Products > Test Equipment
Agilent MSOX4054A repair (NAND corruption issue)
hotacid:
--- Quote from: tv84 on January 14, 2020, 10:21:56 am ---
--- Quote from: hotacid on January 14, 2020, 04:58:02 am ---Yeah the image size is about double that of the 2000/3000 series. But the instrument must have enough RAM to hold the transferred image, right? I'll see if I can split the image in two and do two transfers.
--- End quote ---
This is a complex recovery. You need to have more assurances in order to succeed. The equipment has 128 MBytes RAM as you can see in your boot log.
Aren't you overwriting the prog that is running, when loading into RAM?
Is RAM all OK?
First step, I suggest you do a methodic mapping of your RAM space in order to understand if your loading space is valid. Take a 10 MB chunk and load it at offset 0, 10 MB, 20 MB, 30 MB, 40 MB, 50 MB, etc... and see where it hangs.
Can you stop the bootloader? That would be great. That could allow us to dump NAND.
Can you dump the bootloader (NOR Flash 512kB)?
--- End quote ---
tv84: You make an excellent point. It would make sense that I see the scope hang if I'm overwriting the running program. I will try mapping out the memory as you suggested.
Yes, I can stop the bootloader. There are actually two stages where I can stop it: the first is at the U-Boot monitor prompt, where I am able to execute a large number of possible commands. Please see the attached log for the list. The second is after the "PBOOT" primary boot loader image, which appears to be a Windows CE 6.0 standard bootloader. From there, I have four choices (again, see log). One very interesting one is an option to boot over ethernet. I tried this but the scope is waiting for some response from a host machine over the network that appears to be related to a "Windows CE 6.0 Platform Builder" tool that I need to see if I can get a copy of.
The U-Boot monitor seems to give full control over the CPU resources. I just have to hack around and experiment to figure out how to use it all. It should be possible to dump arbitrary memory regions and run arbitrary code. The only issue is that I'm mostly a hardware guy so it will take me some time :)
--- Quote from: Pinkus on January 15, 2020, 10:34:38 am ---I have all firmware version starting with Keysight branding, thus 4.00 ++
I checked the size of nk.bin of all firmware versions, unfortunately no match so you do not have to bother with 4.xx versions:
4.00: 80922891 byte
4.01-4.04: no such, regarding the release notes
4.05: 81539207 byte
4.06: 81413855 byte
4.07: 79718035 byte
4.08: 81031923 byte
7.10 and newer are all way larger
Unfortunately I do not have any version below 4.00 available. There once was a helpful HP/Agilent group on Yahoo where you could ask for such help. You might try it there if the group still exists. Possibly it moved away from Yahoo to somewhere else ... i have some vague memory about this.
--- End quote ---
Pinkus: Thank you very much for checking on that for me. That is strong evidence that the scope is indeed on a 3.xx build.
--- Quote from: Keysight DanielBogdanoff on January 15, 2020, 10:07:26 pm ---I'm going to check in as well and see what the internal folks have to say.
--- End quote ---
Daniel: I would be thrilled if you could help out! An old firmware image, maybe some hint on possible recovery mechanisms, anything... :D
PA0PBZ:
--- Quote from: hotacid on January 17, 2020, 05:54:41 am ---The second is after the "PBOOT" primary boot loader image, which appears to be a Windows CE 6.0 standard bootloader. From there, I have four choices (again, see log). One very interesting one is an option to boot over ethernet. I tried this but the scope is waiting for some response from a host machine over the network that appears to be related to a "Windows CE 6.0 Platform Builder" tool that I need to see if I can get a copy of.
--- End quote ---
I compiled a tool that you can use on a windows machine many moons ago: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1022267/#msg1022267
The story behind it: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1022248/#msg1022248
TheSteve:
CELoader is a tool I nearly always use during a recovery, :-+ :-+ :-+ :-+ :-+
tv84:
--- Quote from: hotacid on January 17, 2020, 05:54:41 am ---Yes, I can stop the bootloader.
--- End quote ---
Those are good news. Go into NAND susbsytem and see what commands are available.
Attach them here.
Keysight DanielBogdanoff:
I will be following up via PM, it sounds like there's a good chance it's the NAND.
Navigation
[0] Message Index
[#] Next page
[*] Previous page
Go to full version