Author Topic: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?  (Read 796236 times)

0 Members and 2 Guests are viewing this topic.

Offline tsmith35

  • Frequent Contributor
  • **
  • Posts: 250
  • Country: us
what is MSOX3104G
Just Google for this: Keysight "G models"

Looks like it indicates the inclusion of "Frequency response analysis - Bode plot"
 

Online 2N3055

  • Super Contributor
  • ***
  • Posts: 3864
  • Country: hr
what is MSOX3104G
Just Google for this: Keysight "G models"

Looks like it indicates the inclusion of "Frequency response analysis - Bode plot"

Read carefully. A MSOX3104G, a 1 GHz MSO device from 3000 series with a G suffix....not a 3000A or 3000T but 3000G device..
Of course I googled first...
 

Offline Howardlong

  • Super Contributor
  • ***
  • Posts: 5123
  • Country: gb
USB HS is a complex protocol, very verbose and probably cumbersome to debug on a DSO screen, except for some specific bug chasing using triggers.  I use an old Lecroy CATC USB 2.0 protocol analyzer I got on eBay for around $150 and software is still available for download from Lecroy and it runs on Windows 10.  It can capture full USB HS and some units even comes with exerciser that allows you to generate USB signals.

They are two different tools, like a hammer and a screwdriver.

I have a Teledyne Lecroy Mercury T2C to trigger the scope to determine latencies in USB driver code. The Lecroy analyser software is useless for seeing timing trends and bandwidth utilisation on its own.

 
The following users thanked this post: 2N3055, TK

Offline ikutyrev

  • Newbie
  • Posts: 3
  • Country: us
Hi guys,

I'm trying to save a DSO-X 2012A with suspected NAND flash issue, before dealing with sending it to Keysight (already had a bit of back and forth with them and that RMA setup is ongoing...).

I'm trying to boot off a USB drive so that I can just boot in once and then update firmware to the latest one. So far I haven't had any luck booting off flash drive, wanted to check here to see if I'm missing any steps.

My process so far:
-Take a fresh flash drive, formatted FAT16
-Create file infiniivisionStartupOverride.txt with content "True" (excluding quotations)
-Extract contents of 2000XSeries.02.35.2013061800 to flash drive
-Plug in flash drive, power on scope

It seems to try something with the flash drive, I see some activity on the flash drive LED, and then the scope just cycles through the button LED's and does nothing. This is different from powering the scope without a USB, it will attempt to boot then power cycle. When I had the UART debug connected it would read the flash drive, but gave some error message that made it seem like I had missed something in the file structure. I have the UART cable removed for now, or I'd pull up the exact output. I've tried a few different flash drives, all with the same result.

The posts I've seen on booting from USB mentioned unpacking the CAB inside the firmware contents and editing some data, but that seemed oriented towards unlocking features, which I'm not trying to get into (yet), just get the scope working. Also, opening up that CAB shows a bunch of files ending in 3-digit numbers, no folder structure.

Anything I'm missing here?
« Last Edit: August 02, 2021, 04:09:58 pm by ikutyrev »
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1675
  • Country: us
  • I am a Systems Analyst who plays with Electronics
Hi guys,

I'm trying to save a DSO-X 2012A with suspected NAND flash issue, before dealing with sending it to Keysight (already had a bit of back and forth with them and that RMA setup is ongoing...).

I'm trying to boot off a USB drive so that I can just boot in once and then update firmware to the latest one. So far I haven't had any luck booting off flash drive, wanted to check here to see if I'm missing any steps.

My process so far:
-Take a fresh flash drive, formatted FAT16
-Create file infiniivisionStartupOverride.txt with content "True" (excluding quotations)
-Extract contents of 2000XSeries.02.35.2013061800 to flash drive
-Plug in flash drive, power on scope

It seems to try something with the flash drive, I see some activity on the flash drive LED, and then the scope just cycles through the button LED's and does nothing. This is different from powering the scope without a USB, it will attempt to boot then power cycle. When I had the UART debug connected it would read the flash drive, but gave some error message that made it seem like I had missed something in the file structure. I have the UART cable removed for now, or I'd pull up the exact output. I've tried a few different flash drives, all with the same result.

The posts I've seen on booting from USB mentioned unpacking the CAB inside the firmware contents and editing some data, but that seemed oriented towards unlocking features, which I'm not trying to get into (yet), just get the scope working. Also, opening up that CAB shows a bunch of files ending in 3-digit numbers, no folder structure.

Anything I'm missing here?
Follow instructions posted here: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/?topicseen#msg2136181
 

Offline ikutyrev

  • Newbie
  • Posts: 3
  • Country: us
I tried to follow those instructions, but I'm only given a few options for actions, not allowed to enter any commands. I've attached a txt file of the output I get when holding down space on power on. Pressing "u" to enter U-boot just ends in a HW reset.

I've reconnected the TTL UART cable, the message given after it reads the USB (when I'm trying to boot off USB) is "Incorrect Parameters" then it just spins for a while, and eventually power cycles.

EDIT: empty file uploaded, see next post
« Last Edit: August 03, 2021, 06:24:07 pm by ikutyrev »
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3315
  • Country: ca
  • Living the Dream
The file you attached is empty with no contents.

I tried to follow those instructions, but I'm only given a few options for actions, not allowed to enter any commands. I've attached a txt file of the output I get when holding down space on power on. Pressing "u" to enter U-boot just ends in a HW reset.

I've reconnected the TTL UART cable, the message given after it reads the USB (when I'm trying to boot off USB) is "Incorrect Parameters" then it just spins for a while, and eventually power cycles.
VE7FM
 

Offline ikutyrev

  • Newbie
  • Posts: 3
  • Country: us
Sorry, fixed file attached to this post
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 4916
  • Country: ca
infiniivisionStartupOverride.txt function changed time ago, it won't work with newer firmware in the way you expect.
Facebook-free life and Rigol-free shack.
 

Offline wp_wp

  • Regular Contributor
  • *
  • Posts: 50
  • Country: cn
Sorry, fixed file attached to this post
In this situation,you can not see P500 prompt.
You need upload kernel file by Ethernet to scope.
 

Offline Volchenok82

  • Contributor
  • Posts: 7
  • Country: ru
  • Cats are everywhere ...
Hello everyone!
 :)
I skimmed through this topic, but I still don't quite understand how I can unlock my device!  :-BROKE

There is an MSOX3024T oscilloscope with an installed DSOXLAN module and a set of the following options: MSO, MEMUP, SGM, BW20, EDK, ADVMATH, DVMCTR, RML.
The device is manufactured in 2016. I updated the factory firmware (I don't remember the revision) long ago to version 7.30.2019051434. And then I read your messages and got fired up with the idea of ​​how to completely unlock it ...

I have not tried Telnet access yet - this option is more difficult for me.
After reading PhillyFlyers' answer # 2746, I tried to install the original new firmware 7.40.2021031200 on it first, and then uploaded the patched version of the same firmware to it. I used the following set of parameters in the .lnk file:
90 # infiniiVisionLauncher.exe -l D3000BDLB -l BW20 -l SCPIPS -l SEC -l MSO -l MEMUP -l WAVEGEN

The firmware got up without any problems, but the set of options in the device remained the same!

I also tried to slip him an earlier patched firmware 7.35.2020120822 with a different set of parameters:
106 # "\ Program Files \ infiniiVision \ infiniiVisionLauncher.exe" -l D3000BDLA -l BW35 -l SCPIPS -l SEC С -l WAVEGEN

Music again failed!  :-//

Maybe I'm doing something wrong? I put both files (firmware and shortcut) on an empty medium, and then feed them to him ... But after flashing and rebooting, the device returns to me with a set of the same options ...


Please help me figure out how to hack it!
« Last Edit: August 10, 2021, 08:10:00 am by Volchenok82 »
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1675
  • Country: us
  • I am a Systems Analyst who plays with Electronics
There should be no space before and after the # character in the .lnk file
 
The following users thanked this post: Volchenok82

Offline Volchenok82

  • Contributor
  • Posts: 7
  • Country: ru
  • Cats are everywhere ...
Thanks for the answer! Then the parameter string should look like this:

90#infiniiVisionLauncher.exe -l D3000BDLB -l BW20 -l SCPIPS -l SEC -l MSO -l MEMUP -l WAVEGEN

107#"\Program Files\infiniiVision\infiniiVisionLauncher.exe" -l D3000BDLA -l BW35 -l SCPIPS -l SEC С -l WAVEGEN


Tell me, do you need to specify only additional options in the parameter line, or should all existing ones also be prescribed?
Does it make a difference which form of writing the string to use - the first or the second?
...
« Last Edit: August 10, 2021, 12:52:49 am by Volchenok82 »
 

Offline Volchenok82

  • Contributor
  • Posts: 7
  • Country: ru
  • Cats are everywhere ...
I did it, I did it !!! :phew:
Many thanks to everyone, especially PhillyFlyers and his team! :-+
The most recent firmware they patched works as it should! 8)
« Last Edit: August 10, 2021, 08:10:32 am by Volchenok82 »
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1675
  • Country: us
  • I am a Systems Analyst who plays with Electronics
I did it, I did it !!! :phew:
Many thanks to everyone, especially PhillyFlyers and his team! :-+
The most recent firmware they patched works as it should! 8)
which .lnk configuration did you end up using?  You can add BW35 to enable 350MHz option

EDIT: 350MHz option requires the HW mod in addition to the SW hack
« Last Edit: August 10, 2021, 02:57:03 pm by TK »
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3315
  • Country: ca
  • Living the Dream
I did it, I did it !!! :phew:
Many thanks to everyone, especially PhillyFlyers and his team! :-+
The most recent firmware they patched works as it should! 8)
which .lnk configuration did you end up using?  You can add BW35 to enable 350MHz option

He was adding it before but it will never work as his scope is limited to 200 MHz without a hardware mod.
VE7FM
 

Offline TK

  • Super Contributor
  • ***
  • Posts: 1675
  • Country: us
  • I am a Systems Analyst who plays with Electronics
I did it, I did it !!! :phew:
Many thanks to everyone, especially PhillyFlyers and his team! :-+
The most recent firmware they patched works as it should! 8)
which .lnk configuration did you end up using?  You can add BW35 to enable 350MHz option

He was adding it before but it will never work as his scope is limited to 200 MHz without a hardware mod.
Yes, you are right...  350MHz needs the hw mod
 

Offline Volchenok82

  • Contributor
  • Posts: 7
  • Country: ru
  • Cats are everywhere ...
I used this set of parameters:

90#infiniiVisionLauncher.exe -l D3000BDLB -l BW35 -l SCPIPS -l SEC -l MSO -l MEMUP -l WAVEGEN

But as you correctly noted, it did not work, because there is a hardware limitation in the bandwidth of this model!  If someone wrote here that he managed to programmatically increase the bandwidth from 200 to 350 or even up to 500 MHz - do not believe ...
 :popcorn:

« Last Edit: August 10, 2021, 06:00:18 pm by Volchenok82 »
 

Offline wp_wp

  • Regular Contributor
  • *
  • Posts: 50
  • Country: cn
With HW mod,you can hack MSOX3024T to 500MHz。
 

Offline TheSteve

  • Supporter
  • ****
  • Posts: 3315
  • Country: ca
  • Living the Dream
With HW mod,you can hack MSOX3024T to 500MHz。

Or 1 GHz, or even 1.5 GHz :)

https://www.eevblog.com/forum/testgear/keysight-3000t-scope-1-ghz-hardware-upgrade-mod/

500 MHz is much less work though.
VE7FM
 
The following users thanked this post: wp_wp

Offline Volchenok82

  • Contributor
  • Posts: 7
  • Country: ru
  • Cats are everywhere ...
With HW mod,you can hack MSOX3024T to 500MHz。

Thanks for the offer!   :P

I saw post  #1013 how this can be done, I will think about it in the future - I am not yet mature enough to open it and re-solder something there!   :-/O
 

Offline Volchenok82

  • Contributor
  • Posts: 7
  • Country: ru
  • Cats are everywhere ...
« Last Edit: August 12, 2021, 06:27:56 pm by Volchenok82 »
 

Offline lzqing

  • Contributor
  • Posts: 11
  • Country: cn
I am try to write serial number to my DSOX2022A, when i fix it from corrupted NAND flash ,but now the serial number is Unset status;
I plan to try leaked SecureDataTool , get error below , anybody has old files backup and could you share me 'Agilent.Cdf.Core.Kernel.dll'. I think FW2.0 or 1.10 include this file.


\usb> \usb\AgilentConfidential_SecureDataTool_Client.exe Get-SerialNumber -ResultFile "\usb\GetSerialNumberResult.txt" -ErrorFile "\usb\GetSerialNumberErrorFile.txt"
Caption: AgilentConfidential_SecureDataTool_Client.exe
Title  : Error
Text   : An unexpected error has occurred in AgilentConfidential_SecureDataTool_Client.exe.
Select Quit and then restart this program, or select Details for more information.

Can't find PInvoke DLL 'Agilent.Cdf.Core.Kernel.dll'.

Details: AgilentConfidential_SecureDataTool_Client.exe
MissingMethodException
Can't find PInvoke DLL 'Agilent.Cdf.Core.Kernel.dll'.

   at Agilent.Cdf.Api.Security.P500SecureStream.get_Length()
   at eh.aa(SecureStreamId A_0, ci A_1)
   at eh.p()
   at Agilent.Cdf.Api.Security.SecureStorage.ReadCommonArea()
   at Agilent.Cdf.Tools.SecureDataTool.GetSerialNumberCommand.BeginProcessing()
   at b2.a.p(b2 A_0)
   at b2.a.n(IEnumerable`1 A_0, b A_1)
   at b2.b.e(a A_0, IEnumerable`1 A_1)
   at b2.h(IEnumerable`1 A_0)
   at g2.a(String[] A_0)
 

Offline lzqing

  • Contributor
  • Posts: 11
  • Country: cn
No,should be Agilent.Cdf.Core.Kernel.dll 。
 

Offline wp_wp

  • Regular Contributor
  • *
  • Posts: 50
  • Country: cn
Have you tested?
I tested.
With Agilent.Cdf.Api.dll,you can not modify serial number and model number.
You must have Agilent.Cdf.Core.Kernel.dll also.
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf