Agilent MSO 5000/6000/7000 - anyone hacked these scopes?

[Orange]

I also have another question, last night i wanted to perform a user calibration, i set the switch to uncalibrated but the scope said it was calibrated. (protected)
Does anyone have encountered that problem?

Haasje93

That's funny.
Last week I wanted to do a  user calibration on my MSO7014A, and the scope would not let me. It said it was protected, toggled the switch several times, and it refused to let me do the calibration.
I opened it up, and took the main board out and measured the switch. Switch was wrong, no contact on one position......

I took the switch of the board and opened it, nothing obvious to see. I cleaned it and put it back together and now both positions worked OK. Soldered it in and it works again.

Bad switch, perhaps the complete series. It was a red C&K slide switch....

[mikeselectricstuff]

I also have another question, last night i wanted to perform a user calibration, i set the switch to uncalibrated but the scope said it was calibrated. (protected)
Does anyone have encountered that problem?

Haasje93

That's funny.
Last week I wanted to do a  user calibration on my MSO7014A, and the scope would not let me. It said it was protected, toggled the switch several times, and it refused to let me do the calibration.
I opened it up, and took the main board out and measured the switch. Switch was wrong, no contact on one position......

I took the switch of the board and opened it, nothing obvious to see. I cleaned it and put it back together and now both positions worked OK. Soldered it in and it works again.

Bad switch, perhaps the complete series. It was a red C&K slide switch....

Maybe something like silver plated, tarninshing over a long time of no use.

[swperk]

Even better:
6GHz is working perfectly!
But the smallest Time Base is staying at 100 ps, same as with 2.5 GHz and 4 GHz
The original smallest time base was 500 ps at the 1 GHz setting.

infiniivsion_ext.lnk:
91#\System\infiniivision\infiniivisionlauncher.exe -l MSO -l BW250 -l BW250 -l BW400 -l BW600


Now lets add all the other options again

Thanks for this *very* educational narrative! What is the meaning of the "Unsealed Instrument" warning? Does it have any affect on the operation, calibration, or any other aspect of the scope? Can this warning be gotten rid of?

Stan

[HighVoltage]

Even better:
6GHz is working perfectly!
But the smallest Time Base is staying at 100 ps, same as with 2.5 GHz and 4 GHz
The original smallest time base was 500 ps at the 1 GHz setting.

infiniivsion_ext.lnk:
91#\System\infiniivision\infiniivisionlauncher.exe -l MSO -l BW250 -l BW250 -l BW400 -l BW600



Now lets add all the other options again

Thanks for this *very* educational narrative! What is the meaning of the "Unsealed Instrument" warning? Does it have any affect on the operation, calibration, or any other aspect of the scope? Can this warning be gotten rid of?

Stan

This warning will stay and be visible only after a reboot of the scope until you press the back button.
I have found no limitations at all and all operations are working perfectly to specifications.

[swperk]

Thanks for the clarification. One other thing: I tried installing the all options .lnk file and when my scope started up, it showed it as a 6 GHz scope with all options except the last one in the string (JITTER). I checked and re-checked, verified the length of the string as 246 characters, and reloaded it and restarted the scope several times, but no luck. It always comes up with everything but the jitter option, and when I press the jitter key, it confirms this by telling me that it's not installed. My scope is a 1 GHz MSOX6004A with the app bundle, so by default it has the jitter option. I can see the jitter option (along with all the other options) when I remove the .lnk file from the \System\Startup folder and reboot the scope. Any ideas? Thanks!

[swperk]

Solved! The last character of my .lnk file was the "R" in "JITTER". I added a space at the end and all is well. Not sure why it worked, but it did.

[tomvid]

Hello,

well I wish I knew this forum some years ago, when older versions of bin/jzp files were available. I just downloaded the actual versions (6.20) for the scope 6000. After running

Code: [Select]

unjzp sys.jzp sys.bin sys_rev.txt I get a very short sys_rev.txt file (1KB), it contains just a following text:

Code: [Select]

@(#)REV: 06.20.0000 Apr 23 2015 10:42:11Does this mean, Keysight changed the structure of the source files, so our unjzp can't cope with them anymore?
Does anybody have the older files, that can be adjusted? I would like to play with my scope a bit...

[HighVoltage]

Solved! The last character of my .lnk file was the "R" in "JITTER". I added a space at the end and all is well. Not sure why it worked, but it did.

Congratulations!
Small things in the .lnk file have huge influences, great that you solved it.

[abyrvalg]

tomvid, short txt file is correct. It's just a revision string from jzp header to pack it back later. Don't touch it, look at bin.

[andreathepsyco]

Hi everybody! I've been lurking this topic for a long time and finally i got my hands on a MSO6034A and i'm pretty happy of the purchase . Unfortunately i wasnt' able to make the bin file hack to work. I'm using version 6.20 and the instruction provided earlier in this thread (Go to 0x00231998 and replace 38 09 FF FD by 38 00 00 01). Can anybody tell me where am i mistaking? Or lend me a copy of firmware 6.16? Thank you!

EDIT: I hadn't searched well enough apparently... As was already pointed out by @berk98 many pages ago the fix is the same as before but with a different offset:

sys6000.bin 6.20.0000:
offset 0x002E80F8:  94 21 F8 E0 7C 08 02 A6 -> change to -> 38 60 00 00 4E 80 00 20

tested: it works!

[GotObsoleteScopes?]

Hi all - I've had a great time reading through this whole thread. It's awesome seeing how knowledgeable many of y'all are is just sweet. I'm working on implementing the servo d me u hack on a DSO6054a, but I'm not getting anything in the option menu when I finish the VxWorkd mod, and CD bin doesn't show a license file either. Any guidance for next steps? I'm not quite ready to modify the bin yet, but I will if I have to. Any advice for the bin mod on the DSO6054a?

Sent from my SM-G955U using Tapatalk

[johnmx]

What are the options TEL, TOM and CIR?

I cannot find any info about them anywhere...

[nctnico]

CIR is circular segmented recording. Normally the oscilloscope would capture X segments and then stop. With CIR you get an extra setting which continues to capture segments until you press stop. The UI doesn't really show what is going on so I guess that is the reason Agilent never made this very usefull feature available as a normal option.

[zitt]

Were there specific instructions for booting off USB on these (6000A) scopes?

I want to play around without actually modifying the firmware on the scope's "memory"... and my scope has SEC installed at factory.
Is there a "de-brick" procedure documented to recover from a bad situation?

[mikeselectricstuff]

Were there specific instructions for booting off USB on these (6000A) scopes?

I want to play around without actually modifying the firmware on the scope's "memory"... and my scope has SEC installed at factory.
Is there a "de-brick" procedure documented to recover from a bad situation?

ISTR it is possible to boot from USB, I don't recall the details but probably in this thread somewhere

[zitt]

ISTR it is possible to boot from USB, I don't recall the details but probably in this thread somewhere

I grew a pair last night and threw caution to the wind. After realising the scope would boot from USB using the 4 second reset rule.

I started by removing SEC option as documented by abyrvalg at this post.

Once I saw how easy SEC was to disable and I had the scope booting off usb; I went ahead and modified the copy of the .jzp per 6.20 instructions here and the tools here. Once I had all the .lic installed for the software I was interested in and verified the usb hack would work. I went ahead and upgraded the scope using the usb modified binary. Everything seems good.

Does anyone know if the USB ports can really be used with a USB keyboard? Mine doesn't seem to recognise the keyboard.
I couldn't figure out how to bring up the utility menus from within VNC.

[Howardlong]

A quick note, a couple of days ago I hooked up my 7104B running 6.16 to IO libraries... and the liberated options mysteriously disappeared.

FWIW I was using the service menu method.

I re-enabled them again using the same method afterwards.

I won't be using IO libraries again!

[HighVoltage]

A quick note, a couple of days ago I hooked up my 7104B running 6.16 to IO libraries... and the liberated options mysteriously disappeared.

Good to know, thanks for sharing this.

What did you do with the IO libraries on the scope?
Did you send any commands or was detecting the scope enough to loose the "service mode"
Was this repeatable?

[Howardlong]

A quick note, a couple of days ago I hooked up my 7104B running 6.16 to IO libraries... and the liberated options mysteriously disappeared.

Good to know, thanks for sharing this.

What did you do with the IO libraries on the scope?
Did you send any commands or was detecting the scope enough to loose the "service mode"
Was this repeatable?

I was looking at running a SCPI command to set a non standard high baud rate on the uart serial decoder without having to spend ages twiddling the knob.

I only noticed afterwards that the options had disappeared after a restart the next day. I’ve been using it liberated pretty much daily for the past two year or so with no problems until now.

[Haasje93]

Thanks for sharing this!

[jameswhong]

Just writing to say it works on DSO7054B.

[Howardlong]

Thanks for sharing this!

FWIW, I ended up achieving my aim of being able to directly key in large arbitrary UART baud rates perfectly well using telnet without any problems, no need for the Keysight I/O libraries and BenchVue etc. I am sure many already knew this, for some reason I incorrectly thought there was more to it.

[TiN]

Hello all,

Hope you guys don't mind if I join this little party?

Received my 7014A (circa 2009) today. It's all working, so I used info to "improve" it a little.
Figured out strap for 7104, but obviously 1G 50ohm hardware is missing, so I think we need schematics for front end to perform a proper modification.
My PCB does not have the Teledyne relay spot, so it will be more challenging than popping some parts on PCB..



To add some photos into collection, my 7014A HW (stock condition):



PCB Rev 002  54693-26410
PCB sticker number 54689-66410 , which is bit puzzling as it's not the one known in other DSO7xxx posts.
Original firmware was ver5.25

Front end magic:

[Howardlong]

I have a 7104B, I can "take it apaaaart" and get some pics if you like.

Those AFE shields look like they're clipped on push fit rather than soldered is that right? (The AFE shields in my 3054A were soldered, and were difficult to remove without damaging the board's copper layers).

[TiN]

I have a 7104B, I can "take it apaaaart" and get some pics if you like.

Those AFE shields look like they're clipped on push fit rather than soldered is that right? (The AFE shields in my 3054A were soldered, and were difficult to remove without damaging the board's copper layers).

Yes, please. More the better.
Shields are clipped, but you will have to take the board out (or lift it slightly), because shields fixed by screw, which is not accessible (blocked by frame metal). You'd need unfasten PCB screws, remove 4 small screws near BNC ports from front, release two plastic clips and then board comes out very easy.
It took me 5 minutes to take board out.

Ideally I'd need photos of both sides.