DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?

[Dubbie]

Thanks for the warning Howard.
I was too afraid to clean my board so left it.
It's quite tricky getting the can off. I lifted it gently with forceps while holding the iron on the joint. Getting the iron in the right position isn't easy.

[Howardlong]

Clearly, pcb cleaning is very very important.. Though, my question to you, is what cleaning agent would you recommend in this case?

I think if done again, I would avoid cleaning agents at all, as once it's in the relays it'll take ages to dissipate/evaporate. In my case I had intermittent self-oscillation on the channel that was reverse engineered for some weeks despite several attempts resolve. I used Fluxclene and IPA, both are somewhat ionic (think in terms of them leaving measurable resitances in the megohms range), but wish I hadn't: the problem is that I've used these by habit for a long time after working on boards to remove flux residue. In the end it resolved itself but it took some weeks, as well as a lot of head scratching trying to figure out what was going on. I don't routinely work on high impedance stuff, so this was a new phenomenon to deal with for me.

[TheSteve]

Howard - it is unfortunate that you had issues after making such a massive sacrifice for the forum. So once again let me say thank you for your efforts which went above and beyond. I found my DSOX3000 was harder to rework then the average device(because of the small thin traces/pads and knowing the cost of the device) which makes your efforts even greater.

All that said I'd certainly perform the mod again as having a 500 MHz scope instead of a 100/200 MHz scope rocks.
When I did mine I used no-clean solder and didn't add any flux - I didn't do much cleaning other then some gentle wipes with an alcohol soaked q-tip. It is clear Keysight isn't afraid of the solder/flux they use - look at how much there is around the Teledyne relay.

At this point I'd say it wouldn't be too bad too to mod a 3014T/3024T the same as has been done with the 3000A, the hardware would be 500 MHz but without the license you'd be stuck at 350 MHz.
Someone could guess at the capacitor values to perform the 1 GHz mod - do the math on the values used for 100/200 MHz and 350/500 MHz and see if you could determine some logical 1 GHz values. Knowing the value of the scope though and the cost of the Teledyne relays you'd have to be pretty bold.

Keysight probably isn't up for donating a 100 MHz scope to experiment on...

[TopLoser]

Keysight probably isn't up for donating a 100 MHz scope to experiment on...

I am though... There's a spare MSOX3024T under my desk.

[adranp]

As usual Ian is here to help. My opinion is that you should keep that in case something goes terribly wrong and one of the "lab rat" scopes we are trying to mod dies irreparably.

:TheSteve

As you are saying, going to 350/500 Mhz is indeed a very good upgrade. A tempting one at least. From my position I can tell you I'm not doing the mod necessarily for me, as I'm doing it for the community. I learned a lot from the community and there's a time to give something back.

If we find a way to determine the capacitor/inductors values and I manage to procure 4 Teledyne relays, I'm willing to try the mod to 1Ghz.

The easiest way would be someone with a 1Ghz scope do these measurements so we compile the BOM. Otherwise it would be a hit and miss operation for determining the right values.

As a side note for all interested parties.. Moving the K503 relay into the K501 position requires hot air desoldering.. I would add that to the BOM to swap it as
desoldering and resoldering might have unknown consequences as the part is rated at maximum 5s 250degrees reflow. These are specified as flux resistant but non-cleanable inside.

[memset]

The easiest way would be someone with a 1Ghz scope do these measurements so we compile the BOM. Otherwise it would be a hit and miss operation for determining the right values.

Even better option is to leak these values from scope's schematics. Or leak the schematics.
Why the hell every iPhone's schematic is leaked while Apple is known to be total paranoid about secrecy.

[memset]

Clearly, pcb cleaning is very very important.. Though, my question to you, is what cleaning agent would you recommend in this case?

Just don't use any cleaning agent and use very small amounts of no-clean flux for any soldering.

[adranp]

:Memset

I think the answer to the iPhone schematics leak is that the interest for those is huge, and the money that can be earned based on that through repairs can be more than significant. Cannot say the same for our case.
As we go more into the consumer society concept, people refuse to think at repairing stuff. 

If someone is kind enough to help us with a 1ghz scope disassembly and removal of the interesting parts in our mod, can ship them to me (on my expense) and I can measure them with a precision LCR meter and return them fast. This is the case with someone that does not have access to a sub-pF meter.

[memset]

As a side note for all interested parties.. Moving the K503 relay into the K501 position requires hot air desoldering.

Not necessary. It's possible to desolder these relays side by side using good soldering iron with some wide blade tip. Or even with common tip using additional wire to separate pin from its pad. Pretty doable without melting the whole package.

[memset]

At this point I'd say it wouldn't be too bad too to mod a 3014T/3024T the same as has been done with the 3000A, the hardware would be 500 MHz but without the license you'd be stuck at 350 MHz.

Another good thing about 1 GHz mod is getting the whole bandwidth without affecting any software licenses. You'll loose MSO license (if any), but scope will work at 1GHz and 5GSa/s out of the box - without any SW mods.
I think it's still legal to replace chip passives in the equipment you own, even in US.

[Howardlong]

Another good thing about 1 GHz mod is getting the whole bandwidth without affecting any software licenses. You'll loose MSO license (if any), but scope will work at 1GHz and 5GSa/s out of the box - without any SW mods.

Why does the MSO licence break?

[Dubbie]

Yeah I don't want to lose my mso license. I use it all the time. It is a legit one from Keysight.


Sent from my phone using Tapatalk

[cgroen]

Sorry for this "beginner question", but what is the default userid/password for the 3024T. My googling didn't bring it up... ?
(I have a brand new MSOX3024T with the APP2BNDL, and I'm getting curious

[Pinkus]

.....and I'm getting curiousous

You are not the only one. But........ the login id/password are currently unknown (or at least not public).

[cgroen]

Thanks Pinkus,
then it is not just my lack of skills 

[Howardlong]

ISTR there was some suggestion in this thread the credentials are unique to the scope, I imagine tied into the serial number or MAC address (assuming there's a MAC address without the LAN card, I would imagine there is).

[memset]

Sorry for this "beginner question", but what is the default userid/password for the 3024T. My googling didn't bring it up... ?

Telnet password for T-series is unique and Serial / MAC address based.
Same is true for 6000X and maybe 4000X series.

[memset]

Why does the MSO licence break?

As far as I remember from my earlier experiments, 1GHz version use different MSO license. So if you change strapping to 1GHz, original MSO license will not be used anymore.

[Dubbie]

That's a shame. MSO is probably more useful to me at the moment than 1Ghz


Sent from my phone using Tapatalk

[memset]

That's a shame. MSO is probably more useful to me at the moment than 1Ghz

-l MSO than.

[TheSteve]

That's a shame. MSO is probably more useful to me at the moment than 1Ghz

-l MSO than.

Hard to do on the 3000T model when we can't login.

[PA0PBZ]

Hard to do on the 3000T model when we can't login.

Apart from that I don't think we know if it is possible to activate the options like that on a T model.

[adranp]

:memset  - Is strapping for 1Ghz the same as for 350/500Mhz ? I was under this impression..

Regarding user/pass - has anyone tried a brute force dictionary based attempt to enter the device?

I'm thinking that I could try to mod to 350/500Mhz until I find a way to get my hands on the Teledyne relays needed for 1Ghz.
:Memset  - Do you happen to have the values of your original parts in 3000A scope so I can compare it with mine's? I looked in the thread but I did see just values for upper bandwidth scopes.  If the values will be different I'm thinking that values of 350/500 mod might be different also. Correct me if I'm wrong.

Thanks..

[TheSteve]

Compare the color dots on the inductors - if they are the same the the capacitors will be the same.

[abyrvalg]

user: "infiniivision"
pass: "skywalker1977"+hash(ModelName, SerialNumber, MACAddress)

Need to figure out how to hash that data exactly