Author Topic: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?  (Read 599733 times)

0 Members and 1 Guest are viewing this topic.

Online Mr. Scram

  • Super Contributor
  • ***
  • Posts: 7716
  • Country: 00
  • Display aficionado
Right - those were the instructions I was following. My mistake was that when I didn't see the options enabled, I assumed I still had to copy the .lnk file over.
You do, by means of the .cab file. Open it up to see what it does.
« Last Edit: August 12, 2019, 02:40:59 am by Mr. Scram »
 
The following users thanked this post: bitbanger

Offline bitbanger

  • Regular Contributor
  • *
  • Posts: 156
SMH.... I just realized I never loaded the 2.5 cab file... went straight for the 2.41.

Was able to get booted to UI by again quickly killing infiniivisionLauncher.exe. Loaded 2.5, reboot, confirmed 2.5. Loaded 2.41 patch, worked.

Thanks for the help realizing my mistake. :)
« Last Edit: August 12, 2019, 03:13:50 am by bitbanger »
 
The following users thanked this post: Mr. Scram

Offline jeccylx

  • Newbie
  • Posts: 4
  • Country: cn
Can anyone help me? I have an oscilloscope of 3054A, and it keeps bootloop.
The following is the data output of the serial port.
Code: [Select]


U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  internal ecc 128 MiB

Debug serial initialized ........OK
RTC: 2019-8-13   19:47:31.91 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built May  7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008


System ready!
Preparing for download...
RTC: 2019-8-13   19:47:31.95 UTC
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXXOOOOOOOOOXOOOOXOXXOXOXXOXOXOXOXXXXOOXXXOOOOOOXXOXXOXXXXXXOOOXXXOXXOOOXXXOOOXOOXOOXXOOXOXOOOOXOXOOOOOXOOOXOOXOXOXOXXXXXOXXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOXOOOXOOX
OOOOXXXOOOOXOOXOOXOOOOOOOOOXOXOOOXOOOOOOXOXOOOOOXXOOOOOOOXOXOXXOOXOXOOOXOOOXOOXOXXXOXOOOXOXXXXOXOXXOXXXXXOXOXXOOOXXXOXXXXXXOXXXXXXOXXXXOXOXOXOOOXXXXOXXXXXOOOXXOXXOOXXOX
XXOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXXXOXOOOXOXOOXOOXXXXXXXXXXXXOXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x1ACA724, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x1ACA724  Name="" Target=RAM
 Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
RTC: 2019-8-13   19:47:35.40 UTC
Launching windows CE image by jumping at address 0x  362000

Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Feb 27 2019)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 00:30:D3:21:61:2F
Phy found addr 31 (ticks=3030)
WaitForLink Start (ticks=3032)
No Link (ticks=4047)
<--EDeviceInitialize

GMAC DMA status register = 0x0
LIN: Data Valid
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Running infiniiVisionInstallHelper
Failed to start/configure network.
Device load time:
   NANDFLASH: 0 ms
   SNANDFLASH: 0 ms
SHIM DLL, LoadRealDll [PalIO.dll] for [AgilentPalIO.dll]
SHIM [AgilentPalIO.dll] Get Process Addresses
Our command line is
Performing Startup
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]
SHIM [AgilentPalSStorage.dll] Get Process Addresses
Released build, Feb 27 2019, 20:34:05
Initializing FPGA...
****
FPGA Type: Wyoming
Ver: 2.011 Released
Build Time: Tue May 27 16:03:14 2014
Build Machine: TS2404M
****
No option module detected
Keyboard firmware version 32... ok
Keyboard Info: Board id 1, Board rev 3
 

Offline Gribo

  • Frequent Contributor
  • **
  • Posts: 398
  • Country: ca
2nd batch of my DSOXLAN boards is ready. If anyone is interested, send me a PM. Will ship worldwide.
 

Offline Alanme

  • Regular Contributor
  • *
  • Posts: 56
  • Country: fr
  • i am not perfect but i know that
Hello
@ jeccylx
I think you must try the method describe in Page 89 reply 2201
« Last Edit: August 17, 2019, 09:21:10 pm by Alanme »
 

Offline jeccylx

  • Newbie
  • Posts: 4
  • Country: cn
@ Alanme
Thank you for your reply. I have upgraded the firmware several times. It should not be the problem with the firmware. |O |O
 

Offline Frank_Canada

  • Contributor
  • Posts: 5
  • Country: ca
Can anyone tell me where to download previous firmware files (2000XSeries.02.01.2011111500.cab, 2000XSeries.02.43.2018020635.ksx)?

I am trying to fix my scope using titiris method (thanks by the way) but I think there is a compatibility issue.
« Last Edit: August 28, 2019, 06:48:20 pm by Frank_Canada »
 

Offline Alanme

  • Regular Contributor
  • *
  • Posts: 56
  • Country: fr
  • i am not perfect but i know that
 

Offline Frank_Canada

  • Contributor
  • Posts: 5
  • Country: ca
Merci!
 

Offline Alanme

  • Regular Contributor
  • *
  • Posts: 56
  • Country: fr
  • i am not perfect but i know that
De rien
 

Offline Frank_Canada

  • Contributor
  • Posts: 5
  • Country: ca
@jeccylx I ran into the same kind of problem and I think the NAND chip is corrupted (reflashed many times with different firmware versions). I am replacing the NAND flash memory by a brand new one and I'll let you know whether or not it works.
 
The following users thanked this post: jeccylx

Offline TK

  • Super Contributor
  • ***
  • Posts: 1098
  • Country: us
  • I am a Systems Analyst who plays with Electronics
If you contact Keysight service, they should be able to repair it for free.  They just swap the whole board and recalibrate the scope for you.  Even if the scope is out of warranty, this fault is covered.
 

Online TheSteve

  • Supporter
  • ****
  • Posts: 2963
  • Country: ca
  • GHz
@jeccylx I ran into the same kind of problem and I think the NAND chip is corrupted (reflashed many times with different firmware versions). I am replacing the NAND flash memory by a brand new one and I'll let you know whether or not it works.

Don't do it unless you've backed up the entire memory. More then just the base firmware is stored in the flash, it also has your serial #, calibration data and license files.
What is the exact problem you're having with the scope?
VE7FM
 

Offline Frank_Canada

  • Contributor
  • Posts: 5
  • Country: ca
@theSteve Blank screen problem.
The Uboot stops after: "BALDWIN_DDI: cBaldwinHwIf::Init: Success!"

U-Boot 2010.03 (Jan 26 2011 - 12:37:34)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  128 MiB
...
...
GMAC DMA status register = 0x0
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
« Last Edit: August 29, 2019, 05:45:14 pm by Frank_Canada »
 

Online TheSteve

  • Supporter
  • ****
  • Posts: 2963
  • Country: ca
  • GHz
That is most likely is a NAND memory corruption issue. If it is then Keysight should repair/replace the scope for no charge. It is possible to also fix it yourself if needed and the information on doing it is in this thread. However it isn't always simple. I recommend calling Keysight and asking them about having it repaired because of a NAND corruption fault.
VE7FM
 

Offline Frank_Canada

  • Contributor
  • Posts: 5
  • Country: ca
I followed the instructions of Titiris and reloaded the nk.nb0 file (loady 0x0361000 115200) of the firmware (and also tried different versions of firmware) but the same problem remains: U-Boot stops at the same place.
So bought brand new NAND memory, replaced the old NAND by the new one on the board and redid the same process (loady 0x0361000 115200). Now U-boots goes further but is kind of stock in a loop:

BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
Exception 'Data Abort' (4): Thread-Id=04100002(pth=8371a340), Proc-Id=00400002(pprc=816a8308) 'NK.EXE', VM-active=01e40002(pprc=87fcbeac) 'udevice.exe'
PC=c08fa088(baldwin_ddi.dll+0x0000a088) RA=c08fa07c(baldwin_ddi.dll+0x0000a07c) SP=d137f660, BVA=00000000
Exception 'Data Abort' (4): Thread-Id=04100002(pth=8371a340), Proc-Id=00400002(pprc=816a8308) 'NK.EXE', VM-active=01e40002(pprc=87fcbeac) 'udevice.exe'
PC=c01a5d84(gwes.dll+0x00055d84) RA=c01a5d6c(gwes.dll+0x00055d6c) SP=d137fdd8, BVA=00000104
Autonegociation Start (ticks=4633)
+StartAutoNegotiation: pDeviceContext 0xd05694c0
Exception 'Raised Exception' (-1): Thread-Id=047a0002(pth=8372bc20), Proc-Id=03a50006(pprc=837eeee0) 'recoverInfiniiVision.exe', VM-active=03a50006(pprc=837eeee0) 'recoverInfiniiVision.exe'
PC=400233d0(coredll.dll+0x000133d0) RA=803782c8(kernel.dll+0x000062c8) SP=0005fd1c, BVA=00000000
Exception 'Raised Exception' (-1): Thread-Id=04820002(pth=8372bc20), Proc-Id=03a5000a(pprc=837eeee0) 'recoverInfiniiVision.exe', VM-active=03a5000a(pprc=837eeee0) 'recoverInfiniiVision.exe'
PC=400233d0(coredll.dll+0x000133d0) RA=803782c8(kernel.dll+0x000062c8) SP=0005fd1c, BVA=00000000
Exception 'Raised Exception' (-1): Thread-Id=048a0002(pth=8372bc20), Proc-Id=03a5000e(pprc=837eeee0) 'recoverInfiniiVision.exe', VM-active=03a5000e(pprc=837eeee0) 'recoverInfiniiVision.exe'
PC=400233d0(coredll.dll+0x000133d0) RA=803782c8(kernel.dll+0x000062c8) SP=0005fd1c, BVA=00000000
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1098
  • Country: us
  • I am a Systems Analyst who plays with Electronics
 :popcorn:It is probably because of something TheSteve already said... there is scope data stored at the factory on the NAND that is not going to be restored if you replace the memory chip
« Last Edit: August 30, 2019, 07:38:41 pm by TK »
 
The following users thanked this post: Mr. Scram

Online TheSteve

  • Supporter
  • ****
  • Posts: 2963
  • Country: ca
  • GHz
I've never tried installing a new NAND(as it is not needed for the corruption issue) but if I did I don't know how it would get formatted into a proper filesystem unless u-boot can do that automagically. And reading the needed information off the old NAND is also tough as it needs to be mounted as a filesystem so the scope unique data can be backed up.
VE7FM
 

Offline Hydrawerk

  • Super Contributor
  • ***
  • Posts: 2380
  • Country: 00
Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2368 on: September 10, 2019, 02:33:55 pm »
Hello, I have a DSOX2002A since 2013. https://www.eevblog.com/forum/reviews/my-new-toy-)-agilent-dsox2002a-sex-on-a-stick!/25/
There is an old cracked firmware in my scope that somebody gave me back in 2013 or so. I loaded it into my scope and it works since then. All options from 2013 are unlocked for me. :-) My 5 year warranty expired in 2018.
Is there a new cracked firmware available now? Or is it more complicated and I need a LAN board to do some dangerous steps? Is there a danger of bricking my scope?
Yes, I have read last posts and the process seems to be dangerous and complicated for me now. Thanks for help.
Amazing machines. https://www.youtube.com/user/denha (It is not me...)
 

Online Mr. Scram

  • Super Contributor
  • ***
  • Posts: 7716
  • Country: 00
  • Display aficionado
Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2369 on: September 10, 2019, 02:59:42 pm »
Hello, I have a DSOX2002A since 2013. https://www.eevblog.com/forum/reviews/my-new-toy-)-agilent-dsox2002a-sex-on-a-stick!/25/
There is an old cracked firmware in my scope that somebody gave me back in 2013 or so. I loaded it into my scope and it works since then. All options from 2013 are unlocked for me. :-) My 5 year warranty expired in 2018.
Is there a new cracked firmware available now? Or is it more complicated and I need a LAN board to do some dangerous steps? Is there a danger of bricking my scope?
Yes, I have read last posts and the process seems to be dangerous and complicated for me now. Thanks for help.
Firmware 2.50 is available and can be installed through the menu system with no LAN required. As always there are no guarantees and you do this at your own risk but most if not all issues seem to stem from people not RTFM. Read the post linked below.

https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2364363/#msg2364363
 

Offline Hydrawerk

  • Super Contributor
  • ***
  • Posts: 2380
  • Country: 00
Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2370 on: September 11, 2019, 02:36:06 pm »
OK, I did the upgrade with a help from a forum member. My scope seems to be working OK. There is now a 200 000 waveforms / sec update rate.
As scribble wrote, rename from .ksx to .cab if current scope fireware is older than v2.41. I had to do it!
Amazing machines. https://www.youtube.com/user/denha (It is not me...)
 

Online Mr. Scram

  • Super Contributor
  • ***
  • Posts: 7716
  • Country: 00
  • Display aficionado
Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2371 on: September 11, 2019, 02:55:47 pm »
Does anyone have an idea what the official bandwidth upgrades for the 3000T series cost? As far as I can tell no one lists the actual prices which is utterly annoying.
 

Offline TopLoser

  • Supporter
  • ****
  • Posts: 1852
  • Country: gb
Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2372 on: September 11, 2019, 03:04:48 pm »
Does anyone have an idea what the official bandwidth upgrades for the 3000T series cost? As far as I can tell no one lists the actual prices which is utterly annoying.

https://www.altoo.dk/Oscilloscopes/Medium+3000T-4000X/Options+and+Upgrades/
 
The following users thanked this post: Mr. Scram

Offline EE-digger

  • Regular Contributor
  • *
  • Posts: 117
  • Country: us
Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2373 on: September 12, 2019, 01:02:26 am »
In the US, Newark, for  one, lists them.  DSOXT3B1T104U = $10,564 for the 1GHz upgrade, returned to service center.
 

Online B0B45

  • Contributor
  • Posts: 9
  • Country: de
Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2374 on: September 12, 2019, 11:07:45 am »
Hey Guys,

I consider to send my scope to Keysight for calibration.
The scope is hw and sw modded from 100Mhz to 500Mhz and has FW 2.50.
My plan is to reinstall the origial FW 2.50 before i sent it in.
Question: Can I always change back from the origial fw 2.50? Will there be leftovers of the fw hack after the FW update on the scope?
Do you think its a good idea to do a full calibration after the scope has been modified in general?

Regards B0B
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf