DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?

[ELIK]

Thanks for your kind words, but this pcb and schematics are really simplest. 
It was developed for my MSOX3034T, I will post the gerbers and schematics of this pcb, just need to collect all in a pile and organize... 

[TK]

It should work as long as you have the 2.41 Firmware.
Not sure if there's any new firmware since then... hmmm

As far as I've remembered, someone with 3000X also tried this method some time back with success, and the command in the switches in the link are taken from the 3000X series with trial and error to see which options works for the 2000X series.

New 1000X series is another different can of worms but might work... who wants to be the sacrificial lamb and test it on their 1000X ? 

Looks like 1000X series has a different firmware update approach.  I tried running the uninstall.cab and 1000X does not know what to do with it.  I changed the extension to .ksx (like the new 2.42 2000X / 3000X firmware) and the same error.  I also created new .cab file trying to verify directory content of \Secure and write the content to \usb and I get the same error.  Until a new firmware is released by Keysight for the 1000X series, it is an unknown territory...

Well, I tested again today.  It looks like on 1000X the recipe.xml file was renamed install.xml (Thanks Daniel for posting the FRA patch).  Regenerated the .ksx file using makecab on windows and I was able to install the infiniiVision.lnk file from USB (Using v241_link_install.cab hack method).  The only problem is that it activates 200MHz but does not take any other option like the 2000X / 3000X. I tried -l DIS, -l ALL, -l EMBD, -l COMP, -l AUTO... and I cannot enable serial decode.  I even removed -l BW10 and still get 200MHz activated (but I think it is limited by hardware to 70-100MHz... I have a modded EDUX1002G).

It adds an interesting Attenuation Compensation Test to the Service Menu (picture attached)

Note: same information was posted in the 1000X hacking thread.  I recommend posting followup discussions on this thread: https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/msg1224021/#msg1224021

[BlueX]

Please could anyone confirm that the hack (lan/telnet) works for the model DSOX 3014T? Thank you.

[ELIK]

About MSOX3000 - Yes, confirmed.
By my opinion, no difference between MSOX, DSOX or other similar tool in plane of licensing.

p.s. Please don' ask me "how", because our "serene" life will end quickly. Just read carefully all pages of this thread, from start to end, and do not be afraid to make experiments with your scope.

[Jwalling]

Yes, confirmed.
Please don' ask me "how", because our "serene" life will end quickly. Just read carefully all pages of this thread, from start to end.

Yeah, it's only 1600+ posts to read. Don't be lazy!

[TopLoser]

Yes, confirmed.
Please don' ask me "how", because our "serene" life will end quickly. Just read carefully all pages of this thread, from start to end.

I wouldn't buy a T series scope hoping to hack the software options right now...  I'm not aware that anybody has done it and yes I've read all the pages of this thread since the beginning.

[PA0PBZ]

I wouldn't buy a T series scope hoping to hack the software options right now...  I'm not aware that anybody has done it and yes I've read all the pages of this thread since the beginning.

+1

but if anyone wants to send me a T version I'd be happy to give it a try

[[IDC]Dragon]

Yes, confirmed.

Huh, did I miss something? At least I'm not not aware of a way to unlock the T, deliberately bought a non-T last model year.

Please don' ask me "how", because our "serene" life will end quickly.

C'mon, we've also had this.

[BlueX]

ELIK, do you have a 3000T series oscilloscope? I read almost half of the posts and could not find references about someone who has played with a 3000T.

[ELIK]

ELIK, do you have a 3000T series oscilloscope? I read almost half of the posts and could not find references about someone who has played with a 3000T.

- Yes I have it now. 

Hi group,

Take a look at this eBay item 172559013145

http://www.ebay.ca/itm/KEYSIGHT-Infiniivision-MSOX3034T-Mixed-signal-Oscilloscope-350Mhz-MEGA-ZOOM-/172559013145?hash=item282d519519:g:GqYAAOSwhlZYuQIj


I have good reason to believe that it has been 'hacked'.

Regards,

Jay_Diddy_B

(It may have been an extreme teardown)

A time to open a small secret: I am a "happy buyer" of this item... (laugh and tears).
Tears really, because it was wounded hardly inside and outside.
By the black spots on the face of tool, I think someone was drive on the car across this oscilloscope, the face had a tire tracks crossing of front panel.
My eyes see a picture - the man left so crazy expensive tool on the road behind his car. And while bla-bla-bla via the phone, he forgot that the device is not in the trunk, he sat behind the wheel and drive the car back.

1. Was sacked inside - there is no AC power module, no cables by the power module, no vent.fan inside. Not fatally, because this AC-DC power module produces just one voltage (13V), can be changeable with other with 100W and more power, same as vent.fan. The multi-wire power cable between the main pcb and the secondary power board was maded simply, was cutted by the 2 dead computer 24-pin ATX power supplies - they have absolutely similar connectors(!).

2. The PCB has a deep crack near of LAN box - butnot fatally. As it turned out, no really important wires are not interrupted.

3. All 4 big BGA MCUs was detouched with copper padstacks (partially) due to strong bending of the Board. Padstacks of BGAs was partially stay on the pcb but detouched, partially was torn and stay on the chip's balls. Horror of course, but week of hard job with microscope, and all 4 chips was soldered back on repaired padstacks. 

Thank to all Gods that the thieves-repairmen not stuck their noses under the aluminum cover of the main Board, otherwise if just one of detouched MCU have been lost, then there would be no chances in repairing of this tool.

The LCD 8.5" (without touch panel - it so rare, can't found cheap) was ordered in Ebay, 45USD with delivery.
"8.5" Original AUO G085VW01 V.3 INDUSTRY LCD Screen Display"
http://www.ebay.com/itm/381681332559?_trksid=p2057872.m2749.l2649&ssPageName=STRK%3AMEBIDX%3AIT
-if someone will be need it, but I think be better to find V.1 or V.2 version, because this smooth V.3 by my tests and even by it's datasheet, have no pin used for turning image upside down, need to turn this display physically...

There was many of not so fatal damages inside, I am lazy to describe all. The back cover was repaired too, by me.
But now I can tell one - the tool is working now. It's really great tool, I am in love!!

Could anyone explain me exactly, what is the MAIN difference between MSOX3000T and MSOX3000A? 

[lowimpedance]

Jeez I would love to see a photo of the 'lazarus' 3000T now functional after that horrid treatment.

[ELIK]

 
No problem, but just after june 8th. Now I am still in vacation, not at home.
Because I do not had the hope to revive him, did not make pictures of the destruction and recovery, have only a few pictures, all pictures are left in my home PC.

[azer]

Could anyone explain me exactly, what is the MAIN difference between MSOX3000T and MSOX3000A? 

The main difference is that the "T" has a touch screen. Except for that I believe they should be mostly the same spec and functionality wise.

[ELIK]

Absolutely TRUE!
So, therefore, why you are believe that for the oscilloscope that just have a touchscreen panel with small additional pcb inside, such tool must have a super-mega improved licensing software inside, against of tools without touchscreen??? 

[TheSteve]

The T series also has a higher sample rate then the A for the 100/200/350/500 MHz models, it can display 8 measurements on screen instead of 4 and has zone triggering which is setup by the touchscreen. It probably has other additional features, maybe Daniel will chime in.

[ELIK]

It really doesn't matter in the case of a system of licensing in the firmware of scope. All these "increased speeds and channels" - are all just a nice bonuses for owners. There, according to all our experiments so far, the licensing ways are absolutely common for all known models 1000, 2000, 3000.
Here is the gerbers of my DSOXLAN card (version with SMD JACK) (DSOXLAN_SMD.zip)

Here is the picture of DSOX3000T PCB, array of 4 MCUs, one of them (padstacks) already repired

[ELIK]

Jeez I would love to see a photo of the 'lazarus' 3000T now functional after that horrid treatment.

All that is left in my PC

[Howardlong]

Does the 3000T have a VESA mount or was that a DIY enhncement?

[TheSteve]

Does the 3000T have a VESA mount or was that a DIY enhncement?

That was his own DIY mod.

[ELIK]

Can anyone please measure the approx. height of knobs?
I want to try to find something like original...
Thanks!

[mikeselectricstuff]

For the achievement of getting that working again , I'm sure  Daniel would be happy to throw some knobs & cosmetic parts your way...

[gamalot]

Can anyone please measure the approx. height of knobs?
I want to try to find something like original...
Thanks!

about 13.2mm

[cgroen]

Can anyone please measure the approx. height of knobs?
I want to try to find something like original...
Thanks!

about 13.2mm

Oh yes, ELIK should get a prize for that work
(A bag of knobs etc would be the right thing to do from Keysight  )

[memset]

All that is left in my PC

OMG, that's prosto ofigenno, tovarisch!

[ELIK]

Ha-ha-ha, yes, crazy job.
Thanks for knobs measuring