Author Topic: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ? (Read 1378103 times)

tabajaralabs · « **Reply #3500 on:** April 10, 2025, 11:47:08 pm »

Quote from: analogRF on April 10, 2025, 08:46:46 pm

this is way too early in the boot process. even pboot has not started, forget about WinCE and nk.nb0 and all of that.
To me looks like either a RAM issue or NOR flash.
i think there was a dump of NOR flash somewhere in the forum but I dont have it

does it stop there every time you power on? or does it go further randomly sometimes?

Unfortunately, stops every time
This must not be a RAM issue because it worked before. Yesterday I bricked the scope trying to update it. I selected a wrong file and goodbye scope.
The bad part is that this scope isn't mine. I gotta save it at all costs.

The NOR flash dump, I have it here. A nice user sent it to me. But how to load it in NOR memory? I still haven't found a way to do that.

onesystem · « **Reply #3501 on:** April 11, 2025, 12:52:19 am »

Looks like this post has somewhat of a hint on how to flash NOR... Check in that area and see if it leads you anywhere good.

Quote from: tv84 on November 10, 2021, 05:04:47 pm

Mine was a pure 3000A.

But without any previous erasures...

Since sajsoni provided his MAC address, here is a FULL dump of the NOR mem for sajsoni to flash.

This includes all the bootloaders and the env. vars and the correct MAC address, as taken from a 3000A dump.

I think it can't get any simpler. Use the SPEAR600 app to flash only this file from offset 0.

analogRF · « **Reply #3502 on:** April 11, 2025, 01:18:11 am »

Quote from: tabajaralabs on April 10, 2025, 11:47:08 pm

Quote from: analogRF on April 10, 2025, 08:46:46 pm
this is way too early in the boot process. even pboot has not started, forget about WinCE and nk.nb0 and all of that.
To me looks like either a RAM issue or NOR flash.
i think there was a dump of NOR flash somewhere in the forum but I dont have it

does it stop there every time you power on? or does it go further randomly sometimes?

Unfortunately, stops every time
This must not be a RAM issue because it worked before. Yesterday I bricked the scope trying to update it. I selected a wrong file and goodbye scope.
The bad part is that this scope isn't mine. I gotta save it at all costs.

The NOR flash dump, I have it here. A nice user sent it to me. But how to load it in NOR memory? I still haven't found a way to do that.

if you have a .bin dump just desolder the chip and program it. that's what I'd do.

all bootloaders (uboot,pboot,xboot) are included in the FW file but I dont think you can construct the correct NOR flash image just by having those 3 files.
you need to have a clone image of the flash

Bud · « **Reply #3503 on:** April 11, 2025, 02:05:57 am »

Quote from: analogRF on April 11, 2025, 01:18:11 am

all bootloaders (uboot,pboot,xboot) are included in the FW file but I dont think you can construct the correct NOR flash image just by having those 3 files.

I think you can, see this post
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg3801974/#msg3801974

Bud · « **Reply #3504 on:** April 11, 2025, 02:08:00 am »

Quote from: tabajaralabs on April 10, 2025, 11:47:08 pm

The NOR flash dump, I have it here. A nice user sent it to me. But how to load it in NOR memory? I still haven't found a way to do that.

You can do it using ST Spear600 Flasher Utility through the USB port, should still be available on ST web site.

Bud · « **Reply #3505 on:** April 11, 2025, 02:22:20 am »

Quote from: tabajaralabs on April 10, 2025, 08:38:14 pm

Quote
U-Boot 2010.03 (Sep 09 2010 - 14:47:56)Agilent P500

CPU: SPEAr600
DRAM: 128 MiB
Flash: 512 KiB
NAND: 128 MiB
In: serial
Out: serial
Err: serial
SerNum:serial number not programmed
Chip: BD Board Rev: 4
Net: smsc

And the scope locks up.

I think you have a problem with FPGA initialization. After Net: smsc the scope tries to initialize the FPGA, and maybe failing because never even getting to it due to corrupt NOR or other reason. My this guess is also consistent with where boot stops when you trying to boot manually from USB port.
You should probably go ahead with flashing the NOR by either desoldering and using a programmer or in-place using ST Flasher Util. Normally if FPGA programming failed there is a message in the log saying this.

Bud · « **Reply #3506 on:** April 11, 2025, 02:30:28 am »

I showed here how to check FPGA image, before getting to reflashing the NOR. Also read the posts after it on that page.
https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/msg5746541/#msg5746541

It was for the 1000 scope but should work for 2000, just use the right FPGA image length.

analogRF · « **Reply #3507 on:** April 11, 2025, 02:42:57 am »

Quote from: Bud on April 11, 2025, 02:22:20 am

Quote from: tabajaralabs on April 10, 2025, 08:38:14 pm
Quote
U-Boot 2010.03 (Sep 09 2010 - 14:47:56)Agilent P500

CPU: SPEAr600
DRAM: 128 MiB
Flash: 512 KiB
NAND: 128 MiB
In: serial
Out: serial
Err: serial
SerNum:serial number not programmed
Chip: BD Board Rev: 4
Net: smsc

And the scope locks up.

I think you have a problem with FPGA initialization. After Net: smsc the scope tries to initialize the FPGA, and maybe failing because never even getting to it due to corrupt NOR or other reason. My this guess is also consistent with where boot stops when you trying to boot manually from USB port.
You should probably go ahead with flashing the NOR by either desoldering and using a programmer or in-place using ST Flasher Util. Normally if FPGA programming failed there is a message in the log saying this.

yes from his other longer boot log I suspected the FPGA but in the normal UART boot log there is no message about FPGA yet
and FPGA failure normally does not stop the boot at that point. It goes on further and you can even stop autoboot and get into prompt and program the FPGA manually from a good copy and then proceed to normal recovery procedure. In his case there is still no message about FPGA and the process stops that's why I think Flash is more likely
But you are right this stopping point is just before the FPGA programming being done.

tabajaralabs · « **Reply #3508 on:** April 11, 2025, 02:59:16 am »

Quote

I think you have a problem with FPGA initialization. After Net: smsc the scope tries to initialize the FPGA, and maybe failing because never even getting to it due to corrupt NOR or other reason. My this guess is also consistent with where boot stops when you trying to boot manually from USB port.
You should probably go ahead with flashing the NOR by either desoldering and using a programmer or in-place using ST Flasher Util. Normally if FPGA programming failed there is a message in the log saying this.

Ok, reloaded the FPGA code with the FPGA2000A.BIN file. Size was the same.
Now boot works like this:

Quote

Windows CE Kernel for ARM (Thumb Enabled) Built on Jun 16 2009 at 10:08:15
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Jan 13 2011)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000 size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
Exception 'Data Abort'(4) Thread-Id=00570002(pth=87fdd9cc) PC=8036b6fc BVA=00000
003, dwInfo = 00000001
R0=84973960 R1=000006a0 R2=815a6a60 R3=00000020
R4=00001000 R5=84973000 R6=00000004 R7=815a6a60
R8=815a6238 R9=00000000 R10=00000000 R11=00000000
R12=00000000 SP=d00afe44 Lr=8036b45c Psr=2000001f
Exception 'Data Abort'(4) Thread-Id=00570002(pth=ffffc65c) PC=8038dc10 BVA=00000
003, dwInfo = 00000001
R0=815aa520 R1=00000001 R2=ffffffff R3=815aa468
R4=03f3f000 R5=83f3f000 R6=83f3f000 R7=d00afe64
R8=d00afe60 R9=00000000 R10=00000000 R11=00000000
R12=8038db98 SP=ffffc7ac Lr=8038dbec Psr=80000013
Exception 'Data Abort' (4): Thread-Id=00570002(pth=87fdd9cc), Proc-Id=00400002(p
prc=815a8308) 'NK.EXE', VM-active=01e00002(pprc=87f53000) 'udevice.exe'
PC=8038dc10(kernel.dll+0x0001bc10) RA=8038dbec(kernel.dll+0x0001bbec) SP=ffffc7a
c, BVA=00000000
Exception 'Data Abort'(4) Thread-Id=014c0002(pth=87f76000) PC=8038fd64 BVA=00000
003, dwInfo = 00000001
R0=00000000 R1=87f76000 R2=6000001f R3=ffffc800
R4=815aa704 R5=7fff0000 R6=00000000 R7=00000000
R8=00100000 R9=d02be740 R10=d0292980 R11=00000000
R12=8038fd64 SP=d02be4e4 Lr=8038fd64 Psr=6000001f
Exception 'Data Abort'(4) Thread-Id=014c0002(pth=ffffc46c) PC=8038d5d0 BVA=00000
003, dwInfo = 00000001
R0=83f3f000 R1=00000001 R2=ffffffff R3=815aa468
R4=83f3f000 R5=00000000 R6=00000001 R7=815aa704
R8=d05726a0 R9=00000001 R10=00000004 R11=00000000
R12=8038d504 SP=ffffc5bc Lr=ffffc800 Psr=80000013
Exception 'Data Abort' (4): Thread-Id=014c0002(pth=87f76000), Proc-Id=00400002(p
prc=815a8308) 'NK.EXE', VM-active=00400002(pprc=815a8308) 'NK.EXE'
PC=8038d5d0(kernel.dll+0x0001b5d0) RA=ffffc800(+0xffffc800) SP=ffffc5bc, BVA=
00000000
Exception 'Data Abort'(4) Thread-Id=00f30006(pth=8694a9e4) PC=8038fd64 BVA=00000
003, dwInfo = 00000001
R0=00000000 R1=8694a9e4 R2=6000001f R3=ffffc800
R4=815aa704 R5=7fff0000 R6=00000001 R7=0000fffe
R8=00000001 R9=002a0000 R10=00000000 R11=00000000
R12=8038fd64 SP=d072fe20 Lr=8038fd64 Psr=6000001f
Exception 'Data Abort'(4) Thread-Id=00f30006(pth=ffffc27c) PC=8038d5d0 BVA=00000
003, dwInfo = 00000001
R0=83f3f000 R1=00000001 R2=ffffffff R3=815aa468
R4=83f3f000 R5=00000000 R6=00000001 R7=815aa704
R8=00000000 R9=00000001 R10=00000000 R11=00000000
R12=8038d504 SP=ffffc3cc Lr=ffffc800 Psr=80000013
Exception 'Data Abort' (4): Thread-Id=00f30006(pth=8694a9e4), Proc-Id=00400002(p
prc=815a8308) 'NK.EXE', VM-active=00400002(pprc=815a8308) 'NK.EXE'
PC=8038d5d0(kernel.dll+0x0001b5d0) RA=ffffc800(+0xffffc800) SP=ffffc3cc, BVA=
00000000

I *STILL* cannot boot automatically. If I turn off and on the scope, the same happens:

Quote

U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU: SPEAr600
DRAM: 128 MiB
Flash: 512 KiB
NAND: fsmc-ecc1 128 MiB
In: serial
Out: serial
Err: serial
SerNum:serial number not programmed
Chip: BD Board Rev: 4
Net: smsc

Then, if I go to the USB serial channel and type BOOT, the boot starts and stops on these lots of exception errors.

Did I went forward?

Thanks you all for all the support, recovering this scope is VERY important to me

tabajaralabs · « **Reply #3509 on:** April 11, 2025, 03:04:47 am »

If I load NK.NB0 via
TFTPBOOT 0x0361000 NK.NB0
GO 0x0362000

I get the following result

Quote

Windows CE Kernel for ARM (Thumb Enabled) Built on Mar 8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Jan 23 2024)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000 size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200 (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
Exception 'Data Abort'(4) Thread-Id=00580002(pth=87fdaa8c) PC=80378630 BVA=00000
003, dwInfo = 00000001
R0=849af730 R1=00000000 R2=00000000 R3=00000000
R4=849af000 R5=81e3a454 R6=81e3a624 R7=00000000
R8=00000000 R9=00000000 R10=00000000 R11=00000000
R12=00000000 SP=d00afe60 Lr=8038e4e0 Psr=0000001f
Exception 'Data Abort'(4) Thread-Id=00580002(pth=ffffc654) PC=8038e468 BVA=00000
003, dwInfo = 00000001
R0=81e3a520 R1=00000001 R2=ffffffff R3=81e3a468
R4=03f44000 R5=83f44000 R6=83f44000 R7=d00afe60
R8=d00afe64 R9=00000000 R10=00000000 R11=00000000
R12=8038e3f0 SP=ffffc7a4 Lr=8038e444 Psr=80000013
Exception 'Data Abort' (4): Thread-Id=00580002(pth=87fdaa8c), Proc-Id=00400002(p
prc=81e38308) 'NK.EXE', VM-active=018c0002(pprc=87fc8eac) 'udevice.exe'
PC=8038e468(kernel.dll+0x0001c468) RA=8038e444(kernel.dll+0x0001c444) SP=ffffc7a
4, BVA=00000000
Exception 'Data Abort'(4) Thread-Id=00580002(pth=87fdaa8c) PC=8038e9f4 BVA=00000
003, dwInfo = 00000001
R0=00000001 R1=00000000 R2=000061af R3=81e4006e
R4=00000037 R5=81e3a520 R6=00003fff R7=81e38010
R8=00000004 R9=ffffffff R10=81e38308 R11=000000fb
R12=00580003 SP=ffffbd10 Lr=8038e9a8 Psr=8000001f
Exception 'Data Abort'(4) Thread-Id=00580002(pth=ffffc464) PC=8038de34 BVA=00000
003, dwInfo = 00000001
R0=83f44000 R1=00000001 R2=ffffffff R3=81e3a468
R4=83f44000 R5=00000000 R6=00000001 R7=81e3a704
R8=84c5cb80 R9=00000001 R10=81e38308 R11=81e39dd0
R12=8038dd68 SP=ffffc5b4 Lr=ffffc800 Psr=80000013
Exception 'Data Abort' (4): Thread-Id=00580002(pth=87fdaa8c), Proc-Id=00400002(p
prc=81e38308) 'NK.EXE', VM-active=018c0002(pprc=87fc8eac) 'udevice.exe'
PC=8038de34(kernel.dll+0x0001be34) RA=ffffc800(+0xffffc800) SP=ffffc5b4, BVA=
00000000
Exception 'Data Abort'(4) Thread-Id=00580002(pth=87fdaa8c) PC=80386228 BVA=00000
030, dwInfo = 00000007
R0=00000000 R1=00000000 R2=0000001b R3=0000000b
R4=00000004 R5=81e3a704 R6=81e38308 R7=00000001
R8=00000003 R9=81e3a704 R10=04eb0000 R11=83080000
R12=00580003 SP=ffffc194 Lr=80386228 Psr=4000001f
Exception 'Data Abort'(4) Thread-Id=00580002(pth=87fdaa8c) PC=80386228 BVA=00000
030, dwInfo = 00000007
R0=00000000 R1=00000000 R2=0000001b R3=0000000b
R4=00000004 R5=81e3a704 R6=81e38308 R7=00000001
R8=00000003 R9=81e3a704 R10=04eb0000 R11=83080000
R12=00580003 SP=ffffc194 Lr=80386228 Psr=4000001f
Exception 'Data Abort'(4) Thread-Id=00580002(pth=87fdaa8c) PC=803789e4 BVA=00000
057, dwInfo = 00000007
R0=00000000 R1=00000000 R2=0000001b R3=0000000b
R4=00000004 R5=81e3a704 R6=81e38308 R7=00000001
R8=00000003 R9=81e3a704 R10=04eb0000 R11=83080000
R12=00580003 SP=ffffc104 Lr=80386228 Psr=4000001f
Exception 'Data Abort'(4) Thread-Id=00580002(pth=ffffc26c) PC=8037fbd8 BVA=00000
057, dwInfo = 00000007
R0=87f7c444 R1=ffffc800 R2=00000004 R3=00000000
R4=87f7c444 R5=81e3a704 R6=81e3a660 R7=00000000
R8=00000001 R9=81e3a704 R10=04eb0000 R11=83080000
R12=00000000 SP=ffffc3bc Lr=8037600c Psr=60000013
Exception 'Data Abort'(4) Thread-Id=00580002(pth=87fdaa8c) PC=803789e4 BVA=00000
024, dwInfo = 00000007
R0=00000000 R1=00000000 R2=0000001b R3=0000000b
R4=00000004 R5=81e3a704 R6=81e38308 R7=00000001
R8=00000003 R9=81e3a704 R10=04eb0000 R11=83080000
R12=00580003 SP=ffffc104 Lr=80386228 Psr=4000001f
Exception 'Data Abort'(4) Thread-Id=00580002(pth=ffffc000) PC=8037ea4c BVA=00000
024, dwInfo = 00000007
R0=00000004 R1=00000000 R2=87fffe98 R3=00000004
R4=8037600c R5=00000004 R6=87fdaa8c R7=81e3a4b8
R8=00000000 R9=ffffc800 R10=ffffc1e8 R11=8037fbd8
R12=00580003 SP=ffffc150 Lr=8037ea34 Psr=60000013
Exception 'Data Abort'(4) Thread-Id=00580002(pth=87fdaa8c) PC=803789e4 BVA=00000
024, dwInfo = 00000007
R0=00000000 R1=00000000 R2=0000001b R3=0000000b
R4=00000004 R5=81e3a704 R6=81e38308 R7=00000001
R8=00000003 R9=81e3a704 R10=04eb0000 R11=83080000
R12=00580003 SP=ffffc104 Lr=80386228 Psr=4000001f
Exception 'Data Abort'(4) Thread-Id=00580002(pth=ffffbd94) PC=8037ea4c BVA=00000
024, dwInfo = 00000007
R0=00000004 R1=00000000 R2=87fffe98 R3=00000004
R4=8037ea34 R5=00000004 R6=87fdaa8c R7=81e3a4b8
R8=00000000 R9=ffffc800 R10=ffffbf7c R11=8037ea4c
R12=00580003 SP=ffffbee4 Lr=8037ea34 Psr=60000013
Exception 'Data Abort'(4) Thread-Id=00580002(pth=87fdaa8c) PC=803789e4 BVA=00000
024, dwInfo = 00000007
R0=00000000 R1=00000000 R2=0000001b R3=0000000b
R4=00000004 R5=81e3a704 R6=81e38308 R7=00000001
R8=00000003 R9=81e3a704 R10=04eb0000 R11=83080000
R12=00580003 SP=ffffc104 Lr=80386228 Psr=4000001f
Exception 'Data Abort'(4) Thread-Id=00580002(pth=ffffbb28) PC=8037ea4c BVA=00000
024, dwInfo = 00000007
R0=00000004 R1=00000000 R2=87fffe98 R3=00000004
R4=8037ea34 R5=00000004 R6=87fdaa8c R7=81e3a4b8
R8=00000000 R9=ffffc800 R10=ffffbd10 R11=8037ea4c
R12=00580003 SP=ffffbc78 Lr=8037ea34 Psr=60000013
Exception 'Data Abort'(4) Thread-Id=00580002(pth=87fdaa8c) PC=803789e4 BVA=00000
024, dwInfo = 00000007
R0=00000000 R1=00000000 R2=0000001b R3=0000000b
R4=00000004 R5=81e3a704 R6=81e38308 R7=00000001
R8=00000003 R9=81e3a704 R10=04eb0000 R11=83080000
R12=00580003 SP=ffffc104 Lr=80386228 Psr=4000001f
Exception 'Data Abort'(4) Thread-Id=00580002(pth=ffffb8bc) PC=8037ea4c BVA=00000
024, dwInfo = 00000007
R0=00000004 R1=00000000 R2=87fffe98 R3=00000004
R4=8037ea34 R5=00000004 R6=87fdaa8c R7=81e3a4b8
R8=00000000 R9=ffffc800 R10=ffffbaa4 R11=8037ea4c
R12=00580003 SP=ffffba0c Lr=8037ea34 Psr=60000013
Exception 'Data Abort'(4) Thread-Id=00580002(pth=87fdaa8c) PC=803789e4 BVA=00000
024, dwInfo = 00000007
R0=00000000 R1=00000000 R2=0000001b R3=0000000b
R4=00000004 R5=81e3a704 R6=81e38308 R7=00000001
R8=00000003 R9=81e3a704 R10=04eb0000 R11=83080000
R12=00580003 SP=ffffc104 Lr=80386228 Psr=4000001f
Exception 'Data Abort'(4) Thread-Id=00580002(pth=ffffb650) PC=8037ea4c BVA=00000
024, dwInfo = 00000007
R0=00000004 R1=00000000 R2=87fffe98 R3=00000004
R4=8037ea34 R5=00000004 R6=87fdaa8c R7=81e3a4b8
R8=00000000 R9=ffffc800 R10=ffffb838 R11=8037ea4c
R12=00580003 SP=ffffb7a0 Lr=8037ea34 Psr=60000013
Exception 'Data Abort'(4) Thread-Id=00580002(pth=87fdaa8c) PC=803789e4 BVA=00000
024, dwInfo = 00000007
R0=00000000 R1=00000000 R2=0000001b R3=0000000b
R4=00000004 R5=81e3a704 R6=81e38308 R7=00000001
R8=00000003 R9=81e3a704 R10=04eb0000 R11=83080000
R12=00580003 SP=ffffc104 Lr=80386228 Psr=4000001f
Exception 'Data Abort'(4) Thread-Id=00580002(pth=ffffb3e4) PC=8037ea4c BVA=00000
024, dwInfo = 00000007
R0=00000004 R1=00000000 R2=87fffe98 R3=00000004
R4=8037ea34 R5=00000004 R6=87fdaa8c R7=81e3a4b8
R8=00000000 R9=ffffc800 R10=ffffb5cc R11=8037ea4c
R12=00580003 SP=ffffb534 Lr=8037ea34 Psr=60000013
ExceptException 'Data Abort'(4) Thread-Id=00580002(pth=87fdaa8c) PC=803789e4 BVA
=ffff105c, dwInfo = 00000007
R0=00000000 R1=00000000 R2=0000001b R3=0000000b
R4=00000004 R5=81e3a704 R6=81e38308 R7=00000001
R8=00000003 R9=81e3a704 R10=04eb0000 R11=83080000
R12=00580003 SP=ffffc104 Lr=80386228 Psr=4000001f
Exception 'Data Abort'(4) Thread-Id=00580002(pth=ffff0e98) PC=80378484 BVA=ffff1
05c, dwInfo = 00000007
R0=ffff105c R1=00000004 R2=60000093 R3=ffffc800
R4=81e36ae0 R5=000001af R6=00000000 R7=00000001
R8=81e366ac R9=81e36724 R10=000001af R11=80368b00
R12=8037dfbc SP=ffff0fe8 Lr=8036bf54 Psr=60000093
Exception 'Data Abort'(4) Thread-Id=00580002(pth=87fdaa8c) PC=803789e4 BVA=00000
024, dwInfo = 00000007
R0=00000000 R1=00000000 R2=0000001b R3=0000000b
R4=00000004 R5=81e3a704 R6=81e38308 R7=00000001
R8=00000003 R9=81e3a704 R10=04eb0000 R11=83080000
R12=00580003 SP=ffffc104 Lr=80386228 Psr=4000001f
Exception 'Data Abort'(4) Thread-Id=00580002(pth=ffff0c2c) PC=8037ea4c BVA=00000
024, dwInfo = 00000007
R0=00000004 R1=00000000 R2=803736f8 R3=00000004
R4=8036bf54 R5=00000004 R6=87fdaa8c R7=81e3a4b8
R8=00000000 R9=ffffc800 R10=ffff0e14 R11=80378484
R12=00580003 SP=ffff0d7c Lr=8037ea34 Psr=60000093
Exception 'Data Abort'(4) Thread-Id=00580002(pth=87fdaa8c) PC=803789e4 BVA=00000
024, dwInfo = 00000007
R0=00000000 R1=00000000 R2=0000001b R3=0000000b
R4=00000004 R5=81e3a704 R6=81e38308 R7=00000001
R8=00000003 R9=81e3a704 R10=04eb0000 R11=83080000
R12=00580003 SP=ffffc104 Lr=80386228 Psr=4000001f
Exception 'Data Abort'(4) Thread-Id=00580002(pth=ffff09c0) PC=8037ea4c BVA=00000
024, dwInfo = 00000007
R0=00000004 R1=00000000 R2=87fffe98 R3=00000004
R4=8037ea34 R5=00000004 R6=87fdaa8c R7=81e3a4b8
R8=00000000 R9=ffffc800 R10=ffff0ba8 R11=8037ea4c
R12=00580003 SP=ffff0b10 Lr=8037ea34 Psr=60000093
Exception 'Data Abort'(4) Thread-Id=00580002(pth=87fdaa8c) PC=803789e4 BVA=00000
024, dwInfo = 00000007
R0=00000000 R1=00000000 R2=0000001b R3=0000000b
R4=00000004 R5=81e3a704 R6=81e38308 R7=00000001
R8=00000003 R9=81e3a704 R10=04eb0000 R11=83080000
R12=00580003 SP=ffffc104 Lr=80386228 Psr=4000001f
Exception 'Data Abort'(4) Thread-Id=00580002(pth=ffff0754) PC=8037ea4c BVA=00000
024, dwInfo = 00000007
R0=00000004 R1=00000000 R2=87fffe98 R3=00000004
R4=8037ea34 R5=00000004 R6=87fdaa8c R7=81e3a4b8
R8=00000000 R9=ffffc800 R10=ffff093c R11=8037ea4c
R12=00580003 SP=ffff08a4 Lr=8037ea34 Psr=60000093
Exception 'Data Abort'(4) Thread-Id=00580002(pth=87fdaa8c) PC=803789e4 BVA=00000
024, dwInfo = 00000007
R0=00000000 R1=00000000 R2=0000001b R3=0000000b
R4=00000004 R5=81e3a704 R6=81e38308 R7=00000001
R8=00000003 R9=81e3a704 R10=04eb0000 R11=83080000
R12=00580003 SP=ffffc104 Lr=80386228 Psr=4000001f
Exception 'Data Abort'(4) Thread-Id=00580002(pth=ffff04e8) PC=8037ea4c BVA=00000
024, dwInfo = 00000007
R0=00000004 R1=00000000 R2=87fffe98 R3=00000004
R4=8037ea34 R5=00000004 R6=87fdaa8c R7=81e3a4b8
R8=00000000 R9=ffffc800 R10=ffff06d0 R11=8037ea4c
R12=00580003 SP=ffff0638 Lr=8037ea34 Psr=60000093

Please note where the exceptions begins... OHCI/System.c - USB initialization. Maybe a problemm with the pendrive I made? Of course, I got a NEW 4GB Pen Drive from Sandisk, same error. Maybe the structure is somewhat wrong? I did it just like https://salvagedcircuitry.com/2000a-nand-recovery.html site

UPDATE: If I plug the USB pen drive off, no errors beyond the OHCI\System.C lines:

Quote

Windows CE Kernel for ARM (Thumb Enabled) Built on Mar 8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Jan 23 2024)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000 size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200 (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 00:30:D3:14:9C:AE
Phy found addr 31 (ticks=3199)
WaitForLink Start (ticks=3201)
Link Detected (ticks=3203)

GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
Flushed Transmit Buffer
phyCfg->dwSpeed 0x64
phyCfg->bFullDuplex 0x1
<--EDeviceInitialize

GMAC DMA status register = 0x600004
GMAC Device enable interrupt
DriverStart
GMAC Device enable interrupt
LIN: Data Valid
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.

Bud · « **Reply #3510 on:** April 11, 2025, 05:20:44 am »

Man, i am totally lost with you starting the scope and getting something on the UART port, then switching to USB serial to type "boot", and with some USB pen drive plugged in (to where?). Can you get rid of the damn pen drive and just stick to normal boot, i also having problems understanding why you are using the internal UART and USB at the same time. What is going on here?

Bud · « **Reply #3511 on:** April 11, 2025, 05:30:53 am »

Quote from: tabajaralabs on April 11, 2025, 02:59:16 am

Ok, reloaded the FPGA code with the FPGA2000A.BIN file. Size was the same.

How did you reload? What does that mean size was the same, the same as what?

tabajaralabs · « **Reply #3512 on:** April 11, 2025, 08:22:21 am »

Quote from: Bud on April 11, 2025, 05:20:44 am

Man, i am totally lost with you starting the scope and getting something on the UART port, then switching to USB serial to type "boot", and with some USB pen drive plugged in (to where?). Can you get rid of the damn pen drive and just stick to normal boot, i also having problems understanding why you are using the internal UART and USB at the same time. What is going on here?

Ok, sorry. Here we go.
Internal UART, turn the scope on:

Quote

U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU: SPEAr600
DRAM: 128 MiB
Flash: 512 KiB
NAND: fsmc-ecc1 128 MiB
In: serial
Out: serial
Err: serial
SerNum:serial number not programmed
Chip: BD Board Rev: 4
Net: smsc

No prompt, no nothing. This is what appears, I can do nothing beyond that. If I turn it off, on again, that is what happens.

Bud · « **Reply #3513 on:** April 11, 2025, 12:30:26 pm »

And then input/output switches itself to the USB port? Is this why you from this point use USB console?

tabajaralabs · « **Reply #3514 on:** April 11, 2025, 08:39:59 pm »

Quote from: Bud on April 11, 2025, 12:30:26 pm

And then input/output switches itself to the USB port? Is this why you from this point use USB console?

Yes. I can only access the p500> prompt and enter commands if I use the USB B port on the back of the scope. Even if in the boot appears the in/out/err with serial besides it:

Quote

U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU: SPEAr600
DRAM: 128 MiB
Flash: 512 KiB
NAND: fsmc-ecc1 128 MiB
In: serial
Out: serial
Err: serial
SerNum:serial number not programmed
Chip: BD Board Rev: 4
Net: smsc

onesystem · « **Reply #3515 on:** April 11, 2025, 08:44:31 pm »

Maybe it will help if you tell us what exactly you loaded into that scope, and which way it was done (via regular update function, or using some other method)

tabajaralabs · « **Reply #3516 on:** April 11, 2025, 09:43:02 pm »

A long time ago, when the 2.41 patched firmware was released, I created a package with 3 files - the patched firmware, the "v241 link install" and the remote front panel cab
I was tired, installed the second file (v241 link install) instead of the first file (the complete patched firmware) via file explorer on scope.
Poof. There things went south

Bud · « **Reply #3517 on:** April 11, 2025, 10:07:01 pm »

Quote from: tabajaralabs on April 11, 2025, 08:39:59 pm

Quote from: Bud on April 11, 2025, 12:30:26 pm
And then input/output switches itself to the USB port? Is this why you from this point use USB console?
Yes. I can only access the p500> prompt and enter commands if I use the USB B port on the back of the scope. Even if in the boot appears the in/out/err with serial besides it:
Quote
U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU: SPEAr600
DRAM: 128 MiB
Flash: 512 KiB
NAND: fsmc-ecc1 128 MiB
In: serial
Out: serial
Err: serial
SerNum:serial number not programmed
Chip: BD Board Rev: 4
Net: smsc

This is weird, can’t remember this ever mentioned by anyone.
What do you get if enter printenv in p500.?

tabajaralabs · « **Reply #3518 on:** April 11, 2025, 10:12:43 pm »

Quote from: Bud on April 11, 2025, 10:07:01 pm

Quote from: tabajaralabs on April 11, 2025, 08:39:59 pm
Quote from: Bud on April 11, 2025, 12:30:26 pm
And then input/output switches itself to the USB port? Is this why you from this point use USB console?
Yes. I can only access the p500> prompt and enter commands if I use the USB B port on the back of the scope. Even if in the boot appears the in/out/err with serial besides it:
Quote
U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU: SPEAr600
DRAM: 128 MiB
Flash: 512 KiB
NAND: fsmc-ecc1 128 MiB
In: serial
Out: serial
Err: serial
SerNum:serial number not programmed
Chip: BD Board Rev: 4
Net: smsc
This is weird, can’t remember this ever mentioned by anyone.
What do you get if enter printenv in p500.?

Output from printenv:

Quote

p500> printenv
ramboot=dhcp 0x4000000 nk.bin;bootm 0xf8050000
baudrate=115200
usbtty=cdc_acm
splashdata=0xd0000000
dispParm1=0x300 0x400 0x2625A00 0x1 0x3
dispParm2=0x20 0x4c 0x1 0x2 0x3
boardversion=4
ps=0
rtc=0
erase_env=protect off 1:4;erase 1:4
store_uboot=protect off 1:1-3;erase 1:1-3;cp.b 0x800000 0xF8010000 ${filesize};protect on 1:1-3;imi 0xF8010000
get_uboot_eth=dhcp 0x800000 u-boot_image.bin;run store_uboot
get_uboot_uart=loadb 0x800000 115200;run store_uboot
serialnum=serial number not programmed
ethact=smsc
bootaddr=0x700
loadaddr=0x00800000
chipversion=BD
fpgadata=0xd0060000
pbootdelay=0
bootCeFlash=bootm 0xf8050000
uart2=115200
bootcmd=run keyrst;run bootCeFlash
keyrst=mw d8100400 6 1;mw d8100008 0 1;mw d8100008 2 1
infiniiVisionCabFile=
infiniiVisionHostname=
infiniiVisionNetworkAdapter=
infiniiVisionInstallStatus=installing cab file
fpgasize=0x45480
ethaddr=00:30:d3:14:9c:ae
preboot=set stdin usbtty;set stdout usbtty;set stderr usbtty
bootdelay=-1
bootfile=nk.nb0
filesize=1AC8668
blocksize=0x1ad0000
fileaddr=800000
gatewayip=192.168.0.1
netmask=255.255.255.0
serverip=192.168.0.200
dnsip=181.213.132.2
image2=0xd1600000
pimage=1
fimage=1
nimages=1
fsstart=0x2c00000
numfilesystems=1
lengthfilesystem1=0x5400000
lengthfilesystem2=0x0
image1=0xd0600000
image2=0xd1600000
verify=n
ipaddr=192.168.1.146
stdin=usbtty
stdout=usbtty
stderr=usbtty

Environment size: 1365/16380 bytes
p500>

Bud · « **Reply #3519 on:** April 12, 2025, 01:54:57 am »

Get rid of preboot variable, set stdin,stdout and stderr to serial, set bootdelay=3, then reboot and watch the output on the UART. Your scope is currently switching to USB console at some point and you may be missing some error messages while your computer USB connection is enumerated.

tabajaralabs · « **Reply #3520 on:** April 12, 2025, 03:57:05 am »

Quote from: Bud on April 12, 2025, 01:54:57 am

Get rid of preboot variable, set stdin,stdout and stderr to serial, set bootdelay=3, then reboot and watch the output on the UART. Your scope is currently switching to USB console at some point and you may be missing some error messages while your computer USB connection is enumerated.

Ok, thanks for the tip. Now it boots as before (turn on, UART activity, buttons flash on front).
I used the pendrive + NK.NB0 from version 2.43 as before.

bootp 0x0361000 nk.nb0
(loads data thru network)
go 0x0362000

Log:

Quote

## Starting application at 0x00362000 ...
Windows CE Kernel for ARM (Thumb Enabled) Built on Mar 8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Jan 23 2024)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000 size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200 (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
Exception 'Data Abort'(4) Thread-Id=00580002(pth=87fdaa8c) PC=80378628 BVA=00000003, dwInfo = 00000001
R0=84999a10 R1=00000000 R2=00000000 R3=00000000
R4=84999000 R5=81e3a454 R6=81e3a624 R7=00000000
R8=00000000 R9=00000000 R10=00000000 R11=00000000
R12=00000000 SP=d00afe60 Lr=8038e4e0 Psr=0000001f
Exception 'Data Abort'(4) Thread-Id=00580002(pth=ffffc654) PC=8038e468 BVA=00000003, dwInfo = 00000001
R0=81e3a520 R1=00000001 R2=ffffffff R3=81e3a468
R4=03f3f000 R5=83f3f000 R6=83f3f000 R7=d00afe60
R8=d00afe64 R9=00000000 R10=00000000 R11=00000000
R12=8038e3f0 SP=ffffc7a4 Lr=8038e444 Psr=80000013
Exception 'Data Abort' (4): Thread-Id=00580002(pth=87fdaa8c), Proc-Id=00400002(pprc=81e38308) 'NK.EXE', VM-active=018c0002(pprc=87fc8eac) 'udevice.exe'
PC=8038e468(kernel.dll+0x0001c468) RA=8038e444(kernel.dll+0x0001c444) SP=ffffc7a4, BVA=00000000
Exception 'Data Abort'(4) Thread-Id=00580002(pth=87fdaa8c) PC=8038ead8 BVA=00000003, dwInfo = 00000001
R0=00000001 R1=00000000 R2=000061af R3=0000ffff
R4=000012d4 R5=81e3a520 R6=00003fff R7=81e38010
R8=00000004 R9=ffffffff R10=81e38308 R11=000000fb
R12=00580003 SP=ffffbd10 Lr=8038e9a8 Psr=2000001f
Exception 'Data Abort'(4) Thread-Id=00580002(pth=ffffc464) PC=8038de34 BVA=00000003, dwInfo = 00000001
R0=83f3f000 R1=00000001 R2=ffffffff R3=81e3a468
R4=83f3f000 R5=00000000 R6=00000001 R7=81e3a704
R8=84c44b80 R9=00000001 R10=81e38308 R11=81e39dd0
R12=8038dd68 SP=ffffc5b4 Lr=ffffc800 Psr=80000013
Exception 'Data Abort' (4): Thread-Id=00580002(pth=87fdaa8c), Proc-Id=00400002(pprc=81e38308) 'NK.EXE', VM-active=018c0002(pprc=87fc8eac) 'udevice.exe'
PC=8038de34(kernel.dll+0x0001be34) RA=ffffc800(+0xffffc800) SP=ffffc5b4, BVA=00000000
Exception 'Data Abort'(4) Thread-Id=00580002(pth=87fdaa8c) PC=80386228 BVA=00000030, dwInfo = 00000007
R0=00000000 R1=00000000 R2=0000001b R3=0000000b
R4=00000004 R5=81e3a704 R6=81e38308 R7=00000001
R8=00000003 R9=81e3a704 R10=04eb0000 R11=83080000
R12=00580003 SP=ffffc194 Lr=80386228 Psr=4000001f
Exception 'Data Abort'(4) Thread-Id=00580002(pth=87fdaa8c) PC=80386228 BVA=00000030, dwInfo = 00000007
R0=00000000 R1=00000000 R2=0000001b R3=0000000b
R4=00000004 R5=81e3a704 R6=81e38308 R7=00000001
R8=00000003 R9=81e3a704 R10=04eb0000 R11=83080000
R12=00580003 SP=ffffc194 Lr=80386228 Psr=4000001f
Exception 'Data Abort'(4) Thread-Id=00580002(pth=87fdaa8c) PC=803789e4 BVA=00000057, dwInfo = 00000007
R0=00000000 R1=00000000 R2=0000001b R3=0000000b
R4=00000004 R5=81e3a704 R6=81e38308 R7=00000001
R8=00000003 R9=81e3a704 R10=04eb0000 R11=83080000
R12=00580003 SP=ffffc104 Lr=80386228 Psr=4000001f
Exception 'Data Abort'(4) Thread-Id=00580002(pth=ffffc26c) PC=8037fbd8 BVA=00000057, dwInfo = 00000007
R0=87f7c444 R1=ffffc800 R2=00000004 R3=00000000
R4=87f7c444 R5=81e3a704 R6=81e3a660 R7=00000000
R8=00000001 R9=81e3a704 R10=04eb0000 R11=83080000
R12=00000000 SP=ffffc3bc Lr=8037600c Psr=60000013
Exception 'Data Abort'(4) Thread-Id=00580002(pth=87fdaa8c) PC=803789e4 BVA=00000024, dwInfo = 00000007
R0=00000000 R1=00000000 R2=0000001b R3=0000000b
R4=00000004 R5=81e3a704 R6=81e38308 R7=00000001
R8=00000003 R9=81e3a704 R10=04eb0000 R11=83080000
R12=00580003 SP=ffffc104 Lr=80386228 Psr=4000001f
Exception 'Data Abort'(4) Thread-Id=00580002(pth=ffffc000) PC=8037ea4c BVA=00000024, dwInfo = 00000007
R0=00000004 R1=00000000 R2=87fffe98 R3=00000004
R4=8037600c R5=00000004 R6=87fdaa8c R7=81e3a4b8
R8=00000000 R9=ffffc800 R10=ffffc1e8 R11=8037fbd8
R12=00580003 SP=ffffc150 Lr=8037ea34 Psr=60000013
Exception 'Data Abort'(4) Thread-Id=00580002(pth=87fdaa8c) PC=803789e4 BVA=00000024, dwInfo = 00000007
R0=00000000 R1=00000000 R2=0000001b R3=0000000b
R4=00000004 R5=81e3a704 R6=81e38308 R7=00000001
R8=00000003 R9=81e3a704 R10=04eb0000 R11=83080000
R12=00580003 SP=ffffc104 Lr=80386228 Psr=4000001f
Exception 'Data Abort'(4) Thread-Id=00580002(pth=ffffbd94) PC=8037ea4c BVA=00000024, dwInfo = 00000007
R0=00000004 R1=00000000 R2=87fffe98 R3=00000004
R4=8037ea34 R5=00000004 R6=87fdaa8c R7=81e3a4b8
R8=00000000 R9=ffffc800 R10=ffffbf7c R11=8037ea4c
R12=00580003 SP=ffffbee4 Lr=8037ea34 Psr=60000013
Exception 'Data Abort'(4) Thread-Id=00580002(pth=87fdaa8c) PC=803789e4 BVA=00000024, dwInfo = 00000007
R0=00000000 R1=00000000 R2=0000001b R3=0000000b
R4=00000004 R5=81e3a704 R6=81e38308 R7=00000001
R8=00000003 R9=81e3a704 R10=04eb0000 R11=83080000
R12=00580003 SP=ffffc104 Lr=80386228 Psr=4000001f
Exception 'Data Abort'(4) Thread-Id=00580002(pth=ffffbb28) PC=8037ea4c BVA=00000024, dwInfo = 00000007
R0=00000004 R1=00000000 R2=87fffe98 R3=00000004
R4=8037ea34 R5=00000004 R6=87fdaa8c R7=81e3a4b8
R8=00000000 R9=ffffc800 R10=ffffbd10 R11=8037ea4c
R12=00580003 SP=ffffbc78 Lr=8037ea34 Psr=60000013
Exception 'Data Abort'(4) Thread-Id=00580002(pth=87fdaa8c) PC=803789e4 BVA=00000024, dwInfo = 00000007
R0=00000000 R1=00000000 R2=0000001b R3=0000000b
R4=00000004 R5=81e3a704 R6=81e38308 R7=00000001
R8=00000003 R9=81e3a704 R10=04eb0000 R11=83080000
R12=00580003 SP=ffffc104 Lr=80386228 Psr=4000001f
Exception 'Data Abort'(4) Thread-Id=00580002(pth=ffffb8bc) PC=8037ea4c BVA=00000024, dwInfo = 00000007
R0=00000004 R1=00000000 R2=87fffe98 R3=00000004
R4=8037ea34 R5=00000004 R6=87fdaa8c R7=81e3a4b8
R8=00000000 R9=ffffc800 R10=ffffbaa4 R11=8037ea4c
R12=00580003 SP=ffffba0c Lr=8037ea34 Psr=60000013
Exception 'Data Abort'(4) Thread-Id=00580002(pth=87fdaa8c) PC=803789e4 BVA=00000024, dwInfo = 00000007
R0=00000000 R1=00000000 R2=0000001b R3=0000000b
R4=00000004 R5=81e3a704 R6=81e38308 R7=00000001
R8=00000003 R9=81e3a704 R10=04eb0000 R11=83080000
R12=00580003 SP=ffffc104 Lr=80386228 Psr=4000001f
Exception 'Data Abort'(4) Thread-Id=00580002(pth=ffffb650) PC=8037ea4c BVA=00000024, dwInfo = 00000007
R0=00000004 R1=00000000 R2=87fffe98 R3=00000004
R4=8037ea34 R5=00000004 R6=87fdaa8c R7=81e3a4b8
R8=00000000 R9=ffffc800 R10=ffffb838 R11=8037ea4c
R12=00580003 SP=ffffb7a0 Lr=8037ea34 Psr=60000013
Exception 'Data Abort'(4) Thread-Id=00580002(pth=87fdaa8c) PC=803789e4 BVA=00000024, dwInfo = 00000007
R0=00000000 R1=00000000 R2=0000001b R3=0000000b
R4=00000004 R5=81e3a704 R6=81e38308 R7=00000001
R8=00000003 R9=81e3a704 R10=04eb0000 R11=83080000
R12=00580003 SP=ffffc104 Lr=80386228 Psr=4000001f
Exception 'Data Abort'(4) Thread-Id=00580002(pth=ffffb3e4) PC=8037ea4c BVA=00000024, dwInfo = 00000007
R0=00000004 R1=00000000 R2=87fffe98 R3=00000004
R4=8037ea34 R5=00000004 R6=87fdaa8c R7=81e3a4b8
R8=00000000 R9=ffffc800 R10=ffffb5cc R11=8037ea4c
R12=00580003 SP=ffffb534 Lr=8037ea34 Psr=60000013
ExceptionException 'Data Abort'(4) Thread-Id=00580002(pth=87fdaa8c) PC=803789e4 BVA=ffff105c, dwInfo = 00000007
R0=00000000 R1=00000000 R2=0000001b R3=0000000b
R4=00000004 R5=81e3a704 R6=81e38308 R7=00000001
R8=00000003 R9=81e3a704 R10=04eb0000 R11=83080000
R12=00580003 SP=ffffc104 Lr=80386228 Psr=4000001f
Exception 'Data Abort'(4) Thread-Id=00580002(pth=ffff0e98) PC=80378484 BVA=ffff105c, dwInfo = 00000007
R0=ffff105c R1=00000004 R2=60000093 R3=ffffc800
R4=81e36ae0 R5=000001af R6=00000000 R7=00000001
R8=81e366ac R9=81e36724 R10=000001af R11=80368b00
R12=8037dfbc SP=ffff0fe8 Lr=8036bf54 Psr=60000093
Exception 'Data Abort'(4) Thread-Id=00580002(pth=87fdaa8c) PC=803789e4 BVA=00000024, dwInfo = 00000007
R0=00000000 R1=00000000 R2=0000001b R3=0000000b
R4=00000004 R5=81e3a704 R6=81e38308 R7=00000001
R8=00000003 R9=81e3a704 R10=04eb0000 R11=83080000
R12=00580003 SP=ffffc104 Lr=80386228 Psr=4000001f
Exception 'Data Abort'(4) Thread-Id=00580002(pth=ffff0c2c) PC=8037ea4c BVA=00000024, dwInfo = 00000007
R0=00000004 R1=00000000 R2=803736f8 R3=00000004
R4=8036bf54 R5=00000004 R6=87fdaa8c R7=81e3a4b8
R8=00000000 R9=ffffc800 R10=ffff0e14 R11=80378484
R12=00580003 SP=ffff0d7c Lr=8037ea34 Psr=60000093
Exception 'Data Abort'(4) Thread-Id=00580002(pth=87fdaa8c) PC=803789e4 BVA=00000024, dwInfo = 00000007
R0=00000000 R1=00000000 R2=0000001b R3=0000000b
R4=00000004 R5=81e3a704 R6=81e38308 R7=00000001
R8=00000003 R9=81e3a704 R10=04eb0000 R11=83080000
R12=00580003 SP=ffffc104 Lr=80386228 Psr=4000001f
Exception 'Data Abort'(4) Thread-Id=00580002(pth=ffff09c0) PC=8037ea4c BVA=00000024, dwInfo = 00000007
R0=00000004 R1=00000000 R2=87fffe98 R3=00000004
R4=8037ea34 R5=00000004 R6=87fdaa8c R7=81e3a4b8
R8=00000000 R9=ffffc800 R10=ffff0ba8 R11=8037ea4c
R12=00580003 SP=ffff0b10 Lr=8037ea34 Psr=60000093
Exception 'Data Abort'(4) Thread-Id=00580002(pth=87fdaa8c) PC=803789e4 BVA=00000024, dwInfo = 00000007
R0=00000000 R1=00000000 R2=0000001b R3=0000000b
R4=00000004 R5=81e3a704 R6=81e38308 R7=00000001
R8=00000003 R9=81e3a704 R10=04eb0000 R11=83080000
R12=00580003 SP=ffffc104 Lr=80386228 Psr=4000001f
Exception 'Data Abort'(4) Thread-Id=00580002(pth=ffff0754) PC=8037ea4c BVA=00000024, dwInfo = 00000007
R0=00000004 R1=00000000 R2=87fffe98 R3=00000004
R4=8037ea34 R5=00000004 R6=87fdaa8c R7=81e3a4b8
R8=00000000 R9=ffffc800 R10=ffff093c R11=8037ea4c
R12=00580003 SP=ffff08a4 Lr=8037ea34 Psr=60000093
Exception 'Data Abort'(4) Thread-Id=00580002(pth=87fdaa8c) PC=803789e4 BVA=00000024, dwInfo = 00000007
R0=00000000 R1=00000000 R2=0000001b R3=0000000b
R4=00000004 R5=81e3a704 R6=81e38308 R7=00000001
R8=00000003 R9=81e3a704 R10=04eb0000 R11=83080000
R12=00580003 SP=ffffc104 Lr=80386228 Psr=4000001f
Exception 'Data Abort'(4) Thread-Id=00580002(pth=ffff04e8) PC=8037ea4c BVA=00000024, dwInfo = 00000007
R0=00000004 R1=00000000 R2=87fffe98 R3=00000004
R4=8037ea34 R5=00000004 R6=87fdaa8c R7=81e3a4b8
R8=00000000 R9=ffffc800 R10=ffff06d0 R11=8037ea4c
R12=00580003 SP=ffff0638 Lr=8037ea34 Psr=60000093

tabajaralabs · « **Reply #3521 on:** April 12, 2025, 04:06:36 am »

Quote from: Bud on April 12, 2025, 01:54:57 am

Get rid of preboot variable, set stdin,stdout and stderr to serial, set bootdelay=3, then reboot and watch the output on the UART. Your scope is currently switching to USB console at some point and you may be missing some error messages while your computer USB connection is enumerated.

Just out of curiosity, I tried booting with the pendrive + Nk.NB0 file generated from version 1.10.2011031600 which is the lowest version I could find (and the original software of the scope was an even lower version). Here is the log:

Quote

## Starting application at 0x00362000 ...
Windows CE Kernel for ARM (Thumb Enabled) Built on Jun 16 2009 at 10:08:15
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Mar 16 2011)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000 size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
Exception 'Data Abort'(4) Thread-Id=00570002(pth=87fdd9cc) PC=8036b6f8 BVA=00000003, dwInfo = 00000001
R0=84955520 R1=00000ae0 R2=815a6a60 R3=00000020
R4=00001000 R5=84955000 R6=00000004 R7=815a6a60
R8=815a6238 R9=00000000 R10=00000000 R11=00000000
R12=00000000 SP=d00afe44 Lr=8036b45c Psr=2000001f
Exception 'Data Abort'(4) Thread-Id=00570002(pth=ffffc65c) PC=8038dc10 BVA=00000003, dwInfo = 00000001
R0=815aa520 R1=00000001 R2=ffffffff R3=815aa468
R4=03f3f000 R5=83f3f000 R6=83f3f000 R7=d00afe64
R8=d00afe60 R9=00000000 R10=00000000 R11=00000000
R12=8038db98 SP=ffffc7ac Lr=8038dbec Psr=80000013
Exception 'Data Abort' (4): Thread-Id=00570002(pth=87fdd9cc), Proc-Id=00400002(pprc=815a8308) 'NK.EXE', VM-active=01e00002(pprc=87f52000) 'udevice.exe'
PC=8038dc10(kernel.dll+0x0001bc10) RA=8038dbec(kernel.dll+0x0001bbec) SP=ffffc7ac, BVA=00000000
Exception 'Data Abort'(4) Thread-Id=014c0002(pth=87f76000) PC=8038fd64 BVA=00000003, dwInfo = 00000001
R0=00000000 R1=87f76000 R2=6000001f R3=ffffc800
R4=815aa704 R5=7fff0000 R6=00000000 R7=00000000
R8=00100000 R9=d02be740 R10=d02a4220 R11=00000000
R12=8038fd64 SP=d02be4e4 Lr=8038fd64 Psr=6000001f
Exception 'Data Abort'(4) Thread-Id=014c0002(pth=ffffc46c) PC=8038d5d0 BVA=00000003, dwInfo = 00000001
R0=83f3f000 R1=00000001 R2=ffffffff R3=815aa468
R4=83f3f000 R5=00000000 R6=00000001 R7=815aa704
R8=80375708 R9=00000001 R10=00000004 R11=00000000
R12=8038d504 SP=ffffc5bc Lr=ffffc800 Psr=80000013
Exception 'Data Abort' (4): Thread-Id=014c0002(pth=87f76000), Proc-Id=00400002(pprc=815a8308) 'NK.EXE', VM-active=00400002(pprc=815a8308) 'NK.EXE'
PC=8038d5d0(kernel.dll+0x0001b5d0) RA=ffffc800(+0xffffc800) SP=ffffc5bc, BVA=00000000
Exception 'Data Abort'(4) Thread-Id=00f30006(pth=868f7a08) PC=8038fd64 BVA=00000003, dwInfo = 00000001
R0=00000000 R1=868f7a08 R2=6000001f R3=ffffc800
R4=815aa704 R5=7fff0000 R6=00000001 R7=0000fffe
R8=00000001 R9=002a0000 R10=00000000 R11=00000000
R12=8038fd64 SP=d072fe20 Lr=8038fd64 Psr=6000001f
Exception 'Data Abort'(4) Thread-Id=00f30006(pth=ffffc27c) PC=8038d5d0 BVA=00000003, dwInfo = 00000001
R0=83f3f000 R1=00000001 R2=ffffffff R3=815aa468
R4=83f3f000 R5=00000000 R6=00000001 R7=815aa704
R8=00000000 R9=00000001 R10=00000000 R11=00000000
R12=8038d504 SP=ffffc3cc Lr=ffffc800 Psr=80000013
Exception 'Data Abort' (4): Thread-Id=00f30006(pth=868f7a08), Proc-Id=00400002(pprc=815a8308) 'NK.EXE', VM-active=00400002(pprc=815a8308) 'NK.EXE'
PC=8038d5d0(kernel.dll+0x0001b5d0) RA=ffffc800(+0xffffc800) SP=ffffc3cc, BVA=00000000

Bud · « **Reply #3522 on:** April 12, 2025, 05:32:32 am »

Man, just post the log as it is , without interjecting. Does the scope now spit everything to UART console after you set input/output?

tabajaralabs · « **Reply #3523 on:** April 12, 2025, 02:48:48 pm »

Quote from: Bud on April 12, 2025, 05:32:32 am

Man, just post the log as it is , without interjecting. Does the scope now spit everything to UART console after you set input/output?

Yes, now the scope directs all info to serial port. And the logs are as is, I just copied from the teraterm output and pasted here. Anything else I should do?

Bud · « **Reply #3524 on:** April 12, 2025, 02:55:42 pm »

Where is the start part before it gets to p500 prompt. Do you still interrupt the boot to get to the prompt or does the scope stops by itself, which it should not if you changed the bootdelay variable. I want to see everything from the moment you turn the scope on, no pressing Cal buttons, no hitting space bar, no pen drive. Just let it roll.


EEVblog Main Site	EEVblog on Youtube	EEVblog on Twitter	EEVblog on Facebook	EEVblog on Odysee

Author Topic: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ? (Read 1378103 times)

Share me