Author Topic: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?  (Read 1103665 times)

0 Members and 4 Guests are viewing this topic.

Offline TK

  • Super Contributor
  • ***
  • Posts: 1722
  • Country: us
  • I am a Systems Analyst who plays with Electronics
I have read the firmware version I transfer over to the unit has to be similar to the (corrupted) one on the NAND, or the boot may not get far.
????? How will I know wat was on it?
I was reading about how to load binary file over serial line (ymodem mode).
But I would need the firmware file. The one can boot from USB.
This is the most detailed post about how to repair a NAND corrupted scope: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/?topicseen#msg2136181
 

Online TheSteve

  • Supporter
  • ****
  • Posts: 3741
  • Country: ca
  • Living the Dream
The 4000 series does have the network card built in, so the file can be transferred via network which only takes a few seconds. All info for that and the tools needed are also shared/posted in this thread.
VE7FM
 

Offline oaba

  • Contributor
  • Posts: 35
  • Country: ie
I have read that  allready.
But I do not have the firmware for 4000x. I need the version boot from usb drive.
I would be happy if someone has a working version.
« Last Edit: June 19, 2021, 06:02:31 pm by oaba »
 

Offline oaba

  • Contributor
  • Posts: 35
  • Country: ie
I was reading about the telnet option through the lan. But you have to have a working scope for that?
My firmware is corrupted. Can i telnet in?
But still my question is. Can I flash the newest firmware. Even the one was on the scope was a very early version?

« Last Edit: June 19, 2021, 06:15:19 pm by oaba »
 

Offline oaba

  • Contributor
  • Posts: 35
  • Country: ie
Bud You are right about the  serial and ymodem :)
Just the ymodem was sounds to be something like a network protocol. After I saw that is a serial protocol. :)
 

Offline oaba

  • Contributor
  • Posts: 35
  • Country: ie
Bud
So the question is who has the matching firmware?
Address=0x80361000  Length=0x4E09D90  Name="" Target=RAM

0x4E09D90(Hex)=81,829,264(dec)   

I have a 4.08 version   48,886,006  in size  when it is unpacked 62,130,090
7.4 version 49,908,286  is size when is unpacked 63,572,647

Am I wrong somewhere?
« Last Edit: June 19, 2021, 06:49:14 pm by oaba »
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1722
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Bud
So the question is who has the matching firmware?
Address=0x80361000  Length=0x4E09D90  Name="" Target=RAM

0x4E09D90(Hex)=81,829,264(dec)   

I have a 4.08 version   48,886,006  in size  when it is unpacked 62,130,090
7.4 version 49,908,286  is size when is unpacked 63,572,647

Am I wrong somewhere?
The image you need to flash is not the full upgrade package. I think it is the nk.bin (or something similar) file. The network method is not telnet, is using bootp protocol to get the image to flash from a bootp server
 
The following users thanked this post: oaba

Online Bud

  • Super Contributor
  • ***
  • Posts: 6860
  • Country: ca
oaba, you have to do your homework. I do not have a  4000 machine. Read the posts where people did Ymodem download and pay attention to image file extension they used. Was it nk.bin or some other image file. You've got to learn how to extract image file from update package and how to convert it to the format Ymodem is expecting. Same applies if you use tftp to boot from network instead of serial. You can use an image you have, worst case it won't load it will not do any damage.
Facebook-free life and Rigol-free shack.
 
The following users thanked this post: oaba

Offline oaba

  • Contributor
  • Posts: 35
  • Country: ie
Thanks BUD
:) I have got it now. Just worried, I will over write valuable calibration data. Screw somwthing up even further if I do not use the right firmware,
 :palm:
I got the lenght of the nk.nb0 :) 
4.08  81508824
7.4    88100356
So the original was 81829264 (seems newer than 4.08 but older than 7.4)
And i am doing the rest. Will see.
I had to modify the dosetup.py. That is writen in python 2.  And python 3 throw faults.
line 8 print (" "),
line 19 print ("mkdir "+path)
line 26 print ("mv "+parm.get("value")+" -> "+path)
« Last Edit: June 20, 2021, 07:12:47 am by oaba »
 

Offline oaba

  • Contributor
  • Posts: 35
  • Country: ie
The serial upload always fail at 75.4percent.
The window of transfer stop to count. After couple seconds waiting and closes.
Ater restart the serial com says.
It fails exactly at the same place.
EBOOT_ReadFlash failed offset 4ad764
EBOOT_ReadFlash failed location d04b4000
« Last Edit: June 20, 2021, 01:50:35 pm by oaba »
 

Online Bud

  • Super Contributor
  • ***
  • Posts: 6860
  • Country: ca
Not good....looks like some flash is damaged. I'd still try TFTP boot to see if get same error.
If so, focus may need to shift to use bootloader's flash commands to see if bad flash sectors are detected, and/or manually mark bad sectors. For that you may need brighter minds than me.
Facebook-free life and Rigol-free shack.
 
The following users thanked this post: wp_wp

Offline oaba

  • Contributor
  • Posts: 35
  • Country: ie
Actually I have got it to work.   :phew:
After 3 times try (2 hours each) The upload failed at about 75 percent. The scope did not start.
In the terminal window I was getting the same message.
I tryed before to turn the scope on and off. I have read sometimes the scope can boot up. but no effect.
What I did after this turmoil.
I pressed the r  (reset) 10-15 times. And suddenly I have seen in the serial com.
The scope started to boot.
When the scope was fully booted up. I did not turn it off. I downloaded the new firmware from keysight to an USB. And upgraded the firmware.
Scope is back to business.
Thanks for every one to helping me out.
Especially BUD.
 

Online Bud

  • Super Contributor
  • ***
  • Posts: 6860
  • Country: ca
Not sure i understand the turning the thing off and on and resetting  but glad it worked in the end!
Facebook-free life and Rigol-free shack.
 

Offline oaba

  • Contributor
  • Posts: 35
  • Country: ie
I was just reading about it. If you turn it OFF and ON a couple times the scope can boot suddenly.
That did not work for me.
But with the serial connection. I was using the r command to keep reseting it. And it was booting up. That was enough for me to do a firmware upgrade from the usb stick.
 

Online Bud

  • Super Contributor
  • ***
  • Posts: 6860
  • Country: ca
I see. Did you monitor the first "good" startup log? I've seen something that may be interpreted as sort of "self healing" of the flash, when during boot if the scope cant read flash it pulls the second image and if successful, marks failed flash sectors on the first image.
Facebook-free life and Rigol-free shack.
 

Offline Pinkus

  • Frequent Contributor
  • **
  • Posts: 768
I was just reading about it.
He probably read my comments somewhere about when my DSOX4000 had flash problems. My scope often started 1 times out of 10 when switched on, the other 9 times it hung after a while. Though it got worse and finally, sometimes it needed 100 tries. Sending a Reset through UBOOT will do the same but is quicker and healthier for the electronics than 100x switch-off / switch-on.

@oaba: do not feel too lucky and be prepared: rewriting/updating the firmware did help for a few weeks at the beginning but my scope quickly failed again. Later, even this flash-rewrite did not help anymore (neither USB or UART or ethernet).
 

Offline oaba

  • Contributor
  • Posts: 35
  • Country: ie
Pinkus.
What was at the end? Because I contacted Keysight they not interested.
Only if I pay for the diagnostic, post, and at the end the new board.  (thousands)

I am thinking to replace the flash. Is there anyone did that before?
 

Offline oaba

  • Contributor
  • Posts: 35
  • Country: ie
I celebrate with a flash cake. To keep the boys cool :popcorn:.
 

Offline oaba

  • Contributor
  • Posts: 35
  • Country: ie
« Last Edit: June 21, 2021, 07:20:12 pm by oaba »
 


Offline TK

  • Super Contributor
  • ***
  • Posts: 1722
  • Country: us
  • I am a Systems Analyst who plays with Electronics
I am not sure you can replace the flash without loosing calibration and serial number information...
 

Offline Pinkus

  • Frequent Contributor
  • **
  • Posts: 768
Pinkus.
What was at the end? Because I contacted Keysight they not interested.
Only if I pay for the diagnostic, post, and at the end the new board.  (thousands)
I asked Keysight about the repair and of course I also was afraid, that the examination alone would cost a fortune. But no, it was not. This is what they answered:
Within approx. 4 working days after receiving your device , we will perform a technical examination and send you an offer for repair and calibration.  There are no costs for the examination.

Fortunately, they identified the flash as the cause and applied the service note regarding corrupted flash. Result: free repair  :phew:
To be honest: I knew the problem was caused by the flash chip. If they would have tried to sneak out, I would be a Keysight hater by now. Now I am the opposite as I honor companies that take responsibility for such problems. Win-Win  :D
 

Offline oaba

  • Contributor
  • Posts: 35
  • Country: ie
TK
You have to dump the content first.
1: with a programmer. (Elnec can program and read this flash.)
2:If you good enough. You can write your own code to make your micro to read the flash  and send it to the JTAG. Trough the JTAG you can have a full controll of you controller. First you have to put it on halt. And after you can run your own software on it. Example read the flash memory and send it to the JTAG.
We should  find someone who has tis programmer with the bga63  adapter.
So you always have a safety net. Even when your scope going to be 20 years old.  You can recover it.
 

Offline Howardlong

  • Super Contributor
  • ***
  • Posts: 5313
  • Country: gb
I just realised that in 7.40 Keysight have added USB trigger/decoding, including HS for >=1GHz scopes.

On my MSOX3104T, which already has a kosher factory installed bundle, upgrading to 7.40 didn't enable USB trigger/decode.

I enabled it using the patched 7.40 .ksx with the following infiniivision.lnk:

Code: [Select]
69#"\Program Files\infiniiVision\infiniivisionLauncher.exe" -l D3000USBB

Note that this only applies if you already have the original bundle installed on a >=1GHz scope. The original 1GHz bandwidth and bundle options remain installed.

If you have a different starting point such as bandwidths and/or pre-installed options, different settings may apply.

Note that HS requires a high speed differential probe, whereas FS and LS work on all analogue & digital channels.

Hmm... that feature was pretty much the only reason I have a Tek MDO4000 on the bench, and an expensive Tek differential probe.
« Last Edit: July 04, 2021, 08:06:52 pm by Howardlong »
 
The following users thanked this post: 2N3055

Offline Electrojunky

  • Newbie
  • Posts: 2
  • Country: us
A big thank you to all of the people that have made this possible! You guys are truly amazing.

Does anyone know if this method will work on Keysight's S series oscilloscope? I've searched the forums but wasn't able to find any mention of it.
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf