DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?

[laoyou519@gmail.com]

Congratulations!


Another member has successfully fixed it.

Dm me, i give you the "personal purpose only" file.

Regards,

Feng

I need your personal-only files. Thank you.

[dl250]

Tools for calibration files backup & restore:
The dump ksxs perform calibration backup, and the result calibration files will dump to the usb drive.
The write ksxs perform calibration resotre,before use it, put the calibration files you save before to the root folder of the drive.
Technically all should working, but use on your own risk.
Suitable for DSOX/MSOX 2000/3000A 3000T/G  4000A series.
Link: https://mega.nz/folder/YH1AWLqQ#ENzgpsBRdkfujWH6toXs1A

I remember a few years ago I play with the TDS700D oscilloscope, and someone write the script to do the backup of these old scopes, I think have a backup of the dsox would be nice too, so there's the files.

Could you share a copy of the calibration file backup and recovery tool?

[BillCRM]

The link still works, you could download it by yourself.

[analogRF]

Hello

MSO-X 2014A

Has anyone had any success with version 2.67?

I upgraded to 2.67 and lost all my licenses. Now, I have tried to go back to 2.66, but it has been unsuccessful. When I tried to install the 2.66 firmware from the USB, it suddenly disconnected the USB and nothing happened.

Also
I accidentally activated the test period for the licenses, and now I have it until mid-January.

Any suggestion, helps?

Best regards,

any success with 2.67?
finding the place to apply the patch is not difficult but finding the CRC address and its scope is beyond me

[sprit]

What are your environment variables?

Hi Bud

here is my env var

Code: [Select]

U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  fsmc-ecc1 128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
BMP data is not valid. Use splash bmp
Press space to stop autoboot: 2
p500> printenv
bootcmd=tftp 0x4000000 nk.bin;bootm 0xf8050000
ramboot=dhcp 0x4000000 nk.bin;bootm 0xf8050000
bootdelay=3
baudrate=115200
preboot=splash load;fpga;expi
netmask=255.255.255.0
usbtty=cdc_acm
fpgadata=0xd0060000
fpgasize=0x75394
splashdata=0xd0000000
dispParm1=0x300 0x400 0x2625A00 0x1 0x3
dispParm2=0x20 0x4c 0x1 0x2 0x3
boardversion=4
ps=0
rtc=0
erase_env=protect off 1:4;erase 1:4
store_uboot=protect off 1:1-3;erase 1:1-3;cp.b 0x800000 0xF8010000 ${filesize};protect on 1:1-3;imi 0xF8010000
get_uboot_eth=dhcp 0x800000 u-boot_image.bin;run store_uboot
get_uboot_uart=loadb 0x800000 115200;run store_uboot
ethaddr=00:30:d3:1d:77:5c
serialnum=serial number not programmed
chipversion=BD
nimages=1
image1=0xd0400000
fsstart=0x2c00000
numfilesystems=1
lengthfilesystem1=0x5400000
lengthfilesystem2=0x0
ecc=1
ethact=smsc
gatewayip=192.168.1.1
serverip=192.168.1.5
verify=n
ipaddr=192.168.1.192

Environment size: 891/16380 bytes
Hope it can help.

Feng

[sprit]

Today I took it out again to continue repairing it. I still don't know where that 128xxx frequency came from. Is the expected frequency range between 39.5 and 405 39.5MHz-40.5MHz? I used a frequency counter and oscilloscope to probe around the tcxo but couldn't find any frequencies that matched. Or perhaps the FPGA is faulty (which I think is very rare). Does anyone have any ideas? By the way, could anyone share the Windows CE screen access file for this 2000 series? I'd like to double-check some information. Thank you very much.

Code: [Select]

FPGA Clock Count = 12871648, expecting between 395 and 405
HARDWARE ERROR!!!!! ******** FPGA Clock failure ******** (14)

Sincerely,

Feng

[sprit]

I finally fixed the Clock FPGA error.  The self-research was quite frustrating  . Luckily, it finally works (partially ).

I forgot to back up the NOR of this dsox2k model, so could someone please share the backup file with me? I programmed it using the SPearUnity tool, so some variables might be inaccurate. Thank you very much.

Code: [Select]

p500> go 0x00362000
## Starting application at 0x00362000 ...
Windows CE Kernel for ARM (Thumb Enabled) Built on Jun 16 2009 at 10:08:15
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Nov  8 2012)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
-EDeviceLoadEeprom 00:30:D3:1D:A6:BD
Phy found addr 31 (ticks=2977)
WaitForLink Start (ticks=2979)
Link Detected (ticks=2981)

 GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
Flushed Transmit Buffer
phyCfg->dwSpeed 0x64
<--EDeviceInitialize

GMAC DMA status register = 0x600004
GMAC Device enable interrupt
DriverStart
GMAC Device enable interrupt
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Running infiniiVisionInstallHelper
ERROR: OALIoCtlHalGetDeviceInfo: Device doesn't support IOCTL_HAL_GET_DEVICE_INFO::SPI_GETBOOTMENAME
Autonegociation Start (ticks=5005)
+StartAutoNegotiation: pDeviceContext 0xd0ce3820
Running ConfigureNetworkNative
Autonegociation End (ticks=7515)
WaitForLink Start (ticks=7516)
Link Detected (ticks=7519)

 GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
cable attached
Waiting for network to configure.
NetworkReadyThread ADDRESS_CHANGE_EVENT
IP Address 192.168.1.5
Subnet Mask 255.255.255.0
Gateway Server Address 192.168.1.100
DHCP Server Address 192.168.1.100
<?xml version="1.0"?>
<networkConfig><dhcp>true</dhcp>
<ipAddress>0.0.0.0</ipAddress>
<subnet>0.0.0.0</subnet>
<gateway></gateway>
<dnsServer></dnsServer>
<hostName>infiniivisionbd</hostName>
<domainName></domainName>
<adapterName>GMAC1</adapterName>
</networkConfig>

Starting Agilent LXI Services.
Starting ProcessStartupFolder
ProcessStartupFolder: \usb\Startup\
                                   running \usb\Startup\infiniivision.lnk...
Ending ProcessStartupFolder
                           Before P/Invoke
Our command line is
Performing Startup

      creating \Agilent Flash\webupdate\Released build, Nov  8 2012, 18:24:42
Initializing FPGA...
****
FPGA Type: Idaho
Ver: 1.094 Released
Build Time: Wed Oct 24 15:40:11 2012
Build Machine: DW3647M2
****
Programming LAN option module...
Option module FPGA programing DONE...
Keyboard firmware version 32... ok
Keyboard Info: Board id 7, Board rev 2
Startup sequence is complete.
Saved configuration invalid
System has been running 68.254021 seconds
Start Up Sequence 35.294993
Memory Load 53%
   System Physical Memory 41.688 / 79.648 MB
   Process Virtual Memory 43.813 / 1024.000 MB
-----> InfiniiVision is running <-----

Feng

[onesystem]

Hi Feng! Well done on fixing the error! Could you please tell us what you found and how you fixed it? I am very curious!

[sprit]

Everything is going pretty smoothly. I'm looking for a way to recalibrate it. Can anyone share the files in the secure/cal folder with me?

Regards,

Feng

[sprit]

Hi Feng! Well done on fixing the error! Could you please tell us what you found and how you fixed it? I am very curious!

Hi.

Can I keep it a secret? 

Anyway, because I chose the wrong NAND model (Winbond instead of Micron), Windows didn't recognize it properly. Therefore, I had to replace it with a Micron flash memory chip. Since it's a new NAND, I need to update the new FPGA address, something I haven't done before, and that's what's causing the error. Then I modified the environment variable so that the machine would automatically download from the NAND, instead of the previous TFTPboot.

After tinkering with the firmware, I noticed there are some launch variables of infiniium.Out of curiosity, I tried one of them, especially the service mode, but it made no difference. Something like "infiniium --srv". I was hoping it would restart the software in a different interface, but nothing changed.  Can someone tell me what the --srv command is doing? Or am I doing something wrong?

[BillCRM]

Finally and finally, I became one of the dsox4000 owners.
There used to be a nice dsox4054a listed in Chinese ebay (Xianyu) about half years ago, only about 3 grands. But at that time, I don't have spare money to buy it. and it sold out a few month later. Pretty regret about that. I repaired over 10 dsox2000/3000a series these years, but never have the chance to own a dsox4000. Just a week before, I saw a dsox4032a listed as can't boot condition for only 1.7k. I think I shsouldn't lost the chance again and bought it without thinking twice.
After it arrived, it even came with the front cover, and the condition looks like new, then it came to how to repair it and make it work again.
As many forum memeber know, after v2.35 and on all 3000t/4000a firmwares, boot from usb is no longer supported. Although I got the raw chip data from my friend, and could fix it by replace the chip with a programmed new one, but without soldering and keep everything origional is still better, then I suddenly realized keysight still leave us a great solution.
There are 2 images in the firmware! The image 1 is which we usually used to do the repair. The image 2 is only active when the system thinks it got a firmware corruption. Maybe I could try to use the image 2 to repair the scope. Then I do the classic way, ksx to cab, get the nk.bin.comp, convert to nk.nb0, and use teraterm to transfer the image to the scope, after some time, go 0x00362000, waiting nervously, the scope showed up the classic window to ask for firmware reinstall, it came to life! And after a firmware update, it fully recovered and booting smoothly.
Hope this story could give someone some ideas one day, the firmware origionally in the scope still use agilent splash screen so it's a very early version, and what I use to do the recovery is the 7.66 version, so I believe this method might needn't to make the firmware have version close to the one in the scope and maybe it's a easier way.
Have to say, a 12 inch touch display is quite amazing, and much better than the no touch one on the 3000A series.

[sprit]

Hello,

Does anyone have this version?

Code: [Select]

01.01.0000000000 1.01
01.01.2010010700 1.01

01.20.2011063000 1.20
02.00.2011101301 2.00
02.01.2011111500 2.01
I need these versions for personal research purposes. I would greatly appreciate it.

Sincerely,

Feng

#edited

[onesystem]

Hello,
Does anyone have this version?

Code: [Select]

01.01.0000000000 1.01
01.01.2010010700 1.01
01.10.2011031600 1.10
01.20.2011063000 1.20
02.00.2011101301 2.00
02.01.2011111500 2.01I need these versions for personal research purposes. I would greatly appreciate it.
Sincerely,
Feng

There is an excellent blog by one of the members of this forum:https://www.salvagedcircuitry.com/2000a-nand-recovery.html

It has in it the archive of firmware:https://www.salvagedcircuitry.com/docs/2000a-nand-recovery/2000a-3000a-firmware.zip

See if you find in it what you need.

[sprit]

Hello.

Unfortunately, neither Savage nor xDevs' repositories contain firmware versions lower than 2.10.

I searched the forums and found some links, but they are all expired. I also messaged them, but their account has been inactive for several years, so things are pretty much at a standstill.

[tv84]

Unfortunately, neither Savage nor xDevs' repositories contain firmware versions lower than 2.10.

You're wrong. Salvage repo has 2000XSeries.01.10.2011031600.

[BillCRM]

Actually even sprit's own photo shows the 1.10 version. He didn't realized it.

[sprit]

  mybad. I mean the versions I mentioned above. The available versions don't have what I'm looking for.   

So, yeah, I need version 2.0. Sorry for the misunderstanding. 

Sincerely,

Feng

[tv84]

I mean the versions I mentioned above.

   But 2000XSeries.01.10.2011031600 is one of the versions you have in you list! 

[sprit]

  edited.

By the way, could you share version 2.05 of 3000x? Thank you very much.

Feng

[LorenzoDL]

2.66 - patched, with instructions:
https://drive.proton.me/urls/1K0PPRF874#FXGQ6VhVbNJK

First of all, thanks everyone for this massive work.

I have a couple of questions, should this patch work for a 3000 series scope? (I have a 3034A)
my understanding is that there is no difference in the fw binaries between the 2000 and 3000 firmwares, but I don't know if there is a difference in the patching.

Also has someone be able to patch the 2.67 fw?

Thanks, Lorenzo

[sprit]

Work hard play hard   
Finally, the serial number and model number are back. It took too long. 
Now I need to find an older firmware version to figure out how to calibrate it. 

[dso2ng]

Hi wp_wp and BillCRM,

First of all, thank you so much for all the incredible work shared in this thread. It has been extremely helpful.

I recently acquired a DSOX4034A and I'm trying to patch the V7.66 firmware. I saw that wp_wp has successfully patched V7.66 for the 4000A/4000G series (Reply #3720), and BillCRM has also been working with V7.66 on a DSOX4032A (Reply #3785).

Would either of you be willing to share the specific nk.bin offsets (or context bytes / hex signature) for the Options Patch and Nag Patch locations in the 4000X series V7.66 firmware? The record number would also be very helpful.

I've read through the thread extensively and understand the patching process (extract nk.bin, hex edit, fix checksum, repack), but I'm stuck on locating the exact patch addresses for this specific firmware version.

Any help would be greatly appreciated. Thanks in advance!

[Infor]

DSOX4000A V7.66 WinCE nk.bin patcher (Options + Nag + checksum adjust)
Offsets and byte changes:
    Patch Options
    0x01273223 : 0x04 -> 0x00
    0x01273224 : 0x00 -> 0x00
    0x01273225 : 0xA0 -> 0xA0
    0x01273226 : 0xE1 -> 0xE3
    Patch Nag
    0x012F0553 : 0xB4 -> 0x01
    0x012F0554 : 0xF1 -> 0x00
    0x012F0555 : 0x93 -> 0xA0
    0x012F0556 : 0xE5 -> 0xE3
  Checksum field
    checksum_offset = 0x00DC8F07
    New checksum
    (Example from notes: 0x3F397201 -> 0x3F397066 after these edits)

[sprit]

Hi, after some testing, I finally succeeded in restoring (90%) this DSOX2014.

Frustrated by the numerous bad blocks on my 128MB NAND cards, I replaced them with a 256MB card with fewer bad blocks, and that worked. I also tried a 512MB card, but that also had too many bad blocks, so I ultimately chose the 256MB card with the fewest errors xD.

Currently, there's only one minor issue with the LAN card. I can set a static IP address for it, but I can't ping or telnet to the device. Previously, when I telnetted, it always had an IP address quite similar to my PC's, like 192.168.1.xxx, and I could easily telnet to it using the username and password via that IP. But now, it always refuses to connect to my PC. If I set the LAN configuration to automatic, the IP range drops to 169.xxx.xxx.xxx. I've also tried scanning that IP range from the router but couldn't detect it. Am I doing something wrong?

By the way, could anyone share the calibration file for this model? I've searched for version 2.0 to find a way to downgrade and also to find the calibration method that the manufacturer hid in the firmware, but it seems to have disappeared from the internet, or maybe I just didn't use the right keywords to find them. Anyway, thank you all for your great contributions over the years, and I wish you all the best.

Sincerely,
Feng.

Code: [Select]

U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  fsmc-ecc1 256 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   smsc
Press space to stop autoboot:  0
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2015-05-07   8:18:27 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    37749 Bytes = 36.9 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK
RTC: 2024-1-23   19:39:15.42 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built May  7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008

fimage (3) is out of range. It must be a decimal integer between 0 and nimages (1)

System ready!
Preparing for download...
RTC: 2024-1-23   19:39:15.47 UTC
 Loading image 1 from memory at 0xD0400000
O
BL_IMAGE_TYPE_BIN

X
XXXXXOOOOXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXOOOOOOOOOXOOOOXXXOXOXXXOOXOXXOXXXXOOOXXXOOOOOXOOXOXXXOOOXXOOOXXOOOOXOOXOOXXOOOXOOOOOXOOOXOOOXXXXXXOXOXXOXXXXXXXOXXXOOOXOOOOXXOOOOXOOOOXOXOXOOOOOOXOOOOXOXOOOOOXXOOOOOXXOOOOX
XOOOOOOOOOXOOOOXOOOOOOOXXOOOOOXXOOOOXOXOXOOXOXOOOXOOOXOOOXXXOXOOOXOXXXXOXOOXXOXXOXXOOOXXOXOXXOXXXXXOOXOXXXXOXOOXOXOOOOXOOOOXOOOXOOXOOXOOOXOOXXXXXXXXXXXXXXOXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x124867C, LaunchAddr = 0x80362000

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x124867C  Name="" Target=RAM
 Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
RTC: 2024-1-23   19:39:17.90 UTC
Launching windows CE image by jumping at address 0x  362000

Windows CE Kernel for ARM (Thumb Enabled) Built on Jun 16 2009 at 10:08:15
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Feb 22 2012)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
FMD_GetBlockStatus::Logical block 0x3E5 is marked as bad
FMD_GetBlockStatus::Logical block 0x4D6 is marked as bad
FMD_GetBlockStatus::Logical block 0x3E5 is marked as bad
FMD_GetBlockStatus::Logical block 0x4D6 is marked as bad
 EDeviceLoadEeprom, MAC address not programmed.
-EDeviceLoadEeprom 03:04:05:06:07:08
Phy found addr 31 (ticks=3715)
WaitForLink Start (ticks=3716)
Link Detected (ticks=3719)

 GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
Flushed Transmit Buffer
phyCfg->dwSpeed 0x64
<--EDeviceInitialize

GMAC DMA status register = 0x600004
GMAC Device enable interrupt
DriverStart
GMAC Device enable interrupt
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Autonegociation Start (ticks=5743)
+StartAutoNegotiation: pDeviceContext 0xd05b37e0
Starting ProcessStartupFolder
running \Secure\Startup\infiniivision.lnk...
Running infiniiVisionInstallHelper
Autonegociation End (ticks=8253)
WaitForLink Start (ticks=8254)
Link Detected (ticks=8257)

 GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
cable attached
Ending ProcessStartupFolder
                           Before P/Invoke
Running ConfigureNetworkNative
Loading \Agilent Flash\config\networkSettings.xml configuration file.
Waiting for network to configure.
Our command line is
Performing Startup

      creating \Agilent Flash\webupdate\Released build, Feb 22 2012, 09:04:05
Initializing FPGA...
****
FPGA Type: Idaho
Ver: 1.087 Released
Build Time: Wed Jan 04 19:40:14 2012
Build Machine: DW3647M2
****
<?xml version="1.0"?>
<networkConfig><dhcp>true</dhcp>
<ipAddress>169.254.201.195</ipAddress>
<subnet>255.255.0.0</subnet>
<gateway>0.0.0.0</gateway>
<dnsServer>0.0.0.0</dnsServer>
<hostName>a-dx2014a-70964</hostName>
<domainName></domainName>
<adapterName>GMAC1</adapterName>
</networkConfig>

Failed to start/configure network.
Programming LAN option module...
Option module FPGA programing DONE...
Keyboard firmware version mismatch, 31 (binary) vs 32 (keyboard)
Programming keyboard firmware...
  Initializing UART... ok
  Unlocking flash memory... ok
  Erasing flash memory... ok
  Blank checking... ok
  Writing memory... ok
  Verifying memory... ok
New keyboard firmware version 1.031... ok
Keyboard Info: Board id 7, Board rev 2
Startup sequence is complete.
System has been running 69.830719 seconds
Start Up Sequence 56.085680
Memory Load 49%
   System Physical Memory 38.520 / 79.648 MB
   Process Virtual Memory 43.813 / 1024.000 MB
-----> InfiniiVision is running <-----


[analogRF]

DSOX4000A V7.66 WinCE nk.bin patcher (Options + Nag + checksum adjust)
Offsets and byte changes:
    Patch Options
    0x01273223 : 0x04 -> 0x00
    0x01273224 : 0x00 -> 0x00
    0x01273225 : 0xA0 -> 0xA0
    0x01273226 : 0xE1 -> 0xE3
    Patch Nag
    0x012F0553 : 0xB4 -> 0x01
    0x012F0554 : 0xF1 -> 0x00
    0x012F0555 : 0x93 -> 0xA0
    0x012F0556 : 0xE5 -> 0xE3
  Checksum field
    checksum_offset = 0x00DC8F07
    New checksum
    (Example from notes: 0x3F397201 -> 0x3F397066 after these edits)

any chance you might also have the patch for 2.67 on 3000X?
I know the option and nag patches but I cannot figure out the checksum range