Author Topic: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?  (Read 692598 times)

0 Members and 4 Guests are viewing this topic.

Online TheSteve

  • Supporter
  • ****
  • Posts: 3160
  • Country: ca
  • Living the Dream
Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2550 on: September 20, 2020, 02:37:55 am »
Has anyone with a 3000 or 4000 series ever tried "CAKE" or "AFTER DUSK" as the screensaver text?

I saw CAKE mentioned previously but never saw a response. These don't work on my 1102G, but are in the DLL alongside TREK. Hopefully I can try them on my 3034T once I get it repaired.

CAKE = Text with the developer names and other text which changes.

AFTER DUSK = Flying scopes with wing and scope probes.
VE7FM
 

Online ElectronMan

  • Contributor
  • Posts: 46
  • Country: us
Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2551 on: September 20, 2020, 02:56:27 am »
Thanks, I saw a lot of that text from CAKE in the binary, and the AFTER DUSK is obviously a reference to the windows After Dark screen saver.

I've been digging into the R&S RTB2004 firmware and one thing I've noticed immediately is the complete lack of "Easter Eggs." They are all business.
 

Online TheSteve

  • Supporter
  • ****
  • Posts: 3160
  • Country: ca
  • Living the Dream
Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2552 on: September 20, 2020, 03:36:32 am »
Thanks, I saw a lot of that text from CAKE in the binary, and the AFTER DUSK is obviously a reference to the windows After Dark screen saver.

I've been digging into the R&S RTB2004 firmware and one thing I've noticed immediately is the complete lack of "Easter Eggs." They are all business.

Shame, it is always good to have a little fun.
VE7FM
 

Offline wp_wp

  • Contributor
  • Posts: 21
  • Country: cn
Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2553 on: September 20, 2020, 02:47:01 pm »
https://cal.equipment/doc/HP_Agilent_Keysight/DSOX/
This link is void,who can give a new link?
Thank you!
« Last Edit: September 20, 2020, 11:13:05 pm by wp_wp »
 

Offline Hydrawerk

  • Super Contributor
  • ***
  • Posts: 2396
  • Country: 00
Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2554 on: September 26, 2020, 10:32:10 pm »
Has anyone with a 3000 or 4000 series ever tried "CAKE" or "AFTER DUSK" as the screensaver text?

I saw CAKE mentioned previously but never saw a response. These don't work on my 1102G, but are in the DLL alongside TREK. Hopefully I can try them on my 3034T once I get it repaired.

CAKE = Text with the developer names and other text which changes.

AFTER DUSK = Flying scopes with wing and scope probes.
Will this work on a DSOX2000A series scope??
Amazing machines. https://www.youtube.com/user/denha (It is not me...)
 


Offline Hydrawerk

  • Super Contributor
  • ***
  • Posts: 2396
  • Country: 00
Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2556 on: September 28, 2020, 09:12:48 pm »
CAKE = Text with the developer names and other text which changes.

AFTER DUSK = Flying scopes with wing and scope probes.
OK, this does not work on my DSOX2002A. :-( Are there any other possible secret passwords? (Yes, TREK works for me.)
Amazing machines. https://www.youtube.com/user/denha (It is not me...)
 

Offline bmwman91

  • Newbie
  • Posts: 4
  • Country: us
Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2557 on: September 29, 2020, 08:32:19 pm »
Hello! I have been lurking off & on in this thread for quite a while and finally decided to jump in since I am looking to "upgrade" from my Rigol DS1104Z-S Plus. It has served me well, but the ergonomics & speed just are not quite cutting it, at least not compared to the Agilent/Keysight stuff I get to use at work. I have an opportunity to get a pretty good deal on a used MSOX2024A, and I remembered this thread from a couple of years ago. My question is regarding which v2.5 firmware to use from this post:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2945740/#msg2945740

I see there is FW for DSOX2000X, and DSOX3000A. It has been mentioned in here in a few places that the FW for 2000A & 3000A are the same, but I wanted to confirm that I will want to use the 3000A file on a 2024A, not the 2000X FW.

Thanks for all of the curiosity and hard work in here! I am continually impressed and encouraged by what the DIY community does!
Would you say that I have a plethora of piñatas?
 

Offline Bill Woodbridge

  • Contributor
  • Posts: 14
  • Country: gb
A quick question on this well-worn topic please, with apologies as although I’ve studied this thread for about 3 weeks I’m still not absolutely sure of the answer.

Does PhillyFlyer’s patched firmware (2.50 for the 3000A series, in my case, details below) preserve the original .lnk file and its command line options once it is installed?  My understanding is that it does, and that the process of changing/fiddling about with the .lnk file happens as a second stage after the firmware installation.

I ask because I want to capture and preserve the scope’s original .lnk file in case I need to revert to it if I encounter problems, but I need the PhillyFlyer patched firmware installed first in order to be able to Telnet in reliably and copy off the original .lnk to USB (if I’ve understood correctly).

Other than this question I think I’m ready to dive in for a full ‘enhancement’ project.  If anyone can recommend the latest brew for the .lnk command line options I’d also be very grateful please.  I am unclear on the best ‘bundle’ option to use, as many of them seem to overlap:  D3000BDLA, ALL (I gather this achieves permanently enabled trial licenses with the * displayed, so I’d prefer not to go for that one), or DIS?  (I know BW20 and MSO, at least, must be included separately)

Many thanks for clarification and to all previous researchers - 'standing on the shoulders of giants' springs to mind.


DSOX3014A (100MHz)
Firmware 2.50 (recently installed successfully from the Keysight website)
LAN/VGA module fitted
Installed licenses shown on the ‘About’ screen: EDK, SGM, WAVEGEN, DVM, RML
 

Offline Bill Woodbridge

  • Contributor
  • Posts: 14
  • Country: gb

An update: I took the plunge and have now achieved a fantastic result (eventually, after a few pitfalls).  Here they are, based on my experience in the hope they might be useful for others.

I based my procedure on Cretone’s list post 2504 for which many thanks (modified for the 3000A obviously).  My own observations, setbacks, pitfalls etc in italics after each step

1.   Download PhillyFlyers’ 3000A series patched firmware 2.50 from the web to a FAT32 USB stick.

The hosting site mega.nz was blocked by my ISP – I needed to temporarily switch DNS servers to Google’s public DNS (8.8.8.8 and 8.8.4.4) to overcome this

2.   Plug the USB stick into the front USB port of the (running) scope, install the patched firmware via the standard firmware update procedure (Utility / File Explorer / goto USB / Load File).  Once the reboot is complete, keep the scope powered up.

Flawless update, scope rebooted immediately, no visible changes or warning messages – excellent. 

3.   Create a file infiniivision.txt with a raw text editor on a PC containing the infiniivisionLauncher command line with the options required (not forgetting to adjust the character count, ie the no. of characters to the right of the #).  Mine was:

93#"\Program Files\infiniiVision\infiniiVisionLauncher.exe" -l D3000BDLA -l BW20 -l MSO -l MEMUP

This was the biggest pitfall which took me a day to resolve.  The syntax for each option is hyphen then lowercase l then space then option code.  However, in most forum posts, the lowercase l looked to me like the pipe (vertical bar) character and even though I copied and pasted from the forum into my text editor and ended up (correctly) with lowercase ls, I was convinced it had translated them incorrectly and laboriously went through with a hex editor changing them back to pipes (unicode 7C).  (Eventually, through Telnet / CMD, I found the syntax for the infiniivisionLauncher.exe command and the penny finally dropped)

4.   Unplug the USB stick from the scope, save this infiniivision.txt file onto it, then replug it into the scope.  The file should now be visible through Utility / File Explorer.

Don’t be tempted to try and load the file into the scope like in step 2 – it’s not firmware!

5.   Time for Telnet: plug the scope into your local Ethernet, make sure the LAN config is set to automatic (Utility / I/O / LAN settings) wait for it to acquire an IP address (assuming you have a hub or similar with DHCP server capability connected).  Then Telnet into the IP address shown on the I/O information screen, username and password as per previous posts.  The Telnet window should then give the Windows CE command prompt:

Pocket CMD v 6.00
\>

Telnet was rock-solid throughout, and thanks to the patched firmware there seemed to be no restriction on having to time it to coincide with the boot-up phase of the scope.  I was dreading the networking, being an amateur, but simply plugging in to a typical home broadband network with a DHCP-serving hub it was incredibly easy and the scope sorted out its config automatically within seconds.  Alternatives are fiddling with static IP addresses, subnet masks etc and point-point Ethernet (scope – PC) with a crossover cable …

6.   Use the Telnet / CMD session to backup the existing .lnk, then transfer the .txt file from USB and rename it to .lnk thus:

rename \Secure\Startup\infiniivision.lnk \Secure\Startup\infiniivision.bak
copy \usb\infiniivision.txt \Secure\Startup\infiniivision.txt
cd \Secure\Startup
rename infiniivision.txt infiniivision.lnk

An initial worry was that even dir /a /s did not reveal the \Secure directory, however using cd \Secure will navigate to it and then enable dir to list its contents.  The original infiniivision.lnk file was present, but empty (0 bytes) and with the archive flag set - I backed it up nevertheless!  Note the copy command requires the full path and filename for both source and destination – just specifying the destination directory isn’t sufficient.  The cd into \Secure\Startup was necessary because attempting the rename from the root directory gave an error message that the command line (with the full path included in the filenames) was too long.  Finally, there are lots of ‘i’s in infiniivision, I lost count of the number of times I forgot the double i in the middle.

Historically the advice on the forum has been to kill the running inifiniivision.exe instance before doing the file manipulation, but lately this step seems to have been omitted in most recommendations.  I didn’t kill it, because I simply forgot all about that step.  Leaving it running didn’t seem to cause any problems, but of course the scope requires a reboot to pick up the new .lnk file and enable the options.


7.   Turn off the scope – a tense moment for potential bricking, as the die is now cast.  Turned on again, flawless and fast boot up, with all the newly-enabled options present and correct on the About screen (and enabled on the appropriate buttons etc).

This happy result was only after I had fixed the l / | confusion in the .lnk file of course.  When I was still blundering about with the pipe character, the scope booted up correctly (luckily) but naturally none of the additional options appeared on the About screen.

So thanks once again for all the contributions that helped me get to this point. 

I have a horrible temptation to start poking about with the 350MHz hardware mods now ...
 
The following users thanked this post: mlloyd1, dunkemhigh


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf