DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?

[ktsee]

can this step do for DSOX2012A too? Or it will need another script?

[andreas_jka]

Hi,

I just managed to repair a broken and scraped DSOX 3012A (screen did not work and turned out that the 23VDC was short circuit due to a faulty capacitor). Since the scope is old I searched for FW upgrades and found this amazing thread!

I have now read most parts and are wondering if anyone could provide me with a PhillyFlyers patched FW 2.65 for the 3000-X series scopes? I would be most grateful.

Please send me a PM and I will get back with my email (I enabled the option to send me a email directly when I registered so maybe that will work as well).

The current FW is 2.37 so I hope it will be possible to upgrade completely through USB since the scope does not have any ethernet port.

Thank you in advance!

Andreas

[ELIK]

Hello
6 years of successful working of my MSOX3034T after crash, now few days ago a bad things come. 
The NAND was corrupted after long non-stop working of scope at hot weather +35 degrees. The command "nand bad" shows 5 bad sectors in NAND.
Now I restored the scope via LAN and serial port. Currently, the software version is 7.30 on scope.
But I see the two main problems.

1: Any update of scope via USB stick with original or patched .KSX firmware is unsuccessful. Every time I see via serial terminal the stuck when unpacking and reading of files by USB stick.
After minute-two of update the scope shows me the warning "Error, file loaded incorrectly". Another usb stick, with that was successful updates in past, does not helps, all was same.
When restoring of scope, was no trys by me to factory erase of NAND because I'm afraid to erase some hidden data like calibration data or serial number stored in NAND.
Maybe anyone have a way of fixing this problem with failed update via usb?

2: When the scope was restored, the message shown always "Instrument is uncalibrated. Please refer to User Cal status for details".
 The window of cal.status shows the "Results: FAILED, cal. date: zeroes, fault: Factory Cal failed" with no comments.
 The User Calibration with 5-ends cable, always stops with fault "Can't calibrate, bla-bla-bla refer to Keysight staff".
 Now all lines of scope inputs on screen are very noised, show about 8mm thickness of noise on screen.
 That means the factory calibration data is lost in my scope, is this possible at all?

In what place/folder the calibration data stored in this MSOX3034T? I think, in another place not same as in DSO3000A or other scopes.
I tried to read via terminal the content of filesystem, the folder /Secure have just 2 folders inside "Infiniivision" and "Startup", nothing else.
In past, I readed via MCU and Segger JTAG the full raw dump of NAND (256MB). Not sure that my reading was fully correct, but in dump I see some adequate data like labels, warnings and other readable data.
Is it possible to program the NAND with this binary raw dump readed by this NAND few years ago? Did someone such flashing successfully or something similar?

I read out the datasheet on this NAND, it have a few OTP pages for store of some static data like Serial Numbers. But can't find the way of dump these pages via terminal or via MCU JTAG. Is it possible to read these OTP pages with some simle ways?

Need your help,
Thanks before for the answers..

[albertr]

I would try to restore the nand dump to a brand new nand chip and then try to replace the old nand chip with a new one on the board.

-albertr

[ElectronMan]

Hello
6 years of successful working of my MSOX3034T after crash, now few days ago a bad things come. 
The NAND was corrupted after long non-stop working of scope at hot weather +35 degrees. The command "nand bad" shows 5 bad sectors in NAND.
Now I restored the scope via LAN and serial port. Currently, the software version is 7.30 on scope.
But I see the two main problems.

1: Any update of scope via USB stick with original or patched .KSX firmware is unsuccessful. Every time I see via serial terminal the stuck when unpacking and reading of files by USB stick.
After minute-two of update the scope shows me the warning "Error, file loaded incorrectly". Another usb stick, with that was successful updates in past, does not helps, all was same.
When restoring of scope, was no trys by me to factory erase of NAND because I'm afraid to erase some hidden data like calibration data or serial number stored in NAND.
Maybe anyone have a way of fixing this problem with failed update via usb?

2: When the scope was restored, the message shown always "Instrument is uncalibrated. Please refer to User Cal status for details".
 The window of cal.status shows the "Results: FAILED, cal. date: zeroes, fault: Factory Cal failed" with no comments.
 The User Calibration with 5-ends cable, always stops with fault "Can't calibrate, bla-bla-bla refer to Keysight staff".
 Now all lines of scope inputs on screen are very noised, show about 8mm thickness of noise on screen.
 That means the factory calibration data is lost in my scope, is this possible at all?

In what place/folder the calibration data stored in this MSOX3034T? I think, in another place not same as in DSO3000A or other scopes.
I tried to read via terminal the content of filesystem, the folder /Secure have just 2 folders inside "Infiniivision" and "Startup", nothing else.
In past, I readed via MCU and Segger JTAG the full raw dump of NAND (256MB). Not sure that my reading was fully correct, but in dump I see some adequate data like labels, warnings and other readable data.
Is it possible to program the NAND with this binary raw dump readed by this NAND few years ago? Did someone such flashing successfully or something similar?

I read out the datasheet on this NAND, it have a few OTP pages for store of some static data like Serial Numbers. But can't find the way of dump these pages via terminal or via MCU JTAG. Is it possible to read these OTP pages with some simle ways?

Need your help,
Thanks before for the answers..

I had to do this recently with my 3034T. I can recover the files from your dump if you would like.

They get stored under \Secure\cal.

[ELIK]

Yes sorry, the folder "cal" is invisible but present, it have a 4 files. I copied these files to usb flash and observed. they are all empty, looks just as dummy files with mostly zeroes inside.
sernum.dat (length 76 bytes) have no sernum, zeroes inside.
FactoryCal0.dat (708 bytes), have in dump a date "00.00.YYYYMMDDXX" s and filled with "03 00 00 00" repeated words
ServiceCal0.dat (704 bytes), same, have a date "00.00.YYYYMMDDXX" and filled with "03 00 00 00"
UserCal16.dat (27kb) have a date "00.00.YYYYMMDDXX" and filled with some bytes.

[xiaofengya8975]

Who can provide MSOX 3000T or DSOX 3000T version 7.3 firmware? My DSOX3054T won't start! The links on the forums are all broken. Unable to download

[msuthar]

A search turned up nothing on this.

Has anyone determined if the 3000G firmware is that same as the 3000T, albeit for naming?  As anyone imperiled their G yet to try "upgrading"

Yes, it worked on new MSO-X3054G which came with factory installed 7.57 firmware which was downgraded to 7.30 patched.
Looking for patched 7.50 for 3000T firmware can anyone PM please.
73

[Electrojunky]

Hello!

Would anyone be so kind as to provide a copy of PhillyFlyers patched FW 2.65 for the 2000-X series scope?

Thank you!!

[rev3rse]

 Hello everyone,

   Massive thanks  for the work.
 
 Long story short ...

   I've upgraded a DSOX2002A scope a few months back ... and screwed the .lnk files ... attached a ttl serial - I think it started several times. Putty flooded with errors.
   A few months passed - bought a dsoxlan card, attached serial and dsoxlan - used CELoader - managed to start the scope. RE-flashed the firmware.

   I can logon with telnet  - but I DON'T HAVE \Secure folder. Even if I create the folder with mkdir - on next reboot it's gone.
   I always get the error "System concerns detected" - OS versio is not correct.

  I tried everything. Creting the folder. Re-flashing multiple times with original / patched firmware (2.65). Cannot find "Secure folder". In serial teminal I see the message: Creating \Secure\cal" ... but the folder does not exist.
 I tried attrib -H -R -S ... nope ...

   What's the deal ? Why I lost "Secure" folder ? What can I do to "factory reset" the scope.

Apreciated !
Popte.

[rdebets]

Just in case somebody runs into this problem: my DSOX3034T just lost it's T......the touch screen no longer worked.
I took the unit apart and reseated the 2 touch screen flex cables, reassembled and it works again.


The touchscreen is separate from the display and is a Dawar DW00398D quite solidly built using two glass plates.

[rev3rse]

 ... I tried a few things in the last few hours.
  Like I mentioned ... I have serial and dsoxlan (clone) card.

 Telneting into the scope works with modified firmware. no \secure folder. But -
   - I have a serial number, (in about) and a valid MAC address.
   - I have NO calibration data. Last calibration date 1970 ...

  I have no options installed. If I kill the app (processmgr kill infiniivisionlauncher.exe) and start it again like this: infiniivisionLauncher.exe -l MSO -l WAVEGEN --perf -l D2000AUTB -l D2000GENB -l D2000BDLB -l BW10 -l BW20 -l SCPIPS -l PLUS -l VID -l CABLE -l ASV
  Options appear in "about" but - I still have the message with System concerns detected" - OS version is not correct.

 I am posting this because I defenitely have another question  -
  about 10 pages back when the last firmware was posted - I notice a difference in MD5 checksums for the file between 3000 and 2000 series. Well I used 3000XSeries.02.65.20210307001_patched.ksx ...  NOT 2000 ... because somewhere back in the thread someone said they are identical. Could that be a problem ?
 
  I tried to reflash the original 2.65 firmware using an usb stick - and I have the same error "System concerns detected" - OS version is not correct. "   - and now I cannot telnet (I know there's a python script to login at the precise right time ... but ... I don't think it's helpful).

  I don't really see any ECC errors in serial console (I might be wrong).

 Can someone point me please to a legit 2000 series 2.65 firmware ? Maybe I screwed things up using that 3000X one ?? (since the md5 is different) ?

 What do you  guys think ?

  Thankyou readers !
   Popte.

[J-R]

You can download all of the official firmware files directly from Keysight.

The official 2000X and 3000X firmware files are 100% identical, but the patched ones are not, as you have found.  Personally I would play it safe and use the correct patch file.

Another note, your command line looks a bit suspect.  For example, you are telling it the bandwidth is both 100MHz and 200MHz?

What are you using for your .lnk file?  This is a simple one that will work for both 2000X and 3000X: 59#infiniivisionLauncher.exe -l all -l BW20 -l SCPIPS -l CABLE

[rev3rse]

You can download all of the official firmware files directly from Keysight.

I would apreciate if someone could help me with a patched 2000 series firmware. I have all the official (most of them) since version 1.10.

The official 2000X and 3000X firmware files are 100% identical, but the patched ones are not, as you have found.  Personally I would play it safe and use the correct patch file.

It was a mistake. Wasn't intended - I really tought then that they are identical. ...
Do you think this is the cause for the filesystem  problem ? The reason I don't have a /Secure/ ffolder ?

Another note, your command line looks a bit suspect.  For example, you are telling it the bandwidth is both 100MHz and 200MHz?

Yes ... I noticed last evening. Tried my command line with  -l BW20 only - and works. But with both ... still works.
I copy/pasted the command from someone on this thread that had success with it on a 2002A. So ... if for someone else worked ....

What are you using for your .lnk file?  This is a simple one that will work for both 2000X and 3000X: 59#infiniivisionLauncher.exe -l all -l BW20 -l SCPIPS -l CABLE

Well this is the big problem. I DON'T HAVE a .lnk file (or I cannot see it). Since I don't have a /secure folder .... I don't have a lnk file. The application (infiniivisionLauncher.exe) starts at boot-up - but I DON'T know who invokes the executable ... and from where.
I can kill it like I mentioned in my last post - and I can start it with parameters ... works but still with an error.

Now that you cleared up the thing that the patched files have diffs .... I am really starting to think this is the root of my problem.
What should I do ? Can someone please help me with a patched 2.65 firmware for 2002A ?
Also .. Should I "recover" the scope using teraterm - and serial ? Is it worth it ? Since it's booting and I have network - isn't there an easier way to do that ?
I tried (currently) an official 2.65 firmware for 2002A - same error ...

Thankyou.
Popte.

[rev3rse]

Hello everyone,

  I still have no ideea how to "factory" reset this scope.
  The error "System Concerns Detected: OS versio is not correct. Please reload system firmware"  - remains, no matter what. Official firmware, patched one ...


I tried 2002A firmware.
 Please take a look at my screenshow - with 2xPutty open.


  Any ideeas ?

Thankyou,

Popte.

[ElectronMan]

Hello everyone,

  I still have no ideea how to "factory" reset this scope.
  The error "System Concerns Detected: OS versio is not correct. Please reload system firmware"  - remains, no matter what. Official firmware, patched one ...


I tried 2002A firmware.
 Please take a look at my screenshow - with 2xPutty open.


  Any ideeas ?

Thankyou,

Popte.

On the 3000 \Secure is often hidden. You can try to cd into it (without it listed).

But if it is being recreated on boot every time, you have bigger problems. I had that issue and needed to erase the bad block via JTAG to get \Secure to stay. Otherwise it would be recreated empty on every bootup.

[ThomasDK]

Can someone send me the patched firmware for DSOX2000?

Thanks

[diegodgo]

Hello.
Could someone please send me a copy of the PhillyFlyers corrected firmware 2.65 for the DSOX2002A? By PM or email diegodgo@gmail.com

Thanks.

[marekx]

I will also step into this queue. Please could anyone share link or a copy of the PhillyFlyers 2.65 patched firmware for DSOX2000 t991731@protonmail.com

With best wishes,
Marek

[cmilak34]

Hello everyone!

I have a problem with oscilloscope.

Patient: MSO-X 3102A
Symptoms: standard NAND corruption

I based on the famous manual of titiris. I used 3000XSeries.02.35.2013061800 firmware.

Everything works up until running the "go 0x00362000" command. A logo appeared on the display, but the whole boot procedure in Tera Term stopped at some point:

Code: [Select]

ime for NANDFLASH to load: 0 ms.
Time for SNANDFLASH to load: 0 ms.
Starting ProcessStartupFolder
running \Secure\Startup\infiniivision.lnk...
Ending ProcessStartupFolder
                           System.TypeLoadException: TypeLoadException
   at Agilent.InfiniiVision.infiniiVisionLauncher.Main(String[] args)

It looks like instead of loading the image from the memory stick, the corrupted image from the oscilloscope is loaded further.

I have tried different paths in the infiniivision.lnk file:

Code: [Select]

48#\Secure\infiniiVision\infiniivisionLauncher.exeor

Code: [Select]

44#\usb\infiniiVision\infiniiVisionLauncher.exeor

Code: [Select]

51#\usb\Secure\infiniiVision\infiniivisionLauncher.exe Doesn't work.
Any ideas?

[ha110ween]

Could anyone send me the PhillyFlyers patched firmware for DSOX 4000X Series?

bh3nvn@hotmail.com

Thanks

[ha110ween]

Could anyone send me the PhillyFlyers patched firmware for DSOX 4000X Series?

bh3nvn@hotmail.com

Thanks

Thanks to all friends!
Worked on my MSO-X 4034A.

[pausmth32]

Hi,
If I could get a copy or link to PhillyFlyers patched firmware for the dsox2002a that would be great! pausmth@gmail.com or PM
Thanks in advance!

[jirikv]

Hi,
can I also ask someone to send me PhillyFlyers patched firmware for the DSOX2000X
jirikva528@gmail.com or PM
Thanks a lot!

[cmilak34]

As I mentioned earlier my oscilloscope (MSO-X 3102A) has the typical NAND corruption.  I have already tried the tetris method with firmware versions 2.1, 2.3, 2.35 - no succes. I've tried different USB drives, different paths in the infiniivision.lnk file, but it still won't start booting from the USB drive.

I finally started comparing the lengths of the different firmwares. It looks like the firmware on my oscilloscope is  2.36.

Has anyone managed to fix their oscilloscope in this situation?

Can anyone tell me what the numbers in the paths mean?
For example:

Code: [Select]

44#\usb\infiniiVision\infiniiVisionLauncher.exeWhat

Code: [Select]

44# mean?