and remember, at scopes with firmware versions below 2.4x the flash will be corrupted after RND(TIME). The scope will not boot anymore and is bricked and needs to be serviced by Keysight. After firmware 2.4x the scope will detect this and repairs itself .... somehow.
Thus with 2.35 or 2.38 there is the constant danger, that your scope (DSOX2000a and DSOX3000a series) won't boot anymore at some day.
I’ve seen quite a few new R&S RTB 2000 series ones being returned with issues though, they seem to be having some teething problems. Good warranty support from R&S as well though.
I’ve seen quite a few new R&S RTB 2000 series ones being returned with issues though, they seem to be having some teething problems. Good warranty support from R&S as well though.
Not to hijack the thread but can you give us any more details on issues with the RTB2000 series ?
50/50 dead power supplies and touch screen faults. One with all inputs dead.
50/50 dead power supplies and touch screen faults. One with all inputs dead.
Thanks. I just got one and the power supply is humming (high pitch whine) when the scope is in standby mode. Sound like a vibrating ceramic cap or inductor.
50/50 dead power supplies and touch screen faults. One with all inputs dead.
Thanks. I just got one and the power supply is humming (high pitch whine) when the scope is in standby mode. Sound like a vibrating ceramic cap or inductor.
I *think* there may be a service note on that...
Pretty sure he is talking about an RTB2000, not a DSOX2000/3000(which does have an old service note about a power supply update because of an audible noise).
\windows\loadP500Flash -u ceImage1 \usb\nk_patched.bin.comp
<!-- Update CE Kernel (backup) -->
\windows\loadP500Flash -u ceImage2 \usb\nk_patched.bin.comp
<!-- Update bootloader -->
blah...blah...blah...
<!-- Update CE Kernel -->
\windows\loadP500Flash -u ceImage1 \usb\nk_patched.bin.comp
<install>
<!-- Set the ramdisk to 68MB -->
<ramdiskSize>71303168</ramdiskSize>
<!-- Stop the scope application -->
<killProcess>infiniivisionLauncher.exe</killProcess>
<killProcess>AgilentLxiWebService.exe</killProcess>
<killProcess>vncServer.exe</killProcess>
<killProcess>websockify.exe</killProcess>
<!-- ******** -->
<!-- Update CE Kernel -->
<installStep>
<file checksum="03929973A08EFEB08FB31DA8B2AAF200">nk.bin.comp</file>
<command>\windows\loadP500Flash -u ceImage1 %TEMP%\nk.bin.comp</command>
<onFailure>
<filePath>\Agilent Flash\config\errorLog.txt</filePath>
<message>Firmware update failed (0x0422). Please retry firmware update.</message>
<action>reboot</action>
</onFailure>
</installStep>
<!-- Reboot -->
<installStep>
<command>\windows\rebootInfiniivision.exe</command>
</installStep>
<boardLoadOptions>
<ECC>4</ECC>
</boardLoadOptions>
</install>
<!-- Update CE Kernel (backup) -->
<installStep>
<file checksum="03929973A08EFEB08FB31DA8B2AAF200">nk.bin.comp</file>
<command>\windows\loadP500Flash -u ceImage2 %TEMP%\nk.bin.comp</command>
<onFailure>
<filePath>\Agilent Flash\config\errorLog.txt</filePath>
<message>Firmware update failed (0x0420). Please retry firmware update.</message>
<action>reboot</action>
</onFailure>
</installStep>
<!-- Update bootloader -->
<installStep>
<file checksum="7ccacd88343adb62f9276a362bc7f5d3">updateBootLoaders2.exe</file>
<file checksum="33bb47d750ae3732cd8657f407008ef0">pboot_rel.bin</file>
<command>%TEMP%\updatebootloaders2.exe</command>
<onFailure>
<filePath>\Agilent Flash\config\errorLog.txt</filePath>
<message>Firmware update failed (0x0421). Please retry firmware update.</message>
<action>reboot</action>
</onFailure>
</installStep>
you mentioned "bricked the scope" ,i'm not good at english ,does it mean this way may be harmful to scope ,such as breaking the scope ?
DE BD7JATYes, a wrong step or wrong link might lead to your scope being unusable, and you'd need to send it back to the factory for repair.
That being said... has anyone actually BRICKED their scope yet? I don't remember of one but eh... it's quite a long thread.
Also, I've attached the file all inside a zip. The steps are basically :
1) Extract all files (including the .lnk) to the root of your usb drive
2) From the scope's front panel, press Utility ->File Explorer -> Press to go to: <USB Drive label>(usually "usb")
3) From the drop down, scroll to the v241_link_install.cab to select
4) Press Load file
The scope will ask for your confirmation and then it will load/update and reboot.
FYI, my link file is :
160#\Secure\infiniiVision\infiniivisionLauncher.exe -l DIS -l MSO --perf -l MEMUP -l SCPIPS -l CABLE -l SGMC -l FLEXC -l TOM -l BW20 -l ADVMATH -l EMBD -l EDK -l VID
the other cab uninstall the link file and restores your previous setting.
Cheers
Does this hack work with DSOX2012A ? I am planning to buy one
Does this hack work with DSOX2012A ? I am planning to buy oneSure, it will work with all versions. However, I would strongly advice not to purchase one: The DSOX2000 series does not allow serial protocoll analysis on the digital channels (only analogue channels) and with only two analogue channels you will be stucked quickly (e.g. with a simple SPI protocol).
My advice: either get a 2-channel 3000-series scope or go for the 4-channel version. The 2-channel version should be purchased only if it comes with a massive price reduction as selling this later will become very difficult.
Hugoneus, check this post for CPU JTAG https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg274963/#msg274963
Another possibility is BootROM USB flash loader mode:
ST's flash utility http://www.st.com/web/en/catalog/tools/PF257557
This mode should be activated by pulling BOOT_SEL pin (K18, check the picture) low at power on, but no reports on this so far. The PCB picture in JTAG post looks like there is a track in inner layer going to this pin, perhaps you can look closer. If it is tied straight to VCC then bad luck, otherwise try shorting it to GND and turning the scope on with USB cable attached to PC - does something pops up?
Also SPEAr600 RM says that ROM enters USB boot if normal (flash) boot fails regardless of BOOT_SEL state. But this requires primary bootloader in flash to be corrupted "correctly" so ROM doesn't recognize it (briefly shorting some flash DATA lines at power up is common way to simulate this state).
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1419736/#msg1419736
Looks like they had to take a serial interface from the scope and turn it into GPIB using an FPGA on this board.
The message about the "System OS concerns detected...", that still comes up, that may be a check against the file that's in the flash, I'm not sure, but haven't figured out yet how to remove that message.. but I'm curious if that one doesn't appear if we flash the patched DLL into the ceimage1 in flash...? I will be trying that soon...
As far as the 'mobileVNC.exe', the reason I mentioned it is if anyone wanted to see the real 'Windows CE desktop', which is what this mobileVNC takes you to when you login with it.. the 'vncserver.exe' that the scope already runs, just gives you a VNC connection to control the scope itself.. I wanted to see if there was anything interesting to look at with the actual windows CE desktop... there really isn't much to see, I was hoping to be able to view some registry data from there, but no luck..
The latest firmware 2.43 (5 March 2018) according to the release notes:
2000 X-Series Enhancements
All 2000 X-Series oscilloscopes manufactured after
March 5, 2018 now have:
- Increased waveform update rate of
200,000 wfms/s
- Standard memory upgrade: 1 Mpts
- Standard segmented memory
- Additional trigger modes
- Additional math functions
Any 2000 X-Series oscilloscopes manufactured
before March 5, 2018 can be upgraded using the
DSOX2PLUS option.
See pages 16 and 18.
For more information
www.keysight.com/find/2000X-Series
infiniivisioncore.dll [snip] ** note: in 2.42, the dll is no longer on disk, so you have to patch this directly in the nk.bin, and write to flash **