DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?

[odessa]

Did you get rid of the nag message ?

[gaminn]

Yes. The scope is in its original state. Keysight's 2.50 original firmware loaded.

I still would like to try enable all options for my scope. Can someone please help me with that and write exact steps needed to upgrade the scope? What files do I have to load to usb flash drive? My scope is MSOX2024A.

[gaminn]

It was 50 : 50 to connect to my scope during startup via telnet (2.50 firmware) using telnet_dsox.py. Also it didn't automatically launch the scope with all options enabled.  I modified the file a little, this version is able to connect everytime. Just launch it and then turn on the scope.

pip install pyping is required

[The_PCB_Guy]

Hi all,

I received my LAN boards in the mail today so I went ahead and built one up and plugged it in. I updated my scope to the patched v2.50 firmware that PhillyFlyers provided and that seemed to work just fine. I then went into the scope's I/O menu and got the IP address (I left it as auto-config, I hope that's ok) and took note of the given IP. I then connected my laptop to the LAN card via an ethernet cable and used PuTTY to telnet into the scope. I was able to log in. However, I then tried to run the following command:

ren \secure\startup\infiniivision.lnk \secure\startup\infiniivision.bak

This returned an error:

REN: Cannot form path from \secure\startup\infiniivision.bak. Name too long or malformed.

Suspecting it couldn't find the directory I simply typed "dir" and sure enough, "\secure" was not in there.


    Directory of \

01/01/98  12:00p    <DIR>                    Network
01/01/98  12:00p    <DIR>                    usb
04/16/19  08:33a    <DIR>                    Application Data
04/16/19  08:33a    <DIR>                    profiles
04/16/19  08:33a    <DIR>                    Documents and Settings
04/16/19  08:33a                          23 Control Panel.lnk
04/16/19  08:33a    <DIR>                    My Documents
04/16/19  08:33a    <DIR>                    Program Files
04/16/19  08:33a    <DIR>                    Temp
04/16/19  08:33a    <DIR>                    Windows

    Found 10 file(s). Total size 23 bytes.
    1 Dir(s) 24293376 bytes free


Where is the "\secure" directory, exactly?

Thank you,
Matt

[PhillyFlyers]

Hi all,

I received my LAN boards in the mail today so I went ahead and built one up and plugged it in. I updated my scope to the patched v2.50 firmware that PhillyFlyers provided and that seemed to work just fine. I then went into the scope's I/O menu and got the IP address (I left it as auto-config, I hope that's ok) and took note of the given IP. I then connected my laptop to the LAN card via an ethernet cable and used PuTTY to telnet into the scope. I was able to log in. However, I then tried to run the following command:

ren \secure\startup\infiniivision.lnk \secure\startup\infiniivision.bak

This returned an error:

REN: Cannot form path from \secure\startup\infiniivision.bak. Name too long or malformed.

Suspecting it couldn't find the directory I simply typed "dir" and sure enough, "\secure" was not in there.


    Directory of \

01/01/98  12:00p    <DIR>                    Network
01/01/98  12:00p    <DIR>                    usb
04/16/19  08:33a    <DIR>                    Application Data
04/16/19  08:33a    <DIR>                    profiles
04/16/19  08:33a    <DIR>                    Documents and Settings
04/16/19  08:33a                          23 Control Panel.lnk
04/16/19  08:33a    <DIR>                    My Documents
04/16/19  08:33a    <DIR>                    Program Files
04/16/19  08:33a    <DIR>                    Temp
04/16/19  08:33a    <DIR>                    Windows

    Found 10 file(s). Total size 23 bytes.
    1 Dir(s) 24293376 bytes free


Where is the "\secure" directory, exactly?

Thank you,
Matt

I believe that folder is hidden, so it won't show in a 'dir' listing..

sorry we all missed noticing the lower-case spelling in your questions before... the folder is:

"\Secure"

[The_PCB_Guy]

Did I miss something? I renamed the old .lnk file to .bak and copied the new .lnk file to the correct file, and got confirmation that it copied properly. I then rebooted my scope and immediately went into Utility -> Service -> About Oscilloscope. Unfortunately I am missing quite a few options, most notably the MSO option which is really the one I'm looking for:

• MEMUP
• EMBD
• AUTO
• FLEX
• PWR
• COMP
• SGM
• MASK
• BW20
• AUDIO
• EDK
• WAVEGEN
• AERO
• VID
• ADVMATH
• DVM
• RML

I previously just had the DSOX3APPBNDL which had the following:

• ADVMATH
• AERO
• AUDIO
• AUTO
• COMP
• EMBD
• FLEX
• MASK
• MEMUP
• PWR
• SGM
• VID
• WAVEGEN

As you can see, I definitely have some new options installed but I'm still missing some others. What happened to the MSO option? My scope is a DSO but has the connections for the digital leads, so I assumed it was supported.

Thoughts?

Otherwise, all seems to be well!

UPDATE
I guess my .lnk file wasn't written properly or something, because it did not seem to apply the way it was supposed to. Instead I used PhillyFlyers' .lnk file contents and I am fully upgraded! Thanks a lot everyone!

[2N3055]

A question:

What does SCPIPS (Infiniium Mode) do?

[odessa]

Ok,

This is interesting ... just updated my 2012A with Phillyflyers 2.5 firmware with patched comp file. Then added this lnk file to the old USB 2.41 lnk install hack  ( On page 62, posted by Luminax )

Code: [Select]

80#infiniivisionLauncher.exe -l DIS -l MSO --perf -l BW20 -l SCPIPS -l CABLE -l VID
The scope is now fully unlocked and I have no red nag messages, this was done without telnet.

[The_PCB_Guy]

A question:

What does SCPIPS (Infiniium Mode) do?

I presume it has something to do with SCPI (Standard Commands for Programmable Instruments).

[scribble]

Ok,

This is interesting ... just updated my 2012A with Phillyflyers 2.5 firmware with patched comp file. Then added this lnk file to the old USB 2.41 lnk install hack  ( On page 62, posted by Luminax )

Code: [Select]

80#infiniivisionLauncher.exe -l DIS -l MSO --perf -l BW20 -l SCPIPS -l CABLE -l VID
The scope is now fully unlocked and I have no red nag messages, this was done without telnet.

I have the exact same scope and also want to upgrade but it's very confusing as to which posters instructions to use...
Can you tell me which official firmware you had installed before starting the upgrade and which firmware you used to do the unlock as I can only see a v2.5 for the 3000 series on the previous page?
What sequence did you follow?

[odessa]

Hi,
The 2000 and 3000 are the same firmware. I used the 2.5 firmware posted by phillyflyers to upgrade to 2.5.

Then I created the lnk file using the code I posted and replaced the one in the hack posted by Luminax.

After the scope rebooted I ran the install.cab in Luminax's hack and that's it.

I also unlocked my 2004A using the above and it works perfectly, no nag messages, fully unlocked.

Edit: To answer your question about which firmware I started with, I used official 2.41 but I've flashed modded 2.43 and modded 2.5 whilst trying different things. The scope accepted them all without a problem.

[scribble]

Thank You!
Worked perfectly

For others wanting to do this, the Scopes for Dummies version as follows:

Download Phillyflier's patched firmware from post #2167 on page 87
Download Luminax's license patch from post #1529 on page 62
Extract license patch, open cmd window (if using MS Windows), navigate to license patch folder and rename infiniivision.lnk to .txt
Edit infiniivision.txt and replace text in the file with Odessa's modification from post#2197 on page 88
80#infiniivisionLauncher.exe -l DIS -l MSO --perf -l BW20 -l SCPIPS -l CABLE -l VID
Save and rename file back to .lnk
Copy firmware file (rename from .ksx to .cab if current scope fireware is older than v2.41) to FAT32 formatted USB drive
Copy licence files (2x .cab files and .lnk file) to same USB drive

Now go to your scope, turn on and plug in USB drive to front USB port
Press [Utility] > File Explorer, select the firmware file (3000XSeries.02.50.2019022736_patched.cab); then, press Load File, wait for scope to load and reboot.
Check firmware has updated to v2.5, if successful continue
Press [Utility] > File Explorer, select v241_link_install.cab file; then, press Load File, wait for scope to load and reboot.
Check licenses have all been added and if so...

Thank you to all those that made this possible 
 

[news9801]

The 3000 series cannot be used in this way.

 

[The_PCB_Guy]

The 3000 series cannot be used in this way.

 

Cannot be used in what way? I have a 3024 and I was able to update to the hacked firmware and install the other licenses.

[Pinkus]

My DSOX4000 is causing more and more problems. It often took several (up to 10x) power-ups until it booted up. Usually the LEDs only flashed briefly 1x or 2x. I already mentioned it a few months ago here or in another thread. Looks like the well known flash corruption of many Keysight products.

Unfortunately it now almost doesn't start anymore. Sometimes I need to switch on/off 100x to get it running and often even this does not work
When it is finally running, it can run for days without any problems - just booting is a problem.

Today it luckily started again and I quickly installed the latest firmware (7.20.2017102615) over the existing one hoping, that the flash memory would be rewritten and OK again - but unfortunately it didn't work out. I had the feeling that the firmware installation tried it 2 or 3 times and then the scope was dead. I was scared it would be now dead forever. I tried it 100x yesterday without any luck ... fortunately it booted today after a few tries - it came up with the new firmware, i.e. it was installed. 

The question now is, can I do anything myself (read data, rewrite Flash, etc.) or shall I just send it to the Keysight service praying that they know about the service note for a free repair of a damaged flash?
Does anybody know the exact service note # for the 4000 series? It might help to point it out to them.

Maybe someone has a hint for me?

Thanks

[TK]

Try the Keysight route first, as they will replace the full PCB as part of the service note

[Pinkus]

Try the Keysight route first, as they will replace the full PCB as part of the service note

I should note, this scope is from 2013. I am just afraid they will deny any Nand flash problem and sending me a $3000 quote.
Scope lights up very shortly some LEDs (not all) after pressing the power switch and thats it. I stays completely dark (no LEDs, no re-boot etc.), power supply and fan are working.
If these LEDs are indicating anything and if somebody has more details, I can send post list which LEDs are lit for 0.1 seconds after switching the unit on.

At the weekend I will try to record the output of the serial interface to see where it stops. I know, I should have done this before, but there is always some work getting in the way and/or I am just to lazy. But now, the scope is dead I will have to bite.....

[TheSteve]

I've never seen a nand corruption fault like that, post the boot log and we'll hopefully know for sure.

[TK]

What is the firmware version?  I don't think it matters how old the scope is.

[news9801]

The 3000 series cannot be used in this way.

 

Cannot be used in what way? I have a 3024 and I was able to update to the hacked firmware and install the other licenses.

Do you have to use LAN CARD and use Telnet to crack the version you said?

The current method of using #2201 cannot be successfully cracked.

[The_PCB_Guy]

Do you have to use LAN CARD and use Telnet to crack the version you said?

The current method of using #2201 cannot be successfully cracked.

Oh, I'm not sure about the procedure in post #2201. I used the USB + telnet method and it worked just fine.

What's wrong with the all-USB method? I haven't tried that one.

[januszb]

news9801:
Note that the post refers to the 2000/3000A series of scopes and not the 3000T scopes which have different firmware and a different procedure.

It would be interesting and more helpful if you indicate exactly what happens rather than simply that it does not work - the procedure is fairly tried and tested now.

[Pinkus]

I've never seen a nand corruption fault like that, post the boot log and we'll hopefully know for sure.

So finally I took the time and disassembled my (99,9% of the time) non starting DSOX4024a and recorded the boot log:

Code: [Select]

U-Boot 2010.03 (May 18 2017 - 11:28:22)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  fsmc-ecc1 256 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2015-10-29   8:22:14 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    37935 Bytes = 37 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK
RTC: 2019-5-19   17:56:28.13 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built Oct 29 2015 01:39:04
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008

image2 value is out of range 0 so it will be ignored.
  It must be a hexadecimal integer between 0xd00000000 and 0xd7ffffff or between 0x800000000 and 0x87ffffff.

System ready!
Preparing for download...
RTC: 2019-5-19   17:56:28.18 UTC
 Loading image 1 from memory at 0xD0400000

-->>> [Note: here it stops booting, no LEDs are lighting]  <<<--
Of course I hoped my scope would start today that I have a comparison, but I had no luck. I tried it 100 times....

So anybody who can read this boot log and give an advise?
As noted before: the scope is running the latest unhacked firmware 7.20.2017102615  and I also tried a re-installation of the firmware.

Thanks in advance for any help/advise

Edit: In case this helps. I stopped the bootloader and got this from the P500 after stopping the boot loader:

Code: [Select]

Press space to stop autoboot: 

p500> imls
Legacy Image at F8000000:
   Image Name:   XLOADER
   Created:      2010-09-24  21:30:18 UTC
   Image Type:   ARM Linux Firmware (uncompressed)
   Data Size:    5370 Bytes = 5.2 KiB
   Load Address: d2800b00
   Entry Point:  d2800b00
   Verifying Checksum ... OK
Legacy Image at F8010000:
   Image Name:   UBOOT
   Created:      2017-05-18   3:33:11 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    195988 Bytes = 191.4 KiB
   Load Address: 03f00000
   Entry Point:  03f00000
   Verifying Checksum ... OK
Legacy Image at F8050000:
   Image Name:   PBOOT
   Created:      2015-10-29   8:22:14 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    37935 Bytes = 37 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK


[The_PCB_Guy]

So finally I took the time and disassembled my (99,9% of the time) non starting DSOX4024a and recorded the boot log....

I know absolutely nothing about the firmware/software on these scopes, but the line saying the serial number is not set seems wrong. I wonder if somehow your serial number got wiped and that prevents it from booting most of the time?

[TheSteve]

The no serial message is normal. However if I had to guess I'd say the issue is not NAND corruption. Most of the time an image can be read and part way through fails with a checksum message. Your issue seems more like it can't read the flash at all. I've also never seen one that can boot once in a while, every corrupted scope I've seen never boots, no matter the number of attempts(although I assume it could happen).
Lastly any corrupted scope I have seen when a recovery and update with current firmware is performed it fixes the issue 100%.