Author Topic: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ? (Read 1356058 times)

tabajaralabs · « **Reply #3375 on:** December 19, 2024, 01:20:00 am »

I must be doing something very, very stupid.
Ok, I am not able to see the software booting (up to the keysight screen) again. I changed software versions (from 2.35 to 2.30, scope seems to be in 2.36). Changed pen drive (from a no-name keysight gift 4gb pen drive to a 16gb cruzer from sandisk), u-boot version (something newer, came back for the original) and I just cannot make it boot again.

When I load P500drv and u-boot, get the P500> prompt I do:
Editenv ipaddr (to change ip to 192.168.0.30 - don't know why setenv does not saves it)
tftp 0x361000
go 0x362000

And the system locks up, no message, no nothing. Tried both USB formats discussed - one with the /secure dir and another without. of course changed the infitiivision.lnk from /usb/secure/... to /usb/... including changing the lenght of the string in the beginning.

I don't know what else can I do.

Is it remotely possible to extract an entire NAND dump from a working scope and load it on this broken scope? How?

I believe it would help a lot.

Thanks!

BillCRM · « **Reply #3376 on:** December 19, 2024, 02:29:13 am »

The file structure I used is like this, I used this set of file on nearly 10 machines and all worked fine.

BillCRM · « **Reply #3377 on:** December 19, 2024, 02:34:35 am »

Quote from: tabajaralabs on December 18, 2024, 07:13:19 pm

Quote from: BillCRM on December 13, 2024, 02:23:16 am
If you need, I could also provide a dump of the whole nand, but this might be the last solution as using other's nand dump will cause a serial number change and wrong cal data.
However, I believe your condition is due to wrong usb file structure.

Bill, are you talking about the entire program memory area or just the uboot? Unfortunately, my knowledge about this scope is VERY limited. It would be nice if I could get an entire dump from a good osciloscope and install on mine. I tried 6 different firmware versions (all old versions and the 2.50 cracked one) and wasn't able to make it boot. It tries to boot, load the (ugly) keysight boot screen and returns a segfault in many appls.

Tried to run MTEST but it locks up. Got a good, working (2 channel) dso-x2002A and it locks up on the MTEST too. So I don't believe the problem is RAM bound.

I confess I am completely lost, and I cannot find a line of logic. Begging for help, I cannot let this scope let go. It looks like to be SO near!

BTW, I have the LAN interface, so I can load and boot way faster than serial.

Maybe if someone created a correct USB boot drive image + NK.NB0 file for me to try to load...If you can do that feel free to send me a private message

Thanks and sorry for being so noob

I got both, in short, I used to removed the 25p40 chip which store the uboot and mac data, and the micron/ST nand chip which store the windows and scope program. Then I put them on the programmer and read to made the backup. If you need, I could provide these files.

Bud · « **Reply #3378 on:** December 19, 2024, 03:34:15 am »

@taba.. i recommend you fix your NOR first. Get back to where you started before doing anything with NAND.
Reprogramming NAND at physical level with someone's image may not work. If yourNAND has bad blocks they have been marked as bad. Bill's NAND may have totally different bad block mapping. Writing his image in your chip will overwrite your bad blocks map so your bad blocks will be treated as good ones, whereas they are not. you get the idea.

BillCRM · « **Reply #3379 on:** December 19, 2024, 02:16:04 pm »

Quote from: Bud on December 19, 2024, 03:34:15 am

@taba.. i recommend you fix your NOR first. Get back to where you started before doing anything with NAND.
Reprogramming NAND at physical level with someone's image may not work. If yourNAND has bad blocks they have been marked as bad. Bill's NAND may have totally different bad block mapping. Writing his image in your chip will overwrite your bad blocks map so your bad blocks will be treated as good ones, whereas they are not. you get the idea.

Keysight seems didn't implement such fancy bad block mapping systems, I believe they only use some simple ecc correction and use the second image as backup, I used to trying to hack the options directly from raw nand data and used 4 different nand chips to make programming nands eaiser(old nands have flux on it and need cleaning to read, I just use a new nand chip each time), and all the chips were working. So I believe this is no a problem.
The real problem is serial number and cal data.
Maybe someone have the secure data tools in hand?

tabajaralabs · « **Reply #3380 on:** December 19, 2024, 02:17:09 pm »

Quote from: Bud on December 19, 2024, 03:34:15 am

@taba.. i recommend you fix your NOR first. Get back to where you started before doing anything with NAND.
Reprogramming NAND at physical level with someone's image may not work. If yourNAND has bad blocks they have been marked as bad. Bill's NAND may have totally different bad block mapping. Writing his image in your chip will overwrite your bad blocks map so your bad blocks will be treated as good ones, whereas they are not. you get the idea.

Please send, I'll try it!

Bud · « **Reply #3381 on:** December 19, 2024, 02:26:29 pm »

I do not have 2000/3000 materials.

BillCRM · « **Reply #3382 on:** December 19, 2024, 02:29:35 pm »

I don't think that's danger too, just read the nand and make backup before using new data, I think that's totally fine.

BillCRM · « **Reply #3383 on:** December 19, 2024, 02:31:33 pm »

https://mega.nz/file/pTUAxS5B#51LV_M-pZ7U5CE42efZr4yT3wvPe8lJkjrGGvy66kak
Here you go, all the images were there, 1000X,2000X,3000X, nor and nand.
Hope this helps!

albertr · « **Reply #3384 on:** December 19, 2024, 05:52:26 pm »

Bill,

Would it be possible to upload the modified(liberated) ver 7.65 f/w to MEGA too? I'm looking for both 3000T & 4000X series f/w, thanks!

-albertr

lampask · « **Reply #3385 on:** December 19, 2024, 06:40:51 pm »

Quote from: BillCRM on December 19, 2024, 02:31:33 pm

Here you go, all the images were there, 1000X,2000X,3000X, nor and nand.

So, this 3000X dump comes from 3000A or 3000T/G series?

BillCRM · « **Reply #3386 on:** December 20, 2024, 02:46:52 am »

Quote from: lampask on December 19, 2024, 06:40:51 pm

Quote from: BillCRM on December 19, 2024, 02:31:33 pm
Here you go, all the images were there, 1000X,2000X,3000X, nor and nand.
So, this 3000X dump comes from 3000A or 3000T/G series?

From 3000A, Don‘t use it on 3000T/G!!!!!!!!!!!!!!!

BillCRM · « **Reply #3387 on:** December 20, 2024, 02:54:36 am »

The programmer I used is a Xgecu T48, in case someone may ask. Read and Write were both fine.

Thor-Arne · « **Reply #3388 on:** December 20, 2024, 10:46:42 pm »

Quote from: ShQ on October 29, 2024, 10:46:43 am

So, this is new: having come into possession of a broken DSO-X 3054A, I figured I'd try my luck to see if Keysight would honour the extended warranty related to the NAND service note. The confirmation for the repair request, however, states the following:

Quote
In case you reject this repair quote or do not accept it before the quote expiration date, we will charge a technical evaluation fee of 350 EUR. In sending your instrument to us, you are deemed to have accepted this term.
Not sure if this is worth risking now.

Now, I'm not sure I'm reading this right.

They demand €350 just for giving you a quote if you don't accept it.

PioB · « **Reply #3389 on:** December 26, 2024, 11:45:48 am »

Hi
I have a DSOX2002A from work which I am trying to get back to work after a nand corruption. I followed titiris'post (or https://salvagedcircuitry.com/2000a-nand-recovery.html ) but unfortunately after trying "go" it breaks with an error I haven't seen mentioned and I am not sure what I did wrong. I'd be grateful for any hints. (Version 2.41, downloaded from salvagedcircuitry) I only have python 3 installed, so I removed all the lines containing "print" in dosetup.py, I think the script ran ok and produced the memorystick allright

Code: [Select]

 tree
Folder PATH listing for volume IST AG
Volume serial number is 1CB5-AFB6
D:.
├───help
├───infiniiVision
│   ├───fpga
│   ├───upgrade
│   └───web
│       ├───css
│       ├───help
│       ├───image
│       ├───include
│       │   └───web-socket-js
│       ├───lib
│       ├───Lxi
│       │   └───Identification
│       └───navbar
├───Startup
└───Temp

PS D:\> more .\Startup\infiniivision.lnk
48#\Secure\infiniiVision\infiniivisionLauncher.exe
PS D:\> more .\infiniivisionStartupOverride.txt
True

Code: [Select]

U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  fsmc-ecc1 128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0
p500> loady 0x0361000 115200
## Ready for binary (ymodem) download to 0x00361000 at 115200 bps...
C

U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  fsmc-ecc1 128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2015-05-07   8:18:27 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    37749 Bytes = 36.9 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK
RTC: 2024-12-26   20:52:11.12 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built May  7 2015 01:                                                 38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008


System ready!
Preparing for download...
RTC: 2024-12-26   20:52:11.16 UTC
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXXRewrite recommended, internal ECC corrected data at 0xc1d
Rewrite recommended, internal ECC corrected data at 0xc22
ORewrite recommended, internal ECC corrected data at 0xc26
Rewrite recommended, internal ECC corrected data at 0xc2a
OOOXXORewrite recommended, internal ECC corrected data at 0xc6a
Rewrite recommended, internal ECC corrected data at 0xc6a
OORewrite recommended, internal ECC corrected data at 0xc8f
Rewrite recommended, internal ECC corrected data at 0xc90
Rewrite recommended, internal ECC corrected data at 0xc91
Rewrite recommended, internal ECC corrected data at 0xc98
Rewrite recommended, internal ECC corrected data at 0xc99
ORewrite recommended, internal ECC corrected data at 0xc9c
OORewrite recommended, internal ECC corrected data at 0xcc0
Rewrite recommended, internal ECC corrected data at 0xcce
OOXOXOORewrite recommended, internal ECC corrected data at 0xd0f
OOORewrite recommended, internal ECC corrected data at 0xd3c
ORewrite recommended, internal ECC corrected data at 0xd48
Rewrite recommended, internal ECC corrected data at 0xd4c
OOXOOXOXRewrite recommended, internal ECC corrected data at 0xda1
ORewrite recommended, internal ECC corrected data at 0xdab
Rewrite recommended, internal ECC corrected data at 0xdb4
ORewrite recommended, internal ECC corrected data at 0xdc7
ORewrite recommended, internal ECC corrected data at 0xdd9
OXXXOORewrite recommended, internal ECC corrected data at 0xe0a
Rewrite recommended, internal ECC corrected data at 0xe11
ORewrite recommended, internal ECC corrected data at 0xe1c
ORewrite recommended, internal ECC corrected data at 0xe29
ORewrite recommended, internal ECC corrected data at 0xe3c
ORewrite recommended, internal ECC corrected data at 0xe55
OOOXRewrite recommended, internal ECC corrected data at 0xe90
OORewrite recommended, internal ECC corrected data at 0xeb9
OOXRewrite recommended, internal ECC corrected data at 0xed5
Rewrite recommended, internal ECC corrected data at 0xede
Rewrite recommended, internal ECC corrected data at 0xee2
OXXRewrite recommended, internal ECC corrected data at 0xee9
Rewrite recommended, internal ECC corrected data at 0xef2
OXXRewrite recommended, internal ECC corrected data at 0xef4
OXRewrite recommended, internal ECC corrected data at 0xf16
OXRewrite recommended, internal ECC corrected data at 0xf2d
OXRewrite recommended, internal ECC corrected data at 0xf32
OXRewrite recommended, internal ECC corrected data at 0xf42
Rewrite recommended, internal ECC corrected data at 0xf43
OXXXXRewrite recommended, internal ECC corrected data at 0xf61
OOXXXRewrite recommended, internal ECC corrected data at 0xf78
ORewrite recommended, internal ECC corrected data at 0xf97
ORewrite recommended, internal ECC corrected data at 0xf9c
OOORewrite recommended, internal ECC corrected data at 0xfd8
Rewrite recommended, internal ECC corrected data at 0xfdb
OXXOXXRewrite recommended, internal ECC corrected data at 0xffb
OXXXXXXRewrite recommended, internal ECC corrected data at 0x1014
ORewrite recommended, internal ECC corrected data at 0x1023
Rewrite recommended, internal ECC corrected data at 0x102d
ORewrite recommended, internal ECC corrected data at 0x1034
Rewrite recommended, internal ECC corrected data at 0x1036
Rewrite recommended, internal ECC corrected data at 0x103e
OXXXRewrite recommended, internal ECC corrected data at 0x1045
Rewrite recommended, internal ECC corrected data at 0x104b
OXXRewrite recommended, internal ECC corrected data at 0x1052
ORewrite recommended, internal ECC corrected data at 0x1075
OXRewrite recommended, internal ECC corrected data at 0x1081
OXXOORewrite recommended, internal ECC corrected data at 0x10ad
OXRewrite recommended, internal ECC corrected data at 0x10cf
OXRewrite recommended, internal ECC corrected data at 0x10d1
Rewrite recommended, internal ECC corrected data at 0x10d4
Rewrite recommended, internal ECC corrected data at 0x10de
OORewrite recommended, internal ECC corrected data at 0x10f3
OXXRewrite recommended, internal ECC corrected data at 0x1108
ORewrite recommended, internal ECC corrected data at 0x1119
Rewrite recommended, internal ECC corrected data at 0x1123
ORewrite recommended, internal ECC corrected data at 0x1138
OXORewrite recommended, internal ECC corrected data at 0x115e
ORewrite recommended, internal ECC corrected data at 0x116b
Rewrite recommended, internal ECC corrected data at 0x1179
ORewrite recommended, internal ECC corrected data at 0x1183
OXOXRewrite recommended, internal ECC corrected data at 0x11a7
Rewrite recommended, internal ECC corrected data at 0x11ad
OORewrite recommended, internal ECC corrected data at 0x11cf
Rewrite recommended, internal ECC corrected data at 0x11d7
OOOXRewrite recommended, internal ECC corrected data at 0x120e
ORewrite recommended, internal ECC corrected data at 0x121a
Rewrite recommended, internal ECC corrected data at 0x1229
ORewrite recommended, internal ECC corrected data at 0x1233
OXRewrite recommended, internal ECC corrected data at 0x123e
Rewrite recommended, internal ECC corrected data at 0x124e
OOXRewrite recommended, internal ECC corrected data at 0x126c
OXOXRewrite recommended, internal ECC corrected data at 0x128b
Rewrite recommended, internal ECC corrected data at 0x1292
OXXXXXXXRewrite recommended, internal ECC corrected data at 0x12ae
OXXXRewrite recommended, internal ECC corrected data at 0x12b3
OORewrite recommended, internal ECC corrected data at 0x12db
OXRewrite recommended, internal ECC corrected data at 0x12df
OORewrite recommended, internal ECC corrected data at 0x12f6
OXRewrite recommended, internal ECC corrected data at 0x130a
Rewrite recommended, internal ECC corrected data at 0x130e
OXRewrite recommended, internal ECC corrected data at 0x131e
ORewrite recommended, internal ECC corrected data at 0x132e
ORewrite recommended, internal ECC corrected data at 0x1343
OOXRewrite recommended, internal ECC corrected data at 0x135e
OOORewrite recommended, internal ECC corrected data at 0x1397
OXRewrite recommended, internal ECC corrected data at 0x1399
OXRewrite recommended, internal ECC corrected data at 0x13a9
Rewrite recommended, internal ECC corrected data at 0x13b1
OXRewrite recommended, internal ECC corrected data at 0x13c6
ORewrite recommended, internal ECC corrected data at 0x13d0
OORewrite recommended, internal ECC corrected data at 0x13ef
OOOX
ORewrite recommended, internal ECC corrected data at 0x1434
Rewrite recommended, internal ECC corrected data at 0x1438
OOXRewrite recommended, internal ECC corrected data at 0x1463
ORewrite recommended, internal ECC corrected data at 0x1469
Rewrite recommended, internal ECC corrected data at 0x146b
OXRewrite recommended, internal ECC corrected data at 0x148a
OORewrite recommended, internal ECC corrected data at 0x14a2
Rewrite recommended, internal ECC corrected data at 0x14a4
Rewrite recommended, internal ECC corrected data at 0x14a7
ORewrite recommended, internal ECC corrected data at 0x14b3
OXRewrite recommended, internal ECC corrected data at 0x14c6
ORewrite recommended, internal ECC corrected data at 0x14d5
ORewrite recommended, internal ECC corrected data at 0x14ed
ORewrite recommended, internal ECC corrected data at 0x14f4
Rewrite recommended, internal ECC corrected data at 0x14f5
OXRewrite recommended, internal ECC corrected data at 0x1516
OXRewrite recommended, internal ECC corrected data at 0x1519
OORewrite recommended, internal ECC corrected data at 0x153c
OXXOORewrite recommended, internal ECC corrected data at 0x156c
ORewrite recommended, internal ECC corrected data at 0x157f
ORewrite recommended, internal ECC corrected data at 0x158a
Rewrite recommended, internal ECC corrected data at 0x1593
ORewrite recommended, internal ECC corrected data at 0x159d
ORewrite recommended, internal ECC corrected data at 0x15ab
ORewrite recommended, internal ECC corrected data at 0x15b6
ORewrite recommended, internal ECC corrected data at 0x15cb
OXRewrite recommended, internal ECC corrected data at 0x15d5
Rewrite recommended, internal ECC corrected data at 0x15da
Rewrite recommended, internal ECC corrected data at 0x15dd
ORewrite recommended, internal ECC corrected data at 0x15e5
ORewrite recommended, internal ECC corrected data at 0x15f5
OOXOOOOORewrite recommended, internal ECC corrected data at 0x1676
OXOXORewrite recommended, internal ECC corrected data at 0x16a6
Rewrite recommended, internal ECC corrected data at 0x16ab
OOOXOXORewrite recommended, internal ECC corrected data at 0x16f7
Rewrite recommended, internal ECC corrected data at 0x1703
ORewrite recommended, internal ECC corrected data at 0x170e
ORewrite recommended, internal ECC corrected data at 0x171a
ORewrite recommended, internal ECC corrected data at 0x1724
Rewrite recommended, internal ECC corrected data at 0x1727
OORewrite recommended, internal ECC corrected data at 0x174f
OXXRewrite recommended, internal ECC corrected data at 0x1759
OOORewrite recommended, internal ECC corrected data at 0x1785
Rewrite recommended, internal ECC corrected data at 0x178a
Rewrite recommended, internal ECC corrected data at 0x1793
OXRewrite recommended, internal ECC corrected data at 0x1798
Rewrite recommended, internal ECC corrected data at 0x17a3
Rewrite recommended, internal ECC corrected data at 0x17a4
OXRewrite recommended, internal ECC corrected data at 0x17ae
OORewrite recommended, internal ECC corrected data at 0x17cf
OXORewrite recommended, internal ECC corrected data at 0x17e9
Rewrite recommended, internal ECC corrected data at 0x17ec
ORewrite recommended, internal ECC corrected data at 0x1809
OXRewrite recommended, internal ECC corrected data at 0x180d
OOXXRewrite recommended, internal ECC corrected data at 0x1833
OXORewrite recommended, internal ECC corrected data at 0x1852
ORewrite recommended, internal ECC corrected data at 0x186f
OOXXXRewrite recommended, internal ECC corrected data at 0x188a
Rewrite recommended, internal ECC corrected data at 0x1893
OXXXXXXOXRewrite recommended, internal ECC corrected data at 0x18b0
OXXOXXXXXRewrite recommended, internal ECC corrected data at 0x18cb
OXOXXOXXORewrite recommended, internal ECC corrected data at 0x1912
Rewrite recommended, internal ECC corrected data at 0x1916
OXXXOOXXRewrite recommended, internal ECC corrected data at 0x1947
OXXOXIncorrect Data 2 EccResult: 303cff EccError: 3300c0 EccRead: 33c3f
 EBOOT_ReadFlash failed offset cac9ec
 EBOOT_ReadFlash failed location d0cb0000
ODeCompressFlash: CeCompressDecode() failed
 CeDecompressFlashBlock failed
****** Data record 133 corrupted, ABORT!!! ******

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x15264A8  Name="" Target=RAM
 Loading image 1 failed, trying next one
 Loading image 2 from memory at 0xD1600000
Rewrite recommended, internal ECC corrected data at 0x2c07
Rewrite recommended, internal ECC corrected data at 0x2c0e
O
BL_IMAGE_TYPE_BIN

X
XXXXXRewrite recommended, internal ECC corrected data at 0x2c13
Rewrite recommended, internal ECC corrected data at 0x2c13
ORewrite recommended, internal ECC corrected data at 0x2c2f
ORewrite recommended, internal ECC corrected data at 0x2c36
OOXXRewrite recommended, internal ECC corrected data at 0x2c5d
OORewrite recommended, internal ECC corrected data at 0x2c7d
Rewrite recommended, internal ECC corrected data at 0x2c85
ORewrite recommended, internal ECC corrected data at 0x2c8c
ORewrite recommended, internal ECC corrected data at 0x2c9c
Rewrite recommended, internal ECC corrected data at 0x2ca6
OORewrite recommended, internal ECC corrected data at 0x2cc2
Rewrite recommended, internal ECC corrected data at 0x2cc5
Rewrite recommended, internal ECC corrected data at 0x2cc8
ORewrite recommended, internal ECC corrected data at 0x2cda
OXRewrite recommended, internal ECC corrected data at 0x2ce6
OXRewrite recommended, internal ECC corrected data at 0x2cec
Rewrite recommended, internal ECC corrected data at 0x2cf7
OORewrite recommended, internal ECC corrected data at 0x2d08
ORewrite recommended, internal ECC corrected data at 0x2d1c
ORewrite recommended, internal ECC corrected data at 0x2d2c
OORewrite recommended, internal ECC corrected data at 0x2d4d
Rewrite recommended, internal ECC corrected data at 0x2d51
Rewrite recommended, internal ECC corrected data at 0x2d54
ORewrite recommended, internal ECC corrected data at 0x2d5e
Rewrite recommended, internal ECC corrected data at 0x2d5f
Rewrite recommended, internal ECC corrected data at 0x2d63
Rewrite recommended, internal ECC corrected data at 0x2d68
OXRewrite recommended, internal ECC corrected data at 0x2d71
ORewrite recommended, internal ECC corrected data at 0x2d75
Rewrite recommended, internal ECC corrected data at 0x2d76
Rewrite recommended, internal ECC corrected data at 0x2d7b
OXRewrite recommended, internal ECC corrected data at 0x2d88
Rewrite recommended, internal ECC corrected data at 0x2d94
OXRewrite recommended, internal ECC corrected data at 0x2da2
OOORewrite recommended, internal ECC corrected data at 0x2dd0
OXXXRewrite recommended, internal ECC corrected data at 0x2dea
ORewrite recommended, internal ECC corrected data at 0x2df3
ORewrite recommended, internal ECC corrected data at 0x2e05
Rewrite recommended, internal ECC corrected data at 0x2e06
Rewrite recommended, internal ECC corrected data at 0x2e06
Rewrite recommended, internal ECC corrected data at 0x2e07
Rewrite recommended, internal ECC corrected data at 0x2e0a
Rewrite recommended, internal ECC corrected data at 0x2e0d
Rewrite recommended, internal ECC corrected data at 0x2e13
ORewrite recommended, internal ECC corrected data at 0x2e20
Rewrite recommended, internal ECC corrected data at 0x2e22
OOORewrite recommended, internal ECC corrected data at 0x2e5d
Rewrite recommended, internal ECC corrected data at 0x2e5e
ORewrite recommended, internal ECC corrected data at 0x2e60
Rewrite recommended, internal ECC corrected data at 0x2e61
Rewrite recommended, internal ECC corrected data at 0x2e66
Rewrite recommended, internal ECC corrected data at 0x2e71
ORewrite recommended, internal ECC corrected data at 0x2e78
OXRewrite recommended, internal ECC corrected data at 0x2e8c
Rewrite recommended, internal ECC corrected data at 0x2e8e
Rewrite recommended, internal ECC corrected data at 0x2e8f
Incorrect Data 1 EccResult: a96996 EccError: f0fc0 EccRead: a66656
 EBOOT_ReadFlash failed offset 1740fc1
 EBOOT_ReadFlash failed location d1746000
ORewrite recommended, internal ECC corrected data at 0x2e8c
Rewrite recommended, internal ECC corrected data at 0x2e8e
Rewrite recommended, internal ECC corrected data at 0x2e8f
Incorrect Data 1 EccResult: a96996 EccError: f0fc0 EccRead: a66656
 EBOOT_ReadFlash failed
Block length: 0x34b6b  is larger than 0x10000
 CeDecompressFlashBlock failed
****** Data record 17 corrupted, ABORT!!! ******

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x15264A8  Name="" Target=RAM
 Loading image 2 failed, trying next one
 All images failed

Press r to reset


U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  fsmc-ecc1 128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0
p500>
p500>
loady 0x0361000 115200
## Ready for binary (ymodem) download to 0x00361000 at 115200 bps...
CCxyzModem - CRC mode, 1(SOH)/21658(STX)/0(CAN) packets, 4 retries
## Total Size      = 0x015264a8 = 22176936 Bytes
p500> go 0x00362000
## Starting application at 0x00362000 ...
Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Oct 22 2015)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 00:30:D3:20:AA:D3
Phy found addr 31 (ticks=6306)
WaitForLink Start (ticks=6308)
No Link (ticks=7311)
<--EDeviceInitialize

GMAC DMA status register = 0x0
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Running infiniiVisionInstallHelper
Failed to start/configure network.
Time for NANDFLASH to load: 0 ms.
Time for SNANDFLASH to load: 0 ms.
Time for USB Hard Disk Drive to load: 0 ms.
ERROR: OALIoCtlHalGetDeviceInfo: Device doesn't support IOCTL_HAL_GET_DEVICE_INF                                                 O::SPI_GETBOOTMENAME


U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  fsmc-ecc1 128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2015-05-07   8:18:27 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    37749 Bytes = 36.9 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK
RTC: 2024-12-26   21:28:40.41 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built May  7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008


System ready!
Preparing for download...
RTC: 2024-12-26   21:28:40.44 UTC
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXXRewrite recommended, internal ECC corrected data at 0xc1d
Rewrite recommended, internal ECC corrected data at 0xc22
ORewrite recommended, internal ECC corrected data at 0xc26
Rewrite recommended, internal ECC corrected data at 0xc2a
OOOXXORewrite recommended, internal ECC corrected data at 0xc6a
Rewrite recommended, internal ECC corrected data at 0xc6a
OORewrite recommended, internal ECC corrected data at 0xc8f
Rewrite recommended, internal ECC corrected data at 0xc90
Rewrite recommended, internal ECC corrected data at 0xc91
Rewrite recommended, internal ECC corrected data at 0xc98
Rewrite recommended, internal ECC corrected data at 0xc99
ORewrite recommended, internal ECC corrected data at 0xc9c
OORewrite recommended, internal ECC corrected data at 0xcc0
Rewrite recommended, internal ECC corrected data at 0xcce
OOXOXOORewrite recommended, internal ECC corrected data at 0xd0f
OOORewrite recommended, internal ECC corrected data at 0xd3c
ORewrite recommended, internal ECC corrected data at 0xd48
Rewrite recommended, internal ECC corrected data at 0xd4c
OOXOOXOXRewrite recommended, internal ECC corrected data at 0xda1
ORewrite recommended, internal ECC corrected data at 0xdab
Rewrite recommended, internal ECC corrected data at 0xdb4
ORewrite recommended, internal ECC corrected data at 0xdc7
ORewrite recommended, internal ECC corrected data at 0xdd9
OXXXOORewrite recommended, internal ECC corrected data at 0xe0a
Rewrite recommended, internal ECC corrected data at 0xe11
ORewrite recommended, internal ECC corrected data at 0xe1c
ORewrite recommended, internal ECC corrected data at 0xe29
ORewrite recommended, internal ECC corrected data at 0xe3c
ORewrite recommended, internal ECC corrected data at 0xe55
OOOXRewrite recommended, internal ECC corrected data at 0xe90
OORewrite recommended, internal ECC corrected data at 0xeb9
OOXRewrite recommended, internal ECC corrected data at 0xed5
Rewrite recommended, internal ECC corrected data at 0xede
Rewrite recommended, internal ECC corrected data at 0xee2
OXXRewrite recommended, internal ECC corrected data at 0xee9
Rewrite recommended, internal ECC corrected data at 0xef2
OXXRewrite recommended, internal ECC corrected data at 0xef4
OXRewrite recommended, internal ECC corrected data at 0xf16
OXRewrite recommended, internal ECC corrected data at 0xf2d
OXRewrite recommended, internal ECC corrected data at 0xf32
OXRewrite recommended, internal ECC corrected data at 0xf42
Rewrite recommended, internal ECC corrected data at 0xf43
OXXXXRewrite recommended, internal ECC corrected data at 0xf61
OOXXXRewrite recommended, internal ECC corrected data at 0xf78
ORewrite recommended, internal ECC corrected data at 0xf97
ORewrite recommended, internal ECC corrected data at 0xf9c
ORewrite recommended, internal ECC corrected data at 0xfb3
OORewrite recommended, internal ECC corrected data at 0xfd8
Rewrite recommended, internal ECC corrected data at 0xfdb
OXXOXXRewrite recommended, internal ECC corrected data at 0xffb
OXXXXXXRewrite recommended, internal ECC corrected data at 0x1014
ORewrite recommended, internal ECC corrected data at 0x1023
Rewrite recommended, internal ECC corrected data at 0x102d
ORewrite recommended, internal ECC corrected data at 0x1034
Rewrite recommended, internal ECC corrected data at 0x1036
Rewrite recommended, internal ECC corrected data at 0x103e
OXXXRewrite recommended, internal ECC corrected data at 0x1045
Rewrite recommended, internal ECC corrected data at 0x104b
OXXRewrite recommended, internal ECC corrected data at 0x1052
Rewrite recommended, internal ECC corrected data at 0x1058
ORewrite recommended, internal ECC corrected data at 0x1075
OXRewrite recommended, internal ECC corrected data at 0x1081
OXXOORewrite recommended, internal ECC corrected data at 0x10ad
OXRewrite recommended, internal ECC corrected data at 0x10cf
OXRewrite recommended, internal ECC corrected data at 0x10d1
Rewrite recommended, internal ECC corrected data at 0x10d4
Rewrite recommended, internal ECC corrected data at 0x10de
OORewrite recommended, internal ECC corrected data at 0x10f3
OXXRewrite recommended, internal ECC corrected data at 0x1108
ORewrite recommended, internal ECC corrected data at 0x1119
Rewrite recommended, internal ECC corrected data at 0x1123
ORewrite recommended, internal ECC corrected data at 0x1138
OXOORewrite recommended, internal ECC corrected data at 0x116b
Rewrite recommended, internal ECC corrected data at 0x1179
ORewrite recommended, internal ECC corrected data at 0x1183
OXOXRewrite recommended, internal ECC corrected data at 0x11a7
Rewrite recommended, internal ECC corrected data at 0x11ad
OORewrite recommended, internal ECC corrected data at 0x11cf
Rewrite recommended, internal ECC corrected data at 0x11d7
OOOXRewrite recommended, internal ECC corrected data at 0x120e
ORewrite recommended, internal ECC corrected data at 0x121a
Rewrite recommended, internal ECC corrected data at 0x1229
ORewrite recommended, internal ECC corrected data at 0x1233
OXRewrite recommended, internal ECC corrected data at 0x123e
Rewrite recommended, internal ECC corrected data at 0x124e
OOXRewrite recommended, internal ECC corrected data at 0x126c
OXOXRewrite recommended, internal ECC corrected data at 0x128b
Rewrite recommended, internal ECC corrected data at 0x1292
OXXXXXXXRewrite recommended, internal ECC corrected data at 0x12ae
OXXXRewrite recommended, internal ECC corrected data at 0x12b3
OORewrite recommended, internal ECC corrected data at 0x12db
OXRewrite recommended, internal ECC corrected data at 0x12df
OORewrite recommended, internal ECC corrected data at 0x12f6
OXRewrite recommended, internal ECC corrected data at 0x130a
Rewrite recommended, internal ECC corrected data at 0x130e
OXRewrite recommended, internal ECC corrected data at 0x131e
ORewrite recommended, internal ECC corrected data at 0x132e
ORewrite recommended, internal ECC corrected data at 0x1343
OOXRewrite recommended, internal ECC corrected data at 0x135e
OOORewrite recommended, internal ECC corrected data at 0x1397
OXRewrite recommended, internal ECC corrected data at 0x1399
OXRewrite recommended, internal ECC corrected data at 0x13a9
Rewrite recommended, internal ECC corrected data at 0x13b1
OXORewrite recommended, internal ECC corrected data at 0x13d0
OORewrite recommended, internal ECC corrected data at 0x13ef
OOOX
ORewrite recommended, internal ECC corrected data at 0x1434
Rewrite recommended, internal ECC corrected data at 0x1438
OOXRewrite recommended, internal ECC corrected data at 0x1463
ORewrite recommended, internal ECC corrected data at 0x1469
Rewrite recommended, internal ECC corrected data at 0x146b
OXRewrite recommended, internal ECC corrected data at 0x148a
OORewrite recommended, internal ECC corrected data at 0x14a2
Rewrite recommended, internal ECC corrected data at 0x14a4
Rewrite recommended, internal ECC corrected data at 0x14a7
ORewrite recommended, internal ECC corrected data at 0x14b3
OXRewrite recommended, internal ECC corrected data at 0x14c6
ORewrite recommended, internal ECC corrected data at 0x14d5
ORewrite recommended, internal ECC corrected data at 0x14ed
ORewrite recommended, internal ECC corrected data at 0x14f4
Rewrite recommended, internal ECC corrected data at 0x14f5
OXRewrite recommended, internal ECC corrected data at 0x1516
OXRewrite recommended, internal ECC corrected data at 0x1519
OORewrite recommended, internal ECC corrected data at 0x153c
OXXOORewrite recommended, internal ECC corrected data at 0x156c
ORewrite recommended, internal ECC corrected data at 0x157f
ORewrite recommended, internal ECC corrected data at 0x158a
Rewrite recommended, internal ECC corrected data at 0x1593
ORewrite recommended, internal ECC corrected data at 0x159a
Rewrite recommended, internal ECC corrected data at 0x159d
ORewrite recommended, internal ECC corrected data at 0x15ab
ORewrite recommended, internal ECC corrected data at 0x15b6
ORewrite recommended, internal ECC corrected data at 0x15cb
OXRewrite recommended, internal ECC corrected data at 0x15d5
Rewrite recommended, internal ECC corrected data at 0x15da
Rewrite recommended, internal ECC corrected data at 0x15dd
ORewrite recommended, internal ECC corrected data at 0x15e5
ORewrite recommended, internal ECC corrected data at 0x15f5
OOXOOOOORewrite recommended, internal ECC corrected data at 0x1676
OXOXORewrite recommended, internal ECC corrected data at 0x16a6
Rewrite recommended, internal ECC corrected data at 0x16ab
OOOXOXORewrite recommended, internal ECC corrected data at 0x16f7
Rewrite recommended, internal ECC corrected data at 0x1703
ORewrite recommended, internal ECC corrected data at 0x170e
ORewrite recommended, internal ECC corrected data at 0x171a
Rewrite recommended, internal ECC corrected data at 0x171c
ORewrite recommended, internal ECC corrected data at 0x1724
Rewrite recommended, internal ECC corrected data at 0x1727
OORewrite recommended, internal ECC corrected data at 0x174f
OXXRewrite recommended, internal ECC corrected data at 0x1759
OOORewrite recommended, internal ECC corrected data at 0x1785
Rewrite recommended, internal ECC corrected data at 0x178a
Rewrite recommended, internal ECC corrected data at 0x1793
OXRewrite recommended, internal ECC corrected data at 0x1798
Rewrite recommended, internal ECC corrected data at 0x17a3
Rewrite recommended, internal ECC corrected data at 0x17a4
OXRewrite recommended, internal ECC corrected data at 0x17ae
OORewrite recommended, internal ECC corrected data at 0x17cf
OXORewrite recommended, internal ECC corrected data at 0x17e9
Rewrite recommended, internal ECC corrected data at 0x17ec
ORewrite recommended, internal ECC corrected data at 0x1809
OXRewrite recommended, internal ECC corrected data at 0x180d
OOXXRewrite recommended, internal ECC corrected data at 0x1833
OXORewrite recommended, internal ECC corrected data at 0x1852
ORewrite recommended, internal ECC corrected data at 0x186f
OOXXXRewrite recommended, internal ECC corrected data at 0x188a
Rewrite recommended, internal ECC corrected data at 0x1893
OXXXXXXOXRewrite recommended, internal ECC corrected data at 0x18b0
OXXOXXXXXRewrite recommended, internal ECC corrected data at 0x18cb
OXOXXOXXORewrite recommended, internal ECC corrected data at 0x1912
Rewrite recommended, internal ECC corrected data at 0x1916
OXXXOOXXRewrite recommended, internal ECC corrected data at 0x1947
OXXOXIncorrect Data 2 EccResult: 303cff EccError: 3300c0 EccRead: 33c3f
 EBOOT_ReadFlash failed offset cac9ec
 EBOOT_ReadFlash failed location d0cb0000
ODeCompressFlash: CeCompressDecode() failed
 CeDecompressFlashBlock failed
****** Data record 133 corrupted, ABORT!!! ******

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x15264A8  Name="" Target=RAM
 Loading image 1 failed, trying next one
 Loading image 2 from memory at 0xD1600000
Rewrite recommended, internal ECC corrected data at 0x2c07
Rewrite recommended, internal ECC corrected data at 0x2c0e
O
BL_IMAGE_TYPE_BIN

X
XXXXXRewrite recommended, internal ECC corrected data at 0x2c13
Rewrite recommended, internal ECC corrected data at 0x2c13
ORewrite recommended, internal ECC corrected data at 0x2c2f
ORewrite recommended, internal ECC corrected data at 0x2c36
OOXXRewrite recommended, internal ECC corrected data at 0x2c5d
OORewrite recommended, internal ECC corrected data at 0x2c7d
Rewrite recommended, internal ECC corrected data at 0x2c85
ORewrite recommended, internal ECC corrected data at 0x2c8c
ORewrite recommended, internal ECC corrected data at 0x2c9c
Rewrite recommended, internal ECC corrected data at 0x2ca6
OORewrite recommended, internal ECC corrected data at 0x2cc2
Rewrite recommended, internal ECC corrected data at 0x2cc5
Rewrite recommended, internal ECC corrected data at 0x2cc8
ORewrite recommended, internal ECC corrected data at 0x2cda
OXRewrite recommended, internal ECC corrected data at 0x2ce3
Rewrite recommended, internal ECC corrected data at 0x2ce6
OXRewrite recommended, internal ECC corrected data at 0x2cec
Rewrite recommended, internal ECC corrected data at 0x2cf7
OORewrite recommended, internal ECC corrected data at 0x2d08
ORewrite recommended, internal ECC corrected data at 0x2d1c
ORewrite recommended, internal ECC corrected data at 0x2d2c
OORewrite recommended, internal ECC corrected data at 0x2d4d
Rewrite recommended, internal ECC corrected data at 0x2d51
Rewrite recommended, internal ECC corrected data at 0x2d54
ORewrite recommended, internal ECC corrected data at 0x2d5e
Rewrite recommended, internal ECC corrected data at 0x2d5f
Rewrite recommended, internal ECC corrected data at 0x2d63
Rewrite recommended, internal ECC corrected data at 0x2d68
OXRewrite recommended, internal ECC corrected data at 0x2d71
ORewrite recommended, internal ECC corrected data at 0x2d75
Rewrite recommended, internal ECC corrected data at 0x2d76
Rewrite recommended, internal ECC corrected data at 0x2d7b
OXRewrite recommended, internal ECC corrected data at 0x2d88
Rewrite recommended, internal ECC corrected data at 0x2d94
OXRewrite recommended, internal ECC corrected data at 0x2da2
OOORewrite recommended, internal ECC corrected data at 0x2dd0
OXXXRewrite recommended, internal ECC corrected data at 0x2dea
ORewrite recommended, internal ECC corrected data at 0x2df3
ORewrite recommended, internal ECC corrected data at 0x2e05
Rewrite recommended, internal ECC corrected data at 0x2e06
Rewrite recommended, internal ECC corrected data at 0x2e06
Rewrite recommended, internal ECC corrected data at 0x2e07
Rewrite recommended, internal ECC corrected data at 0x2e0a
Rewrite recommended, internal ECC corrected data at 0x2e0d
Rewrite recommended, internal ECC corrected data at 0x2e13
ORewrite recommended, internal ECC corrected data at 0x2e20
Rewrite recommended, internal ECC corrected data at 0x2e22
OOORewrite recommended, internal ECC corrected data at 0x2e5d
Rewrite recommended, internal ECC corrected data at 0x2e5e
ORewrite recommended, internal ECC corrected data at 0x2e60
Rewrite recommended, internal ECC corrected data at 0x2e61
Rewrite recommended, internal ECC corrected data at 0x2e66
Rewrite recommended, internal ECC corrected data at 0x2e71
ORewrite recommended, internal ECC corrected data at 0x2e78
OXRewrite recommended, internal ECC corrected data at 0x2e8c
Rewrite recommended, internal ECC corrected data at 0x2e8e
Rewrite recommended, internal ECC corrected data at 0x2e8f
Incorrect Data 1 EccResult: a96996 EccError: f0fc0 EccRead: a66656
 EBOOT_ReadFlash failed offset 1740fc1
 EBOOT_ReadFlash failed location d1746000
ORewrite recommended, internal ECC corrected data at 0x2e8c
Rewrite recommended, internal ECC corrected data at 0x2e8e
Rewrite recommended, internal ECC corrected data at 0x2e8f
Incorrect Data 1 EccResult: a96996 EccError: f0fc0 EccRead: a66656
 EBOOT_ReadFlash failed
Block length: 0x34b6b  is larger than 0x10000
 CeDecompressFlashBlock failed
****** Data record 17 corrupted, ABORT!!! ******

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x15264A8  Name="" Target=RAM
 Loading image 2 failed, trying next one
 All images failed

Thor-Arne · « **Reply #3390 on:** December 26, 2024, 12:30:03 pm »

This is very similar to my problem on a DSOX-2012A, looks like mine is getting a bit further.

If you figure out something, please let us know.

PioB · « **Reply #3391 on:** December 26, 2024, 02:00:10 pm »

Interesting side note: Before I forgot to put the memory stick in the oscilloscope and hit "go 0x00362000"
The oscilloscope booted up to the regular screen "System concerns detected: OS version not correct. Please reload system firmware". But the keyboard/buttons are not working, so I cannot try and recover the firmware from the usb stick via the normal update mechanism. It doesn't react to anything. Back to trying to load it via serial...

BillCRM · « **Reply #3392 on:** December 26, 2024, 02:52:08 pm »

Quote from: PioB on December 26, 2024, 02:00:10 pm

Interesting side note: Before I forgot to put the memory stick in the oscilloscope and hit "go 0x00362000"
The oscilloscope booted up to the regular screen "System concerns detected: OS version not correct. Please reload system firmware". But the keyboard/buttons are not working, so I cannot try and recover the firmware from the usb stick via the normal update mechanism. It doesn't react to anything. Back to trying to load it via serial...

I believe you just need to wait a little more, some error is acceptable.

This is the console message I recorded.

Code: [Select]

U-Boot 2010.03 (Jan 26 2011 - 12:37:34)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0
p500> loady 0x0361000 115200
## Ready for binary (ymodem) download to 0x00361000 at 115200 bps...
CCxyzModem - CRC mode, 1(SOH)/19482(STX)/0(CAN) packets, 3 retries
## Total Size      = 0x013064d4 = 19948756 Bytes
p500> go 0x00362000
## Starting application at 0x00362000 ...
Windows CE Kernel for ARM (Thumb Enabled) Built on Jan 24 2013 at 14:52:37
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Jun 18 2013)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\GPIO\.\sh600                                                                                                             _gpio_hw.cpp line 170: GPB driver, RegQueryDword('ISTPriority') failed, status:2
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\GPIO\.\sh600                                                                                                             _gpio_hw.cpp line 170: GPB driver, RegQueryDword('ISTPriority') failed, status:2
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 00:30:D3:20:57:C8
Phy found addr 31 (ticks=2578)
WaitForLink Start (ticks=2579)
No Link (ticks=3582)
<--EDeviceInitialize

GMAC DMA status register = 0x0
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Running infiniiVisionInstallHelper
ERROR: OALIoCtlHalGetDeviceInfo: Device doesn't support IOCTL_HAL_GET_DEVICE_INF                                                                                                             O::SPI_GETBOOTMENAME
Failed to start/configure network.
Time for NANDFLASH to load: 0 ms.
Time for SNANDFLASH to load: 0 ms.
Starting ProcessStartupFolder
ProcessStartupFolder: \usb\Startup\
                                   running \usb\Startup\infiniivision.lnk...
Ending ProcessStartupFolder
                           Our command line is
Performing Startup

      creating \Agilent Flash\wfmMem\
      creating \Agilent Flash\LxiMdns\Released build, Jun 18 2013, 12:31:00
Initializing FPGA...
****
FPGA Type: Wyoming
Ver: 1.087 Released
Build Time: Wed Jan 04 19:40:06 2012
Build Machine: DW3647M2
****
No option module detected
Keyboard firmware version 32... ok
Keyboard Info: Board id 1, Board rev 3
Keyboard Info: Board id 1, Board rev 3
Startup sequence is complete.
System has been running 109.374260 seconds
Start Up Sequence 90.829385
Memory Load 55%
   System Physical Memory 43.063 / 79.086 MB
   Process Virtual Memory 50.500 / 1024.000 MB
-----> InfiniiVision is running <-----

PioB · « **Reply #3393 on:** December 26, 2024, 02:54:33 pm »

Oh that message appeared on the screen, the terminal also gave me "infiniivision is running" but no buttons on the front panel or encoders reacted to me clicking/turning them. (and a reboot was back to just lighting up the first four or five LEDs and then stopping)

Bud · « **Reply #3394 on:** December 26, 2024, 04:01:36 pm »

Here is another informative post outside of EEVBlog. Check what the guy is saying about identifying the right firmware version, veryfying Ymodem uploaded properly, and folder structure on the USB drive.

https://salvagedcircuitry.com/2000a-nand-recovery.html

PioB · « **Reply #3395 on:** December 26, 2024, 06:35:53 pm »

Thanks, I just saw that I forgot to put the folder "Secure" on the stick too and rectified that, but it's still not booting.
The correct firmware to use on my scope _is_ 2.41 as established by salvaged circuits.*

Does anyone have a zip file of the memory stick for 2.41 by any chance so I can try and boot some working stick? (I tried with two different cables, a genuine 3V3 FTDI and a PL2101, that didn't make any difference in the process).

*"Completed file(s):
-------------------------------------------------------------------------------

: Address=0x80361000 Length=0x15264A8 Name="" Target=RAM"

PioB · « **Reply #3396 on:** December 26, 2024, 08:26:30 pm »

Thank you very much!

It worked now. I could start and install the 2.41 cab.
I then installed the 2.60 ksx and that booted fine. So now I don't need to fear any nand corruption anymore.
Next step is reading the posts on enabling all the options.

Code: [Select]

 tree
Folder PATH listing for volume IST AG
Volume serial number is 1CB5-AFB6
D:.
├───help
├───Startup
├───Temp
└───Secure
    ├───help
    ├───infiniiVision
    │   ├───fpga
    │   ├───upgrade
    │   └───web
    │       ├───css
    │       ├───help
    │       ├───image
    │       ├───include
    │       │   └───web-socket-js
    │       ├───lib
    │       ├───Lxi
    │       │   └───Identification
    │       └───navbar
    └───Startup
PS D:\> more .\Startup\infiniivision.lnk
51#\usb\Secure\infiniiVision\infiniivisionLauncher.exe
PS D:\> more .\infiniivisionStartupOverride.txt
True

Bud · « **Reply #3397 on:** December 26, 2024, 09:22:52 pm »

Great!

maurit · « **Reply #3398 on:** December 27, 2024, 02:56:10 pm »

Good morning,
if you are interested I have some DSOX-Lan cards left with 3D printed frames.
As in the pictures.
I sell for 40 Euros + shipping.
Or: https://www.ebay.it/itm/326294298586
I ship from Italy.
maurinot AT libero DOT it

PioB · « **Reply #3399 on:** December 28, 2024, 01:31:29 pm »

So I am trying to learn, but seem to be at the bottom of a huge mountain. If some experienced mountain guide could point me (to) the path to learning more about reverse engineering

I opened nk.bin from 2.42 in ghidra (Arm cortex little endian) and went to the address* 0x00FBC7FF
But unfortunately it seems like I forgot to set a switch because there seems to be nothing that makes these four bytes stand out, no "found a function" or "array=..." around these. If I search for the same four bytes in firmware 2.66, I find >500 hits and ghidra tells me that is quite enough, thank you very much.
So how do I identify the correct position where to replace the one byte? A bit above, there was mention of "record 17x" or so, but I haven't seen a reference to that (in ghidra) that I am able to identify.

Did I open the file wrongly and everything would be clear with the correct architecture chosen or am I overlooking something else fundamental?
Thank you very much for any hints.

Once I understood how it's done in 2.42 which is documented with the address, I'll try 2.66 for this DSOX2000 (and if that works, there's my 3000T waiting

)

*" There 4 bytes for patch "04 00 a0 e1" to "00 00 a0 e3" in start address FBC7FFh and checksum in address D40457h changed from "EB" to "E9". Actually checksum contain 4 bytes, but changed only this last byte (first in file as it's little endian). Checksum algorithm is UByte8bit.
" Post by Safar July 27 2017


EEVblog Main Site	EEVblog on Youtube	EEVblog on Twitter	EEVblog on Facebook	EEVblog on Odysee

Author Topic: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ? (Read 1356058 times)

Share me