Author Topic: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?  (Read 793970 times)

0 Members and 2 Guests are viewing this topic.

Offline wp_wp

  • Regular Contributor
  • *
  • Posts: 50
  • Country: cn
Sorry but I was typing wrong. Was reading too much posts. :)
I need the 2.35 firmware for the DSO4024A. if you have it please?
for the 4000A X-series scopes,the first firmware is 4000XSeries.03.00.201209XXXX.agx
 

Offline oaba

  • Contributor
  • Posts: 27
  • Country: ie
Hi Wp_Wp
My issue is the flash got corrupted. I was reading a post how to fix it trhough serial connection.
And it said the 2.35 firmware was the last one that accepted the boot from USB.

Is there other method to fix my firmwre?
Or the 3.0 is the way to go'?
 

Offline wp_wp

  • Regular Contributor
  • *
  • Posts: 50
  • Country: cn
For 4000X series scope,if it has NAND corruption problem,you can have two method to repair it:
1.from v3.12 or older firmwares to make a set files to recover it
2.from newer(maybe v7.31 or later)firmware,you can get a special kernel file to recover it
 

Offline wp_wp

  • Regular Contributor
  • *
  • Posts: 50
  • Country: cn
Hi Wp_Wp
My issue is the flash got corrupted. I was reading a post how to fix it trhough serial connection.
And it said the 2.35 firmware was the last one that accepted the boot from USB.

Is there other method to fix my firmwre?
Or the 3.0 is the way to go'?
V2.35 is for 2000X、3000X,not for 3000X-T and 4000X.
For 4000X,as far as I know,V3.12 firmware is the last one that accepted the boot from USB.
 

Offline oaba

  • Contributor
  • Posts: 27
  • Country: ie
Do you have any of those file or the description of the method?
Pllease?
I do not know what the firmware was on it originally. I did not see that information in the serial com.
« Last Edit: June 19, 2021, 12:39:17 pm by oaba »
 

Offline oaba

  • Contributor
  • Posts: 27
  • Country: ie
Debug serial initialized ........OK

Microsoft Windows CE Bootloader Common Library Version 1.4 Built Aug 12 2011 11:03:19
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008

image2 value is out of range 0 so it will be ignored.
  It must be a hexadecimal integer between 0xd00000000 and 0xd7ffffff or between 0x800000000 and 0x87ffffff.

System ready!
Preparing for download...
 Loading image 1 from memory at 0xD0400000
O
BL_IMAGE_TYPE_BIN

X
XXXXXOOOOXXOOOOOOOOXOXXOOOOOOOIncorrect Data 1 EccResult: 3c3330 EccError: c0c03c EccRead: fcf30c
 EBOOT_ReadFlash failed offset 4ad764
 EBOOT_ReadFlash failed location d04b4000
ODeCompressFlash: CeCompressDecode() failed
 CeDecompressFlashBlock failed
****** Data record 11 corrupted, ABORT!!! ******

Completed file(s):
-------------------------------------------------------------------------------
  • : Address=0x80361000  Length=0x4E09D90  Name="" Target=RAM

 Loading image 1 failed, trying next one
 All images failed

Press r to reset

 

Offline wp_wp

  • Regular Contributor
  • *
  • Posts: 50
  • Country: cn
Do you have any of those file or the description of the method?
Pllease?
I do not know what the firmware was on it originally. I did not see that information in the serial com.
what the firmware was on it is not important.
the important thing is when you press space in keyboard,and turn on the scope,can you see P500> prompt,or other information,for example, d)download from ethernet now,or d)download from platform builder now.
the information will determine what method you should use.
 
The following users thanked this post: oaba

Offline Bud

  • Super Contributor
  • ***
  • Posts: 4898
  • Country: ca
Search this thread for "Ymodem" to learn how upload firmware via serial.
Facebook-free life and Rigol-free shack.
 
The following users thanked this post: oaba

Offline oaba

  • Contributor
  • Posts: 27
  • Country: ie
I presedd space. That stopped the boot.
And i have got the prompt. But I do not see any options.

Press space to stop autoboot:  0
p500>
 

Offline oaba

  • Contributor
  • Posts: 27
  • Country: ie
I went to help

There is an option to load the bin from serial or ymodem mode.

I will read a bit so as suggested. ymodem I guess way faster than serial.
How can I get to find the bin file?
 

Offline oaba

  • Contributor
  • Posts: 27
  • Country: ie
I have read the firmware version I transfer over to the unit has to be similar to the (corrupted) one on the NAND, or the boot may not get far.
????? How will I know wat was on it?
I was reading about how to load binary file over serial line (ymodem mode).
But I would need the firmware file. The one can boot from USB.
« Last Edit: June 19, 2021, 03:17:51 pm by oaba »
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 4898
  • Country: ca
I have read the firmware version I transfer over to the unit has to be similar to the (corrupted) one on the NAND, or the boot may not get far.
????? How will I know wat was on it?

Your serial log says:
Quote
: Address=0x80361000  Length=0x4E09D90  Name="" Target=RAM
You will need to find the firmware version which bin file matches the Length.
Facebook-free life and Rigol-free shack.
 
The following users thanked this post: oaba

Offline Bud

  • Super Contributor
  • ***
  • Posts: 4898
  • Country: ca
I went to help

There is an option to load the bin from serial or ymodem mode.

I will read a bit so as suggested. ymodem I guess way faster than serial.
How can I get to find the bin file?

Serial is a type of connection. Ymodem  is  a protocol. Saying Ymodem is faster than serial does not make sense. It is like saying TCP is faster than Ethernet.
Facebook-free life and Rigol-free shack.
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1671
  • Country: us
  • I am a Systems Analyst who plays with Electronics
I have read the firmware version I transfer over to the unit has to be similar to the (corrupted) one on the NAND, or the boot may not get far.
????? How will I know wat was on it?
I was reading about how to load binary file over serial line (ymodem mode).
But I would need the firmware file. The one can boot from USB.
This is the most detailed post about how to repair a NAND corrupted scope: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/?topicseen#msg2136181
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3314
  • Country: ca
  • Living the Dream
The 4000 series does have the network card built in, so the file can be transferred via network which only takes a few seconds. All info for that and the tools needed are also shared/posted in this thread.
VE7FM
 

Offline oaba

  • Contributor
  • Posts: 27
  • Country: ie
I have read that  allready.
But I do not have the firmware for 4000x. I need the version boot from usb drive.
I would be happy if someone has a working version.
« Last Edit: June 19, 2021, 06:02:31 pm by oaba »
 

Offline oaba

  • Contributor
  • Posts: 27
  • Country: ie
I was reading about the telnet option through the lan. But you have to have a working scope for that?
My firmware is corrupted. Can i telnet in?
But still my question is. Can I flash the newest firmware. Even the one was on the scope was a very early version?

« Last Edit: June 19, 2021, 06:15:19 pm by oaba »
 

Offline oaba

  • Contributor
  • Posts: 27
  • Country: ie
Bud You are right about the  serial and ymodem :)
Just the ymodem was sounds to be something like a network protocol. After I saw that is a serial protocol. :)
 

Offline oaba

  • Contributor
  • Posts: 27
  • Country: ie
Bud
So the question is who has the matching firmware?
Address=0x80361000  Length=0x4E09D90  Name="" Target=RAM

0x4E09D90(Hex)=81,829,264(dec)   

I have a 4.08 version   48,886,006  in size  when it is unpacked 62,130,090
7.4 version 49,908,286  is size when is unpacked 63,572,647

Am I wrong somewhere?
« Last Edit: June 19, 2021, 06:49:14 pm by oaba »
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1671
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Bud
So the question is who has the matching firmware?
Address=0x80361000  Length=0x4E09D90  Name="" Target=RAM

0x4E09D90(Hex)=81,829,264(dec)   

I have a 4.08 version   48,886,006  in size  when it is unpacked 62,130,090
7.4 version 49,908,286  is size when is unpacked 63,572,647

Am I wrong somewhere?
The image you need to flash is not the full upgrade package. I think it is the nk.bin (or something similar) file. The network method is not telnet, is using bootp protocol to get the image to flash from a bootp server
 
The following users thanked this post: oaba

Offline Bud

  • Super Contributor
  • ***
  • Posts: 4898
  • Country: ca
oaba, you have to do your homework. I do not have a  4000 machine. Read the posts where people did Ymodem download and pay attention to image file extension they used. Was it nk.bin or some other image file. You've got to learn how to extract image file from update package and how to convert it to the format Ymodem is expecting. Same applies if you use tftp to boot from network instead of serial. You can use an image you have, worst case it won't load it will not do any damage.
Facebook-free life and Rigol-free shack.
 
The following users thanked this post: oaba

Offline oaba

  • Contributor
  • Posts: 27
  • Country: ie
Thanks BUD
:) I have got it now. Just worried, I will over write valuable calibration data. Screw somwthing up even further if I do not use the right firmware,
 :palm:
I got the lenght of the nk.nb0 :) 
4.08  81508824
7.4    88100356
So the original was 81829264 (seems newer than 4.08 but older than 7.4)
And i am doing the rest. Will see.
I had to modify the dosetup.py. That is writen in python 2.  And python 3 throw faults.
line 8 print (" "),
line 19 print ("mkdir "+path)
line 26 print ("mv "+parm.get("value")+" -> "+path)
« Last Edit: June 20, 2021, 07:12:47 am by oaba »
 

Offline oaba

  • Contributor
  • Posts: 27
  • Country: ie
The serial upload always fail at 75.4percent.
The window of transfer stop to count. After couple seconds waiting and closes.
Ater restart the serial com says.
It fails exactly at the same place.
EBOOT_ReadFlash failed offset 4ad764
EBOOT_ReadFlash failed location d04b4000
« Last Edit: June 20, 2021, 01:50:35 pm by oaba »
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 4898
  • Country: ca
Not good....looks like some flash is damaged. I'd still try TFTP boot to see if get same error.
If so, focus may need to shift to use bootloader's flash commands to see if bad flash sectors are detected, and/or manually mark bad sectors. For that you may need brighter minds than me.
Facebook-free life and Rigol-free shack.
 
The following users thanked this post: wp_wp

Offline oaba

  • Contributor
  • Posts: 27
  • Country: ie
Actually I have got it to work.   :phew:
After 3 times try (2 hours each) The upload failed at about 75 percent. The scope did not start.
In the terminal window I was getting the same message.
I tryed before to turn the scope on and off. I have read sometimes the scope can boot up. but no effect.
What I did after this turmoil.
I pressed the r  (reset) 10-15 times. And suddenly I have seen in the serial com.
The scope started to boot.
When the scope was fully booted up. I did not turn it off. I downloaded the new firmware from keysight to an USB. And upgraded the firmware.
Scope is back to business.
Thanks for every one to helping me out.
Especially BUD.
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf