Author Topic: Agilent MSOX4054A repair (NAND corruption issue)  (Read 2655 times)

0 Members and 1 Guest are viewing this topic.

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3174
  • Country: ca
  • Living the Dream
Re: Agilent MSOX4054A repair (NAND corruption issue)
« Reply #25 on: February 13, 2020, 05:03:16 am »
If the bad block happened to be the one with the secure data stored on it then those items will be gone. I've had one that lost all license data.
The model and serial # are stored in some encrypted form I do believe. I know on many Keysight products the model/serial can be set via a scpi command but I believe they usually need a factory flag to be set which allows it to be programmed one time.
VE7FM
 

Offline jake111

  • Regular Contributor
  • *
  • Posts: 58
  • Country: us
Re: Agilent MSOX4054A repair (NAND corruption issue)
« Reply #26 on: February 13, 2020, 05:36:08 am »
Well I don't think Keysight will be willing to help with this so I am going to have to walk through the code and see if the information I need is there.  I suspect it is based on what I've found so far

1) RegisterNativeSecureStorageCallbacks
2) SecureStorage_Add
3) SecureStorage_Clear
4) SecureStorage_Free
5) SecureStorage_ModelNumber
6) SecureStorage_Read
7) SecureStorage_ReadCommonArea
8) SecureStorage_Retrieve
9) SecureStorage_SerialNumber
10) SecureStorage_Write

It appears that there is the ability to write to the secure storage in these DLL's.  Will take some time to figure out.  I'll post back when I do.  Whether or not it can be done with SCPI command is still a mystery as those DLL's appear to be obsfucated so that will be a piece of work since this is not at all my specialty.
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3174
  • Country: ca
  • Living the Dream
Re: Agilent MSOX4054A repair (NAND corruption issue)
« Reply #27 on: February 13, 2020, 05:53:09 am »
I know with other instruments I have seen they do not have the ability to encrypt the model/serial, only decrypt it. There is a tool which encrypts the data and sends it via SCPI.
The command format is often something like  "SecureDataTool_<Client>.exe Initialize-ModelNumber" and "SecureDataTool_<Client>.exe Initialize-SerialNumber <SerialNumber>".

When the 2000/3000a series first came out there was a "leak" with the firmware update which included the tool to generate a model/serial #. You had to extract the binary and run it on the scope itself, but it was there. You could use the keys the binary contained to generate your own signed license files. After the leak Keysight changed the private key so it only worked with really old scopes. Being as you have have no keys at all it is certainly worth having a look at. The firmware update was version 1.10 - released before the 4000 series even existed I am sure.
VE7FM
 
The following users thanked this post: jake111

Offline jake111

  • Regular Contributor
  • *
  • Posts: 58
  • Country: us
Re: Agilent MSOX4054A repair (NAND corruption issue)
« Reply #28 on: February 13, 2020, 06:43:31 am »
I know with other instruments I have seen they do not have the ability to encrypt the model/serial, only decrypt it. There is a tool which encrypts the data and sends it via SCPI.
The command format is often something like  "SecureDataTool_<Client>.exe Initialize-ModelNumber" and "SecureDataTool_<Client>.exe Initialize-SerialNumber <SerialNumber>".

When the 2000/3000a series first came out there was a "leak" with the firmware update which included the tool to generate a model/serial #. You had to extract the binary and run it on the scope itself, but it was there. You could use the keys the binary contained to generate your own signed license files. After the leak Keysight changed the private key so it only worked with really old scopes. Being as you have have no keys at all it is certainly worth having a look at. The firmware update was version 1.10 - released before the 4000 series even existed I am sure.


Very good point - Thanks Steve!!!
 

Online tv84

  • Super Contributor
  • ***
  • Posts: 1845
  • Country: pt
Re: Agilent MSOX4054A repair (NAND corruption issue)
« Reply #29 on: May 15, 2020, 09:36:08 pm »
Whether or not it can be done with SCPI command is still a mystery as those DLL's appear to be obsfucated so that will be a piece of work since this is not at all my specialty.

I placed here the full list of SCPI commands for the 4000 v7.20.

If it helps having it mapped for another FW version (7.30 for example), I can try to do it.  With those mappings you can clearly see the addresses of the functions that are called via the SCPI commands.
 

Offline wp_wp

  • Contributor
  • Posts: 34
  • Country: cn
Re: Agilent MSOX4054A repair (NAND corruption issue)
« Reply #30 on: September 27, 2020, 02:58:25 pm »
For what it's worth, I had DSO-X3054A with the same problem.  Mine has recurring NAND corruption issue even after I fixed it, I have corrupt NAND blocks being reloaded on almost every startup (visible in the serial console).  Originally I was on 2.35 firmware which bricks when corrupt, it would become corrupt after being off for only a few minutes.

It was stuck at the infinitely looping lights on the front panel even after using bootp command to load nk.bin from my computer and then using the NAND WRITE to write it to the NAND (this could also be accomplished by using ymodem transfer thru serial but MUCH slower).  I suddenly realized that this message about failing to program the FPGA was important...  So after programming NAND (which I had to do every few boots because it would become corrupt again) I then transferred FPGA3000A.bin (for 3000 series) into memory and programmed the FPGA with it, then without rebooting, booted with the boot command.  Viola!  My machine then proceeded to boot from my 2.35 USB boot disk, and I then hastily upgraded it to 2.50.

Now it boots reliably but on almost every boot it notes corrupt NAND blocks and rewrites them.  I think my NAND is not long for this world, but thought I would mention this trick in case someone else gets stuck at the infinitely looping lights and can't figure out why.  It seems that the FPGA has to be programmed in order for the infiniivision launcher to proceed far enough to get the machine to boot from USB.  I assume that the FPGA data must normally be stored in NAND and this is why mine lost it.  NAND alzheimers is a terrible thing.
hi,jake111
how did you program the FPGA in P500?
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf