DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?

[wp_wp]

https://cal.equipment/doc/HP_Agilent_Keysight/DSOX/
This link is void,who can give a new link?
Thank you!

[Hydrawerk]

Has anyone with a 3000 or 4000 series ever tried "CAKE" or "AFTER DUSK" as the screensaver text?

I saw CAKE mentioned previously but never saw a response. These don't work on my 1102G, but are in the DLL alongside TREK. Hopefully I can try them on my 3034T once I get it repaired.

CAKE = Text with the developer names and other text which changes.

AFTER DUSK = Flying scopes with wing and scope probes.

Will this work on a DSOX2000A series scope??

[JFJ]

https://cal.equipment/doc/HP_Agilent_Keysight/DSOX/
This link is void,who can give a new link?
Thank you!

The Internet Archive has cached that page, but not its linked files:
https://web.archive.org/web/20190411134148/https://cal.equipment/doc/HP_Agilent_Keysight/DSOX/

However, the archived links do work on the original site (with the https://web.archive.org/web/20190411134148/ prefix removed), e.g:
https://cal.equipment/doc/HP_Agilent_Keysight/DSOX/3000XSeries.01.10.2011031600.cab
https://cal.equipment/doc/HP_Agilent_Keysight/DSOX/3000XSeries.02.10.2012022200.cab
https://cal.equipment/doc/HP_Agilent_Keysight/DSOX/3000XSeries.02.20.2012110802.cab
https://cal.equipment/doc/HP_Agilent_Keysight/DSOX/3000XSeries.02.30.2013032600.cab
https://cal.equipment/doc/HP_Agilent_Keysight/DSOX/3000XSeries.02.35.2013061800.cab
https://cal.equipment/doc/HP_Agilent_Keysight/DSOX/3000XSeries.02.37.2014052002.cab

[Hydrawerk]

CAKE = Text with the developer names and other text which changes.

AFTER DUSK = Flying scopes with wing and scope probes.

OK, this does not work on my DSOX2002A. :-( Are there any other possible secret passwords? (Yes, TREK works for me.)

[bmwman91]

Hello! I have been lurking off & on in this thread for quite a while and finally decided to jump in since I am looking to "upgrade" from my Rigol DS1104Z-S Plus. It has served me well, but the ergonomics & speed just are not quite cutting it, at least not compared to the Agilent/Keysight stuff I get to use at work. I have an opportunity to get a pretty good deal on a used MSOX2024A, and I remembered this thread from a couple of years ago. My question is regarding which v2.5 firmware to use from this post:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2945740/#msg2945740

I see there is FW for DSOX2000X, and DSOX3000A. It has been mentioned in here in a few places that the FW for 2000A & 3000A are the same, but I wanted to confirm that I will want to use the 3000A file on a 2024A, not the 2000X FW.

Thanks for all of the curiosity and hard work in here! I am continually impressed and encouraged by what the DIY community does!

[Bill Woodbridge]

A quick question on this well-worn topic please, with apologies as although I’ve studied this thread for about 3 weeks I’m still not absolutely sure of the answer.

Does PhillyFlyer’s patched firmware (2.50 for the 3000A series, in my case, details below) preserve the original .lnk file and its command line options once it is installed?  My understanding is that it does, and that the process of changing/fiddling about with the .lnk file happens as a second stage after the firmware installation.

I ask because I want to capture and preserve the scope’s original .lnk file in case I need to revert to it if I encounter problems, but I need the PhillyFlyer patched firmware installed first in order to be able to Telnet in reliably and copy off the original .lnk to USB (if I’ve understood correctly).

Other than this question I think I’m ready to dive in for a full ‘enhancement’ project.  If anyone can recommend the latest brew for the .lnk command line options I’d also be very grateful please.  I am unclear on the best ‘bundle’ option to use, as many of them seem to overlap:  D3000BDLA, ALL (I gather this achieves permanently enabled trial licenses with the * displayed, so I’d prefer not to go for that one), or DIS?  (I know BW20 and MSO, at least, must be included separately)

Many thanks for clarification and to all previous researchers - 'standing on the shoulders of giants' springs to mind.


DSOX3014A (100MHz)
Firmware 2.50 (recently installed successfully from the Keysight website)
LAN/VGA module fitted
Installed licenses shown on the ‘About’ screen: EDK, SGM, WAVEGEN, DVM, RML

[Bill Woodbridge]

An update: I took the plunge and have now achieved a fantastic result (eventually, after a few pitfalls).  Here they are, based on my experience in the hope they might be useful for others.

I based my procedure on Cretone’s list post 2504 for which many thanks (modified for the 3000A obviously).  My own observations, setbacks, pitfalls etc in italics after each step

1.   Download PhillyFlyers’ 3000A series patched firmware 2.50 from the web to a FAT32 USB stick.

The hosting site mega.nz was blocked by my ISP – I needed to temporarily switch DNS servers to Google’s public DNS (8.8.8.8 and 8.8.4.4) to overcome this

2.   Plug the USB stick into the front USB port of the (running) scope, install the patched firmware via the standard firmware update procedure (Utility / File Explorer / goto USB / Load File).  Once the reboot is complete, keep the scope powered up.

Flawless update, scope rebooted immediately, no visible changes or warning messages – excellent. 

3.   Create a file infiniivision.txt with a raw text editor on a PC containing the infiniivisionLauncher command line with the options required (not forgetting to adjust the character count, ie the no. of characters to the right of the #).  Mine was:

93#"\Program Files\infiniiVision\infiniiVisionLauncher.exe" -l D3000BDLA -l BW20 -l MSO -l MEMUP

This was the biggest pitfall which took me a day to resolve.  The syntax for each option is hyphen then lowercase l then space then option code.  However, in most forum posts, the lowercase l looked to me like the pipe (vertical bar) character and even though I copied and pasted from the forum into my text editor and ended up (correctly) with lowercase ls, I was convinced it had translated them incorrectly and laboriously went through with a hex editor changing them back to pipes (unicode 7C).  (Eventually, through Telnet / CMD, I found the syntax for the infiniivisionLauncher.exe command and the penny finally dropped)

4.   Unplug the USB stick from the scope, save this infiniivision.txt file onto it, then replug it into the scope.  The file should now be visible through Utility / File Explorer.

Don’t be tempted to try and load the file into the scope like in step 2 – it’s not firmware!

5.   Time for Telnet: plug the scope into your local Ethernet, make sure the LAN config is set to automatic (Utility / I/O / LAN settings) wait for it to acquire an IP address (assuming you have a hub or similar with DHCP server capability connected).  Then Telnet into the IP address shown on the I/O information screen, username and password as per previous posts.  The Telnet window should then give the Windows CE command prompt:

Pocket CMD v 6.00
\>

Telnet was rock-solid throughout, and thanks to the patched firmware there seemed to be no restriction on having to time it to coincide with the boot-up phase of the scope.  I was dreading the networking, being an amateur, but simply plugging in to a typical home broadband network with a DHCP-serving hub it was incredibly easy and the scope sorted out its config automatically within seconds.  Alternatives are fiddling with static IP addresses, subnet masks etc and point-point Ethernet (scope – PC) with a crossover cable …

6.   Use the Telnet / CMD session to backup the existing .lnk, then transfer the .txt file from USB and rename it to .lnk thus:

rename \Secure\Startup\infiniivision.lnk \Secure\Startup\infiniivision.bak
copy \usb\infiniivision.txt \Secure\Startup\infiniivision.txt
cd \Secure\Startup
rename infiniivision.txt infiniivision.lnk

An initial worry was that even dir /a /s did not reveal the \Secure directory, however using cd \Secure will navigate to it and then enable dir to list its contents.  The original infiniivision.lnk file was present, but empty (0 bytes) and with the archive flag set - I backed it up nevertheless!  Note the copy command requires the full path and filename for both source and destination – just specifying the destination directory isn’t sufficient.  The cd into \Secure\Startup was necessary because attempting the rename from the root directory gave an error message that the command line (with the full path included in the filenames) was too long.  Finally, there are lots of ‘i’s in infiniivision, I lost count of the number of times I forgot the double i in the middle.

Historically the advice on the forum has been to kill the running inifiniivision.exe instance before doing the file manipulation, but lately this step seems to have been omitted in most recommendations.  I didn’t kill it, because I simply forgot all about that step.  Leaving it running didn’t seem to cause any problems, but of course the scope requires a reboot to pick up the new .lnk file and enable the options.

7.   Turn off the scope – a tense moment for potential bricking, as the die is now cast.  Turned on again, flawless and fast boot up, with all the newly-enabled options present and correct on the About screen (and enabled on the appropriate buttons etc).

This happy result was only after I had fixed the l / | confusion in the .lnk file of course.  When I was still blundering about with the pipe character, the scope booted up correctly (luckily) but naturally none of the additional options appeared on the About screen.

So thanks once again for all the contributions that helped me get to this point. 

I have a horrible temptation to start poking about with the 350MHz hardware mods now ...

[bmwman91]

I also successfully upgraded my MSOX2024A using only USB and the instructions found in this post:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2932770/#msg2932770

Necessary files / option strings were pulled from these posts:
Firmware: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2945740/#msg2945740
Option strings for infiniivision.lnk: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2351031/#msg2351031
Link file install scripts: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1189010/#msg1189010

[wp_wp]

The latest 2000X firmware is 2.60 in KeySight web site.
Also the 3000X firmware.

[tabajaralabs]

Greetings from Brazil!
I got my own DSO-X2002A =) and with lots of licences and 200MHz upgrade! 
Firstly, I came to thank who made this possible. I have no enough words to say THANKS to all who helped to hack the planet...eh, the scope

I'd like to add some words to the "Power-super-scope for dummies" instructions. I had lots of questions and the procedure is really simple.
So, to make it easy for dummies like me:

1 - Download Phillyflier's patched firmware from post #2167 on page 87.  Seems the link is dead but you can find it here in the forum

2 - Download Luminax's license patch from post #1529 on page 62

3 - IN THE LUMINAX'S PATCH, Extract license patch. You'll have 3 files. One for install the patch, one for uninstall the patch, and the infinitiivision.lnk file which is the licence itself. Since the file is a LNK file, it will be extracted in windows as a extensionless file and you will not edit it easily. Open cmd window (if using MS Windows), navigate to WHERE YOU EXTRACTED the license patch folder and rename infiniivision.lnk to .txt

4 - Edit infiniivision.txt and replace EVERYTHING in the file with Odessa's modification from post#2197 on page 88 which is written below
80#infiniivisionLauncher.exe -l DIS -l MSO --perf -l BW20 -l SCPIPS -l CABLE -l VID

5 - Save and rename file back to .lnk

6 - Copy firmware file (rename from .ksx to .cab if current scope fireware is older than v2.41) to FAT16 OR FAT32 ROOT DIRECTORY formatted USB drive

7 - IN THE SAME ROOT DIRECTORY Copy licence files (2x .cab files and .lnk file) to same USB drive

Now go to your scope, turn on and plug in USB drive to front USB port
Press [Utility] > File Explorer, select the firmware file (3000XSeries.02.50.2019022736_patched.cab); then, press Load File, wait for scope to load and reboot.
Check firmware has updated to v2.5, if successful continue
Press [Utility] > File Explorer, select v241_link_install.cab file; then, press Load File, wait for scope to load and reboot.
Check licenses have all been added and if so...

Hope that helps to make the procedure less confusing =)

[tabajaralabs]

My scope uses the 2.50 hacked firmware
What happens if I upgrade it to 2.60? Will I loose all licenses?

[wp_wp]

My scope uses the 2.50 hacked firmware
What happens if I upgrade it to 2.60? Will I loose all licenses?

Yes

[msuthar]

I upgraded  to 2.60, I lost all licenses !... Revert back to patched 2.50 ,put back the lnk file and got  all licenses back in working condition.
Now strange thing I have noticed ,when I press Serial decode key it starts the decoding but the green triangle light is not getting lit !
Unit is Agilent DSO-X 2004A

[msuthar]

this is how I get the character count

120#infiniivisionLauncher.exe -l MSO -l WAVEGEN --perf -l D2000BDLA -l BW10 -l BW20 -l SCPIPS -l PLUS -l VID -l CABLE -l ASV
xxxx12345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
                     10               20              30               40              50               60              70               80              90             100             110            120             130

[PA0PBZ]

this is how I get the character count

I don't think the character count is checked anywhere so it does not matter.

[Hydrawerk]

when I press Serial decode key it starts the decoding but the green triangle light is not getting lit !
Unit is Agilent DSO-X 2004A

I think that this is normal function. Can someone confirm it please?

[MarkL]

when I press Serial decode key it starts the decoding but the green triangle light is not getting lit !
Unit is Agilent DSO-X 2004A

I think that this is normal function. Can someone confirm it please?

It's normal.

The green triangles are only on when the knobs to the right (vertical position and size) are active.  The knobs don't do anything for serial decoding, so the indicator is off.

As told to me by an Agilent support engineer.

[tabajaralabs]

In the video analysis of the X2024A  by Dave, he had the serial funcion enabled and the green triangle also didn't lit. So I believe this is the common (albeit stupid) way it works.

[tabajaralabs]

A question for the people who understands better the inner workings of these scopes than me:
Is there a way I can hack the 2.50 patched firmware to change branding/boot screen back to Agilent?
I confess it was a way more beautiful boot screen an logos =)

[wp_wp]

A question for the people who understands better the inner workings of these scopes than me:
Is there a way I can hack the 2.50 patched firmware to change branding/boot screen back to Agilent?
I confess it was a way more beautiful boot screen an logos =)

Yes,you can change boot screen back to Aglient.

[tabajaralabs]

I discovered how to change the boot logo, but unfortunately I wasn't able to save the old firmware boot screen. It isn't avaiable in any firmware update I found. I know of one scope that has the old firmware here, but it will be a lot of work for just one screen :\

[tabajaralabs]

Uh Oh...
A friend of mine has a DSO-X2012A which is already on version 02.50.2019022736 (which is the same of the hacked firmware avaiable here)
He tried to update with the pached firmware and had no success.
Any tips? Maybe the scope isn't storing the firmware because it is already the same version?
Thanks!

[Bud]

I discovered how to change the boot logo, but unfortunately I wasn't able to save the old firmware boot screen. It isn't avaiable in any firmware update I found. I know of one scope that has the old firmware here, but it will be a lot of work for just one screen :\

Is that the one you want?

https://www.eevblog.com/forum/testgear/agilentkeysight-dsox-20003000-custome-boot-screens/msg909912/#msg909912

[tabajaralabs]

Nop...this one!

[Bud]

I see. Great image, let us know if you find it.

If you have Telnet access to the scope that has it, you could extract the compiled splashimage.bin file and implant it on the new scope directly. I believe the .bin file is stored in \secure\infiniivision folder.