DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?

[gbalangero]

Sorry Bud, I didn't understand which memory you were referring to!
I checked the PCB and think I identified the NOR.
It's an ST M25P40VP, SO8 case.
I'm attaching a picture of the PCB location, labeled U3204.
I have a CH341 programmer that supports it and would allow me to do a dump.
Meanwhile, I'm getting information on how to use the ST Flashing utility...

Thanks in advance for your help and clarifications.

[Bud]

Maybe someone who done a work on 3000x scope could chime in how they got access to p500 prompt.

[msuthar]

My msg for the solution forever !!!

https://www.eevblog.com/forum/testgear/keysight-dso-x-3024t-possible-nand-corruption-baldwin_ddi-ident-error/msg6113851/#msg6113851

[Bud]

You should read the user's initial post. His second image is failing, too.

[gbalangero]

Hi Bud, I've made some progress in troubleshooting the oscilloscope 3024T.
I unsoldered the NOR and made a dump.
Subsequently, following your instructions found in this forum thread, I changed the bootdelayt and pbootdelay variables to 3 only at addresses 0x00040004 - 0x00043FFF and recalculated and updated the CRC.

https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/975/
Reply #997

I resoldered the NOR, and now the countdown works, but I still can't access the P500> prompt.
However, the console is only addressed to the rear USB port during the boot delay...

I need to change STDIN=usbtty, STDOUT=usbtty, and STDERR=usbtty to STDIN=serial, STDOUT=serial, and STDERR=serial.
In your opinion, should I change them only in the environment variable memory range or at other addresses as well?

I'm attaching the original memory dump file renamed from .bin to .txt.

Thanks in advance for your help!

[TheSteve]

I seem to recall I cannot get to the p500 prompt on my 3000t series scope either. It has been several years since I have tried though.

[Bud]

I need to change STDIN=usbtty, STDOUT=usbtty, and STDERR=usbtty to STDIN=serial, STDOUT=serial, and STDERR=serial.
In your opinion, should I change them only in the environment variable memory range or at other addresses as well?

In the env variables area. But take an extra effort to update the checksum properly, or there likely be a lot of problems.

[gbalangero]

Thank you Bud for the feedback and information. 

I'll update the checksum after modify, just like I did when I changed the bootdelay times.

Have a Nice Day 

[sprit]

Hi everyone

I was wondering if I should write another topic to summarize how to restore this scope series?

[Bud]

Who can stop you. Go for it.

[sprit]

Hi gbalangero.

Can u upload the original file, i'll check it.

Feng

[jukr69]

Hi Everyone!

I got back my Agilent MSO-X 3054A after a while.

Now i have the idea to bring it up to a modern standard. Is any one able to support me with an actual  FW image?

Something like 3000XSeries.02.65.20210307001....ksx

Thanks for your efforts and support

Best,
Jens :-)

Addendum: Thanks .. got the material!

[salvagedcircuitry]

I'm repairing a nand corrupt agilent 4154a oscilloscope in my free time.
https://www.eevblog.com/forum/testgear/in-need-of-old-firmware-for-agilent-keysight-4000a-oscilloscope/

I've been able to make progress, and accumulated some .agx and .ksx files. I have 3.20, 4.08, 7.56, 7.65.
Judging by the length, 0x4D6BA80, the firmware file I need should be between 3.20 (0x04816C1C) and 4.08 (0x04DBB9D8). 
I have had some successes using the tftp method:

My procedure:

Install tftp64
   Run as admin, select your Ethernet interface (192.168.1.101).
   Set Current Directory to folder with FPGA4000A.bin (exact name/case).
   In settings, Bind TFTP to a specific address. select 192.168.1.101. restart TFTP as admin
   Server starts listening—logs show requests.
Set up USB serial port in teraterm.
   Settings: 115200, 8,N,1.
   Setup > Additional settings > General, then uncheck "Clear display when window resized"
In teraterm, type
setenv serverip 192.168.1.101
saveenv
   teraterm responds with saving environment to flash. unprotected 1 sectors. erasing flash... done.
tftp 900000 FPGA4000A.bin
   file will upload. it says "done"
fpga 900000 45480
   "FPGA programming failed"    <---This is clearly a problem
fpga 900000 0xb62e4                 
fpga 900000 0x04DBB9D8           <---Either of these don't error
   programming does not fail
   >p500 will appear again
tftp 0x0361000 nk.nb0
   responds with:
      Filename 'nk.nb0'.
      Load address: 0x361000
      loading: ####################....
      Loading gets to 75% and errors out
      Serial Terminal Hangs
      Supposed to upload fast to the scope and respond with "done"

I can never get to the next step, "go 0x00362000"
I looked through this thread and I can't find anyone else who has had an error with the "fpga 900000 45480" command.

Any troubleshooting advice appreciated!     

[tv84]

tftp 900000 FPGA4000A.bin
   file will upload. it says "done"
fpga 900000 45480
   "FPGA programming failed"    <---This is clearly a problem
fpga 900000 0xb62e4                 
fpga 900000 0x04DBB9D8           <---Either of these don't error
   programming does not fail
   >p500 will appear again

I don't remember much of this anymore BUT if you are loading the FPGA4000A file with a 0xB62E4 filesize (as I see in the last picture), the only logical command to do is

fpga 900000 0xb62e4

Any other and you'll end up with a bad flash.

Do some crc checks to see if all is good: random example.

Regarding the GO command: you are doing this, right?

[sprit]

Hello salvagedcircuitry

FPGA commands won't always work. Sometimes some machines have errors in that area, while others don't, so this is just an add-on. I'm downloading the firmware for this model and testing it.


Sincerely,

Feng

[lern01]

My DSOX2022a was working normally, but after not using it for three or four days, when I turned it on yesterday, it repeatedly cycled through restarts. Following the methods suggested by some experts, I used a USB-TTL converter and received the following information:

Code: [Select]

U-Boot 2010.03 (Jan 26 2011 - 12:37:34)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2011-01-27  11:38:14 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    36703 Bytes = 35.8 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK

Microsoft Windows CE Bootloader Common Library Version 1.4 Built Jan 27 2011 02:04:15
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008


System ready!
Preparing for download...
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXXOOOOXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXOOOOOOOOOXOOOOXOXOXXXOOXOXXOXXXXXXOOOXXXOOOOOXOOXOXXXOOOXXOOOXXOOOOXOOXOOXXOOOXOOOOOXOOOXOOOXXXXXXOXOXXOXXXXXXXOXXXXOOOXOOOOXOXOOOXOOOOXOXOXOOOOOOXOOOOXOXOOOOOXXOOOOOXX
OOOOXXOOOOOOOOOXOXOOOXOOOOOOOXXOOOOOXXOOOOXOXOXOOXOXOOOXOOOXOOOXXXOXOOOXOXXXXOXOOXXOXXOXXOOOXXOXOXXOXXXXXOOXOXXXXOXOOXOXOOOOXOOOOXOOOXOOXOOXOOOXOOXXXXXXXXXXXXXXOXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x1248684, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x1248684  Name="" Target=RAM
 Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
Launching windows CE image by jumping at address 0x  362000

Windows CE Kernel for ARM (Thumb Enabled) Built on Jun 16 2009 at 10:08:15
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Apr 18 2012)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
-EDeviceLoadEeprom 00:30:D3:20:D6:E4
Phy found addr 31 (ticks=2783)
WaitForLink Start (ticks=2784)
No Link (ticks=3787)
<--EDeviceInitialize

GMAC DMA status register = 0x0
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Running infiniiVisionInstallHelper
Failed to start/configure network.
Starting ProcessStartupFolder
running \Secure\Startup\infiniivision.lnk...
Ending ProcessStartupFolder
                           Before P/Invoke
Exception 'Data Abort' (4): Thread-Id=03530006(pth=837d0a5c), Proc-Id=03500006(pprc=837d0744) 'infiniivisionLauncher.exe', VM-active=03500006(pprc=837d0744) 'infiniivisionLauncher.exe'
PC=411b4c8c(infiniivisioncore.dll+0x004a4c8c) RA=411b5454(infiniivisioncore.dll+0x004a5454) SP=0002f200, BVA=10da7470
The exception 0xC0000005 occurred at address 0x411B4C8C
I created nk.nb0 using nkbintools, and then executed the command `p500> loady 0x0361000 115200`.In Tera Term go to File-> Transfer-> YMODEM->Send... and open the nk.nb0 that you have prepared beforehand. I couldn't upload the file. After a few dozen seconds, the upload interface disappeared. I tried several times, but the result was always the same.

[Bud]

My procedure:
fpga 900000 45480
   "FPGA programming failed"    <---This is clearly a problem
fpga 900000 0xb62e4                 
fpga 900000 0x04DBB9D8           <---Either of these don't error
   programming does not fail

The second parameter in fpga command is the length of the FPGA binary, not the firmware.

[Bud]

, I used a USB-TTL converter and received the following information:
....
 I couldn't upload the file. After a few dozen seconds, the upload interface disappeared. I tried several times, but the result was always the same.

You should try a different converter, different cable, and different terminal program. Seems to be a serial com problem.

[lern01]

The upload was successful, but an error occurred after running `go 0x00362000`:

[lern01]

I only had firmware 02.30.2013032600 on hand,nk.nb0 was created using this version.:

Code: [Select]

Firmware version Short  Hex          Decimal
01.01.0000000000 1.01
01.01.2010010700 1.01
01.10.2011031600 1.10 - 0x01238818 - 19105816
01.10.2011042700 1.10
01.20.2011063000 1.20
02.00.2011101301 2.00
02.01.2011111500 2.01
02.10.2012022200 2.10 - 0x0124867C - 19170940
02.11.2012040400 2.11
02.12.2012041800 2.12
02.20.2012110802 2.20 - 0x01248680 - 19170944
02.30.2013032600 2.30 - 0x012F9870 - 19896432
02.30.2013040502 2.30 - 0x01248684 - 19170948
02.31.2013040901 2.31
02.35.2013061800 2.35 - 0x013064D4 - 19948756
02.36.2013091300 2.36 - 0x013064E8 - 19948776
02.37.2014052002 2.37 - 0x0130656C - 19948908
02.38.2014110300 2.38 -
02.39.20151022602 2.39 - 0x013387B8 - 20154296
02.40.20150828001 2.40
02.41.2015102200 2.41 - 0x015264A8 - 22176936Setting up the USB drive also follows Titis's solution. Format an 8GB USB drive as FAT32，Unzip InfiniiVionSetup, copy dosetup.py, and run python dosetup.py. You will get the directory and files shown in the image. The Secure directory structure is as follows:

Code: [Select]

D:.
├─infiniiVision
│  ├─fpga
│  ├─upgrade
│  └─web
│      ├─css
│      ├─help
│      ├─image
│      ├─include
│      │  └─web-socket-js
│      ├─lib
│      ├─Lxi
│      │  └─Identification
│      └─navbar
└─Startup

d:\Users\lern01\Desktop\DSOX2000a\1\Secure>
I would appreciate it if my friends could point out where I went wrong. Thank you very much!

[lern01]

Formatting works fine under Windows, but when using USB Disk Storage Format, the following error occurs: "Device media is write-protected".

[analogRF]

Code: [Select]

Starting ProcessStartupFolder
running \Secure\Startup\infiniivision.lnk...
Ending ProcessStartupFolder
your log clearly shows that the scope is not reading the USB memory after loading and running the nk.nb0
so something is wrong with the USB stick assuming the usb port itself is ok.
try both the front and back usb ports

[VALE@R@D]

Hello

MSO-X 2014A

Has anyone had any success with version 2.67?

I upgraded to 2.67 and lost all my licenses. Now, I have tried to go back to 2.66, but it has been unsuccessful. When I tried to install the 2.66 firmware from the USB, it suddenly disconnected the USB and nothing happened.

Also
I accidentally activated the test period for the licenses, and now I have it until mid-January.

Any suggestion, helps?

Best regards,

[PlainName]

Formatting works fine under Windows, but when using USB Disk Storage Format, the following error occurs

Just had a similar issue with a dashcam that was not working with the required FAT32 format stick. The problem turned out to be formatting it on Windows when it was originally NTFS formatted. For NTFS, Windows gives it a GPT partition table, and after that even if you reformat it as FAT32 it's not going to work (although it will seem to be fine under Windows). The fix is to change the partition table to MBR and then everything else can understand what it is.

Wonder if this might be the cause of your problem.

[sprit]

The upload was successful, but an error occurred after running `go 0x00362000`:

Hi,

On page 145, there's an article of mine that provides instructions on that.

I always format USB drives in FAT format, not FAT32.

If possible, borrow or buy a LAN expansion board for this model; everything will run more smoothly and be easier to handle.