, booted the 2.37 scope and got telnet access (infiniivision, skywalker1977)

Killed the running version (a step you didn't mention, probably because it was obvious to you!):
processmgr kill infiniiVisionLauncher.exe

Change to application directory
cd \secure\infiniivision

Copy those two old files:
copy \usb\infiniiVisionLauncher.exe
copy \usb\infiniiVisionCore.dll

Reboot and get firmware concerns message, scope still thinks it has 2.37, no problem.

Put Agilent 2.35 upgrade CAB onto USB stick and up(down)grade as normal. Lots of waiting, scope then reboots with 2.35 up and running.

Then reboot with USB stick with modified 2.37 files to get all options including MSO and full bandwidth.


Can you send me the 2.15 cab file ?my email address is dian.zi.mi@163.com
« Last Edit: January 06, 2015, 06:36:09 am by dianzimi »
 
The following users thanked this post: Andrew

Online EEVblog

  • Administrator
  • *****
  • Posts: 37661
  • Country: au
    • EEVblog
It is always said that Agilent/Keysight will swap boards if you want to upgrade from 100/200 to 350/500 Mhz. I am wondering if there is really a significant difference or if they just inject some software instead of swapping boards.

Yes, they have to actually swap boards, the 300/500MHz was a different front end. Although wait a few days and that could be changing...  ;)
 
The following users thanked this post: Andrew

Offline Rigby

  • Super Contributor
  • ***
  • Posts: 1476
  • Country: us
  • Learning, very new at this. Righteous Asshole, too
wait a few days and that could be changing...  ;)

Oh I hate it when you do this.
 
The following users thanked this post: Andrew

Offline kilobyte

  • Regular Contributor
  • *
  • Posts: 73
  • Country: de
    • My Website
I'm curious too.
Maybe it has something to do with the two scopes that i can see on the dropcam livestream?
The looks very very similar.  :)

I'll let it be a surprise.
 
The following users thanked this post: Andrew

Offline Pinkus

  • Frequent Contributor
  • **
  • Posts: 768
I'm curious too.
Maybe it has something to do with the two scopes that i can see on the dropcam livestream?
The looks very very similar.  :)

I'll let it be a surprise.

Mmmmh; Dave says "the 300/500MHz was a different front end." I am wondering what that means, especially to my already existing 200 Mhz version...
 
The following users thanked this post: Andrew

Offline TopLoser

  • Supporter
  • ****
  • Posts: 1922
  • Country: fr
 
The following users thanked this post: Andrew

Online EEVblog

  • Administrator
  • *****
  • Posts: 37661
  • Country: au
    • EEVblog
Mmmmh; Dave says "the 300/500MHz was a different front end." I am wondering what that means, especially to my already existing 200 Mhz version...

I was given wrong information on that unfortunately.
The new 3000T still has different front end hardware between the 100/200 and 350/500 versions.
 
The following users thanked this post: Andrew

Offline WVL_KsZeN

  • Regular Contributor
  • *
  • Posts: 92
  • Country: nl
Bingo!

https://translate.google.com/translate?sl=auto&tl=en&js=y&prev=_t&hl=en&ie=UTF-8&u=http%3A%2F%2Fwww.hw.cz%2Fprodukty%2Fosciloskopy-keysight-dsox3000t-graficky-trigger-pro-kazdeho-inzenyra.html&edit-text=

-comes with a touchscreen
-4Mpts memory
-greatly extended match functions
-correlated signal analysis (time and frequency domain)

and the datasheet aswell : Datasheet
« Last Edit: January 08, 2015, 11:10:01 am by WVL_KsZeN »
 
The following users thanked this post: Andrew

Offline Neganur

  • Supporter
  • ****
  • Posts: 1138
  • Country: fi
woah, a proper full bandwidth 1mV front end. What took them so long :P
 
The following users thanked this post: Andrew

Offline WVL_KsZeN

  • Regular Contributor
  • *
  • Posts: 92
  • Country: nl
woah, a proper full bandwidth 1mV front end. What took them so long :P
No, it's still magnified : "2. Specifications are valid after a 30-minute warm-up period and ± 10 °C from firmware calibration temperature. 1 mV/div and 2 mV/div are a magnification of 4 mV/div setting. For vertical accuracy calculations, use full scale of 32 mV for 1 mV div and 2 mV/div sensitivity setting."
 
The following users thanked this post: Andrew

Offline Neganur

  • Supporter
  • ****
  • Posts: 1138
  • Country: fi
hmm you're right - further down in the characteristics it states the all familiar sentence that you quote. But I don't know what to make of this table then (page 7):

vertical setting steps of 1, 2, 5 mV and the noise stays basically the same in those three settings. Is the noise not amplified?
I guess they had to come up with something to compare it to the Tek scope? Poor move Agilent : /
 
The following users thanked this post: Andrew

Offline WVL_KsZeN

  • Regular Contributor
  • *
  • Posts: 92
  • Country: nl
It's just a digital amplification (only scaling on the display), so of course the noise in Vpp stays the same.
 
The following users thanked this post: Andrew

Offline Neganur

  • Supporter
  • ****
  • Posts: 1138
  • Country: fi
Yeah I guess I still hoped it had real amplification. Magnified pixels again, boo!
 
The following users thanked this post: Andrew

Offline fons

  • Newbie
  • Posts: 2
Hi!

Does anybody know where can I find the 2.35 firmware? The keystone website only lets you download the latest one (2.38)

Thanks!

Thanks to those who sent me the firmware in PM. I had version 2.36 in the scope, after downgrading to 2.35 I can use the usb hack without problems. Thanks!
 
The following users thanked this post: Andrew

Offline Isamun

  • Regular Contributor
  • *
  • Posts: 56
  • Country: no
Last year I was lucky enough to pick up a demo version of a 3034a. All the options where there when I got the unit and are listed with an astrix (*). I haven't updated the firmware yet, due to the fear of loosing my beloved/free options. Anyone know if an update will remove them?
 
The following users thanked this post: Andrew

Offline iRad

  • Regular Contributor
  • *
  • Posts: 149
  • Country: us
  • Are you sure it's safe?
Last year I was lucky enough to pick up a demo version of a 3034a. All the options where there when I got the unit and are listed with an astrix (*). I haven't updated the firmware yet, due to the fear of loosing my beloved/free options. Anyone know if an update will remove them?

The astrix (*) means that the options are either in DEMO MODE or the scope is a STORE DEMO, and thus in demo mode. There has been posts indicating that the store demo units have a runtime of 120 days, but I cannot say for sure. In either case, updating the firmware should not remove the demo, but again, I cannot say for sure...
« Last Edit: January 18, 2015, 05:01:51 pm by iRad »
 
The following users thanked this post: Andrew

Offline ToBeFrank

  • Regular Contributor
  • *
  • Posts: 234
  • Country: us
The astrix (*) means that the options are either in DEMO MODE or the scope is a STORE DEMO, and thus in demo mode. There has been posts indicating that the store demo units have a runtime of 120 days, but I cannot say for sure. In either case, updating the firmware should not remove the demo, but again, I cannot say for sure...

Not necessarily. It could be in distributor mode. If the first item in the list is "All", it's a good bet. My scope has been this way for well over a year. The really cool part is if they put new features in future firmware that require licenses, a distributor scope will automatically turn them on when you upgrade the firmware.

 
The following users thanked this post: Andrew

Offline Isamun

  • Regular Contributor
  • *
  • Posts: 56
  • Country: no
Thank you both.

Last year I was lucky enough to pick up a demo version of a 3034a. All the options where there when I got the unit and are listed with an astrix (*). I haven't updated the firmware yet, due to the fear of loosing my beloved/free options. Anyone know if an update will remove them?

The astrix (*) means that the options are either in DEMO MODE or the scope is a STORE DEMO, and thus in demo mode. There has been posts indicating that the store demo units have a runtime of 120 days, but I cannot say for sure. In either case, updating the firmware should not remove the demo, but again, I cannot say for sure...

Is there a way I can check the runtime? I would presume this would have been reset at their factory when it was "refurbished".

The astrix (*) means that the options are either in DEMO MODE or the scope is a STORE DEMO, and thus in demo mode. There has been posts indicating that the store demo units have a runtime of 120 days, but I cannot say for sure. In either case, updating the firmware should not remove the demo, but again, I cannot say for sure...

Not necessarily. It could be in distributor mode. If the first item in the list is "All", it's a good bet. My scope has been this way for well over a year. The really cool part is if they put new features in future firmware that require licenses, a distributor scope will automatically turn them on when you upgrade the firmware.



I also have the "All" (no astrix).



If I read you correctly, you have performed an update and still kept the options. In your opinion, the case would be the same for me?
« Last Edit: January 18, 2015, 07:01:46 pm by Isamun »
 
The following users thanked this post: Andrew

Offline ToBeFrank

  • Regular Contributor
  • *
  • Posts: 234
  • Country: us
If I read you correctly, you have performed an update and still kept the options. In your opinion, the case would be the same for me?

You should be fine. Whether they are time limited or not, I don't know. It may be the case that you got lucky and they forgot to clear the licenses out of your scope before sending it to you.
 
The following users thanked this post: Andrew

Offline iRad

  • Regular Contributor
  • *
  • Posts: 149
  • Country: us
  • Are you sure it's safe?
If I read you correctly, you have performed an update and still kept the options. In your opinion, the case would be the same for me?
You got a nice catch then with ALL functions enabled. Upgrading firmware should not disable any legitimate features, demo, distributor, or purchased. I see from the screenshot that your firmware is quite old. You'll have a great incentive to upgrade to the latest firmware, with many new capabilities, improved measurements, and bug fixes... Great Score!

One other nice thing to know about your scope, is that it has the 500MHz front end.  :-+
 
The following users thanked this post: Andrew

Offline Isamun

  • Regular Contributor
  • *
  • Posts: 56
  • Country: no
Im happy to report the update went as expected.
Thank you for the confidence boost.


 
The following users thanked this post: Andrew

Offline iRad

  • Regular Contributor
  • *
  • Posts: 149
  • Country: us
  • Are you sure it's safe?
Im happy to report the update went as expected.
Thank you for the confidence boost.


Excellent!  :-+
Now you can check out your new and free ARB you didn't have yesterday...
 
The following users thanked this post: Andrew

Offline oedipe78

  • Newbie
  • Posts: 4
Hello everyone,

Explanations are mixed between different versions. I'm afraid to get a stupidity.   :-BROKE

Someone could explain step by step how to change the latest version (2.38)?
And how to load the modified version?

Does anyone want to change the firmware new scope DSOX/MSOX 3000T ?

Thank you in advance.
 
The following users thanked this post: Andrew

Offline kilobyte

  • Regular Contributor
  • *
  • Posts: 73
  • Country: de
    • My Website
For the data that have to be modified see here
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg569677/#msg569677

And for Firmware Downgrade see TopLosers summary here
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg537981/#msg537981

Does anyone want to change the firmware new scope DSOX/MSOX 3000T ?
Maybe if you like to buy me one of these...  ;D

I already have a dsox3024a at home so i didn't buy a new one in the next time.

I hope they release a firmware package to have a look into.
 
The following users thanked this post: Andrew

Offline oedipe78

  • Newbie
  • Posts: 4
I still have many questions.  :scared:

For the data that have to be modified see here
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg569677/#msg569677

is the infiniiVisionCore.dll (v2.35) file needs to be changed ?

you change address : 0x0x27AF78 , data : 0x00 00 A0 E3 ?

From the Agilent 2.35 upgrade CAB I extracted the files you said:
infiniiVisionLauncher.exe
infiniiVisionCore.dll

Where you find the version 2.35? (it is not available on the official website)

this is the original file?


Put them on a USB stick, booted the 2.37 scope and got telnet access (infiniivision, skywalker1977)

Killed the running version (a step you didn't mention, probably because it was obvious to you!):
processmgr kill infiniiVisionLauncher.exe

Change to application directory
cd \secure\infiniivision

Copy those two old files:
copy \usb\infiniiVisionLauncher.exe
copy \usb\infiniiVisionCore.dll

Reboot and get firmware concerns message, scope still thinks it has 2.37, no problem.
I understood.

Put Agilent 2.35 upgrade CAB onto USB stick and up(down)grade as normal. Lots of waiting, scope then reboots with 2.35 up and running.

Then reboot with USB stick with modified 2.37 files to get all options including MSO and full bandwidth.

you downgrade to version 2.35. This is Original firmware 2.35?

After I upgrade to Version 2.38. This is not the original firmware 2.38, what do I need to change?


 
The following users thanked this post: Andrew


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf