Hi folks! Longtime lurker here coming out of the dark
I recently acquired a used MSOX4054A scope from an auction only to find it doesn't boot when I try to turn it on. The unit is in great shape so I don't suspect anything physical has damaged it.
This is what happens:
1. I push the power button to the "on" position. I hear the fan turn on.
2. The front panel LEDs all turn on and off again once very briefly
3. About 1s later, the "Ref" button LED turns on and stays solid
4. About 1s later, the "Math" button LED turns on and stays solid
5. About 3s later, the "Digital" button LED turns on and stays solid
6. Nothing more happens past this. The scope stays stuck forever
After hours of searching the web on this issue, I came to understand there is a known issue with the 2000X/3000X/3000T/4000X series scopes where the main NAND becomes corrupted over time and this prevents the unit from booting. The descriptions of other peoples issues sounds very similar to my units behavior so I suspect I have the same problem.
I found some mentions of Keysight fixing this problem for free so of course I tried that path first... a week later and several emails + phone calls later, Keysight told me that it won't be covered for me and wouldn't give a reason why. Strangely, the applications engineer I spoke to was also surprised that it wasn't covered but even a 3-way call with him and the repair department didn't help. They wanted $4500 USD so I politely declined.
So now I'm trying to fix this unit at home. Fortunately, there is a quite helpful thread about hacking these series of scopes which contains very valuable information on how to potentially repair this thing. Yes, I read all 97 pages.
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/I've gotten the unit apart and I have access to the serial connection from the SPEAR600-2 CPU. A serial log of the unit booting seems to all but confirm some memory corruption has occurred. Here's a snippet of the serial output (full log attached).
Loading image 1 from memory at 0xD0400000
O
BL_IMAGE_TYPE_BIN
X
XXXXXOOOOXXOOOOOOOOXOXOXOOOOOOOXOOXOXOOOOXXOOOOOOOOOXOOOOXOXOOXXXOOOXOXXXXOOXXOXOOOOOXOOXXXXOXXOOOXOOXXOXXOXOOOXOOXOOXXOOOXOOOOXOXOOOOOXOOOXOOXOXXOXOXOXOXXXXXXOXXXXXOOOOXOOXOOXOOOOXOOOOXXOXOOOOOOOXOOOXOOXOOOOXX
OOOOOXOOXOOXOXOOOOOOOOOXOOOOXOOOOOOXOXOOOOXXOOOOOOOXOOOOXOOXOOOXOOOXOOXXOOXOOXOXXOXOOXOXOXOXOOOXXXOOXOXXOOOXXXXOXOOXOXOOOOXOOOOXOOOXOOXOOXOOOXOOOOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXXXXXXXXXXXXXXOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOIncorrect Data 0 EccResult: 566556 EccError: ff3c3c EccRead: a9596a
EBOOT_ReadFlash failed offset 204eb88
EBOOT_ReadFlash failed location d2054000
ODeCompressFlash: CeCompressDecode() failed
CeDecompressFlashBlock failed
****** Data record 146 corrupted, ABORT!!! ******
I've been following along the footsteps of one user (titiris - thank you!) who reported he was able to fix his NAND corruption by transferring the unpacked firmware kernel image 'nk.nb0' to the scope over the serial connection (using YMODEM mode), booting the image, which then boots from an external USB drive. Once the Infiniium software is up and running, a normal firmware update procedure can be carried out through the scope GUI to repair the damaged files. His explanation is here:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/#msg2136181However, I'm hitting an issue with this method. It seems that the YMODEM image transfer always stops abruptly when it gets to ~75% complete. No error messages or warnings are printed. I also tried following along Frankbuss's method by using TFTP but this hits the same issue... the transfer is working fine until 61466628 Bytes are transferred (out of 81508824 Bytes total) and then it just stops. It looks like the unit is hanging. Is the image too big and the scope ran out of memory? I'm not sure what is going wrong.
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg260917/#msg260917Has anyone tried this on a 4000X series scope? Any suggestions would be greatly appreciated!