EEVblog Electronics Community Forum
Products => Test Equipment => Topic started by: eevblogfan on April 08, 2013, 07:22:59 am
-
hey
I know it's stupide/newbie question but I'll ask it anyway ,
as all knows , you buy the base unit witch in terms of HW it has all , but licence is the big deal witch cost you a-lot , the question is : have anyone tried to write he's own version ? have anyone successfully hack the scope andupgraded the BW to say 200Mhz instead of 70 or so on ? or enable the memory function gen etc ??
P.S: I don't know if it's related to here or perhaps projects (?) so please move me if I am wrong :palm:
thank you in advance :)
-
Nope, no one has done it yet.
-
what a buger :(
since I don't know FPGA and al that sort of stuff I can't even try by my own :'(
it'll be funny if ther's someone who does know how and will manage to do that :-DD
-
Since only thing you need to do to activate all the options is to input correct code. So everything is in there. But I'm pretty sure that Agilent uses some sort assymetric public key crypto system. And I'm also quite sure that whichever chip in the scope does that, is probably tamper-protected to prevent key extraction.
And if you find a way to break/bruteforce that sort of crypto be ready for either of those things to happen:
-get a job in CIA/FBI/etc
-get shot by CIA/FBI/etc
-make it public and get a Nobel prize (and then get shot by CIA/FBI/etc)
-
License hacks were fairly trivial on the earlier scopes as the keys used were accidentally exposed in a firmware update. They're apparently using new keys now, so current scopes aren't vulnerable, but the older ones still are, even with the newly released features.
There was quite a discussion about it in the original thread about these scopes.
Of course you don't get the probes if you hack increased b/w or MSO features, and they frequently give away the wavegen + dvm features - the serial decode and memory options are more attractive.
-
License hacks were fairly trivial on the earlier scopes as the keys used were accidentally exposed in a firmware update. They're apparently using new keys now, so current scopes aren't vulnerable, but the older ones still are, even with the newly released features.
Really? I thought most of the options were only embedded in the newer firmware releases?
-
License hacks were fairly trivial on the earlier scopes as the keys used were accidentally exposed in a firmware update. They're apparently using new keys now, so current scopes aren't vulnerable, but the older ones still are, even with the newly released features.
Really? I thought most of the options were only embedded in the newer firmware releases?
Sure, but putting a newer firmware on an older scope does not alter the keys.
-
License hacks were fairly trivial on the earlier scopes as the keys used were accidentally exposed in a firmware update. They're apparently using new keys now, so current scopes aren't vulnerable, but the older ones still are, even with the newly released features.
Really? I thought most of the options were only embedded in the newer firmware releases?
Sure, but putting a newer firmware on an older scope does not alter the keys.
But why would they offer a trial matching the keys on a firmware version that doesnt have that option embedded? As far as I can tell the old firmware simply doenst have some of the options, so they might need to continue offering the trials of the options that were available in the leaked key against it for that odd customer who hasnt done a firmware update, but why would they release trials or licenses for the new options against the old keys? since you'd have to have the new firmware installed to use them.
-
I don't understand why the keys would be persistent in the scope - surely new firmware = (potentially) new keys, if you want a newer option one an old scope you need to update the FW anyway.
I think I'd be looking at how easy it is to load a modified firmware image - finding the "If <something> then <enable funtion>" code and patching it out shoudn't be that hard.
-
I don't understand why the keys would be persistent in the scope - surely new firmware = (potentially) new keys.
I guess if the trusted keys were part of a user-initiated update process they would be much easier to manipulate than if they're stored in some memory that is at least never written from the code, or possibly write-protected or write-once?
If they're doing secure boot from a read-only bootloader it's probably pretty hard to circumvent, depending on how secure their 'read only' is. If the code can be modified relatively easily and the 'scope will accept it, well it's kind of pointless, but why make things easy ;).
-
Actually the private key used to generate the code does not need to be present in the scope at all. Checking validity of the code can be done with a different (public) key. Knowing that key will not help with generating a new code. All this assuming a correctly implemented public key system. Did they bother to do this or used the same key for both encryption and validation? I guess time will tell ;)
-
I don't understand why the keys would be persistent in the scope - surely new firmware = (potentially) new keys, if you want a newer option one an old scope you need to update the FW anyway.
If they did, every single scope in the field would need new licenses issuing for every enabled feature.
And it's not clear how they would field upgrade scopes without exposing any new keys in the same way as the old keys were (the leak happened because they left the utility which initialises the scope, including the keys, inside the firmware package).
So it may actually involve not only issuing new keys, and new licenses, but recalling every scope so it can be done at the factory...
I guess they're happier just to ignore the small number of people who have both an original scope, and the desire to hack around with it. They're not cheap devices, I doubt it's a huge problem for them.
-
hey
can you use the 30 day trail and hack the scope to think the 30 day's weren't pass ?
thank you in advance :)
-
But why would they offer a trial matching the keys on a firmware version that doesnt have that option embedded? As far as I can tell the old firmware simply doenst have some of the options, so they might need to continue offering the trials of the options that were available in the leaked key against it for that odd customer who hasnt done a firmware update, but why would they release trials or licenses for the new options against the old keys? since you'd have to have the new firmware installed to use them.
The don't issue licenses against firmware versions, they issue licenses against a key, which is stored securely on the scope and (so far) is not updated. Old scopes have one key, which was accidentally published, and new scopes have a different key which AFAIK is still secure.
They likely won't change the keys in a firmware update, and doing so securely would be expensive and awkward for both them and customers (see my previous reply to Mike on why I think that is the case).
They can determine which key your scope uses, presumably just using the serial number, which they need to have in order to issue a license anyway, as it's part of the license string (which is what prevents a license for one scope being any use on another).
Certainly to date, an old scope uses the old keys even with the latest firmware, and so licenses for the new features *need* to be issued with those keys.
-
I don't understand why the keys would be persistent in the scope - surely new firmware = (potentially) new keys, if you want a newer option one an old scope you need to update the FW anyway.
If they did, every single scope in the field would need new licenses issuing for every enabled feature.
That assumes that installed licenses are stored as-is, and validated at startup, which isn't the only way to do it.
One approach would be that 'feature enable' flags are stored in NVRAM or system-writable flash, and get set by entering the license key. So the key is only needed for the process of activating a new feature, and can live in the firmware. Key updates would only affect the process of issuing new licenses, which would be manageable fairly easily, by saying that any new licenses must be installed under the latest FW version.
Obviously this assumes a suitably secure nonvolatile store - NVSRAM in a BGA would be pretty effective.
It also assumes you can't load unauthorised firmware, but if you could, you could patch out the checks so that's no worse.
-
You'd need to store more than a flag, as the license may also contain an expiry date, and the storage would need to be flexible to store any number of licenses, whereas by only storing the key and the serial#, it's fixed, and quite small. By storing the license and validating, it can be as large as there is ordinary flash storage and forward compatible with any new software feature.
And I'm not really making assumptions here - it's been established that license hacking in this way works, so implementation details aside, this is how it is done.
So yes, they could have implemented the system differently, but they didn't. It wouldn't have mattered if they hasn't released their own keys.
-
Ha, I almost created the same thread when I started looking at the 2000/3000 X-Series. After quite a bit of searching I was able to find a couple threads that made it sound they had not been hacked. Sort of surprising considering how many very intelligent people buy and use this kind of tool. Oh well, maybe someday. Until then, I guess Agilent just gets more money from me. :(
-
Sort of surprising considering how many very intelligent people buy and use this kind of tool.
I just assumed most of the people/companies who could readily afford that type of tool don't really need to be hacking options.
-
You'd need to store more than a flag, as the license may also contain an expiry date, and the storage would need to be flexible to store any number of licenses, whereas by only storing the key and the serial#, it's fixed, and quite small. By storing the license and validating, it can be as large as there is ordinary flash storage and forward compatible with any new software feature.
True, but I'd guess storing an expiry date still takes less space than a license key, so probably not much difference. Just need to allocate enough fixed locations for the number of envisaged future options, as opposed to the maximum number of keys installable at one time.
-
Sort of surprising considering how many very intelligent people buy and use this kind of tool.
I just assumed most of the people/companies who could readily afford that type of tool don't really need to be hacking options.
What marmad said.
We don't need a philosophical argument here but remember that Agilent maintains its cutting edge because its profitable. If it wasn't profitable they wouldn't be in that market. I never understood this really - it's not like Agilent has a lock on the market - if you don't like or can't afford their equipment buy something else. There's plenty of manufacturers out there.
-
Sort of surprising considering how many very intelligent people buy and use this kind of tool.
I just assumed most of the people/companies who could readily afford that type of tool don't really need to be hacking options.
Thats what I would assume as well, but the mere concept of "hacking" did not come about from those trying to save money, but for the challenge of undoing what was done and beating a system. Then they typically just give it to the rest.
-
Sort of surprising considering how many very intelligent people buy and use this kind of tool.
I just assumed most of the people/companies who could readily afford that type of tool don't really need to be hacking options.
What marmad said.
We don't need a philosophical argument here but remember that Agilent maintains its cutting edge because its profitable. If it wasn't profitable they wouldn't be in that market. I never understood this really - it's not like Agilent has a lock on the market - if you don't like or can't afford their equipment buy something else. There's plenty of manufacturers out there.
You cant understand the natural desire to get more for less? Everyone wants that, we just dont always get it.
-
Thats what I would assume as well, but the mere concept of "hacking" did not come about from those trying to save money, but for the challenge of undoing what was done and beating a system. Then they typically just give it to the rest.
In general that might be true - but in this context - hacking test and measurement gear (which means you might brick the equipment which you use - i.e. much different possible ramifications than mere software hacking), I think the motives would likely be closer to getting bandwidth, options, etc. that you'd like to have for your own use - but can't readily afford to pay for.
-
Thats what I would assume as well, but the mere concept of "hacking" did not come about from those trying to save money, but for the challenge of undoing what was done and beating a system. Then they typically just give it to the rest.
In general that might be true - but in this context - hacking test and measurement gear (which means you might brick the equipment which you use - i.e. much different possible ramifications than mere software hacking), I think the motives would likely be closer to getting bandwidth, options, etc. that you'd like to have for your own use - but can't readily afford to pay for.
Well I was referring to the real first hacking, back in the hardware, phreaking, etc days before there was "software", but yes I understand your point.
-
There's no real need to hack them anyway given you can just dial back the clock.
-
really ?
can I use the 30 day trail and after 30 days "just" dial the clock back in time and the trail will be accessible again ?
-
You'd need to store more than a flag, as the license may also contain an expiry date
In that case you know the date from the info screen, so you might be able to use that as a baseline to search in the firmware :-//
-
Sort of surprising considering how many very intelligent people buy and use this kind of tool.
I just assumed most of the people/companies who could readily afford that type of tool don't really need to be hacking options.
Yes, the vast majority have no need nor desire to hack their scope, nor would most even think to look for one. Agilent know that and rely on that. If a hack did eventually happen, I doubt they would bat much of an eyelid.
-
Yes, the vast majority have no need nor desire to hack their scope, nor would most even think to look for one. Agilent know that and rely on that. If a hack did eventually happen, I doubt they would bat much of an eyelid.
Honestly, it seems as if even Rigol is not that worried about it (with the DS2000, DS4000, DG4000 series models all being identical inside). It appears as if they've expanded and released better-designed and built lines of test equipment after all of the publicity (and sales) surrounding the DS1000 hack - so I'm guessing it didn't financially damage the company. ;)
-
really ?
can I use the 30 day trail and after 30 days "just" dial the clock back in time and the trail will be accessible again ?
AFAIK one thing they have done is made it not possible to set the clock back to before the release date fo the current firmware. Not sure if they have done anything else to prevent re-trials. Might also be interesting to see if you can request the same trial more than once.
-
really ?
can I use the 30 day trail and after 30 days "just" dial the clock back in time and the trail will be accessible again ?
Yep, the licenses get deleted once they expire but if you dial the clock back you can install them again. So just dial the clock as far back to the build date of the FW you are on after you install and you are golden, of course the only draw back is that you can't install FW updates that comes later than the trial expiration date.
The reinstall trick doesn't work with the internal 30day full trial since there's no install file, I lost them when I dialed the clock forward so they are gone forever for me. I suspect that if you dial forward to 2099 first before activating them and then dial back it might work.
Might also be interesting to see if you can request the same trial more than once.
Tried that, no go. They keep a record of your applications on their server.
-
I think only the hobbyists and work for yourself types would ever bother hacking their equipment, and the % of buyers who would do such a hack are probably a negligible (not 0, but not too important) fraction of their sales.
-
really ?
can I use the 30 day trail and after 30 days "just" dial the clock back in time and the trail will be accessible again ?
The reinstall trick doesn't work with the internal 30day full trial since there's no install file, I lost them when I dialed the clock forward so they are gone forever for me. I suspect that if you dial forward to 2099 first before activating them and then dial back it might work.
Might also be interesting to see if you can request the same trial more than once.
Tried that, no go. They keep a record of your applications on their server.
I have just got an new scope(demo model) with some active trials in it, i dont have the keys so is there any way to export them out for backup ?
Tooms
-
really ?
can I use the 30 day trail and after 30 days "just" dial the clock back in time and the trail will be accessible again ?
Yep, the licenses get deleted once they expire but if you dial the clock back you can install them again. So just dial the clock as far back to the build date of the FW you are on after you install and you are golden, of course the only draw back is that you can't install FW updates that comes later than the trial expiration date.
The reinstall trick doesn't work with the internal 30day full trial since there's no install file, I lost them when I dialed the clock forward so they are gone forever for me. I suspect that if you dial forward to 2099 first before activating them and then dial back it might work.
Might also be interesting to see if you can request the same trial more than once.
Tried that, no go. They keep a record of your applications on their server.
This worked for me only once, setting the clock back and run self cal. The second time they've expired looks like for good. I've tried a couple of different "procedures" but no joy..
-
really ?
can I use the 30 day trail and after 30 days "just" dial the clock back in time and the trail will be accessible again ?
Yep, the licenses get deleted once they expire but if you dial the clock back you can install them again. So just dial the clock as far back to the build date of the FW you are on after you install and you are golden, of course the only draw back is that you can't install FW updates that comes later than the trial expiration date.
The reinstall trick doesn't work with the internal 30day full trial since there's no install file, I lost them when I dialed the clock forward so they are gone forever for me. I suspect that if you dial forward to 2099 first before activating them and then dial back it might work.
Might also be interesting to see if you can request the same trial more than once.
Tried that, no go. They keep a record of your applications on their server.
This worked for me only once, setting the clock back and run self cal. The second time they've expired looks like for good. I've tried a couple of different "procedures" but no joy..
Which one stopped working? The built in one with all features or the downloaded one?
-
really ?
can I use the 30 day trail and after 30 days "just" dial the clock back in time and the trail will be accessible again ?
The reinstall trick doesn't work with the internal 30day full trial since there's no install file, I lost them when I dialed the clock forward so they are gone forever for me. I suspect that if you dial forward to 2099 first before activating them and then dial back it might work.
Might also be interesting to see if you can request the same trial more than once.
Tried that, no go. They keep a record of your applications on their server.
I have just got an new scope(demo model) with some active trials in it, i dont have the keys so is there any way to export them out for backup ?
Tooms
None that I know of, but since you got a demo unit are you sure it's not full licenses? Demo unit usually come fully activated since they aren't meant to stay in your possession for long. When I bought my 3014A the dealer gave me a demo unit before he got the stock in and that one was fully activated.
-
Which one stopped working? The built in one with all features or the downloaded one?
The built in trial that came with the scope. What's a "downloaded one"?
-
Which one stopped working? The built in one with all features or the downloaded one?
The built in trial that came with the scope. What's a "downloaded one"?
Ones that you can apply for on the website, they email you an .lic file, if those expire you just dial the clock back and reinstall.
-
None that I know of, but since you got a demo unit are you sure it's not full licenses? Demo unit usually come fully activated since they aren't meant to stay in your possession for long. When I bought my 3014A the dealer gave me a demo unit before he got the stock in and that one was fully activated.
it has the trial for all options for around 90 days and then they will expire.
I can see in the papirs that i got that they install the demo licenser there is having a runtime of 120 days and there is about 90 days left now, but i dont have the key files and was hoping that i can export them some how.
Thanks
Tooms
-
None that I know of, but since you got a demo unit are you sure it's not full licenses? Demo unit usually come fully activated since they aren't meant to stay in your possession for long. When I bought my 3014A the dealer gave me a demo unit before he got the stock in and that one was fully activated.
it has the trial for all options for around 90 days and then they will expire.
I can see in the papirs that i got that they install the demo licenser there is having a runtime of 120 days and there is about 90 days left now, but i dont have the key files and was hoping that i can export them some how.
Thanks
Tooms
Well, logic dictates that there must be hidden SCPI commands that access what you need. Either way even if you can extract them you have to return the demo unit anyway, and those licenses are locked to the serial of the scope.
Unless you mean you bought an ex-demo?
-
None that I know of, but since you got a demo unit are you sure it's not full licenses? Demo unit usually come fully activated since they aren't meant to stay in your possession for long. When I bought my 3014A the dealer gave me a demo unit before he got the stock in and that one was fully activated.
it has the trial for all options for around 90 days and then they will expire.
I can see in the papirs that i got that they install the demo licenser there is having a runtime of 120 days and there is about 90 days left now, but i dont have the key files and was hoping that i can export them some how.
Thanks
Tooms
Well, logic dictates that there must be hidden SCPI commands that access what you need. Either way even if you can extract them you have to return the demo unit anyway, and those licenses are locked to the serial of the scope.
Unless you mean you bought an ex-demo?
yes i have bought an ex-demo msox3024a there is as good as new but cheaper
Tooms
-
None that I know of, but since you got a demo unit are you sure it's not full licenses? Demo unit usually come fully activated since they aren't meant to stay in your possession for long. When I bought my 3014A the dealer gave me a demo unit before he got the stock in and that one was fully activated.
it has the trial for all options for around 90 days and then they will expire.
I can see in the papirs that i got that they install the demo licenser there is having a runtime of 120 days and there is about 90 days left now, but i dont have the key files and was hoping that i can export them some how.
Thanks
Tooms
Well, logic dictates that there must be hidden SCPI commands that access what you need. Either way even if you can extract them you have to return the demo unit anyway, and those licenses are locked to the serial of the scope.
Unless you mean you bought an ex-demo?
yes i have bought an ex-demo msox3024a there is as good as new but cheaper
Well then become drinking buddies with the dealer, they probably have the files then.
How much did you pay? My 3014A after taxes came in at 6333K USD (190k NTD at 30/1 exchange rate), this is with the SEGMEM and MEMUP options, I also got the Front Panel Cover for free.
-
yes i have bought an ex-demo msox3024a there is as good as new but cheaper
Well then become drinking buddies with the dealer, they probably have the files then.
How much did you pay? My 3014A after taxes came in at 6333K USD (190k NTD at 30/1 exchange rate), this is with the SEGMEM and MEMUP options, I also got the Front Panel Cover for free.
it is an less then 3 month old MSOX 3024A with the LAN/VGA, wavegen, volt meter options and 3 year warrent for the price of 5985$ (with the danish sales tax of 25%)
I also got an front cover and bag for free with the unit and as it is an demo unit then i have all the options for 90 days
it was via the locale agilent partner in Denmark so it is easy for me if there is an issue with
The options that i think i will get leter on for it is I2C, RS232 and maybe the power analyzer option.
Tooms
-
Well, logic dictates that there must be hidden SCPI commands that access what you need.
Why? There is no legitimite reason to need to read license data out.
-
True, but I'd guess storing an expiry date still takes less space than a license key, so probably not much difference. Just need to allocate enough fixed locations for the number of envisaged future options, as opposed to the maximum number of keys installable at one time.
For one or two licenses perhaps storing a flag+date would be more compact, but once you need space for several licenses then storing just the key (which is fairly compact and applies to all licenses) ought to be smaller.
The other possible issue I can think of with your suggested scheme is that it means that the scope firmware necessarily contains the ability to write to the secure storage area, which would provide an additional attack surface for a hack attempt. You can either use an exploit in the firmware to flip a flag, or use the knowledge of how the secure-store is written to in order to write it directly.
With their existing scheme, the software only needs to be able to verify a hash using the securely stored key value, and never needs to write anything, so the mechanism to do so can be left out entirely. The full key information required to author the hash in the first place doesn't even need to be present at all.
Until some muppet leaves the scope initialisation tool in the firmware package.
Of course as you said earlier, the firmware itself could be an easier target than the licenses, for the scopes where the key information is unknown. If the only license check is in the software, it could be as simple as changing a branch or two. The only thing to work out would be what verification of the firmware code is done, and how to defeat it. But fiddling with that seems far more likely to lead to a possibly bricked scope, so it's not something I'd necessarily try unless I either had money to burn or a really pressing need for a feature I couldn't afford to buy...
-
Of course another entirely practical, and more secure solution would be for every scope to have a unique key. When they issue a license they just look it up on their internal database of keys vs. serial number. They already program unique serial numbers in, so adding a unique key would be minimal additional hassle.
The only additional effort would be to link the license issuing system with the production key generator.
-
With their existing scheme, the software only needs to be able to verify a hash using the securely stored key value, and never needs to write anything, so the mechanism to do so can be left out entirely.
As far as I can tell the existing scheme does not store any key, the public key(s) are in the firmware. Which key to use is determined by something in secure storage. Secure storage holds that something, the scope model and serial number. It looks like licences are pretty much stored as received.
Until some muppet leaves the scope initialisation tool in the firmware package.
I very much doubt it was left. I suspect initially the secure storage was encrypted or signed with the same key used to generate licences. The desire to have the scope model number change to reflect installation of MSO and bandwidth options meant the scope had to re-write secure storage and needed to have the private key. Embedding the initialisation tool was an easy kludge to achieve that. The muppet was the one that wanted to change the model number, or the software guy who didn't tell him it was a gaping security hole. That's my theory anyway.
Has anyone recently installed MSO or bandwidth options with a license? Did the model number change?
-
Well, logic dictates that there must be hidden SCPI commands that access what you need.
Why? There is no legitimite reason to need to read license data out.
There has to be some means to fiddle with the license state when they prep the ex-demo for release at least, granted there might only be overwrite commands available.
"5985$"
Wow, that's an awesome deal!
-
Has anyone recently installed MSO or bandwidth options with a license? Did the model number change?
Neither changes the model number - not with the firmware revision which contained the initialisation tool, nor the very latest.
-
Of course as you said earlier, the firmware itself could be an easier target than the licenses, for the scopes where the key information is unknown. If the only license check is in the software, it could be as simple as changing a branch or two. The only thing to work out would be what verification of the firmware code is done, and how to defeat it. But fiddling with that seems far more likely to lead to a possibly bricked scope, so it's not something I'd necessarily try unless I either had money to burn or a really pressing need for a feature I couldn't afford to buy...
Someone who can afford the scope might be more likely to have EEPROM programmers and the like as well, meaning recovery from accidental bricking may not be too difficult. Unless there's some storage that can't be rewritten with external hardware somehow...
Mike makes it look too easy. :D (http://youtu.be/Qjw0NDeP-0Q)
-
Just to make it clear:
* Licenses are stored pretty much as the XML files (same fields) and are loaded/checked from the "Secure NV" on startup
* There is several public keys used to check the license signature, which key is used is dependent of the serial number of the scope. The secret key for the first public key, which is used for all early scope serials, has been leaked by Agilent themselves as a mistake and so it's trivial to generate your own licenses for those scope. That's been common knowledge forever ... it's explained in the original thread somewhere pretty early. Nobody published an easy tool, probably because :
- "why risk it": since it deals with "encryption keys" it might have some legal implications that a fw diff doesn't have
- "why risk agilent fixing the problem": if the problem is not widespread, why bother dedicating resources to fix it thoroughly, their current "work around" works well enough and is safe for all previously issued licenses.
In the worst case, if license code was fixed, attacking the firmware should be possible (despite code signing), but I'm certainly not about to risk bricking a 7k$ piece of test gear ...
-
Just to make it clear:
(...)
In the worst case, if license code was fixed, attacking the firmware should be possible (despite code signing), but I'm certainly not about to risk bricking a 7k$ piece of test gear ...
Your last sentence pretty much sums up all I went through. Happy ending though.
Is anything actually signed or just strong named or whatever they call it?
-
Just to make it clear:
* There is several public keys used to check the license signature, which key is used is dependent of the serial number of the scope. The secret key for the first public key, which is used for all early scope serials, has been leaked by Agilent themselves as a mistake and so it's trivial to generate your own licenses for those scope.
I wonder how hard it is to change the serial number.... 8)
-
My warranty is fixed to the serial number. I am never gonna change it. :(
If you can change it, you can change it back
-
Hey guys,
I am the first one to try the firmware on my 2000x scope and it worked for me. I took the risk of bricking my scope but well I was rewarded with a fully enabled scope.
I don't have a 3000x so I can't say that but I am sure it works on that too since he tested it himself.
So it is a good news for 2000x and 3000x owners.
-
which FW version is this modified firmware based on ?
What is going to happen if I flash this new modded one and afterwards I flash brand new FW when Agilent releases it ?
-
Hey
can you tell me Why is the BW limit only does 20Mhz and don't ask me if I want 100Mhz , Full BW or 20Mhz ?
Ps , Is it software related ? , Ie , can you add that into new version of your file ?
and is that possible to somehow add say in the coupling menu to say put 50 Ohm impidance ? ( I suspect not right ? , becouse ther's no Hw whos support that ... )
thank you :)
-
I think that there is no 50ohm input at DSOX2000. DSOX2000 and DSOX3000 have quite different motherboards.
-
I am the first one to try the firmware on my 2000x scope and it worked for me. I took the risk of bricking my scope but well I was rewarded with a fully enabled scope.
I might have seen it work as well. Just so you know.
-
Confirmed. Works as expected.
-
Pretty darn cool. Ill wait till someone releases such a fix for free through. I dont like the idea of having to pay for cracks/hacks.
-
Does the hacked firmware void the warranty??
-
Does the hacked firmware void the warranty??
More than likely, however like Jailbreaking or something, if you can get the original firmware back on there before you send it in for servicing theyll probably never know you were ever running a customer firmware.
-
Pretty darn cool. Ill wait till someone releases such a fix for free through. I dont like the idea of having to pay for cracks/hacks.
Uhm... how much djvinc charges for this firmware? It's really uncool...
-
Pretty darn cool. Ill wait till someone releases such a fix for free through. I dont like the idea of having to pay for cracks/hacks.
Uhm... how much djvinc charges for this firmware? It's really uncool...
Nevermind, apparently Im not allowed to post the details. PM them for the pricing.
-
Uhm... how much djvinc charges for this firmware? It's really uncool...
The firmware is an initiative that requires a contribution, for many reasons I can't explain easily on this topic. Happy to tell on PM though.
Well, "contribution" should work like "If you like my work - please donate".
It should be all about pride and accomplishment... Making this kind of hacking for living is just low...
I'm surprised, that people on this forum are willing to pay for this - curious what Dave thinks about it 8)
-
Nevermind, apparently Im not allowed to post the details. PM them for the pricing.
Not allowed by whom?
-
Uhm... how much djvinc charges for this firmware? It's really uncool...
The firmware is an initiative that requires a contribution, for many reasons I can't explain easily on this topic. Happy to tell on PM though.
Oh come on, the reason is you want the money.
-
Well, "contribution" should work like "If you like my work - please donate".
It should be all about pride and accomplishment... Making this kind of hacking for living is just low...
I'm surprised, that people on this forum are willing to pay for this - curious what Dave thinks about it 8)
I will of course not allow this forum to be used as a basis to peddle anything potentially illegal, either content or services.
-
Well, "contribution" should work like "If you like my work - please donate".
It should be all about pride and accomplishment... Making this kind of hacking for living is just low...
I'm surprised, that people on this forum are willing to pay for this - curious what Dave thinks about it 8)
I will of course not allow this forum to be used as a basis to peddle anything potentially illegal, either content or services.
Requiring payment (or not) doesn't affect the legality. Possibly the sentence though.
-
FYI: djvinc's account and posts have been deleted at his request.
-
Well, now that that's cleaned up, who can provide us with one of the modified firmwares so we can compare it against the original to see what was changed?
-
Well, "contribution" should work like "If you like my work - please donate".
It should be all about pride and accomplishment... Making this kind of hacking for living is just low...
I'm surprised, that people on this forum are willing to pay for this - curious what Dave thinks about it 8)
I will of course not allow this forum to be used as a basis to peddle anything potentially illegal, either content or services.
Dave what about the Rigol Hack? Is that legal?
-
Dave what about the Rigol Hack? Is that legal?
How long is a piece of string?
How far do you want to open the can of worms?
IMO there is a big difference between sending a simple existing serial command down the existing provided interface, and reverse engineering and bypassing an encrypted software feature set.
Argue away...
-
Dave what about the Rigol Hack? Is that legal?
How long is a piece of string?
How far do you want to open the can of worms?
IMO there is a big difference between sending a simple existing serial command down the existing provided interface, and reverse engineering and bypassing an encrypted software feature set.
Argue away...
Really Dave? Read the first page of Hantek /tekway hack. Extensive reverse engineering was done. You have to by past software by renaming.
Perhaps consider taking down your potentially illegal Rigol hack video in the process :)
"I dont know" in your own tone :) Argument is not my thing, they are all just mind chatter between individuals trying to affirm their own belief.
-
Perhaps consider taking down your potentially illegal Rigol hack video in the process :)
"I dont know" in your own tone :) Argument is not my thing, they are all just mind chatter between individuals trying to affirm their own belief.
Legality aside there is a moral distinction between providing a platform where discussion of hacks/cracks is not censored and providing a platform where hacks/cracks are offered for sale.
-
Perhaps consider taking down your potentially illegal Rigol hack video in the process :)
"I dont know" in your own tone :) Argument is not my thing, they are all just mind chatter between individuals trying to affirm their own belief.
Legality aside there is a moral distinction between providing a platform where discussion of hacks/cracks is not censored and providing a platform where hacks/cracks are offered for sale.
If you own an Agilent perhaps you with think otherwise :) If Dave provide us a free hack I will very happy. Who wants to pay if we can get it free. If you have strong moral discipline, then don't even think about hacking, it is never morally correct.
-
Nevermind, apparently Im not allowed to post the details. PM them for the pricing.
Not allowed by whom?
Not "not allowed" specifically. Perhaps it was a bad choice of words. I was asked not to. And no, it was not by Dave.
-
Nevermind, apparently Im not allowed to post the details. PM them for the pricing.
Not allowed by whom?
Not "not allowed" specifically. Perhaps it was a bad choice of words. I was asked not to. And no, it was not by Dave.
So is it official now that "Agilent" hack is not allowed here in this forum, while other Chinese's stuff is ok ? ???
-
Nevermind, apparently Im not allowed to post the details. PM them for the pricing.
Not allowed by whom?
Not "not allowed" specifically. Perhaps it was a bad choice of words. I was asked not to. And no, it was not by Dave.
So is it official now that "Agilent" hack is not allowed here in this forum, while other Chinese's stuff is ok ? ???
Certainly not. Like I said I was not asked by Dave. As far as I care, he's the only one that makes anything "official" here. Rights of ownership. I just obliged the individual that asked me to edit my post. It's pretty simple to guess who might have asked that and for what reasons. I just dont want to be any further involved in the situation.
-
How many people use this hacked firmware?
And who is willing to release the files here (for free of course) .
-
Really Dave? Read the first page of Hantek / Tekway hack. Extensive reverse engineering was done.
you forgot two things:
- in Europe not a big deal, i own it so i can do what ever i wish to do (as long i do on my own device)
- at time of publishing there was no GPL code released, making these DSO illegal in EU, you can't sue someone
for hacking on not-existing (because illegal) gear.
Well, "contribution" should work like "If you like my work - please donate".
ehm, i give you some stats. I do have "please donate if you like" link, i mentioned it few times here and there (as well poeple who donated did it too) and honestly i did got together less than 300USD - in almost 3yrs. Not that i'm begging now for money, but simply telling the truth about donations.
I have no idea how many hours i spend total on these DSOs, but alone the fact that i reversed the PCB and drew schematics of already 3 hardware revisions was worth more than what i got as donation.
Right, i got now from someone almost brand new Hantek DSO for free (as he bought Rigol DS2202) and another guy was thinking about giving me his Voltcraft DSO for few months. But that's not result of donation but simply people who knows that i fucked up my company :\
Making this kind of hacking for living is just low...
Hardware reversing costs not only time but as well some lab resources, they need to be paid. So it's not for living.
In my case it was a bit different story, i was running my own business in last 10yrs, so for sure i had a chance to pay what was necessary. But other might not have that luck, so yes i understood why "djvinc" asked for money.
-
Hi
I've been following a number of these threads. I own some of the test gear in question but not all.
I understand the name hacker comes from the early days of computing when it was done as a challenge or for bragging rights. Personally, that is the way I look at it.
Whether the results are used by other is a personal decision really, googling turns up so much of this stuff anyway
My only concern if that Dave gets caught in the middle some legal thing or suppliers don't send stuff for review. We have a good thing here, open helpful discussion , a bit of fun and no nazi moderators. Lets not stuff it up
my opinion only flame away
-
Does anyone have the old firmware which leaked the private keys? Obviously Agilent removed it from the web site. If someone can supply me with it I think I can create a license key generator.
You can indeed, but it will only work on very old scopes because the newer ones (according to serial number) are using new keys. Now, if you've figured a way to change the serial number to use the old key or otherwise get around that, then do please elaborate.
-
I found only this:
http://translate.google.cz/translate?sl=auto&tl=en&prev=_t&hl=cs&ie=UTF-8&u=http://zavelos.ru/forum/25389-pomogite-vyitashhit-resurs-iz-dll&act=url (http://translate.google.cz/translate?sl=auto&tl=en&prev=_t&hl=cs&ie=UTF-8&u=http://zavelos.ru/forum/25389-pomogite-vyitashhit-resurs-iz-dll&act=url)
http://www.sendspace.com/file/q9gluq (http://www.sendspace.com/file/q9gluq)
and more discussion here and on following pages:
https://www.eevblog.com/forum/blog/new-agilent-scopes/150/ (https://www.eevblog.com/forum/blog/new-agilent-scopes/150/)
-
The way I see it cracking something for profit = illegal.
Hacking something because you are curious and want to really own what you paid for = real spirit of hacking.
In many EU countries (including mine) there are provisions in copyright law that let users copy/share/do whatever they want _as long as its not for profit_.
-
I'd still like to get the first key though, if anyone has it.
The file containing it is linked two posts up.
-
ehm, i give you some stats. I do have "please donate if you like" link, i mentioned it few times here and there (as well poeple who donated did it too) and honestly i did got together less than 300USD - in almost 3yrs. Not that i'm begging now for money, but simply telling the truth about donations.
Well, I know you are somewhat on "the other side", but... $300 isn't that bad. I think about "contribution" for hacking more like a tip, bonus, not real profit...
It was your choice to spend so many hours on this without thinking about future profits like him :)
Hardware reversing costs not only time but as well some lab resources, they need to be paid. So it's not for living.
[...] But other might not have that luck, so yes i understood why "djvinc" asked for money.
Well, when we are talking in general, I think there are two possible scenarios:
1) Someone already have skills, somewhat equipped lab. Then he buys a product for normal usage and start to tinker with it for pleasure / hobby.
2) Someone targets potentially hackable product, start to learn new skills, "invest" money for lab equipment or even additional people and in the end starts to sell the solution.
First scenario maybe is illigal in some countries, but usually morally acceptable.
But the second one? It's just organized crime... O0 Just like groups in Europe which hack cars immobilizers. Today you can buy this kind of device for 2003-2010 Volkswagen cars for about €400. You just plug it in OBD port, wait 10 seconds and start car with big screwdriver :palm: I guess they also spend many hours and many euros for that... ;)
Anyway - let's say 20 people payed him $140. Scope cost is covered (I don't think he had any other real expenses). And what after that? You think he will stop charging money for his solution? :-DD
-
I'd still like to get the first key though, if anyone has it.
The file containing it is linked two posts up.
I eventually figured out how to download it from that Russian site yesterday, but it doesn't seem to be a complete archive. I'll have another look later.
i have that file still localy and remote on hotfile
https://hotfile.com/dl/131446259/df706bb/3000XSeries.01.10.2011031600.cab.html
-
I'd still like to get the first key though, if anyone has it.
The file containing it is linked two posts up.
I eventually figured out how to download it from that Russian site yesterday, but it doesn't seem to be a complete archive. I'll have another look later.
You dont need download from Russian site. I already reupload the file:
http://www.sendspace.com/file/q9gluq (http://www.sendspace.com/file/q9gluq)
-
first you need the network module...
Indeed. It begs the question - has anyone whacked in a magjack and gotten the scope to use it yet? Early on I remember there was some effort to inspect the network module to see which pin to pull up/down to tell the scope it had a LAN port hooked up but I don't see whether anyone actually did it.
Or maybe if the scope will detect the LAN/VGA being inserted hot, one could just boot up the scope and run over the connector with a weak pullup/pulldown while watching the network menu to see if it activates. Then again, I wouldn't be surprised if rebooting is required after inserting a module.
-
Indeed. It begs the question - has anyone whacked in a magjack and gotten the scope to use it yet? Early on I remember there was some effort to inspect the network module to see which pin to pull up/down to tell the scope it had a LAN port hooked up but I don't see whether anyone actually did it.
There is a Xilinx XC3S100 FPGA on the board. Looks like it is for the VGA output (together with an ADV7125 triple DAC and a CY7C1325 RAM on the back), because the ethernet connection is just two wires, as Dave mentioned in one of his videos and as you can see in my photo of it:
http://i.imgur.com/OSoJtll.jpg (http://i.imgur.com/OSoJtll.jpg)
But I wouldn't be surprised, if they implemented some kind of protection in the FPGA. It has lots of LEs to implement even a small microcontroller in it for a simple verification protocol.
Or maybe if the scope will detect the LAN/VGA being inserted hot, one could just boot up the scope and run over the connector with a weak pullup/pulldown while watching the network menu to see if it activates. Then again, I wouldn't be surprised if rebooting is required after inserting a module.
This could damage the scope, too expensive for me to try it.
In general, I think it is ok to buy the network module. Then hack it :) but of course, don't sell or buy hacks for it.
-
I don't know if we're talking about the same network module, but the only one I know of is the LAN/VGA module which costs $400 USD so buying it is completely out of the question.
At one point I guess I had a brain fart and thought it was under $200, and I was half-seriously toying with the idea of trying to talk myself in to considering it. I looked up the price to get an exact figure for consideration and shat my pants so hard they probably felt the shockwave in china. I still haven't figured out how to cope with the fact that my primary high-end scope is lacking some very basic functionality that even won hung lo scopes usually have.
-
It's fair to buy it, if you are going to hack the rest :P
-
But I wouldn't be surprised, if they implemented some kind of protection in the FPGA. It has lots of LEs to implement even a small microcontroller in it for a simple verification protocol.
I'd say that would be highly unlikely. I really don't think they are too bothered about people making their own LAN interface. It would also be sensible to keep the LAN and VGA functions seperate in case they wanted to do different permutations in the future.
My money is it's just a mag-jack and a pin pulled. May not even be the latter if the Ethernet Phy can detect presence of the jack.
-
- at time of publishing there was no GPL code released
Not quite true. I addressed a request to Agilent directly to get the source for the GPL software distributed with the scope (u-boot mostly) and I received the source package back. I also posted a link to it in the first topic about this scope, probably more than a year ago.
Cheers,
Sylvain
-
I don't know if we're talking about the same network module, but the only one I know of is the LAN/VGA module which costs $400 USD so buying it is completely out of the question.
At one point I guess I had a brain fart and thought it was under $200, and I was half-seriously toying with the idea of trying to talk myself in to considering it. I looked up the price to get an exact figure for consideration and shat my pants so hard they probably felt the shockwave in china. I still haven't figured out how to cope with the fact that my primary high-end scope is lacking some very basic functionality that even won hung lo scopes usually have.
I was able to talk AgilentUsed (their eBay selling account) down to $170 for one. Though that was with my MSOX2024A purchase, but maybe it could be done separately or if someone is planning on buying a 2000 X-series from them...
-
Hi,
Agilent released a version of the 2000x/3000x firmware : v2.35, with minor enhancements.
For those who wonder / try to solve the puzzle, this new version 2.35 is hackable.
Have fun !
-
Wow i saw the Rigol 2000 thread and they are hacking license like nobody's business and reverse engineering I2C info like crazy.
https://www.eevblog.com/forum/testgear/sniffing-the-rigol's-internal-i2c-bus/msg256453/#msg256453 (https://www.eevblog.com/forum/testgear/sniffing-the-rigol's-internal-i2c-bus/msg256453/#msg256453)
-
I don't have this scope, but just out of curiosity - I've downloaded X2000 firmaware.
Where is the catch?
It seems, that modification should be really easy:
1. Unpack update file
2. Unpack infiniiVisionSetup.cab
3. Locate infiniivision.lnk file -> INFINI~1.027
4. Open it, add our precious command line switch, count number of characters and correct value in the beginning of file
5. Pack all files back to infiniiVisionSetup.cab
6. Compute MD5 check sum of infiniiVisionSetup.cab and replace it in recipe.xml
7. Pack all files back into update file
Am I missing any additional checksums/signatures somewhere?
The only (and most important) problem for me, it that I can't figure out what this command line switch is. I'm quite new to IDA and PE executables.
infiniiVisionLauncher.exe just passes command line arguments to infiniiVisionCore.dll, and this file is 16,5MB jungle |O
Nothing obvious popes out right away...
-
the cab file is signed, so if you try this you brick your scope :-\
-
Silly me :) I didn't realized that CAB files can be signed, like exe/msi etc. :)
But what about uboot? Which commands are implemented?
Maybe it will be possible, to modify lnk file via directly digging into file system (loading page from nand, modifying in RAM and writing back).
-
But I wouldn't be surprised, if they implemented some kind of protection in the FPGA. It has lots of LEs to implement even a small microcontroller in it for a simple verification protocol.
I can confirm that the LAN is working when only the ethernet pins are used. Tested with LAN/VGA module when the rest of pins were covered by Kapton tape.
The oscilloscope does not recognize installed module but the telnet, VNC and LXI are working properly. The IP is configurable only through LXI.
-
So we can make a LAN plugin ourselves.
-
So if I put together a PCB with a magjack and plug it into the scope, presumably it has a default IP?
From there, it remains to break out the RS232 lines to the CPU and add that magic command line option and everything is up for grabs?
-
I have an idea to try: there is a kind of install batch script - recipe.xml inside the fw update cab. Replace update commands with a single command that starts infiniiVision.exe with that magic parameter, pack that xml into a .cab and try "updating" from it.
<?xml version="1.0"?>
<install>
<killProcess>infiniivisionLauncher.exe</killProcess>
<installStep>
<!-- replace /magicparameter with right one -->
<command>\Secure\infiniiVision\infiniivisionLauncher.exe /magicparameter</command>
</installStep>
</install>
Anyone willing to try? It shouldn't do any harm in any case - no write commands like original "loadP500Flash" there. A quick test can be made without any parameters - it should restart the scope app
-
So if I put together a PCB with a magjack and plug it into the scope, presumably it has a default IP?
From there, it remains to break out the RS232 lines to the CPU and add that magic command line option and everything is up for grabs?
Yes, you will need just the PCB and MagJack. If you need the status LEDs working you will need few passives.
Default configuration is automatic IP adress from DHCP, so you need just running DHCP on your computer.
-
So if I put together a PCB with a magjack and plug it into the scope, presumably it has a default IP?
From there, it remains to break out the RS232 lines to the CPU and add that magic command line option and everything is up for grabs?
Yes, you will need just the PCB and MagJack. If you need the status LEDs working you will need few passives.
Default configuration is automatic IP adress from DHCP, so you need just running DHCP on your computer.
Thank you!! Do you already have a pinout for the magjack and LEDs? I think there should be sufficient high resolution photos elsewhere to reconstruct it but it sounds like you can save me the trouble with little inconvenience.
I intend to draw up a PCB for this and post the gerbers if no one beats me to it. I guess I'll need to open my scope to get the mechanical dimensions unless someone can provide that as well. That's not a huge deal, but I guess my only hesitation is that if I'm going to make a PCB then I'd much prefer that it be complete with the activation pin to tell the scope to enable the LAN configuration, assuming that even exists.
-
I think before doing a PCB it would be worth checking to see if there is a pullup/pulldown used for option detect. (or at least make sure all the pads are broken out to allow experimentation)
-
I think before doing a PCB it would be worth checking to see if there is a pullup/pulldown used for option detect. (or at least make sure all the pads are broken out to allow experimentation)
I'm waiting for used MagJack datasheet, after that I will make some schematic.
If following pins connected LAN is working including LEDs
43 LAN Green
45 GND
47 LAN
49 LAN
51 GND
53 GND
55 LAN
57 LAN
59 GND
61 GND
63 LAN Yellow
65 GND
46 GND
48 LAN LED Common 0.2uF to GND
50 LAN LED Common 0.2uF to GND
52 GND
54 GND
and everything working, including status LEDs.
I tried to connect also pins
78 GND
80 GND
Where seems to be identification and it resulted in LAN/VGA error on startup.
It is not big deal that the IP cannot be modified from scope itself and needs to be modified through LXI, I think.
The pitch of contacts is 0,8mm, does anyone some tips for protoboard with such a contact spacing?
I just find Dave video related to module:
http://www.eevblog.com/2011/02/17/eevblog-145-agilent-lanvga-module-teardown/ (http://www.eevblog.com/2011/02/17/eevblog-145-agilent-lanvga-module-teardown/)
-
The magjack pinout.
-
Nice pinout of the module. If we only knew the TX+, TX÷, RX+ and RX÷ on those LAN pins we're getting there. If someone has access to a genuine module and a calliper, we could get the proper dimensions for that card-edge connector too. Looking at Dave's video it seems there is a key slot in the middle somewhere.
I just got a MSOX3024A (+ free WaveGen and DVM), but I haven't started playing with it beyond installing the latest official FW. Haven't even activated the full-feature trials.
I'm hoping that if I wait, I don't have to reset the date as often to keep them working... Or did I miss something here?
-
Nice pinout of the module. If we only knew the TX+, TX÷, RX+ and RX÷ on those LAN pins we're getting there. If someone has access to a genuine module and a calliper, we could get the proper dimensions for that card-edge connector too. Looking at Dave's video it seems there is a key slot in the middle somewhere.
I just got a MSOX3024A (+ free WaveGen and DVM), but I haven't started playing with it beyond installing the latest official FW. Haven't even activated the full-feature trials.
I'm hoping that if I wait, I don't have to reset the date as often to keep them working... Or did I miss something here?
wait...what? I have an MSOX3024A also (and have not touched my 30 day trials either). Do we have an unofficial trial date reset h**k?
(I don't think memup to 4Meg is part of the 30 day trials though...)
-
I've got access to an official LAN/VGA module. Will high-res photos of the boards help at all? I can't do anything electrical to the boards, as they're not mine and I can't afford to F it up.
Going on vacation for a week and a half or so, but I should be able to get some 25MP pics when I'm back in the last week of July.
-
Nice pinout of the module. If we only knew the TX+, TX÷, RX+ and RX÷ on those LAN pins we're getting there. If someone has access to a genuine module and a calliper, we could get the proper dimensions for that card-edge connector too. Looking at Dave's video it seems there is a key slot in the middle somewhere.
I just got a MSOX3024A (+ free WaveGen and DVM), but I haven't started playing with it beyond installing the latest official FW. Haven't even activated the full-feature trials.
I'm hoping that if I wait, I don't have to reset the date as often to keep them working... Or did I miss something here?
I have a the genuine module, so the PCB dimensions are not problem, if someone is going to make PCB.
Don not forget that we will also need a plastic container, otherwise there will be no mechanical support of the PCB in the scope.
Today I will finish the schematic with passives.
Currenly I have unpacked image and need to modify the registry file default.fdf. For this I tried script fdf2reg.pl from mkrom 1.36, but it only decode few lines of registry file and end up with error message.
If someone know different way how to extract registry from RAM based file it will be helpful.
Registry contains the commads for automatic startup of the appplication. The modifiing the recipe.xml, seem to be the dead end and not working.
For accessing the scope we need to know the telnet password or disable the telnet autentication in the registry and build up the whole image.
-
I've got access to an official LAN/VGA module. Will high-res photos of the boards help at all? I can't do anything electrical to the boards, as they're not mine and I can't afford to F it up.
Going on vacation for a week and a half or so, but I should be able to get some 25MP pics when I'm back in the last week of July.
If you can get photos as straight on as you can (or scans) alongside a ruler they should be usable for duplicating the board shape. The board photos might be enough to figure out the pinout. I'd guess it's two layers?
-
Another owner of the VGA/LAN module. I have a high end digital caliper too for dimensioning. Let me know if you guys need that info.
-
Why so complicated? Drill a hole in the scope for a magjack, mount it with some hot glue and solder some wires to it :) While you have it open: solder some more wires for the UART connector, maybe even a MAX3232 converter board, because it is 3.3V digital level UART, and then a standard d-sub 9 connector for the case.
-
Who's getting complicated?
-
Why so complicated? Drill a hole in the scope for a magjack, mount it with some hot glue and solder some wires to it :) While you have it open: solder some more wires for the UART connector, maybe even a MAX3232 converter board, because it is 3.3V digital level UART, and then a standard d-sub 9 connector for the case.
You're kidding right, you own one of these scopes? These scopes aren't budget range, they are £1061 upwards. I don't know who here is willing to drill such a beautiful and expensive machine, but I wouldn't do to mine! >:D
Best method is to route or saw a pcb of same dimensions as LAN module and then etch, that's why we are waiting for needed pinouts of LAN module connector, so it's nothing to do with complications.
-
Well, to be fair, only the little plastic cover for the expansion port would need a hole drilled in it. That may be what I choose to do since I don't have a 3d printer to make a case for my LAN module.
-
Hmm... In addition to the MagJack on the cheat PCB we might drop in some pin headers (for wiring to the secret UART), a MAX3232 and a DSUB9 connector instead of the VGA port. It might even fit in the original LAN module case :P
I only wish FrankBuss would elaborate on how to utilize that UART...
-
Hmm... In addition to the MagJack on the cheat PCB we might drop in some pin headers (for wiring to the secret UART), a MAX3232 and a DSUB9 connector instead of the VGA port. It might even fit in the original LAN module case :P
I only wish FrankBuss would elaborate on how to utilize that UART...
:-+ Great idea. (or maybe ft232 and usb instead...)
-
I only wish FrankBuss would elaborate on how to utilize that UART...
The serial port location:
http://i.imgur.com/yYMV75t.jpg (http://i.imgur.com/yYMV75t.jpg)
All you need are some jumper wires, if you don't want to drill a hole. Fits nicely through the USB connector hole 8)
http://i.imgur.com/9gnsuQh.jpg (http://i.imgur.com/9gnsuQh.jpg)
You can then stop the u-boot with space (can be difficult, you have to be fast, use something like HTerm which has a useful "repeat" function to send a sequence automatically until you stop it, or just hold down space while you boot it). Then you can boot the image from network like this:
set serverip 192.168.11.108
dhcp 0x4000000 nk.bin;bootm 0xf8050000
Where 192.168.11.108 is your own server, where TFTP is running and providing nk.bin. You should see something like this:
BOOTP broadcast 1
DHCP client bound to address 192.168.11.106
Using smsc device
TFTP from server 192.168.11.108; our IP address is 192.168.11.106
Filename 'nk.bin'.
Load address: 0x4000000
Loading: **#################################################################
#################################################################
...
You get the nk.bin from the nk.bin.comp from the firmware update cab-file with the bincompress.exe tool, which is included in the evaluation version of the WindowsCE development environment. Use http://www.t-hack.com/wiki/index.php/NK.BIN_toolset (http://www.t-hack.com/wiki/index.php/NK.BIN_toolset) to take a look at the content of nk.bin and to modify it.
-
I only wish FrankBuss would elaborate on how to utilize that UART...
The serial port location:
http://i.imgur.com/yYMV75t.jpg (http://i.imgur.com/yYMV75t.jpg)
All you need are some jumper wires, if you don't want to drill a hole. Fits nicely through the USB connector hole 8)
..or an IDC ribbon cable with IDC D connector, as found on old PCs.
-
Sorry, was the wrong command line, it still boots from the flash. Found my notes again, this is the right sequence:
set serverip 192.168.11.108 ; dhcp 0x361000 nk.nb0 ; go 0x362000
You need cvrtbin.exe from http://www.t-hack.com/wiki/index.php/NK.BIN_toolset (http://www.t-hack.com/wiki/index.php/NK.BIN_toolset) to create nk.nb0 from nk.bin. Use it like this:
cvrtbin.exe -r -a 0x80361000 -w 32 -l 0x01248688 nk.bin
The addresses and length is what viewbin.exe shows, just in case it is different for a newer firmware.
In case you wonder about the 0x80361000 and 0x361000 difference: this is because of physical and virtual memory addresses. Fortunately the mapping is really easy in this case.
-
..or an IDC ribbon cable with IDC D connector, as found on old PCs.
Right, would be even better, because less danger that it gets lose. You can then cut all the wires except the two you need to thread through some holes.
-
There is one trick which can help.
Create following structure on USB drive and the scope will run link or whole firmware from USB flash drive.
1. Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
2. Create "Startup" directory where you can store link for execution
3. (Optional) Copy the folder "infiniiVision" from infiniiVisionSetup.cab. It can be unpacked e.g with WinCE CAB Manager 3.0). It will make the boot sequence little bit longer but allow you to boot up firmware from USB without flashing it ( tested with 2.35 and 2.30)
I can confirm that scope is hackable without the LAN/VGA module or taking the scope apart. If someone will be still interested in manufacturing LAN module I can post schematic.
Please do not ask me for details related to hacking the scope, I will not share them.
-
There is one trick which can help.
Create following structure on USB drive and the scope will run link or whole firmware from USB flash drive.
1. Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
2. Create "Startup" directory where you can store link for execution
3. (Optional) Copy the folder "infiniiVision" from infiniiVisionSetup.cab. It can be unpacked e.g with WinCE CAB Manager 3.0). It will make the boot sequence little bit longer but allow you to boot up firmware from USB without flashing it ( tested with 2.35 and 2.30)
I can confirm that scope is hackable without the LAN/VGA module or taking the scope apart. If someone will be still interested in manufacturing LAN module I can post schematic.
Please do not ask me for details related to hacking the scope, I will not share them.
What path to use in the startup link to load from USB?
I don't know when I'll get around to it but I'm still quite interested in making a PCB for the LAN module.
-
The usb drive's root is seen as \usb folder in rootfs, so just add an \usb\ prefix to the path on usb drive
-
Can someone with opened scope please check where the BOOT_SEL pin (K18) of SPEAr600 goes? Look here for the drawing http://www.st.com/web/en/resource/technical/document/datasheet/CD00248440.pdf (http://www.st.com/web/en/resource/technical/document/datasheet/CD00248440.pdf) pg.93
Grounding this pin at power up should activate USB download mode in cpu's bootrom - an unlimited access to the internals, regardless of fw versions etc, it's in metal
-
Can someone with opened scope please check where the BOOT_SEL pin (K18) of SPEAr600 goes? Look here for the drawing http://www.st.com/web/en/resource/technical/document/datasheet/CD00248440.pdf (http://www.st.com/web/en/resource/technical/document/datasheet/CD00248440.pdf) pg.93
Grounding this pin at power up should activate USB download mode in cpu's bootrom - an unlimited access to the internals, regardless of fw versions etc, it's in metal
How should someone check where the pin goes? The chip is a BGA chip, maybe even with buried vias, if there is a via for this pin at all.
u-boot provides commands to load files over the serial port with y-modem and kermit, maybe even from USB, and you have unlimited access to all internals from it, if you want to dig this deep in the hardware.
-
What path to use in the startup link to load from USB?
I don't know when I'll get around to it but I'm still quite interested in making a PCB for the LAN module.
Folder Startup with file infiniivision.lnk which should contains "45#\usb\infiniiVision\infiniivisionLauncher.exe"
OKI, and do you have any plan for mechanical construction?
Otherwise you can break the DSOX internal connector.
-
FrankBuss,
Dave's teardown video shows that CPU has vias to all pins. Sure, u-boot is enough for now, even that simpler infiniivisionStartupOverride.txt way is enough, but times can change (fixes), but bootrom will still be there forever. Also there is probability that BOOT_SEL is accessible somewhere on lan/vga/gpib slot, who knows. Why not to check?
SPEAr flasher http://www.st.com/web/en/catalog/tools/PF257557 (http://www.st.com/web/en/catalog/tools/PF257557)
-
FrankBuss,
Dave's teardown video shows that CPU has vias to all pins. Sure, u-boot is enough for now, even that simpler infiniivisionStartupOverride.txt way is enough, but times can change (fixes), but bootrom will still be there forever. Also there is probability that BOOT_SEL is accessible somewhere on lan/vga/gpib slot, who knows. Why not to check?
SPEAr flasher http://www.st.com/web/en/catalog/tools/PF257557 (http://www.st.com/web/en/catalog/tools/PF257557)
Thats sounds interesting. It suppose that it should be possible to acces such a pin without dissasembling the scope at least for service purpose, when the UART is not accessible.
-
Thats sounds interesting. It suppose that it should be possible to acces such a pin without dissasembling the scope at least for service purpose, when the UART is not accessible.
I doubt it. Usually such complex systems are programmed once, probably with JTAG on the same connector with the UART signals for u-boot and then the other programming over network, then you do all service tasks over network or USB. Developers at Agilent might have bare boards or with an open case lying on their work desks anyway, with all internal connections accessible.
-
The usb drive's root is seen as \usb folder in rootfs, so just add an \usb\ prefix to the path on usb drive
Folder Startup with file infiniivision.lnk which should contains "45#\usb\infiniiVision\infiniivisionLauncher.exe"
Thanks. That was the first thing I tried. Is there any output on the UART about this process? Any change I make from the default \Secure path results in a failure to boot. Without any error messages, I'm left to just guessing as to why.
I can only come up with three possibilities:
1) my installed firmware version 2.00 works differently (seems unlikely since I can indeed cause a boot failure by entering a wrong path or a successful boot by entering \Secure)
2) it doesn't like the filesystem on my flash drives (seems unlikely too since it reads them fine from the save/restore UI and I even tried formatting one from a real windows machine)
3) the installed firmware 2.00 doesn't want to load a different/newer firmware version 2.35 from USB (I don't yet know how the boot process flows but this also seems unlikely. I had the 2.00 firmware cab somewhere but I can't find it now to try it.)
OKI, and do you have any plan for mechanical construction?
Otherwise you can break the DSOX internal connector.
Not yet but if nothing else I'm pretty sure I can modify the existing plastic cover to support the rear of the PCB. I haven't really taken a close look yet. I use my scope often so I'm not in a hurry to take it down/apart until I'm actually ready to do this.
-
benemorius,
try the same version as inside the scope (or update the scope). There are hardcoded paths to some data files in various places, there are dlls in windows folder (inside nk.bin.comp), so you are trying to start a mix of both versions actually
-
Thanks. That was the first thing I tried. Is there any output on the UART about this process? Any change I make from the default \Secure path results in a failure to boot. Without any error messages, I'm left to just guessing as to why.
No, the UART doesn't show much activity after booting. Maybe the DLLs are missing? I think it searches it in the same directory where the exe file is, and then in \windows, but not in \secure\infiniivision. The easiest way would be to write a cmd-file, which copies the \secure\infiniivision directory to the USB stick, if cmd files can be started with this concept too.
-
benemorius,
try the same version as inside the scope (or update the scope). There are hardcoded paths to some data files in various places, there are dlls in windows folder (inside nk.bin.comp), so you are trying to start a mix of both versions actually
Ok thanks. That must be it. I didn't know if this method interrupted the boot process late enough for that to be possible or not. The firmware I need is probably on my desktop that I haven't unpacked yet since moving so it will have to wait until I have more time to play.
-
The easiest way would be to write a cmd-file, which copies the \secure\infiniivision directory to the USB stick, if cmd files can be started with this concept too.
Hey, that's probably worth trying. :D
-
The easiest way would be to write a cmd-file, which copies the \secure\infiniivision directory to the USB stick, if cmd files can be started with this concept too.
Hey, that's probably worth trying. :D
The files are copying, but they aren't making it to the flash drive. (see below) I'd guess it's mounted read only and the writes are going to a ramdisk somewhere. I'm not nearly familiar enough with windows to have a clue as to how to get it mounted properly for writing.
Still, I do wonder what prevents me from using this to overwrite exe or dll files with modified ones now.
$cat copy.cmd
dir \ > \usb\root.txt
dir \Secure > \usb\secure.txt
dir \Secure\infiniiVision > \usb\infiniiVision.txt
md \zzz
copy "\Secure\infiniiVision\*" \usb\zzz 1> \usb\out.txt 2>\usb\error.txt
dir \usb\zzz >\usb\zzz.txt
$cat out.txt error.txt
Copied 10 file(s).
$ls -a zzz
. ..
$cat zzz.txt
Directory of \usb\zzz
File not found.
0 Dir(s) 357945344 bytes free
$cat root.txt
Directory of \
01/01/98 12:00p <DIR> Network
01/01/98 12:00p <DIR> Agilent Flash
01/01/98 12:00p <DIR> usb
01/01/98 12:00p <DIR> Secure
10/29/11 07:03p <DIR> Application Data
10/29/11 07:03p <DIR> profiles
10/29/11 07:03p <DIR> Documents and Settings
10/29/11 07:03p 23 Control Panel.lnk
10/29/11 07:03p <DIR> My Documents
10/29/11 07:03p <DIR> Program Files
10/29/11 07:03p <DIR> Temp
10/29/11 07:03p <DIR> Windows
Found 12 file(s). Total size 23 bytes.
1 Dir(s) 27090944 bytes free
$cat secure.txt
Directory of \Secure
11/14/11 09:38a <DIR> infiniiVision
11/14/11 09:38a <DIR> Startup
11/14/11 09:38a <DIR> cal
11/14/11 09:38a <DIR> help
11/14/11 09:38a <DIR> bin
11/15/11 09:26a <DIR> System
Found 6 file(s). Total size 0 bytes.
1 Dir(s) 17625088 bytes free
$cat infiniiVision.txt
Directory of \Secure\infiniiVision
11/14/11 09:38a <DIR> web
11/14/11 09:38a <DIR> fpga
10/10/07 07:45p 214552 mscorlib.dll
08/04/11 10:02p 1089536 Agilent.Cdf.Api.dll
03/07/11 01:57p 238080 OpenNETCF.dll
08/04/11 10:02p 9728 WebPageData.dll
03/07/11 01:57p 398336 SetupConverter.exe
08/05/11 12:38p 1152032 splashImage.bin
10/13/11 04:49p 218624 vncserver.dll
10/13/11 04:55p 14748832 infiniiVisionCore.dll
10/13/11 04:49p 11112 infiniiVisionLauncher.exe
10/13/11 04:49p 180224 infiniiVisionWebCom.dll
Found 12 file(s). Total size 18261056 bytes.
1 Dir(s) 17625088 bytes free
-
I don't think the USB drive is write protected, because you can see the logs. "dir /s \" can be interesting too. Maybe update to the the latest firmware 2.35.
One problem in your script: "md \zzz" should be "md \usb\zzz", but I guess you have already created the directory. Also check that it's empty. Sometimes files are write protected in Windows, which you can change with "attrib -r filename" and which you can see with "attrib" (on a Windows machine). Maybe wait a bit longer if the USB drive needs more time to write the files. Windows should mount USB drives without caching, so usually no need to unmount it.
Writing to the \secure directory and subdirectories is possible too. And with the USB startup trick there is no danger to brick the scope, if you have made backups of the files first, because the scope resets, if the application crashes on start, and then it would go into an infinite reset loop. But with the startup file you can restore a non-working executable again.
You could test writing with something non-critical, like replacing the startup image:
copy \secure\infiniivision\splashImage.bin \secure\infiniivision\splashImage.bin.org
\windows\compileImageForSplashScreen \usb\yourimage.png \secure\infiniivision\splashImage.bin
yourimage.png works with 800x480 pixels, 24 bit color, no transparency.
-
I don't think the USB drive is write protected, because you can see the logs.
Doh! I didn't think that one through at all, did I? :palm:
Assuming I didn't make another gross error, what sort of foolery could cause this behavior of allowing the shell to write files but not the copy binary? I haven't come across any mechanism that could do this in unixland - at least nothing that would output "10 files successfully copied" rather than "permission error" or something.
One problem in your script: "md \zzz" should be "md \usb\zzz", but I guess you have already created the directory.
Whoops. You're right. I guess it was accidentally changed in one of the many iterations between the first try and the last one which I copied here. It must have been right at first because the directory has in fact been created.
Also check that it's empty. Sometimes files are write protected in Windows, which you can change with "attrib -r filename" and which you can see with "attrib" (on a Windows machine). Maybe wait a bit longer if the USB drive needs more time to write the files. Windows should mount USB drives without caching, so usually no need to unmount it.
It is indeed empty according to the filesystem. I haven't checked whether any file data was written but I believe a correct FAT implementation should create the file entry before writing any data so worst case should be a 0 byte file reported by the filesystem. I waited about 15 seconds after it should have finished but next time I'll wait longer just in case. I didn't expect a write cache to be enabled either.
Writing to the \secure directory and subdirectories is possible too. And with the USB startup trick there is no danger to brick the scope, if you have made backups of the files first, because the scope resets, if the application crashes on start, and then it would go into an infinite reset loop. But with the startup file you can restore a non-working executable again.
You could test writing with something non-critical, like replacing the startup image:
copy \secure\infiniivision\splashImage.bin \secure\infiniivision\splashImage.bin.org
\windows\compileImageForSplashScreen \usb\yourimage.png \secure\infiniivision\splashImage.bin
yourimage.png works with 800x480 pixels, 24 bit color, no transparency.
I'll test writing next time too and see what happens. I really need to get back to work right now though. I've been distracted long enough already.
-
Sigh... it wasn't Murphy this time. It was Heisenberg.
It would seem that the problem was a sort of programatical measurement problem. The copy command works just fine as long as you don't try to observe it. :palm:
functions as intended:
copy "\Secure\infiniiVision\*" \usb\zzz
does not function as intended; output in error.txt says it copied files, but they're nowhere to be found:
copy "\Secure\infiniiVision\*" \usb\zzz 1>\usb\out.txt 2>\usb\error.txt
As much as I'd like to figure out why, I've got better things to play around with now that I can finally upgrade my firmware.
Incidentally, sucking the firmware out this way and running it from USB worked just fine. :-+
Writing to flash is also uneventful. I haven't overwritten any system or application files yet other than the splashscreen but I'm sure it will work for any file not in use. The registry seems off-limits since windows seems to refuse to copy any file that's open and apparently there's no way around that. :-//
Here's the output of `dir /s /a \` (firmware 2.00)
I snipped out my license files because they're named by guid but they are indeed in that directory and yes you can back them up and reuse them. You just have to rename from *.xml to *.lic and copy the license guid from the filename and put it back in the xml where it belongs. None of the other differences matter. As far as I know, this is the only way to recover the license file for a license that came on the scope from the factory (like a bandwidth upgrade for example)
Directory of \
01/01/98 12:00p <DIR> Network
01/01/98 12:00p <DIR> Agilent Flash
01/01/98 12:00p <DIR> usb
01/01/98 12:00p <DIR> Secure
10/30/11 03:35a <DIR> Recycled
10/30/11 03:35a <DIR> Application Data
10/30/11 03:35a <DIR> profiles
10/30/11 03:35a <DIR> Documents and Settings
10/30/11 03:35a 23 Control Panel.lnk
10/30/11 03:35a <DIR> My Documents
10/30/11 03:35a <DIR> Program Files
10/30/11 03:35a <DIR> Temp
10/30/11 03:35a <DIR> Windows
Found 13 file(s). Total size 23 bytes.
Directory of \Agilent Flash
10/30/11 01:47a <DIR> tmp
10/30/11 01:47a <DIR> wfmMem
10/30/11 01:47a <DIR> setups
10/30/11 01:47a <DIR> config
10/30/11 01:47a <DIR> data
10/30/11 01:47a <DIR> masks
10/30/11 01:47a <DIR> arb
10/30/11 03:30a <DIR> webupdate
10/30/11 01:47a <DIR> LxiMdns
Found 9 file(s). Total size 0 bytes.
Directory of \Agilent Flash\setups
10/30/11 01:47a 0 setup_0.scp
10/30/11 01:47a 0 setup_1.scp
10/30/11 01:47a 0 setup_2.scp
10/30/11 01:47a 0 setup_3.scp
10/30/11 01:47a 0 setup_4.scp
10/30/11 01:47a 0 setup_5.scp
10/30/11 01:47a 0 setup_6.scp
10/30/11 01:47a 0 setup_7.scp
10/30/11 01:47a 0 setup_8.scp
10/30/11 01:47a 0 setup_9.scp
Found 10 file(s). Total size 0 bytes.
Directory of \Agilent Flash\config
10/30/11 01:47a 418 labelList.txt
10/30/11 03:30a 155537 setup.scp
Found 2 file(s). Total size 155955 bytes.
Directory of \Agilent Flash\masks
10/30/11 01:47a 0 mask_0.msk
10/30/11 01:47a 0 mask_1.msk
10/30/11 01:47a 0 mask_2.msk
10/30/11 01:47a 0 mask_3.msk
Found 4 file(s). Total size 0 bytes.
Directory of \Agilent Flash\arb
10/30/11 01:47a 0 arb_0.csv
10/30/11 01:47a 0 arb_1.csv
10/30/11 01:47a 0 arb_2.csv
10/30/11 01:47a 0 arb_3.csv
Found 4 file(s). Total size 0 bytes.
Directory of \Secure
11/14/11 09:38a <DIR> infiniiVision
11/14/11 09:38a <DIR> Startup
11/14/11 09:38a <DIR> cal
11/14/11 09:38a <DIR> help
11/14/11 09:38a <DIR> bin
11/15/11 09:26a <DIR> System
Found 6 file(s). Total size 0 bytes.
Directory of \Secure\infiniiVision
11/14/11 09:38a <DIR> web
11/14/11 09:38a <DIR> fpga
10/10/07 07:45p 214552 mscorlib.dll
08/04/11 10:02p 1089536 Agilent.Cdf.Api.dll
03/07/11 01:57p 238080 OpenNETCF.dll
08/04/11 10:02p 9728 WebPageData.dll
03/07/11 01:57p 398336 SetupConverter.exe
08/05/11 12:38p 1152032 splashImage.bin
10/13/11 04:49p 218624 vncserver.dll
10/13/11 04:55p 14748832 infiniiVisionCore.dll
10/13/11 04:49p 11112 infiniiVisionLauncher.exe
10/13/11 04:49p 180224 infiniiVisionWebCom.dll
Found 12 file(s). Total size 18261056 bytes.
Directory of \Secure\infiniiVision\web
11/14/11 09:38a <DIR> Lxi
11/14/11 09:38a <DIR> help
11/14/11 09:38a <DIR> image
11/14/11 09:38a <DIR> lib
11/14/11 09:38a <DIR> navbar
03/07/11 02:10p 222 ClickFix.js
09/30/11 03:22a 1797 CookieUtils.js
10/10/11 10:02p 349976 InfiniiVision_Quick_Reference.html
09/08/11 10:07p 19999 appletInstall.jar
04/27/11 10:02p 26521 appletScpi.jar
07/30/11 10:01p 915251 appletVnc.jar
04/27/11 10:03p 465 appletsVersion.asp
03/07/11 02:10p 1472 constant.asp
03/07/11 02:10p 4117 doModifyConfig.asp
03/07/11 02:10p 3900 doSave.asp
08/28/11 11:39p 4084 download.asp
08/18/11 10:01p 269 enumConst.asp
09/30/11 03:22a 3635 getImage.asp
03/07/11 02:10p 1413 home.html
03/07/11 02:10p 840 homeBottom.asp
03/07/11 02:10p 3539 homeMiddle.asp
03/07/11 02:10p 12275 homeTop.asp
06/27/11 10:02p 1156 index.asp
03/07/11 02:10p 2975 infoCal.asp
03/07/11 02:10p 3747 infoLicense.asp
03/07/11 02:10p 4144 infoNav.html
04/27/11 10:02p 9940 infoVersion.asp
03/07/11 02:10p 781 information.html
03/07/11 02:10p 1175 lanInfo.asp
03/07/11 02:10p 30473 modifyConfig.asp
03/07/11 02:10p 25393 navigation.asp
03/07/11 02:10p 8858 networkStatus.asp
06/16/11 10:02p 5154 pwdPrompt.asp
06/15/11 11:37a 3287 pwdVerify.asp
10/05/11 11:35p 9268 recall.asp
06/15/11 11:37a 4516 remoteApplet.asp
05/26/11 10:05p 18473 remoteFrontPanel.asp
09/12/11 10:53a 12763 remoteSCPICommands.asp
08/18/11 10:01p 26044 save.asp
06/15/11 11:37a 1206 saveFrame.asp
10/05/11 11:35p 4387 saveRecall.asp
03/07/11 02:10p 2138 scopeInfo.asp
03/07/11 02:10p 4137 style.css
04/27/11 10:03p 2347 toolbarHelp.asp
03/07/11 02:10p 2769 top.asp
04/27/11 10:03p 1067 utils.js
03/07/11 02:10p 11491 viewConfig.asp
Found 47 file(s). Total size 1547464 bytes.
Directory of \Secure\infiniiVision\web\Lxi
11/14/11 09:38a <DIR> Identification
Found 1 file(s). Total size 0 bytes.
Directory of \Secure\infiniiVision\web\Lxi\Identification
03/07/11 02:10p 710 Default.asp
03/07/11 02:10p 12270 LXIIdentification.xsd
Found 2 file(s). Total size 12980 bytes.
Directory of \Secure\infiniiVision\web\help
03/07/11 02:10p 1308 helpBrowserWebControl.asp
03/07/11 02:10p 1460 helpGetImage.asp
03/07/11 02:10p 4666 helpHome.asp
03/07/11 02:10p 6869 helpHomeAdv.asp
03/07/11 02:10p 1216 helpInfoCal.html
03/07/11 02:10p 1359 helpInfoOptions.html
03/07/11 02:10p 1713 helpInfoVersion.asp
03/07/11 02:10p 7834 helpModifyConfig.asp
03/07/11 02:10p 2740 helpNav.asp
03/07/11 02:10p 1337 helpRecall.asp
03/07/11 02:10p 5275 helpRemoteFrontPanel.asp
03/07/11 02:10p 1299 helpRemoteSCPICommands.asp
03/07/11 02:10p 1242 helpSave.asp
03/07/11 02:10p 1290 helpSaveRecall.asp
03/07/11 02:10p 1213 helpStyle.css
03/07/11 02:10p 102 helpVar.asp
03/07/11 02:10p 8319 helpViewConfig.asp
Found 17 file(s). Total size 49242 bytes.
Directory of \Secure\infiniiVision\web\image
03/07/11 02:10p 2192 agilent.gif
03/07/11 02:10p 892 down-over.gif
03/07/11 02:10p 892 down.gif
03/07/11 02:10p 43 filltrans.gif
03/07/11 02:10p 1581 instrumentBanner.gif
03/07/11 02:10p 25781 instrumentImage.jpg
03/07/11 02:10p 1064 keyboard.gif
03/07/11 02:10p 94 line-heading.gif
03/07/11 02:10p 2576 lxi.jpg
03/07/11 02:10p 26492 m2XX2A.jpg
03/07/11 02:10p 28410 m2XX4A.jpg
03/07/11 02:10p 27057 m3XX2A.jpg
03/07/11 02:10p 29031 m3XX4A.jpg
03/07/11 02:10p 6716 popupMenu.jpg
03/07/11 02:10p 4062 popupMenu_wvga.jpg
03/07/11 02:10p 3850 softkey.jpg
03/07/11 02:10p 2558 softkey_wvga.jpg
03/07/11 02:10p 893 up-over.gif
03/07/11 02:10p 893 up.gif
03/07/11 02:10p 1535 web-enable.gif
Found 20 file(s). Total size 166612 bytes.
Directory of \Secure\infiniiVision\web\lib
03/07/11 02:10p 176653 edtftpj.jar
03/07/11 02:10p 1897479 plugin.jar
Found 2 file(s). Total size 2074132 bytes.
Directory of \Secure\infiniiVision\web\navbar
03/07/11 02:10p 405062 PantherTabs.psd
03/07/11 02:10p 48 bluebar.gif
03/07/11 02:10p 1455 config-down.gif
03/07/11 02:10p 1881 config-over.gif
03/07/11 02:10p 1862 config.gif
03/07/11 02:10p 1430 help-down.gif
03/07/11 02:10p 1858 help-over.gif
03/07/11 02:10p 1834 help.gif
03/07/11 02:10p 1425 image-down.gif
03/07/11 02:10p 1894 image-over.gif
03/07/11 02:10p 1856 image.gif
03/07/11 02:10p 1663 printpage-down.gif
03/07/11 02:10p 2132 printpage-over.gif
03/07/11 02:10p 2110 printpage.gif
03/07/11 02:10p 1450 remote-down.gif
03/07/11 02:10p 1861 remote-only.gif
03/07/11 02:10p 1899 remote-over.gif
03/07/11 02:10p 1453 saverecall-down.gif
03/07/11 02:10p 1910 saverecall-over.gif
03/07/11 02:10p 1885 saverecall.gif
03/07/11 02:10p 1541 status-down.gif
03/07/11 02:10p 1964 status-over.gif
03/07/11 02:10p 1972 status.gif
03/07/11 02:10p 1446 utilities-down.gif
03/07/11 02:10p 1910 utilities-over.gif
03/07/11 02:10p 1858 utilities.gif
03/07/11 02:10p 1453 welcome-down.gif
03/07/11 02:10p 1924 welcome-over.gif
03/07/11 02:10p 1865 welcome.gif
Found 29 file(s). Total size 452901 bytes.
Directory of \Secure\infiniiVision\fpga
08/29/11 09:50p 283776 FPGA2000A.bin
08/29/11 09:50p 480148 FPGA3000A.bin
06/10/10 07:46a 72668 gpibFPGA.bin
10/24/10 09:51p 72668 lanFPGA.bin
Found 4 file(s). Total size 909260 bytes.
Directory of \Secure\Startup
11/15/11 09:26a 53 infiniivision.lnk
Found 1 file(s). Total size 53 bytes.
Directory of \Secure\cal
11/15/11 09:31a 76 sernum.dat
11/15/11 08:22a 27244 framecal.dat
11/15/11 08:22a 75031 callog.txt
11/15/11 08:22a 772 factorycal.dat
Found 4 file(s). Total size 103123 bytes.
Directory of \Secure\System
11/15/11 09:26a <DIR> Licensing
Found 1 file(s). Total size 0 bytes.
Directory of \Secure\System\Licensing
11/15/11 09:26a <DIR> Store
Found 1 file(s). Total size 0 bytes.
Directory of \Secure\System\Licensing\Store
<*snip*>
Found 14 file(s). Total size 8167 bytes.
Directory of \Application Data
09/07/06 10:00a 69 desktop.ini
Found 1 file(s). Total size 69 bytes.
Directory of \profiles
10/30/11 03:35a <DIR> default
Found 1 file(s). Total size 0 bytes.
Directory of \Documents and Settings
10/30/11 03:35a 53248 default.vol
Found 1 file(s). Total size 53248 bytes.
Directory of \My Documents
09/07/06 10:00a 69 desktop.ini
Found 1 file(s). Total size 69 bytes.
Directory of \Program Files
09/07/06 10:00a 69 desktop.ini
10/30/11 03:35a <DIR> Agilent
10/30/11 03:35a 19 Command Prompt.lnk
Found 3 file(s). Total size 88 bytes.
Directory of \Program Files\Agilent
10/30/11 03:35a <DIR> IO Libraries Suite
Found 1 file(s). Total size 0 bytes.
Directory of \Program Files\Agilent\IO Libraries Suite
10/30/11 03:35a <DIR> bin
10/30/11 03:35a <DIR> Drivers
Found 2 file(s). Total size 0 bytes.
Directory of \Program Files\Agilent\IO Libraries Suite\bin
10/30/11 03:35a 13312 portmap.exe
Found 1 file(s). Total size 13312 bytes.
Directory of \Program Files\Agilent\IO Libraries Suite\Drivers
10/30/11 03:35a 102400 AgilentLan488Server32.dll
Found 1 file(s). Total size 102400 bytes.
Directory of \Windows
10/30/11 03:35a 206 FTPD.tmp
10/30/11 03:35a <DIR> StartUp
10/30/11 03:35a <DIR> Fonts
10/30/11 03:35a <DIR> Favorites
10/30/11 03:35a 52 System.mky
10/30/11 03:35a 276 SystemLog.xml
10/30/11 03:35a 0 ApplicationLog.xml
10/30/11 03:35a 52 default.mky
10/30/11 03:35a 0 initobj.dat
10/30/11 03:35a <DIR> Recent
10/30/11 03:35a <DIR> Programs
10/30/11 03:35a <DIR> Desktop
10/30/11 03:35a <DIR> www
10/13/11 11:34p 61440 nk.exe
10/13/11 11:19p 246784 kernel.dll
10/13/11 11:36p 643072 coredll.dll
10/13/11 11:34p 4096 oalioctl.dll
10/13/11 11:36p 640000 k.coredll.dll
10/13/11 11:20p 59392 fpcrt.dll
10/13/11 11:20p 59392 k.fpcrt.dll
10/13/11 11:36p 244736 filesys.dll
10/13/11 11:21p 10240 romfsd.dll
10/13/11 11:36p 676864 gwes.dll
10/13/11 11:21p 209920 mgtt_o.dll
10/13/11 11:21p 4096 device.dll
10/13/11 11:21p 14336 udevice.exe
10/13/11 11:21p 63488 devmgr.dll
10/13/11 11:21p 7168 regenum.dll
10/13/11 11:21p 14336 busenum.dll
10/13/11 11:21p 48128 pm.dll
10/13/11 11:20p 14848 servicesEnum.dll
10/13/11 11:20p 28160 servicesd.exe
10/13/11 11:36p 11264 services.exe
10/13/11 11:20p 4096 servicesStart.exe
10/13/11 11:20p 37888 notify.dll
10/13/11 11:21p 90112 exfat.dll
10/13/11 11:21p 11776 diskcache.dll
10/13/11 11:36p 54784 fatutil.dll
10/13/11 11:36p 54784 k.fatutil.dll
10/13/11 11:20p 55808 shell.exe
10/13/11 11:20p 10752 shellcelog.dll
10/13/11 11:20p 7168 toolhelp.dll
10/13/11 11:20p 7168 k.toolhelp.dll
10/13/11 11:21p 38912 zlib.dll
10/13/11 11:36p 38912 console.dll
10/13/11 11:36p 70144 cmd.exe
10/13/11 11:36p 12288 net.exe
10/13/11 11:36p 388096 commctrl.dll
10/13/11 11:36p 88576 commdlg.dll
10/13/11 11:20p 9728 prnport.dll
10/13/11 11:20p 9728 k.prnport.dll
10/13/11 11:36p 5120 prnerr.dll
10/13/11 11:36p 5120 k.prnerr.dll
10/13/11 11:20p 15872 pcl.dll
10/13/11 11:20p 15872 k.pcl.dll
10/13/11 11:20p 131584 fsdmgr.dll
10/13/11 11:21p 21504 mspart.dll
10/13/11 11:20p 23552 ceddk.dll
10/13/11 11:20p 23552 k.ceddk.dll
10/13/11 11:36p 4608 netmui.dll
10/13/11 11:20p 22016 cxport.dll
10/13/11 11:20p 55296 iphlpapi.dll
10/13/11 11:20p 55296 k.iphlpapi.dll
10/13/11 11:20p 39424 ws2.dll
10/13/11 11:20p 39424 k.ws2.dll
10/13/11 11:20p 9216 ws2instl.dll
10/13/11 11:20p 9216 wspm.dll
10/13/11 11:20p 9216 k.wspm.dll
10/13/11 11:20p 10752 nspm.dll
10/13/11 11:20p 10752 k.nspm.dll
10/13/11 11:20p 52736 ws2k.dll
10/13/11 11:20p 33792 ws2serv.dll
10/13/11 11:20p 32256 ssllsp.dll
10/13/11 11:20p 32256 k.ssllsp.dll
10/13/11 11:20p 97280 schannel.dll
10/13/11 11:20p 97280 k.schannel.dll
10/13/11 11:20p 56320 credsvc.dll
10/13/11 11:20p 40448 ipseccfg.exe
10/13/11 11:20p 132608 afd.dll
10/13/11 11:20p 4608 dnsapi.dll
10/13/11 11:20p 4608 k.dnsapi.dll
10/13/11 11:20p 13824 netapi32.dll
10/13/11 11:20p 135168 ndis.dll
10/13/11 11:36p 215552 netui.dll
10/13/11 11:20p 22528 ndisuio.dll
10/13/11 11:20p 29184 dhcp.dll
10/13/11 11:20p 335360 tcpstk.dll
10/13/11 11:20p 152576 redir.dll
10/13/11 11:20p 39936 netbios.dll
<*continued in next post due to 20k character forum post limit*>
-
<*continued from last post due to 20k character forum post limit*>
10/13/11 11:20p 163840 wldap32.dll
10/13/11 11:20p 27136 lpcd.dll
10/13/11 11:20p 6656 lpcrt.dll
10/13/11 11:20p 13824 ping.exe
10/13/11 11:20p 14848 ipconfig.exe
10/13/11 11:20p 11264 ndisconfig.exe
10/13/11 11:20p 14848 route.exe
10/13/11 11:20p 21504 netstat.exe
10/13/11 11:20p 11776 tracert.exe
10/13/11 11:21p 29184 serial.dll
10/13/11 11:21p 25088 usbd.dll
10/13/11 11:21p 18944 usbhid.dll
10/13/11 11:34p 20992 usbmsc.dll
10/13/11 11:34p 21504 usbdisk6.dll
10/13/11 11:21p 14848 usbprn.dll
10/13/11 11:21p 29184 hidparse.dll
10/13/11 11:21p 9216 kbdhid.dll
10/13/11 11:21p 5120 conshid.dll
10/13/11 11:36p 6144 MouHid.dll
10/13/11 11:21p 7168 mmtimer.dll
10/13/11 11:21p 7168 k.mmtimer.dll
10/13/11 11:36p 34816 eventlog.dll
10/13/11 11:36p 6144 eventlogMsgs.dll
10/13/11 11:21p 4608 uiproxy.dll
10/13/11 11:20p 12800 secur32.dll
10/13/11 11:20p 12800 k.secur32.dll
10/13/11 11:20p 194560 kerberos.dll
10/13/11 11:20p 194560 k.kerberos.dll
10/13/11 11:20p 44032 msasn1.dll
10/13/11 11:20p 44032 k.msasn1.dll
10/13/11 11:36p 278528 crypt32.dll
10/13/11 11:36p 278528 k.crypt32.dll
10/13/11 11:20p 24576 cryptdll.dll
10/13/11 11:20p 24576 k.cryptdll.dll
10/13/11 11:20p 6656 winsock.dll
10/13/11 11:20p 6656 k.winsock.dll
10/13/11 11:20p 6144 credprov.dll
10/13/11 11:20p 41472 spnego.dll
10/13/11 11:20p 41472 k.spnego.dll
10/13/11 11:22p 478720 ole32.dll
10/13/11 11:22p 198144 oleaut32.dll
10/13/11 11:22p 99328 dcomssd.dll
10/13/11 11:22p 8704 dllhost.exe
10/13/11 11:22p 327168 rpcrt4.dll
10/13/11 11:22p 355840 imaging.dll
10/13/11 11:36p 142848 mlang.dll
10/13/11 11:36p 136192 shlwapi.dll
10/13/11 11:36p 12800 IECEExt.dll
10/13/11 11:23p 754176 msxml3.dll
10/13/11 11:22p 201728 shdocvw.dll
10/13/11 11:36p 486400 wininet.dll
10/13/11 11:23p 19456 jsproxy.dll
10/13/11 11:36p 313856 urlmon.dll
10/13/11 11:36p 342528 vbscript.dll
10/13/11 11:36p 103424 httpd.dll
10/13/11 11:36p 78848 asp.dll
10/13/11 11:23p 51712 httpdadm.dll
10/13/11 11:23p 20992 telnetd.dll
10/13/11 11:23p 50688 ftpd.dll
10/13/11 11:23p 10240 timesvc.dll
10/13/11 11:36p 289792 ceshell.dll
10/13/11 11:36p 266240 explorer.exe
10/13/11 11:23p 11264 shcore.dll
10/13/11 11:36p 17408 control.exe
10/13/11 11:23p 7680 ctlpnl.exe
10/13/11 11:36p 155136 cplmain.cpl
10/13/11 11:36p 52224 intll.cpl
10/13/11 11:36p 49152 wceldcmd.exe
10/13/11 11:23p 12800 unldcmd.exe
10/10/07 11:58p 67088 mscoree.dll
10/11/07 12:01a 945176 mscoree3_5.dll
10/11/07 12:02a 256536 netcfagl3_5.dll
10/11/07 12:02a 168480 netcfd3dm3_5.dll
10/10/07 11:56p 22904 cgacutil.exe
10/13/11 11:34p 45568 SH600_NandFlash.dll
10/13/11 11:34p 12288 SH600_gpio.dll
10/13/11 11:34p 9216 SH600_spi.dll
10/13/11 11:34p 9728 SH600_i2c.dll
10/13/11 11:34p 8192 SH600_ADC.dll
10/13/11 11:34p 29184 P500_gmacndis.dll
10/13/11 11:35p 73216 SH600_ehci.dll
10/13/11 11:34p 57344 SH600_ohci.dll
10/13/11 11:35p 74240 ehci.dll
10/13/11 11:35p 4096 AgtFlashHelper.dll
10/13/11 11:34p 45568 Ssh600_nandflash.dll
10/13/11 11:35p 11776 p500_uboo.dll
10/13/11 11:35p 36864 TMCP500_CE6_DeviceSideUsb.dll
10/13/11 11:35p 13312 sh600_serial2.dll
10/13/11 11:35p 6656 MapMemoryIntoUserSpace.dll
10/13/11 11:35p 8704 GpibOverSPI_P500_CE6.dll
10/13/11 11:35p 223232 baldwin_ddi.dll
10/13/11 11:35p 126976 loadP500Flash.exe
10/13/11 11:35p 11776 ubootEnvironment.dll
10/13/11 11:35p 8192 ProcessStartupFolder.exe
10/13/11 11:35p 14336 CeCreateUserAccounts.exe
10/13/11 11:35p 36864 ConfigureNetworkNative.exe
10/13/11 11:35p 7168 processMgr.exe
10/13/11 11:35p 3584 rebootInfiniiVision.exe
10/13/11 11:36p 7168 regsvr32.exe
10/13/11 11:36p 37888 infiniiVisionInstallHelper.exe
10/13/11 11:36p 129536 infiniiVisionInstallService.exe
10/13/11 11:36p 36352 libmspack.dll
10/13/11 11:36p 24576 ubootTools.exe
10/13/11 11:36p 10240 compileImageForSplashScreen.exe
10/13/11 11:16p 188416 eGalaxTouch.exe
10/13/11 11:16p 100352 DrawTest.exe
10/13/11 11:16p 93696 Calbration.exe
10/13/11 11:16p 88064 UpdateEEPROM.exe
10/13/11 11:16p 17920 USBTouch.dll
10/13/11 11:19p 19167 ceconfig.h
10/13/11 11:36p 208590 wince.nls
10/13/11 11:36p 170825 default.fdf
10/13/11 11:36p 8763 initdb.ini
09/07/06 10:00a 134 close.2bp
09/07/06 10:00a 134 ok.2bp
09/07/06 10:00a 1030 stdsm.2bp
09/07/06 10:00a 838 viewsm.2bp
09/07/06 10:00a 2038 stdsm.bmp
09/07/06 10:00a 1654 viewsm.bmp
09/07/06 10:00a 176120 rsaenh.dll
09/07/06 10:00a 8779 sysroots.p7b
10/13/11 11:20p 50688 ntlmssp.dll
10/13/11 11:20p 79360 ntlmssp_svc.dll
09/07/06 10:00a 289940 arialbd.ttf
09/07/06 10:00a 228180 arialbi.ttf
09/07/06 10:00a 209248 ariali.ttf
09/07/06 10:00a 118868 arialk.ttf
09/07/06 10:00a 160724 arial.ttf
09/07/06 10:00a 169464 cour.ttf
09/07/06 10:00a 135848 tahoma.ttf
09/07/06 10:00a 961 httpd_default.htm
09/07/06 10:00a 1231 httpd-admin.htm
09/07/06 10:00a 4035 httpd-home.htm
09/07/06 10:00a 1710 httpd-logging.htm
09/07/06 10:00a 3281 httpd-netint.htm
09/07/06 10:00a 1816 httpd-newwebfinished.htm
09/07/06 10:00a 1482 httpd-newwebsite.htm
09/07/06 10:00a 3058 httpd-newwebvdirs.htm
09/07/06 10:00a 1234 httpd-sites.htm
09/07/06 10:00a 1385 httpd-ssl.htm
09/07/06 10:00a 1292 httpd-users.htm
09/07/06 10:00a 8470 httpd-vroot.htm
09/07/06 10:00a 2811 httpd-vrootlist.htm
09/07/06 10:00a 3587 httpd-website.htm
09/07/06 10:00a 1728 httpd-i-authlevel.htm
09/07/06 10:00a 2992 httpd-i-authoverview.htm
09/07/06 10:00a 2313 httpd-i-authtypes.htm
09/07/06 10:00a 2005 httpd-i-dirbrowse.htm
09/07/06 10:00a 1972 httpd-i-home.htm
09/07/06 10:00a 2069 httpd-i-logging.htm
09/07/06 10:00a 2460 httpd-i-overview.htm
09/07/06 10:00a 1030 httpd-i-permissions.htm
09/07/06 10:00a 1772 httpd-i-setpaths.htm
09/07/06 10:00a 1978 httpd-i-ssl.htm
09/07/06 10:00a 2446 httpd-i-upload.htm
09/07/06 10:00a 2570 httpd-i-userlists.htm
09/07/06 10:00a 3601 httpd-i-vdirs.htm
09/07/06 10:00a 1831 httpd-i-webadmin.htm
09/07/06 10:00a 4908 httpd-i-website.htm
09/07/06 10:00a 69 appdata.ini
09/07/06 10:00a 144 desktopdirectory.ini
09/07/06 10:00a 69 favorites.ini
09/07/06 10:00a 69 fonts.ini
09/07/06 10:00a 69 mydocuments.ini
09/07/06 10:00a 69 programfiles.ini
09/07/06 10:00a 69 programs.ini
09/07/06 10:00a 69 recent.ini
09/07/06 10:00a 69 startup.ini
09/07/06 10:00a 24 explore.lnk
09/07/06 10:00a 10786 WindowsCE.jpg
09/07/06 10:00a 19 cmd.lnk
09/07/06 10:00a 23 control.lnk
09/07/06 10:00a 739 copyrts.txt
09/07/06 10:00a 3116 asterisk.wav
09/07/06 10:00a 3388 close.wav
09/07/06 10:00a 2970 critical.wav
09/07/06 10:00a 2682 default.wav
09/07/06 10:00a 3946 empty.wav
09/07/06 10:00a 9204 exclam.wav
09/07/06 10:00a 5656 infbeg.wav
09/07/06 10:00a 1778 infend.wav
09/07/06 10:00a 2088 infintr.wav
09/07/06 10:00a 834 menupop.wav
09/07/06 10:00a 360 menusel.wav
09/07/06 10:00a 3388 openprog.wav
09/07/06 10:00a 1836 question.wav
09/07/06 10:00a 8508 startup.wav
09/07/06 10:00a 2712 windmax.wav
09/07/06 10:00a 2866 windmin.wav
09/07/06 10:00a 3388 recstart.wav
09/07/06 10:00a 3388 recend.wav
10/10/07 11:45p 16936 GAC_CustomMarshalers_v3_5_0_0_cneutral_1.dll
10/10/07 11:46p 349744 GAC_Microsoft.VisualBasic_v8_1_0_0_cneutral_1.dll
10/10/07 11:46p 34360 GAC_Microsoft.WindowsCE.Forms_v3_5_0_0_cneutral_1.dll
10/10/07 11:46p 185920 GAC_Microsoft.WindowsMobile.DirectX_v3_5_0_0_cneutral_1.dll
10/10/07 11:45p 941592 GAC_mscorlib_v3_5_0_0_cneutral_1.dll
10/10/07 11:46p 709656 GAC_System.Data_v3_5_0_0_cneutral_1.dll
02/09/09 06:51a 527552 GAC_System_v3_5_0_0_cneutral_1.dll
10/10/07 11:45p 60960 GAC_System.Drawing_v3_5_0_0_cneutral_1.dll
10/10/07 11:46p 77352 GAC_System.Messaging_v3_5_0_0_cneutral_1.dll
10/10/07 11:46p 20000 GAC_System.Net.IrDA_v3_5_0_0_cneutral_1.dll
10/10/07 11:45p 67112 GAC_System.Web.Services_v3_5_0_0_cneutral_1.dll
10/10/07 11:46p 280112 GAC_System.Windows.Forms_v3_5_0_0_cneutral_1.dll
10/10/07 11:45p 1038360 GAC_System.Xml_v3_5_0_0_cneutral_1.dll
10/10/07 11:46p 88088 GAC_System.Core_v3_5_0_0_cneutral_1.dll
10/10/07 11:46p 35904 GAC_System.Data.DataSetExtensions_v3_5_0_0_cneutral_1.dll
10/10/07 11:45p 42048 GAC_System.Runtime.Serialization_v3_5_0_0_cneutral_1.dll
10/10/07 11:45p 474152 GAC_System.ServiceModel_v3_5_0_0_cneutral_1.dll
10/10/07 11:46p 92704 GAC_System.Xml.Linq_v3_5_0_0_cneutral_1.dll
10/10/07 11:46p 345112 GAC_System.SR_v3_5_0_0_cneutral_1.dll
10/10/07 11:47p 63032 GAC_Microsoft.VisualBasic.SR_v8_1_0_0_cneutral_1.dll
10/13/11 11:34p 178176 SH600_ddi.dll
10/13/11 11:21p 23040 kbdmouse.dll
06/16/11 11:56p 102400 AgilentLan488Server32.dll
06/16/11 11:56p 44032 Agilent.Cdf.Core.Kernel.dll
06/16/11 11:57p 415744 Agilent.Cdf.Api.Unmanaged.dll
06/16/11 11:14p 169984 LxiMdnsResponder.dll
06/16/11 11:14p 11560 LxiMdnsResponderLicense.txt
06/16/11 11:58p 11776 Portability.dll
06/16/11 11:59p 13312 portmap.exe
06/16/11 11:59p 147968 Sicl32.dll
06/16/11 11:59p 81408 siclland.dll
06/16/11 11:59p 82432 siclrpc.dll
06/17/11 12:12a 9216 Agilent.Cdf.Core.Lxi.Web.ComServer.Interop.dll
06/16/11 11:14p 238080 OpenNETCF.dll
06/17/11 12:21a 1089536 Agilent.Cdf.Api.dll
06/17/11 12:21a 36352 Agilent.Cdf.Api.Gui.dll
06/16/11 11:19p 9099 PasswordFront.asp
06/16/11 11:19p 31371 home.asp
06/16/11 11:19p 2315 index.asp
06/16/11 11:19p 41690 modify_config.asp
06/16/11 11:19p 9677 navigation.asp
06/16/11 11:19p 7905 password.asp
06/16/11 11:19p 2268 top.asp
06/16/11 11:19p 23463 view_config.asp
06/16/11 11:19p 710 Default.asp
06/16/11 11:14p 12270 LXIIdentification.xsd
06/16/11 11:19p 38980 QualityLXI.jpg
06/16/11 11:19p 1004 CookieUtils.js
06/16/11 11:19p 2192 agilent.gif
<*holy crap... sorry... I should have just attached it*>
-
<*holy crap... sorry... I should have just attached it*>
06/16/11 11:19p 892 down-over.gif
06/16/11 11:19p 892 down.gif
06/16/11 11:19p 94 line-heading.gif
06/16/11 11:19p 3417 lxi.jpg
06/16/11 11:19p 893 up-over.gif
06/16/11 11:19p 893 up.gif
06/16/11 11:19p 1627 web-device.gif
06/16/11 11:19p 1535 web-enable.gif
06/16/11 11:19p 48 bluebar.gif
06/16/11 11:19p 1095 config-down.gif
06/16/11 11:19p 1068 config-over.gif
06/16/11 11:19p 1064 config.gif
06/16/11 11:19p 525 data-down.gif
06/16/11 11:19p 519 data-over.gif
06/16/11 11:19p 514 data.gif
06/16/11 11:19p 650 help-down.gif
06/16/11 11:19p 679 help-over.gif
06/16/11 11:19p 666 help.gif
06/16/11 11:19p 584 image-down.gif
06/16/11 11:19p 583 image-over.gif
06/16/11 11:19p 570 image.gif
06/16/11 11:19p 920 remote-down.gif
06/16/11 11:19p 907 remote-over.gif
06/16/11 11:19p 895 remote.gif
06/16/11 11:19p 620 welcome-down.gif
06/16/11 11:19p 623 welcome-over.gif
06/16/11 11:19p 614 welcome.gif
06/17/11 12:21a 6144 AgilentLxiWebService.exe
06/16/11 11:55p 70144 AgilentLxiWebComServer.exe
06/16/11 11:57p 32256 Agilent.Cdf.Core.Lxi.Web.ComServer.ProxyStub.dll
06/16/11 11:57p 58880 Agilent.Cdf.Core.Lxi.Web.ComServer.dll
06/17/11 12:21a 6144 AgilentLxiWebStartup.exe
10/13/11 11:16p 41 ConfigureNetwork.lnk
10/13/11 11:16p 99 usbUpdateApp.bat
10/13/11 11:16p 88 usbUpdateFpga.bat
10/13/11 11:36p 177 infiniiVision.txt
Found 365 file(s). Total size 26626785 bytes.
Directory of \Windows\StartUp
09/07/06 10:00a 69 desktop.ini
Found 1 file(s). Total size 69 bytes.
Directory of \Windows\Fonts
09/07/06 10:00a 69 desktop.ini
Found 1 file(s). Total size 69 bytes.
Directory of \Windows\Favorites
09/07/06 10:00a 69 desktop.ini
Found 1 file(s). Total size 69 bytes.
Directory of \Windows\Recent
09/07/06 10:00a 69 desktop.ini
Found 1 file(s). Total size 69 bytes.
Directory of \Windows\Programs
09/07/06 10:00a 69 desktop.ini
10/30/11 03:35a 19 Command Prompt.lnk
10/30/11 03:35a 24 Windows Explorer.lnk
Found 3 file(s). Total size 112 bytes.
Directory of \Windows\Desktop
09/07/06 10:00a 144 desktop.ini
Found 1 file(s). Total size 144 bytes.
Directory of \Windows\www
10/30/11 03:35a 58 current-httpd.log
10/30/11 03:35a <DIR> wwwpub
Found 2 file(s). Total size 58 bytes.
Directory of \Windows\www\wwwpub
10/30/11 03:35a 0 ApplicationLog.txt
10/30/11 03:35a <DIR> navbar
10/30/11 03:35a <DIR> Lxi
10/30/11 03:35a <DIR> image
10/30/11 03:35a 1004 CookieUtils.js
10/30/11 03:35a 23463 view_config.asp
10/30/11 03:35a 2268 top.asp
10/30/11 03:35a 7905 password.asp
10/30/11 03:35a 9677 navigation.asp
10/30/11 03:35a 41690 modify_config.asp
10/30/11 03:35a 2315 index.asp
10/30/11 03:35a 31371 home.asp
10/30/11 03:35a 9099 PasswordFront.asp
10/30/11 03:35a 961 default.htm
Found 14 file(s). Total size 129753 bytes.
Directory of \Windows\www\wwwpub\navbar
10/30/11 03:35a 614 welcome.gif
10/30/11 03:35a 623 welcome-over.gif
10/30/11 03:35a 620 welcome-down.gif
10/30/11 03:35a 895 remote.gif
10/30/11 03:35a 907 remote-over.gif
10/30/11 03:35a 920 remote-down.gif
10/30/11 03:35a 570 image.gif
10/30/11 03:35a 583 image-over.gif
10/30/11 03:35a 584 image-down.gif
10/30/11 03:35a 666 help.gif
10/30/11 03:35a 679 help-over.gif
10/30/11 03:35a 650 help-down.gif
10/30/11 03:35a 514 data.gif
10/30/11 03:35a 519 data-over.gif
10/30/11 03:35a 525 data-down.gif
10/30/11 03:35a 1064 config.gif
10/30/11 03:35a 1068 config-over.gif
10/30/11 03:35a 1095 config-down.gif
10/30/11 03:35a 48 bluebar.gif
Found 19 file(s). Total size 13144 bytes.
Directory of \Windows\www\wwwpub\Lxi
10/30/11 03:35a <DIR> Identification
Found 1 file(s). Total size 0 bytes.
Directory of \Windows\www\wwwpub\Lxi\Identification
10/30/11 03:35a 12270 LXIIdentification.xsd
10/30/11 03:35a 710 Default.asp
Found 2 file(s). Total size 12980 bytes.
Directory of \Windows\www\wwwpub\image
10/30/11 03:35a 1535 web-enable.gif
10/30/11 03:35a 1627 web-device.gif
10/30/11 03:35a 893 up.gif
10/30/11 03:35a 893 up-over.gif
10/30/11 03:35a 3417 lxi.jpg
10/30/11 03:35a 94 line-heading.gif
10/30/11 03:35a 892 down.gif
10/30/11 03:35a 892 down-over.gif
10/30/11 03:35a 2192 agilent.gif
10/30/11 03:35a 38980 QualityLXI.jpg
Found 10 file(s). Total size 51415 bytes.
Total Files Listed:
1094 File(s) 102902884 bytes.
81 Dir(s) 27090944 bytes free
-
The registry seems off-limits since windows seems to refuse to copy any file that's open and apparently there's no way around that. :-//
Usually in WindowsCE systems the registry is part of the nk.bin image and can't be changed. It is loaded at boot time from flash in memory, like all the other programs in the \windows directory.
Here's the output of `dir /s /a \` (firmware 2.00)
Maybe not a good idea to post it all in this forum. You can still edit it: pastebin.com and then a link.
-
Yes, the registry is in default.fdf inside nk.bin, but there is no much interesting. "SecureStorage" component looks more promising, needs to be figured out
-
Benemorius, did you tryied change de splash screen?
did you get any results with yours tests?
-
I only wish FrankBuss would elaborate on how to utilize that UART...
The serial port location:
http://i.imgur.com/yYMV75t.jpg (http://i.imgur.com/yYMV75t.jpg)
All you need are some jumper wires, if you don't want to drill a hole. Fits nicely through the USB connector hole 8)
http://i.imgur.com/9gnsuQh.jpg (http://i.imgur.com/9gnsuQh.jpg)
You can then stop the u-boot with space (can be difficult, you have to be fast, use something like HTerm which has a useful "repeat" function to send a sequence automatically until you stop it, or just hold down space while you boot it). Then you can boot the image from network like this:
set serverip 192.168.11.108
dhcp 0x4000000 nk.bin;bootm 0xf8050000
Where 192.168.11.108 is your own server, where TFTP is running and providing nk.bin. You should see something like this:
BOOTP broadcast 1
DHCP client bound to address 192.168.11.106
Using smsc device
TFTP from server 192.168.11.108; our IP address is 192.168.11.106
Filename 'nk.bin'.
Load address: 0x4000000
Loading: **#################################################################
#################################################################
...
You get the nk.bin from the nk.bin.comp from the firmware update cab-file with the bincompress.exe tool, which is included in the evaluation version of the WindowsCE development environment. Use http://www.t-hack.com/wiki/index.php/NK.BIN_toolset (http://www.t-hack.com/wiki/index.php/NK.BIN_toolset) to take a look at the content of nk.bin and to modify it.
Hi, here is info if someone want to make a NAND dump with JTAG debugger:
To Enable JTAG, you need this SPEAr600 TEST[2:0] pin configuration:
TEST_0=1, TEST_1=1, TEST_2=0
With debugger I did 128MB dump from NAND:
0000:0000-005F:FFFF empty, just 0xFF
0060:0000-00C0:9F61 NK.BIN.COMP, size 12623714 bytes (FW 02.20)
02C2:0000- ???? Other data/files
Now we have NAND dump and need to:
1) hack MD5/RSA file consistency check to enable another files to modify
2) hack RSACryptoServiceProvider::VerifyData() or function which use it (AGILEN~1.003)
With Uboot write modificaton into NAND. Then just install licenses with any signature :-)
Now I'm not able to find MD5/RSA file consistency check. Please help.
-
There is no file consistency check afaik. There is no need to use jtag also, just use the infiniivisionstartupoverride.txt method desribed in previous posts and you'll be able to run a patched scope app from usb flash drive whithout opening the case. There is more that enough info posted in this thread already, just nobody wants to post that final "here is .zip, unpack it to usb flash and use" ;)
Funny situation - dissecting Rigol and Hantek in public is ok, but Agilent's name invokes some kind of shame (or fear?) )))
-
I guess the difference might be that the Hantek and Rigol hacks are just for bandwidth upgrade, all the other features are already included, so it is nice to have it, but most of the time not that important.
Agilent wants even for the voltmeter license EUR 61. And just the RS232/UART decoding license costs EUR 642. You want I2C/SPI, too? Another EUR 642. The sum of all available licenses might be more than EUR 10,000. And there might be people who considers to buy one or more licenses, like I did with the network license. So could be a big loss for Agilent, if there would be a public hack. Which makes it more dangerous to publish such a hack and which might even have negative consequences for Agilent: less money for Agilent means that they have less money for developing more good scopes.
So in my opinion, hack it for fun if you are a hobbyist and if you wouldn't buy one of the expensive licenses anyway, but don't publish the hack.
-
There is no file consistency check afaik. There is no need to use jtag also, just use the infiniivisionstartupoverride.txt method desribed in previous posts and you'll be able to run a patched scope app from usb flash drive whithout opening the case. There is more that enough info posted in this thread already, just nobody wants to post that final "here is .zip, unpack it to usb flash and use" ;)
Funny situation - dissecting Rigol and Hantek in public is ok, but Agilent's name invokes some kind of shame (or fear?) )))
Few reasons:
1. There is security risk when we publish it.
2. Agilent and their engineers are really helpful when I need real assistence.
3. On this forum were hack offered for $$$, so it is under supervision for sure.
4. This thread is in the top when you Google "Agilent DSOX hack".
5. Hack will double or triple the price of hardware.
-
There is no file consistency check afaik. There is no need to use jtag also, just use the infiniivisionstartupoverride.txt method desribed in previous posts and you'll be able to run a patched scope app from usb flash drive whithout opening the case. There is more that enough info posted in this thread already, just nobody wants to post that final "here is .zip, unpack it to usb flash and use" ;)
Funny situation - dissecting Rigol and Hantek in public is ok, but Agilent's name invokes some kind of shame (or fear?) )))
Few reasons:
1. There is security risk when we publish it.
2. Agilent and their engineers are really helpful when I need real assistence.
3. On this forum were hack offered for $$$, so it is under supervision for sure.
4. This thread is in the top when you Google "Agilent DSOX hack".
5. Hack will double or triple the price of hardware.
lol you think making a hack public will double or triple the hardware price?! Are you serious? So I guess all the other scopes/phones/tablets/games/consoles/computers/EVERYTHING ELECTRONIC have all doubled and tripled in price right? Since they have ALL been hacked since there was something to hack! Man, guess Ill be paying $599 for my $299 iPhone next time I upgrade since they jailbroke it.
And to you other "statements"
1) Nope, no security risk here, my scope is just as safe and secure as it was. Are you thinking that if the hack got out to the public that some malicious person might write a "virus" for my scope? Well who's to say I trust that the individuals on this site trying to sell me a hack arent going to do the same thing?! Or that they messed up somewhere and they made a mistake that hasnt been found and it might brick my scope?! This is why its better to let everyone look at your work if youre going to do this sort of thing.
2) Yes, they still are and always will be. They are paid to be so. They want to keep selling products. 99.9999% of the owners of electronic devices never hack or mod them anyway.
3) Most feel its insulting to reverse engineer some other work and then try and charge for it. I would never pay to jailbreak my iPhone or mod my Wii for example.
4) So?
5) You have to be kidding me... Already responded to this in the beginning of this post.
-
There is no file consistency check afaik. There is no need to use jtag also, just use the infiniivisionstartupoverride.txt method desribed in previous posts and you'll be able to run a patched scope app from usb flash drive whithout opening the case. There is more that enough info posted in this thread already, just nobody wants to post that final "here is .zip, unpack it to usb flash and use" ;)
Funny situation - dissecting Rigol and Hantek in public is ok, but Agilent's name invokes some kind of shame (or fear?) )))
Few reasons:
1. There is security risk when we publish it.
2. Agilent and their engineers are really helpful when I need real assistence.
3. On this forum were hack offered for $$$, so it is under supervision for sure.
4. This thread is in the top when you Google "Agilent DSOX hack".
5. Hack will double or triple the price of hardware.
lol you think making a hack public will double or triple the hardware price?! Are you serious? So I guess all the other scopes/phones/tablets/games/consoles/computers/EVERYTHING ELECTRONIC have all doubled and tripled in price right? Since they have ALL been hacked since there was something to hack! Man, guess Ill be paying $599 for my $299 iPhone next time I upgrade since they jailbroke it.
And to you other "statements"
1) Nope, no security risk here, my scope is just as safe and secure as it was. Are you thinking that if the hack got out to the public that some malicious person might write a "virus" for my scope? Well who's to say I trust that the individuals on this site trying to sell me a hack arent going to do the same thing?! Or that they messed up somewhere and they made a mistake that hasnt been found and it might brick my scope?! This is why its better to let everyone look at your work if youre going to do this sort of thing.
2) Yes, they still are and always will be. They are paid to be so. They want to keep selling products. 99.9999% of the owners of electronic devices never hack or mod them anyway.
3) Most feel its insulting to reverse engineer some other work and then try and charge for it. I would never pay to jailbreak my iPhone or mod my Wii for example.
4) So?
5) You have to be kidding me... Already responded to this in the beginning of this post.
My opinion, my rulezz... You can try to hack it by yourself and publish it ;-) I will never do that, for the reason above. Every year I spent more than 25k USD for various test equipment. When I really need for business I will buy it.
I posted in this thread lot of tricks which will be quite useful, thats all.
-
Bragging about a hack and then refusing to give out information does make you look like a bit of a douche...
But then so does spelling rules with a z...
-
Read whole thread....
-
Benemorius, did you tryied change de splash screen?
did you get any results with yours tests?
Yes, changing the splash screen worked.
I did not attempt to overwrite any .exe or .dll files but I see no reason to doubt that it will work too. Running the firmware from USB is slower (longer boot time and occasional menu lag) and you have to remember not to pull the flash drive or else it crashes, but otherwise it works about like normal. I'm happy enough with that that I'd rather not overwrite any other files until I have NAND access, despite all indications being that there's nothing to worry about really.
-
Yes, changing the splash screen worked.
Nice, maybe you can provide a zip file with the USB flash drive content and attach it here? It will be small with a simple monochrome image as an example. Then that crazy aussie bloke and others can just replace the splash screen with their favorite image, if they want to.
I did not attempt to overwrite any .exe or .dll files but I see no reason to doubt that it will work too. Running the firmware from USB is slower (longer boot time and occasional menu lag) and you have to remember not to pull the flash drive or else it crashes, but otherwise it works about like normal. I'm happy enough with that that I'd rather not overwrite any other files until I have NAND access, despite all indications being that there's nothing to worry about really.
There is more than one way to skin a cat, but it is possible with just booting patched files from USB, and all necessary files to patch (one or two, depending on how you hack it) are writable. But needs some work with IDA (https://www.hex-rays.com/products/ida/index.shtml) or other disassemblers. Fortunately the DLLs are not encrypted. With more secure systems like used in iOS, it would be more complicated because of the additional decrypt step.
-
Yes, changing the splash screen worked.
I did not attempt to overwrite any .exe or .dll files but I see no reason to doubt that it will work too. Running the firmware from USB is slower (longer boot time and occasional menu lag) and you have to remember not to pull the flash drive or else it crashes, but otherwise it works about like normal. I'm happy enough with that that I'd rather not overwrite any other files until I have NAND access, despite all indications being that there's nothing to worry about really.
The boot time is annoying, I need to restore backup of my USB two times, because the files on flash became corrupted.
-
There is more that enough info posted in this thread already, just nobody wants to post that final "here is .zip, unpack it to usb flash and use" ;)
Funny situation - dissecting Rigol and Hantek in public is ok, but Agilent's name invokes some kind of shame (or fear?) )))
Not shame I think, but fear of a couple of things.
Fear of what the response from Agilent might be if the .zip file makes it to Hackaday or wherever things go to get really popular these days. It would be sad enough if Rigol responded to the popularity by patching the recent hacks, but an order of magnitude more sad at least if Agilent did the same. For the Rigol options are at least affordable if you really want them. With Agilent some of the stuff is off limits to a large number of us. As in can't have ever. Like at all. The hacks are the only way for some of us to ever have these things and nobody wants to make them go away for anyone.
There is also some fear of Agilent's attitude toward us individually. It is conceivable that I may actually contact Agilent if I ever have a problem with my scope some day since they're one of those remaining companies with whom that is actually worth doing. Given that possibility, it would be good for me if I haven't pissed them off in such a way that their desire to provide assistance is diminished. This is much less true with Rigol. I wouldn't expect much service there whether I'd pissed them off or not.
Someone will eventually post the damn .zip file. Part of the reason it's taking longer is simply that there are fewer Agilent owners out there than Rigol owners. The Agilent owner who just doesn't give a flying fuck simply hasn't come along yet.
-
The boot time is annoying, I need to restore backup of my USB two times, because the files on flash became corrupted.
That's interesting. I've used my scope a lot and haven't encountered any problems with corruption. It doesn't seem like any of the files there are regularly written anyway. I wonder if a different flash drive would change anything?
-
The boot time is annoying, I need to restore backup of my USB two times, because the files on flash became corrupted.
That's interesting. I've used my scope a lot and haven't encountered any problems with corruption. It doesn't seem like any of the files there are regularly written anyway. I wonder if a different flash drive would change anything?
I'm using micro SD Reader and card, not regular USB flash. It can be also source of problems.
-
I only wish FrankBuss would elaborate on how to utilize that UART...
The serial port location:
http://i.imgur.com/yYMV75t.jpg (http://i.imgur.com/yYMV75t.jpg)
All you need are some jumper wires, if you don't want to drill a hole. Fits nicely through the USB connector hole 8)
http://i.imgur.com/9gnsuQh.jpg (http://i.imgur.com/9gnsuQh.jpg)
You can then stop the u-boot with space (can be difficult, you have to be fast, use something like HTerm which has a useful "repeat" function to send a sequence automatically until you stop it, or just hold down space while you boot it). Then you can boot the image from network like this:
set serverip 192.168.11.108
dhcp 0x4000000 nk.bin;bootm 0xf8050000
Where 192.168.11.108 is your own server, where TFTP is running and providing nk.bin. You should see something like this:
BOOTP broadcast 1
DHCP client bound to address 192.168.11.106
Using smsc device
TFTP from server 192.168.11.108; our IP address is 192.168.11.106
Filename 'nk.bin'.
Load address: 0x4000000
Loading: **#################################################################
#################################################################
...
You get the nk.bin from the nk.bin.comp from the firmware update cab-file with the bincompress.exe tool, which is included in the evaluation version of the WindowsCE development environment. Use http://www.t-hack.com/wiki/index.php/NK.BIN_toolset (http://www.t-hack.com/wiki/index.php/NK.BIN_toolset) to take a look at the content of nk.bin and to modify it.
Hi, here is info if someone want to make a NAND dump with JTAG debugger:
To Enable JTAG, you need this SPEAr600 TEST[2:0] pin configuration:
TEST_0=1, TEST_1=1, TEST_2=0
With debugger I did 128MB dump from NAND:
0000:0000-005F:FFFF empty, just 0xFF
0060:0000-00C0:9F61 NK.BIN.COMP, size 12623714 bytes (FW 02.20)
02C2:0000- ???? Other data/files
Now we have NAND dump and need to:
1) hack MD5/RSA file consistency check to enable another files to modify
2) hack RSACryptoServiceProvider::VerifyData() or function which use it (AGILEN~1.003)
With Uboot write modificaton into NAND. Then just install licenses with any signature :-)
Now I'm not able to find MD5/RSA file consistency check. Please help.
Hey Sumino2000,
I found on Agilent site this data sheet containing "memory map", maybe this will help: Link (http://www.google.hr/url?q=http://cp.literature.agilent.com/litweb/pdf/5990-8184EN.pdf&sa=U&ei=GIMMUsWlAYij4gTVu4CYCw&ved=0CBsQFjAA&usg=AFQjCNHoKv1WulM3oR3eRkw5xMyoKsPPzA)
-
Hi guys!
Recently i bought a 2000 series scope with Lan/Vga option, so i started poking around and this is what i managed to find out.
If you have LAN/VGA option you can boot from USB stick and using VNC get access to windows ce desktop,
windows have frame buffer in RAM for user interface, user interface you see on a scope's LCD is generated by MegaZoom,
and original agilent vnc is transmitting megazoom's frame buffer to computer...
This is how you can do it:
1. Make some batch file in "startup" folder on usb stick containing this code:
taskkill /im infiniivisionLauncher.exe
taskkill /im AgilentLxiWebService.exe
This prevents starting infiniivision application and vnc.
2. Download "mobileVNC", you can find a demo version (you'll need version for ARM). You can search "MobileVNC_Demo.zip" i used that one.
Copy executable somewhere on usb and put shortcut to executable in startup folder.
This is how you do it:
write path to executable, in my case its:
48#\usb\Secure\infiniiVision\ARM\MobileVNC.exe
and save it as ".lnk" file, copy that file to startup folder.
If you don't know ip address you can boot scope normaly and see in options-->IO-->LAN assigned ip address.
Enter this address in vnc viewer and conntect to scope, that's it!
You'll notice that it's imposible to copy any .exe files from windows folder.
There are some hidden folders, for example folder containing license and calibration data, you need to check "view hidden files" in options
and then you can "backup" them on USB drive.
If you ever looked at firmware update you probably noticed in recepie.xml:
<!-- Try to update DSO2000 FPGA -->
<installStep>
<file checksum="c4e300bc784756148a13e95f83cf44da">fpga2000a.bin</file>
<command>\windows\loadP500Flash -u fpga --target economy %TEMP%\fpga2000a.bin</command>
</installStep>
<!-- Try to update DSO3000 FPGA -->
<installStep>
<file checksum="12173c04dc2dee18976902c36fc42809">fpga3000a.bin</file>
<command>\windows\loadP500Flash -u fpga --target performance %TEMP%\fpga3000a.bin</command>
</installStep>
but when i called "loadP500Flash -help" in command prompt it responded with:
USAGE:
\Windows\loadP500Flash.exe [-t <economy|performance|coyote>] [-a
<hexidecimal integer>] -u <tloSplash|fpga
|ceImage1|ceImage2|ceImage3|custom> [--]
[--version] [-h] <filename>
Where:
-t <economy|performance|coyote>, --target <economy|performance|coyote>
FPGA target
-a <hexidecimal integer>, --address <hexidecimal integer>
NAND Flash address for the custom update type.
-u <tloSplash|fpga|ceImage1|ceImage2|ceImage3|custom>, --update
<tloSplash|fpga|ceImage1|ceImage2|ceImage3|custom>
(required) Update Type
--, --ignore_rest
Ignores the rest of the labeled arguments following this flag.
--version
Displays version information and exits.
-h, --help
Displays usage information and exits.
<filename>
(required) Filename to write to NAND Flash
updateP500Flash
So what is this "coyote" option? Some model (or series) better than 3000???
What do you think???
-
Coyote is 4000. InfiniiVision is common sw for 2k, 3k, 4k.
Why do you need VNC if there is a built in telnet?
-
Some "oil into the fire":
telnet login/pass:
infiniivision
skywalker1977
-
Apparently djvinc doesnt exist on the interwebs anymore. I'd be happy to pay $140 for a fix.
Oh well. I guess I'll start digging into my 3034. Bummer, I've got better things to do with my time.
-
You don't really need to pay, all the required info is in this thread. You can just boot using a USB flash drive to unlock everything.
Someone needs to throw together a thorough walk through for those that arent as savvy in this area.
-
I don´t really understand what to do in order to "hack" the DSO.
I tried it with the USB method, but I think I haven´t done it the right way.
Maybe someone can help me via private message or so :)
-
Yea me too please. What exactly has been figured out and what can we get out of it? Of course without having to buy it from someone else I mean.
-
I want to buy one of those Agilent oscilloscopes and, as a young academic i'm interested in some particular addons.
I'm not particularly in favor of those who profit with these hacks so i understand all the secrecy about this talk.
However, the way this topic is evolving is putting myself up to the challenge of finding the way to enable some licenses :)
As it seems possible to run the firmware from a USB pen without having to sign any cab and safely make some changes in the files, i ask a naive question that contribute with something (or not) to this topic:
Is it possible to edit one specific binary file in such way that the public key used to verify the license files is changed to the old one so we can use the known private key to sign the licenses?
Since i dont have access to any scope of this range, i have no way to check this idea.... just my two thoughts...
Regards
-
How to hack the firmware
1. Unpack the firmware *.cab by 7zip
2. Unpack infiniiVisionSetup.cab ( e.g. with WinCE CAB Manager 3.0)
Find \Secure\infiniiVision\infiniiVisionCore.dll
3. Change at location 0x277e50 in infiniiVisionCore.dll
byte sequence 04 00 a0 e1 to byte sequence 00 00 a0 e3
4. Enable startup Overide by creating USB flash with following structure in root of USB drive (copy structure from Secure folder from point 2)
Edit in Startup folder file infiniivision.lnk to contains following sequence "62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"
Replace in infiniiVision folder infiniiVisionCore.dll with patched infiniiVisionCore.dll file
5. Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
6. Plug the USB drive to scope and turn it ON
7. There will be red message in letf top corner "Unfinalized Software" and "System Concerns detected: OS version is not correct. Please reload system firmware"
Applications needed:
WinCE CAB Manager http://www.ocpsoftware.com/products.php (http://www.ocpsoftware.com/products.php)
7Zip http://www.7-zip.org/ (http://www.7-zip.org/)
-
How to hack the firmware
1. Unpack the firmware *.cab by 7zip
2. Unpack infiniiVisionSetup.cab ( e.g. with WinCE CAB Manager 3.0)
Find \Secure\infiniiVision\infiniiVisionCore.dll
3. Change at location 0x277e50 in infiniiVisionCore.dll
byte sequence 04 00 a0 e1 to byte sequence 00 00 a0 e3
4. Enable startup Overide by creating USB flash with following structure in root of USB drive (copy structure from Secure folder from point 2)
Edit in Startup folder file infiniivision.lnk to contains following sequence "62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"
Replace in infiniiVision folder infiniiVisionCore.dll with patched infiniiVisionCore.dll file
5. Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
6. Plug the USB drive to scope and turn it ON
7. There will be red message in letf top corner "Unfinalized Software" and "System Concerns detected: OS version is not correct. Please reload system firmware"
Applications needed:
WinCE CAB Manager http://www.ocpsoftware.com/products.php (http://www.ocpsoftware.com/products.php)
7Zip http://www.7-zip.org/ (http://www.7-zip.org/)
Nice. So what can you do with it from this point?
-
After all my Sunday afternoon trying these method I finally succeed! Although there was some pit falls. Everything is working, including the MSO. But in this case I think we will not find any connector to insert in the scope to replicate the original, which must have some embedded hardware too. Any ideas?
Anyone have succeeded hacking the bandwidth from 70 to 100 or even 200 MHz?
Thanks a lot Plesa!
-
Anyone have succeeded hacking the bandwidth from 70 to 100 or even 200 MHz?
The "-l All" in plesa's hack should enable all licenses. But if you buy a 200 MHz license, you get some new 300 MHz probes. Maybe the scope tests the probe types.
BTW: the 16 channel digital input doesn't need any electronics, it is just ground and the input signals, and you can plug-in an old 40 pin IDE cable.
-
How to hack the firmware
1. Unpack the firmware *.cab by 7zip
2. Unpack infiniiVisionSetup.cab ( e.g. with WinCE CAB Manager 3.0)
Find \Secure\infiniiVision\infiniiVisionCore.dll
3. Change at location 0x277e50 in infiniiVisionCore.dll
byte sequence 04 00 a0 e1 to byte sequence 00 00 a0 e3
4. Enable startup Overide by creating USB flash with following structure in root of USB drive (copy structure from Secure folder from point 2)
Edit in Startup folder file infiniivision.lnk to contains following sequence "62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"
Replace in infiniiVision folder infiniiVisionCore.dll with patched infiniiVisionCore.dll file
5. Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
6. Plug the USB drive to scope and turn it ON
7. There will be red message in letf top corner "Unfinalized Software" and "System Concerns detected: OS version is not correct. Please reload system firmware"
Applications needed:
WinCE CAB Manager http://www.ocpsoftware.com/products.php (http://www.ocpsoftware.com/products.php)
7Zip http://www.7-zip.org/ (http://www.7-zip.org/)
I'm assuming to back this out you just install the latest official firmware and call it a day?
-
How would you guys compare the DSOX2000 to the Rigol DS2000, both with all options (freely) activsted? I know that the Agilent scope maintains its waveform update rate much better than Rigol does; however, 1Mpt memory seems kind-of craptastic (how important is this)? Also the Agilent costs about 50% more.
-
I'm assuming to back this out you just install the latest official firmware and call it a day?
This is based on the method plesa described in reply #142 in this thread and boots from the USB flash drive. If you unplug the USB flash drive, it boots the old firmware from the internal scope flash. You can add some copy commands in the startup script on the flash drive to install it permanently.
-
Anyone have succeeded hacking the bandwidth from 70 to 100 or even 200 MHz?
The "-l All" in plesa's hack should enable all licenses. But if you buy a 200 MHz license, you get some new 300 MHz probes. Maybe the scope tests the probe types.
BTW: the 16 channel digital input doesn't need any electronics, it is just ground and the input signals, and you can plug-in an old 40 pin IDE cable.
Fo the badwidth upgrade you will need to replace the mainboard, it is not software upgrade only. The 350/500 MHz version shares same probes. The digital input pinout - upper row signal and the bottom one is ground.
-
Fo the badwidth upgrade you will need to replace the mainboard, it is not software upgrade only.
The scope bandwidth is a software upgrade with hardware required at 350MHz and 1GHz. The probes change at some frequencies as well.
-
Looks like there are different bandwidth upgrades. I know this one, from 100 MHz to 200 MHz (http://www.newark.com/agilent-technologies/dsox3bw24/license-b-w-upg-100-mhz-to-200/dp/31T9060). But right, for the bandwidth upgrade to 350 MHz (http://www.datatec.de/cgi-bin/shop/lshop.cgi?action=showdetail&artnum=dsox3bw32), it is not just software and the scope has to be sent to a service center. I guess they really change the mainboard and not set just some jumper, because of the high price :)
The datasheet for the 350 MHz update (http://cp.literature.agilent.com/litweb/pdf/5990-7759EN.pdf) says, that the old 200 MHz update is obsolete, maybe new scopes are shipped with this license now without the need to buy it. And the 350 MHz hardware update allows an additional software license update to 500 MHz.
-
The "-l All" in plesa's hack should enable all licenses...
If this command enable all licenses, what does the changes in infiniiVisionCore.dll do?
-
Anyone have succeeded hacking the bandwidth from 70 to 100 or even 200 MHz?
The "-l All" in plesa's hack should enable all licenses. But if you buy a 200 MHz license, you get some new 300 MHz probes. Maybe the scope tests the probe types.
BTW: the 16 channel digital input doesn't need any electronics, it is just ground and the input signals, and you can plug-in an old 40 pin IDE cable.
Yes, it is all enabled in the Scope About, but the bandwidth still is showing 70MHz. I know the 200MHz need new probes, but those which came with the 70MHz is 150MHz and should work at least up to 100MHz if enabled.
Good to know about the IDE connector! I can´t find the pin out anywhere. Do you have this info to share?
-
Looks like there are different bandwidth upgrades. I know this one, from 100 MHz to 200 MHz (http://www.newark.com/agilent-technologies/dsox3bw24/license-b-w-upg-100-mhz-to-200/dp/31T9060). But right, for the bandwidth upgrade to 350 MHz (http://www.datatec.de/cgi-bin/shop/lshop.cgi?action=showdetail&artnum=dsox3bw32), it is not just software and the scope has to be sent to a service center. I guess they really change the mainboard and not set just some jumper, because of the high price :)
The datasheet for the 350 MHz update (http://cp.literature.agilent.com/litweb/pdf/5990-7759EN.pdf) says, that the old 200 MHz update is obsolete, maybe new scopes are shipped with this license now without the need to buy it. And the 350 MHz hardware update allows an additional software license update to 500 MHz.
Thats really interesting, I did not see such a document. I just remember it from Agilent sales presentation. It needs to be investigated ;-)
-
Looks like there are different bandwidth upgrades. I know this one, from 100 MHz to 200 MHz (http://www.newark.com/agilent-technologies/dsox3bw24/license-b-w-upg-100-mhz-to-200/dp/31T9060). But right, for the bandwidth upgrade to 350 MHz (http://www.datatec.de/cgi-bin/shop/lshop.cgi?action=showdetail&artnum=dsox3bw32), it is not just software and the scope has to be sent to a service center. I guess they really change the mainboard and not set just some jumper, because of the high price :)
The datasheet for the 350 MHz update (http://cp.literature.agilent.com/litweb/pdf/5990-7759EN.pdf) says, that the old 200 MHz update is obsolete, maybe new scopes are shipped with this license now without the need to buy it. And the 350 MHz hardware update allows an additional software license update to 500 MHz.
Where do you see it's obsolete? The document you linked to certainly doesn't.
Since the front-end has to change jumping to a 350Mhz scope requires it to be sent back in for a main board change (and new probes). All the other upgrades are software-only (and new probes).
-
The datasheet for the 350 MHz update (http://cp.literature.agilent.com/litweb/pdf/5990-7759EN.pdf) says, that the old 200 MHz update is obsolete, maybe new scopes are shipped with this license now without the need to buy it. And the 350 MHz hardware update allows an additional software license update to 500 MHz.
Where do you see it's obsolete? The document you linked to certainly doesn't.
There is some big red text in the PDF on the first page: "Obsolete as of July 25".
Good to know about the IDE connector! I can´t find the pin out anywhere. Do you have this info to share?
See reply #196 from plesa.
The "-l All" in plesa's hack should enable all licenses...
If this command enable all licenses, what does the changes in infiniiVisionCore.dll do?
You can try it: it doesn't accept the command line parameters without the patch.
-
The datasheet for the 350 MHz update (http://cp.literature.agilent.com/litweb/pdf/5990-7759EN.pdf) says, that the old 200 MHz update is obsolete, maybe new scopes are shipped with this license now without the need to buy it. And the 350 MHz hardware update allows an additional software license update to 500 MHz.
Where do you see it's obsolete? The document you linked to certainly doesn't.
There is some big red text in the PDF on the first page: "Obsolete as of July 25".
Hah - my bad - I was looking for text. However, I think they are saying the PROCESS is obsolete, not the upgrades.
-
If your don´t like those warning messages, just replace then in infiniiVisionCore.dll with any message you like using HexEdit. 8)
-
Anyone get the bandwidth upgrade with this hack? Mine enabled all the features but the bandwidth. And yes, the "-l All" in Plesa's hack is there there.
-
Anyone get the bandwidth upgrade with this hack? Mine enabled all the features but the bandwidth. And yes, the "-l All" in Plesa's hack is there there.
Yes. upped from 100 MHz to 200 MHz on DSO-X2014
-
Mine is X-2002 and still stuck in 70MHz :(
-
I tried it in a dsox-2002a, everything worked, except by the bandwidth whic remains 70MHz.
I didnt try a signal with more than 70MHz, but the scope info, show bw: 70.
This work with the dsox3000 too? the changes are the same?
-
Anyone get the bandwidth upgrade with this hack? Mine enabled all the features but the bandwidth. And yes, the "-l All" in Plesa's hack is there there.
Yes. upped from 100 MHz to 200 MHz on DSO-X2014
Dammit. Every time I'm pretty sure I'll be getting a Rigol, I come in this thread and read something compelling enough to make me reconsider.
-
Anyone get the bandwidth upgrade with this hack? Mine enabled all the features but the bandwidth. And yes, the "-l All" in Plesa's hack is there there.
Yes. upped from 100 MHz to 200 MHz on DSO-X2014
Dammit. Every time I'm pretty sure I'll be getting a Rigol, I come in this thread and read something compelling enough to make me reconsider.
It's a beautiful scope, I started with a Rigol, then switched to Agilent and I don't have plans to go back to Rigol for a long period of time, unless there is a very huge reason.
David.
-
Dammit. Every time I'm pretty sure I'll be getting a Rigol, I come in this thread and read something compelling enough to make me reconsider.
It's a beautiful scope, I started with a Rigol, then switched to Agilent and I don't have plans to go back to Rigol for a long period of time, unless there is a very huge reason.
David.
It's probably ultimately going to swing in favor of Rigol again, once I price check a 4-channel Agilent vs. a 4-channel Rigol. I want the Agilent more, but I can't afford $1900 for a DSOX2004A.
Unless Agilent somehow decide to gift me a scope, it will likely be the Rigol DS1104Z-S for me. {insert the rare new scope sadface here}
-
Or you can get in on one of their Premium Used units on eBay which are like new and have the new extended warranty on them. I got my MSOX2024 for $1875. I bought the few upgrades I wanted and the VGA/LAN module, but yea getting them from this thread via the hack would be awesome too.
-
Rigol are doing 4 channel 2000 series scopes now, which should be much cheaper than the 4000 series. Even with the eBay used shop it is hard to justify an Agilent with smaller memory and higher cost, even if the interface is a bit more fluid. Even so, they are just such nice scopes...
DS2000 series with 4 Channel? :o
How do you know that?
-
I just now scanned this thread with interest, as I just picked up an MS0X3104A on Ebay. I actually wanted the probes that came with it, and haven't decided if I will keep the scope (I don't plan to. I plan to play with it for a while, then re-sell it.)
In the meanwhile, I'd like to explore the LAN/VGA functionality without springing for the module. So I followed the discussion here with interest. Did anyone ultimately make a PCB for the LAN/VGA functionality? If so, I'd like to avoid duplicating the effort.
Thanks for any info.
Dave
-
Rigol are doing 4 channel 2000 series scopes now, which should be much cheaper than the 4000 series. Even with the eBay used shop it is hard to justify an Agilent with smaller memory and higher cost, even if the interface is a bit more fluid. Even so, they are just such nice scopes...
I've been wondering why Rigol hasn't had a 4 channel 2000 series scope...
-
Yesterday I did some investigations to locate the picture for that are used for the screensaver.
The Megazoom logo starts at 0x739E30 and has 22876 Bytes and it's a 266x86 pixel array with 1 byte/pixel
The picture uses the same 8 bit color palette as a saved 8bit color Bitmap.
At the adress 73F78C are some information's of the picture 0A 01 = 0x10a = 266 and 00 56 = 0x56 = 86.
So its possible to create a nice customized Screensvaer
Regards
Kai
-
^^^^^^ Very cool. Thanks for sharing that!
-
What means the -l SCPIPS parameter?
I can imagine what the -l ALL do, but not the scpips.
Can someone tell me what it do?
-
It might be SCPI programming standard, not shure yet.
-l ALL enables all "trial" licences but without time limit, that's why there are "*" following each license.
@kilobyte
You can find icon of a starship enterprise at 0x00794018, it's 4032 bytes long, and 478x122 pixels.
It look's like there are more easter eggs hidden, not only "lost" (162342), etch-a-scope and credits.
-
HA! Snap a shot of the Enterprise and post it! I wanna see that one!
-
HA! Snap a shot of the Enterprise and post it! I wanna see that one!
I second that one!
-
Thanks wersi.
I didnt know the SCPI programming standard.
The changes in the dll file, is the same to the 3000X series?
Interesting to think in new easter egg...!!
-
The option SCPIPS could also be the remote logging option to debug the SCPI commands.
And for all Trekkies
see the attachment :)
Yes i also think this could be a easter egg.
It a littlebit hard to find out in which case this picture / function will be started.
Maybe i can find more about this in the disassembly.
-
That's possible too, i'm not shure but there is RML license which is probably "Remote Logging".
2000 and 3000 series uses same firmware, i have 2000 series 'scope.
On 2000 series you can upgrade bandwidth up to 200MHz, also i found two extra options which can be enabled with -l switch. ;)
If you dont like "reload firmware" message, you can find it with hex editor and change it, if You need new line write: 0x1B 0x0A....
If you wanna insert for example agilent copyright message write "<0x1B>M608" or if you wanna insert some graphical resource write for example "<0x1B>P1;"
-
I can't realize why my (2002A) don't go to 200MHz.
Why some users tell they go to 200MHz with the firmware changes, and some (include me) don't.
Another 2 extra instructions?
Expected to exist in this scopes? or something different?
-
The option SCPIPS could also be the remote logging option to debug the SCPI commands.
And for all Trekkies
see the attachment :)
Yes i also think this could be a easter egg.
It a littlebit hard to find out in which case this picture / function will be started.
Maybe i can find more about this in the disassembly.
Ha ha ha! Awesome! Thanks for posting that!
-
When you pass switch SCPIPS to launcher scope returns *** Installing License: Infiniium Mode.
What is infiniium mode?
-
Hi all!
I have a question and, I know that isn't the subject matter of this topic (I apologies), but I hope that someone can help with this, thanks.
Q: The DSOX2000/3000 series gives their maximum waveforms per seconds with auto memory only, or with maximum memory too?
-
Muahahaha! :-DD
Agilent DSOX2000/3000 Easteregg Spaceship Screensaver (https://www.youtube.com/watch?v=A4zTj5a7cGU#ws)
Here is it the Enterprise Screensaver.
I did take a look in the dsox4000 dll and there are a lot more debug information and resources.
I opened the 4000 infiniivision with a resource hacker and I was able to extract bitmaps and Winform dialogs.
After disassembling the dll I searched for the text TREK and found the reference to this in a subfunction with other references to ...Screensaver...
So i tried it on my scope and bingo.
Regards
Kai
-
AH HA HA HA!!! Thats AWESOME!!!
-
Good work!
-
Just tried the USB hack for everything including bandwidth, note to people still struggling: Remember to format the drive to FAT16. Fiddled for half an hour scratching my head before I realized that.
-
I did the hack with a very old and low capacity USB drive and it works fine.
Today I tried with a low cost PNY 8 GB thumbdrive and the system does not recognize the PNY.
Is there a limitation on the USB thumbdrive size ?
Has anybody tried with a 8 GB thumdrive ?
David.
-
I did the hack with a very old and low capacity USB drive and it works fine.
Today I tried with a low cost PNY 8 GB thumbdrive and the system does not recognize the PNY.
Is there a limitation on the USB thumbdrive size ?
Has anybody tried with a 8 GB thumdrive ?
David.
See the above post on formatting FAT16. Vanilla FAT doesn't support partition sizes over 2GB.
-
But... the low capacity USB thumdrive is a FAT32 and it works. :scared:
David.
-
I did the hack with a very old and low capacity USB drive and it works fine.
Today I tried with a low cost PNY 8 GB thumbdrive and the system does not recognize the PNY.
Is there a limitation on the USB thumbdrive size ?
Has anybody tried with a 8 GB thumdrive ?
David.
See the above post on formatting FAT16. Vanilla FAT doesn't support partition sizes over 2GB.
I am using a 4GB stick, FAT16 does support partition size above 2GB if you format it with 64KB cluster size.
But... the low capacity USB thumdrive is a FAT32 and it works. :scared:
David.
All I know is that it didn't work until I reformatted to FAT16.
-
Hi all, 1st post.
I have a newer DSO-X3034A, manufactured 28th week of 2013.
I have tried with the 2.35 Firmware (unpack, modify infiniivisionCore.dll hex data, modify startup .lnk, create startup override .txt file) and my scope simply hangs at the splash screen. I have tried on many flash drives, new and old, and formatted FAT16 default cluster size and FAT16 with 16kb cluster size.
Has anyone verified this as working for newer 3000X or is this maybe only working on the older models?
Any suggestions for this poor university student are welcome... I have saved a lot of money and used my educational discount to get this scope, but I can not afford any more purchases for a long time :)
-
To boldly go... where no hack has gone before!
-
I am still learning but if that is what I must do, then I will give it my best.
I am first trying to understand if this is not working because I have a newer scope, or because I have somehow done something incorrectly.
-
Hi pinkman,
my usb stick is formatted with FAT32 and works without a problem.
It needs a little bit more time to start the application and the splash screen is not shown on my scope.
The folder structure on the flash drive should be
\
+-infiniiVision
+-fpga
+-upgrade
+-web
+-css
+-help
+-image
+-include
+-web-socket-js
+-lib
+-Lxi
+-Identification
+-navbar
+-Startup
So its possible that you do something wrong.
My first test also didn't work because I mistyped something.
Maybe i can try my USB stick on a newer DSOX2000 series scope at work.
-
kilobyte,
Thanks for the reply. My understanding is that I should extract the contents of infiniivisionSetup.cab, then take contents of the "Secure" folder and copy *only* Secure folder contents to Flash root drive. I have done this, but my folder structure looks a little bit different than what you have listed.
Are there any files, other than contents of "Secure" folder(including modified infiniivisionCore.dll) + startupoverride text file that should be on the flash disk?
-
kilobyte,
Thanks for the reply. My understanding is that I should extract the contents of infiniivisionSetup.cab, then take contents of the "Secure" folder and copy *only* Secure folder contents to Flash root drive. I have done this, but my folder structure looks a little bit different than what you have listed.
Are there any files, other than contents of "Secure" folder(including modified infiniivisionCore.dll) + startupoverride text file that should be on the flash disk?
Did you copy whole structure from extracted \3000XSeries.02.35.2013061800.cab\infiniiVisionSetup.cab ? The whole content of \Secure\ folder must be copied to USB flash.
Also check presence of the Startup folder with modified infiniivision.lnk which contains sequence "62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"
-
Muahahaha! :-DD
Agilent DSOX2000/3000 Easteregg Spaceship Screensaver (https://www.youtube.com/watch?v=A4zTj5a7cGU#ws)
Here is it the Enterprise Screensaver.
I did take a look in the dsox4000 dll and there are a lot more debug information and resources.
I opened the 4000 infiniivision with a resource hacker and I was able to extract bitmaps and Winform dialogs.
After disassembling the dll I searched for the text TREK and found the reference to this in a subfunction with other references to ...Screensaver...
So i tried it on my scope and bingo.
Regards
Kai
NICE!!!
-
kilobyte,
Thanks for the reply. My understanding is that I should extract the contents of infiniivisionSetup.cab, then take contents of the "Secure" folder and copy *only* Secure folder contents to Flash root drive. I have done this, but my folder structure looks a little bit different than what you have listed.
Are there any files, other than contents of "Secure" folder(including modified infiniivisionCore.dll) + startupoverride text file that should be on the flash disk?
Did you copy whole structure from extracted \3000XSeries.02.35.2013061800.cab\infiniiVisionSetup.cab ? The whole content of \Secure\ folder must be copied to USB flash.
Also check presence of the Startup folder with modified infiniivision.lnk which contains sequence "62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"
I did copy the entire contents of the \Secure folder. There were files in the "root" directory of the .CAB file (such as FPGA2000.bin, FPGA3000.bin, etc) which I did not copy - So the entire contents of the \Secure folder are duplicated on the root directory of my flash disk.
Then, I modified the infiniivisionCore.dll file as you described, I modified the \Startup\infiniivision.lnk file as you described, and created a file in in the root directory of my flash disk called "infiniivisionStartupOverride.txt" and put the text "True" inside that file.
It appears that I am following the correct procedure... I have tested quite a few different flash disks, old and new - I will see if I can get some different ones and test, but maybe I am unlucky and the newer scopes will require more work.
My next step will be to gain access to the console via the serial port. I assume that doing this will allow me to see startup error messages as a result of my flash disk?
-
This Startrek easteregg screen saver worked fine in my 2002! I love it!
-
Go further! Somebody take a WinCE toolchain and make an S/N changer, change the last digit to use leaked key.
-
I test my usb stick on a dsox2024a at work today.
The DSO is only some month old (July 2013).
It's a pity but it didn't load the firmware from usb stick.
The LED on the flash drive has flashed at startup but after that there was no reaction compared to my DSOX.
Maybe they have changed something in the bootloader or something else.
I think i will buy the LAN Module(as a Christmas gift ;D), maybe with this its possible to do more research on the scope.
-
Huh, now Im more glad I bought a Premium Used from Agilent. Hopefully mine will be an older one and this hack will work on it. Still havent had a change to play with it though as I havent needed anything more than the features Ive already purchased.
-
But... the low capacity USB thumdrive is a FAT32 and it works. :scared:
David.
I made my scope work with the 8GB USB drive.
I had to create a primary partition of 7.65 GB (it won't work with 7.7 or higher), and format it to FAT32.
:-BROKE
David.
-
I test my usb stick on a dsox2024a at work today.
The DSO is only some month old (July 2013).
It's a pity but it didn't load the firmware from usb stick.
The LED on the flash drive has flashed at startup but after that there was no reaction compared to my DSOX.
Maybe they have changed something in the bootloader or something else.
I think i will buy the LAN Module(as a Christmas gift ;D), maybe with this its possible to do more research on the scope.
As I suspected... Agilent probably planned this all along... Release a hackable 1st version of a scope, knowing that newer models will not be hackabe and there will still be a few hackable versions always floating around on the market to generate buzz about hacking... Sales skyrocket with hopeful buyers... Kill product line after 5 years of better than average sales and provide little or no legacy support. Lol.
-
Yea I doubt sales are going to sky rocket on $2000+ oscilloscopes just because there is a hack out there that most will never even hear about.
-
Tried on two July build 3000x scopes and the USB boot method works. Everything except bandwidth upgrade (100MHz still 100MHz and 350MHz still 350MHz) being available.
One is v2.35 and the other v2.30 firmware.
-
Tried on two July build 3000x scopes and the USB boot method works. Everything except bandwidth upgrade (100MHz still 100MHz and 350MHz still 350MHz) being available.
One is v2.35 and the other v2.30 firmware.
I think the USB port is a bit flaky. There were problems with scopes endlessly cycling the LEDs on boot when a USB stick is inserted. Until a couple of firmware updates ago mine would never show the splash screen if a USB stick was inserted. Comments here about needing FAT16 or FAT32 and not more than 7.9GB etc might just be down to the scope liking some sticks more than others.
The scope isn't going to spend a lot of time checking or waiting for a USB stick during boot.
-
Sounds just like trying to boot other operating systems from USB flash drives. It is always hit or miss for me, some just are not accepted on any given computer at boot time, even though they might work fine once the full O/S is loaded
-
Tried on two July build 3000x scopes and the USB boot method works. Everything except bandwidth upgrade (100MHz still 100MHz and 350MHz still 350MHz) being available.
One is v2.35 and the other v2.30 firmware.
I think the USB port is a bit flaky. There were problems with scopes endlessly cycling the LEDs on boot when a USB stick is inserted. Until a couple of firmware updates ago mine would never show the splash screen if a USB stick was inserted. Comments here about needing FAT16 or FAT32 and not more than 7.9GB etc might just be down to the scope liking some sticks more than others.
The scope isn't going to spend a lot of time checking or waiting for a USB stick during boot.
That is exactly what mine does. It boots to the splash screen, and then the LED's cycle... Forever. Maybe I need to try a few more flash drives. Have already been through a dozen of them!
-
I've noticed that scope hangs if there is missig full path to launcher in .lnk file (in startup folder).
For example if you forgot to add "\usb" to launcher path in the .lnk file on USB stick or if you replaced .lnk file in flash memory with one from usb stick; containing "\usb" path, scope will hang. (I did this by mistake)
If you have used "-All" switch, You probably lost 30 trial option.
In case You don't like a little star you can add separate license switches (-l AUTO, -l MSO,.....).
There are two hidden options -l VID and -l CABLE. You can find them by pressing analyse button ;)
Enjoy!
-
I test my usb stick on a dsox2024a at work today.
The DSO is only some month old (July 2013).
It's a pity but it didn't load the firmware from usb stick.
The LED on the flash drive has flashed at startup but after that there was no reaction compared to my DSOX.
Maybe they have changed something in the bootloader or something else.
I think i will buy the LAN Module(as a Christmas gift ;D), maybe with this its possible to do more research on the scope.
Try to format usb stick, copy override.txt and than other system files.
-
Tried on two July build 3000x scopes and the USB boot method works. Everything except bandwidth upgrade (100MHz still 100MHz and 350MHz still 350MHz) being available.
One is v2.35 and the other v2.30 firmware.
You can upgrade 100MHz version only to 200MHz, and 350MHz can go up to 500MHz. (it should..)
-
You can upgrade 100MHz version only to 200MHz, and 350MHz can go up to 500MHz. (it should..)
Yeah I have, but it is using a different method. Was just pointing out that the USB boot method does not appear to enable the bandwidth upgrade :--
-
I DO NOT INTEND FOR THIS TO BE TAKEN NEGATIVELY!
I find it... interesting how so many people SEEM TO BE genuinely upset that they are unable to get more scope than they paid for.
I'm not attacking, I'm not criticizing, nothing like it; it is just very interesting to me that people genuinely believe that they should be able to upgrade their scope for free. Reading that sentence after I typed it out, you may (incorrectly) infer that I am against this point of view; you are wrong.
I guess my interest here comes from the dichotomy between a market that is quickly moving towards software upgrades like this one, and that the market is full of people who believe that once they've purchased something, they own it.
I know in the EU that the "you bought it, you own it" rule applies, but here in the US, that isn't the case. It should be, but it isn't.
I am just wondering where the split started.
-
Dear Rigby,
I guess these guys (me included) can't help You with that problem, since most of us are in to electronic design, hardware and software, and have very little knowledge about sociology and psychology matters. O0
-
I've noticed that scope hangs if there is missig full path to launcher in .lnk file (in startup folder).
For example if you forgot to add "\usb" to launcher path in the .lnk file on USB stick or if you replaced .lnk file in flash memory with one from usb stick; containing "\usb" path, scope will hang. (I did this by mistake)
If you have used "-All" switch, You probably lost 30 trial option.
In case You don't like a little star you can add separate license switches (-l AUTO, -l MSO,.....).
There are two hidden options -l VID and -l CABLE. You can find them by pressing analyse button ;)
Enjoy!
I did not fnd anything which is related to -l CABLE.
I can confirm - adding -l BW50 upgraded the 350MHz version to 500MHz, tested with Vincent pulse generator (see attachment).
Fo someone who is going to buy a new scope can be interested current PROMO
https://www.home.agilent.com/agilent/editorial.jspx?cc=US&lc=eng&ckey=2384797&nid=-33573.0.08&id=2384797 (https://www.home.agilent.com/agilent/editorial.jspx?cc=US&lc=eng&ckey=2384797&nid=-33573.0.08&id=2384797)
-
It's working on 2000 series, You can find it when you press Analyse button. When you add that switch launcher returns: *** Installing License: Cable Calibration.
-l VID adds HD video trigger and -l CABLE adds that cable calibration option which i'm not shure what's it for, didn't try that option yet.
-
Has anyone tested going back to stock after modding the firmware? Any issues there? What about with re-enabling previously purchased upgrades?
-
You'll have all options you had before (because they are enabled by license files), except 30 days trial, if you used "-l ALL" Switch.
-
It's working on 2000 series, You can find it when you press Analyse button. When you add that switch launcher returns: *** Installing License: Cable Calibration.
-l VID adds HD video trigger and -l CABLE adds that cable calibration option which i'm not shure what's it for, didn't try that option yet.
You are right, it is also working on 3k series as well.
Feature is called "Ratio and phase Reference".
Has anyone tested going back to stock after modding the firmware? Any issues there? What about with re-enabling previously purchased upgrades?
The original licenses purchased with scope still remains on scope itself.
The "Hack" is just running unlocked firmware from USB drive.
-
Plesa, can You please look at 0x007D51C8 in core file, You might find more switches that might work on 3000 series which don't work on 2000 series.
-
But... the low capacity USB thumdrive is a FAT32 and it works. :scared:
David.
I made my scope work with the 8GB USB drive.
I had to create a primary partition of 7.65 GB (it won't work with 7.7 or higher), and format it to FAT32.
:-BROKE
David.
Well 7.65GB partition was not working all the time, I just randomly set a partition of 7GB and now it boots every single time.
David.
-
I'm using Corsairs 32GB flash voyager with FAT32, and it works fine.
-
Plesa, can You please look at 0x007D51C8 in core file, You might find more switches that might work on 3000 series which don't work on 2000 series.
You have a good point.
We have new licence Tomography ( TOM )
So current infiniivision.lnk contains:
254#\usb\infiniiVision\infiniivisionLauncher.exe -l MSO -l MEMUP -l MEMMAX -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l EDK -l WAVEGEN -l AERO -l VID -l ADVMATH -l DVM -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l All
-
This is my command line:
62#\usb\secure\infiniiVision\infiniivisionLauncher.exe -l MSO -l memMax -l MEMUP -l EMBD -l AUTO -l COMP -l SGM -l MASK -l EDK -l RML -l ASV -l SGMC -l BW20 -l DIS -l SCPIPS -l VID -l CABLE
This enables all on 2000 series
-
Plesa, have You by any chance figured out what infiniium mode means ???
-
But... the low capacity USB thumdrive is a FAT32 and it works. :scared:
David.
I made my scope work with the 8GB USB drive.
I had to create a primary partition of 7.65 GB (it won't work with 7.7 or higher), and format it to FAT32.
:-BROKE
David.
Well 7.65GB partition was not working all the time, I just randomly set a partition of 7GB and now it boots every single time.
David.
I'm using 8GB and 32 GB flash, both formatted to FAT32 without any issue.
I had only problem during using the USB/MicroSD adaptor ( it was related to microSD connector)
-
Mmmmnnn it maybe the fricking brand is a cheapo PNY.
I have bought this one because two reasons:
1.- I like the size of the memory ( small size ), I want it to be permanently installed on the back of the unit and it is short, there are shorter ones, but more pricy.
2.- The price
Well so far with 7 GB has been working fine, if it starts to fail, I will get a quality one.
David.
-
Plesa, have You by any chance figured out what infiniium mode means ???
I suppose that it is related to some compatibility with Infinium family scope and their SCPI commands, I guess.
-
DavidDLC, if you can borrow LAN module, you can copy modified infiniivisioncore.dll and infiniivision.lnk to internal flash, this way 'scope will boot much faster...
-
Plesa, have You by any chance figured out what infiniium mode means ???
I suppose that it is related to some compatibility with Infinium family scope and their SCPI commands, I guess.
You are probably right.
This is launcher return text:
\> \secure\infiniiVision\infiniivisionLauncher.exe -l MSO -l memMax -l MEMUP -l
EMBD -l AUTO -l COMP -l SGM -l MASK -l EDK -l RML -l ASV -l SGMC -l BW20 -l DIS
-l SCPIPS -l VID -l CABLE --forcemaxmem
Our command line is -l MSO -l memMax -l MEMUP -l EMBD -l AUTO -l COMP -l SGM -l
MASK -l EDK -l RML -l ASV -l SGMC -l BW20 -l DIS -l SCPIPS -l VID -l CABLE --for
cemaxmem
*** Installing License: MSO
*** Installing License: Acq Memory Max
*** Installing License: Acq Memory Max
*** Installing License: Embedded serial decode and trigger
*** Installing License: Automotive serial decode and trigger
*** Installing License: UART/RS232 serial decode and trigger
*** Installing License: Segmented Memory
*** Installing License: Mask limit testing
*** Installing License: 200MHz Bandwidth
*** Installing License: Education kit license
*** Installing License: Distributor license
*** Installing License: Enhanced Video Triggering
*** Installing License: ASV
*** Installing License: Cable Calibration
*** Installing License: Infiniium Mode
*** Installing License: Remote Log
-
Any chance the aero command run on 2000X?
Maybe the software is there, just locked too.
Why different numbers in the lnk file? (Plesa has 254 and Wersi 62)
what does this command?
-
Intresting question, i looked it up on a MSDN this is what i found:
[number of ASCII characters after pound sign allocated to
command-line arguments]#[command line] [optional parameters]
Looks like i should write at least 187...
It works anyway... :)
-
I find it... interesting how so many people SEEM TO BE genuinely upset that they are unable to get more scope than they paid for.
If they bought the scope expecting to do the free upgrade, i.e. that was part of the deliberation when deciding which one to get, I can understand that. For example I am now seriously considering getting an Agilent for my personal use because you can get the free upgrade, otherwise it just isn't worth it.
Upset might be a bit of a strong word. Disappointed would be more accurate.
I know in the EU that the "you bought it, you own it" rule applies, but here in the US, that isn't the case. It should be, but it isn't. Might not be as bad as in the states, but it's bad enough.
Damn straight. The EU isn't ruled by corporations.
Emmh not really. Financial, chemical, automotive, agricultural and defense corporations carries a lot of weight in the EU. But that's an entirely different debate.
-
Any chance the aero command run on 2000X?
Maybe the software is there, just locked too.
Why different numbers in the lnk file? (Plesa has 254 and Wersi 62)
what does this command?
Unfortunatly AERO does not work on 2000 series, i belive decoding is done by FPGA in cooperation with MEGAZOOM IV (Codename: "Baldwin" i belive), so it's not available in 2000 series.
-
To people with fresh scopes worrying about new bootloaders: the startup override hack has nothing with new/old bootloaders, it was found in update files themselves. So if a yesterday's manufactured scope has the same sw version - the hack is also there. So check your USB sticks/folder structure and try again.
-
Bootloader is the same for all 'scopes, it's a u-boot. It's located in separate 512kB memory, You can find all detalis about memory mapping on agilent web site...
Document is called: "5990-8184EN.pdf"
-
Does anyone have NAND flash image?
There is 2,5MB section with serial and model number.
-
Any chance the aero command run on 2000X?
Maybe the software is there, just locked too.
Why different numbers in the lnk file? (Plesa has 254 and Wersi 62)
what does this command?
Is there any usage of AERO at home lab?
Check the infiniivisioncore.dll file for support on 2k family. I do not see it.
The number is the ammount of characters in .lnk file
I checked all functions of scope and did not find anything related to Tomography option (TOM), so it can be related to some upcoming software package like Agilent Spectrum Visualiser (ASV), I guess.
There two additional options FRC (FlexRay Complance) and TEL (Telecom Mask Test) , both not working.
-
Hi,
These seem to be the license options recognized by X3000 “infiniivisionLauncher.exe” v2.35:
Fully documented and sold by Agilent
ADVMATH Advance Math
AERO 1553 & 429 serial decodes
AUDIO Audio serial decode and trigger
AUTO Automotive serial decode and trigger
COMP UART/RS232 serial decode and trigger
EMBD Embedded serial decode and trigger
Flex Ray serial decode
Mask limit testing
MEMUP Acq Memory Max
PWR Power application
SGM Segmented Memory
VID Enhanced Video Triggering
WAVEGEN WaveGen license
EDK Education kit license
BW10 100MHz Bandwidth (BW upgrade for 70 MHz models)
BW20 200MHz Bandwidth (BW upgrade for 70 and 100 MHz models)
BW50 500MHz Bandwidth (BW upgrade for 350 MHz models)
Undocumented and/or Not implemented
TOM Tomotherapy
SGMC Circular Segmented Memory
SCPIPS Infiniium Mode
FLEXC Flex Ray Plus
DIS Distributor license
FRC Flex Ray Compliance
TEL Telecom Mask Test
Unknown (Used for Development/Test?)
RML ? (Remote Logging?)
CABLE ? (Calibration?)
ASV ? (Agilent Spectrum Visualiser?)
ALT FPGA Altera
FPG FPGA Probe
(License management?)
memMax ? (Same as MEMUP?)
memNo Acq Memory Dflt
rmAll Remove All Licenses
All Licenses
Options MSO and DVM, although available in the software, are missing from this list…
Investigation still in progress >:D
-
FLEXC Flex Ray Plus ( I did not see any difference with FLEX)
DIS Distributor license (contains following memMAX,EMBD,AUTO,FLEX,PWR,COMP,SGM,MASK,AUDIO,EDK,WAVEGEN,AERO,VID,ADVMATH,DVM,ASV,RML )
RML Remote Logging ( create log on USB drive of remote commands - useful for automation)
ASV Agilent Spectrum Visualiser ( about 2 years on market, useful for spectrum measurements)
TOM Tomotherapy (As I mentioned probable for some SW like ASV) ????
memMax Maximal Memory ( increased number of segments 500->1000)
SGMC Circular Segmented Memory (require memMAX or MEMUP) - quite usefull, endless loop of segments, require SGM
FRC Flex Ray Compliance (FLEX,FLEXC required but without any obvious function - probably require MASK??)
TEL Telecom Mask Test (unable to boot)
CABLE Measure delay and delta on phase
-
Any chance the aero command run on 2000X?
Maybe the software is there, just locked too.
Why different numbers in the lnk file? (Plesa has 254 and Wersi 62)
what does this command?
Is there any usage of AERO at home lab?
Check the infiniivisioncore.dll file for support on 2k family. I do not see it.
The number is the ammount of characters in .lnk file
I checked all functions of scope and did not find anything related to Tomography option (TOM), so it can be related to some upcoming software package like Agilent Spectrum Visualiser (ASV), I guess.
There two additional options FRC (FlexRay Complance) and TEL (Telecom Mask Test) , both not working.
No, I've never used aero at home, to be honest, neither on work. The question was purely for to know if the decode option was related to hardware or only software.
I think the diferences between wavegen on 2000 and 3000 might be in hardware (that is able or not to generate arbitrary waveforms), but I tought the decode was only in software...
-
if you can borrow LAN module, you can copy modified infiniivisioncore.dll and infiniivision.lnk to internal flash
How does this work? I don't have the LAN module so can't try it out, but this option might convince me to get one. Does the scope have an FTP server or do you telnet in and copy the files around from a command line?
-
And what is the problem copying files WITHOUT lan module? Why not just build a modified update .cab?
-
Just tried the hack on a DSOX3034A that I got last week. I think the build week is 43 of 2013 (late October-ish, there is a 1343 under the QR code on the serial #, MAC addr sticker on the back of the unit). The firmware version that came with it is 02.36.2013091301.
Unfortunately, I'm not having any luck getting it to boot from the USB stick with the hacked Core DLL file. I also tried to get it to boot without modifying any of the files except for the override .txt file, again with no luck.
The scope appears to read information from the USB drive (can see the led flashing). Next, all I get is it cycling through lighting up the channel buttons, intensity and wave gen, run stop and single and then ref, math, digital and serial. It goes through about 8 cycles and then reboots itself. No matter what I have tried, I have seen no change in behavior when trying to boot from the usb flash drive.
To verify that the scope can handle the formatting of the drive, I booted the scope without the usb flash drive plugged in. After the scope was up and operating normally, I plugged in the usb drive and was able to browse the directories via the Save/Recall button.
Not really asking for any one to figure this out, just trying to document another data point for a relatively new scope.
I'd be interested to know if anyone else with a newer scope that came with firmware > 2.35 is having any success with the hack.
-
Hi,
the trick is to use fast USB-Sticks. I use an usb3 32GB (read 30MB/s) Stick without any problems. Yesterday I've tested a Micro USB2 Stick with only 15MB/s. That one only starts the first time, then I have to unplug the Scope to make it work again.
Maybe some of you can make a speed test with your working sticks and post the result to prove me wrong or right.
BTW, a big thanks to the guys who posted the little trick. :-+
regards B0B
-
Just tried the hack on a DSOX3034A that I got last week. I think the build week is 43 of 2013 (late October-ish, there is a 1343 under the QR code on the serial #, MAC addr sticker on the back of the unit). The firmware version that came with it is 02.36.2013091301.
Unfortunately, I'm not having any luck getting it to boot from the USB stick with the hacked Core DLL file. I also tried to get it to boot without modifying any of the files except for the override .txt file, again with no luck.
The scope appears to read information from the USB drive (can see the led flashing). Next, all I get is it cycling through lighting up the channel buttons, intensity and wave gen, run stop and single and then ref, math, digital and serial. It goes through about 8 cycles and then reboots itself. No matter what I have tried, I have seen no change in behavior when trying to boot from the usb flash drive.
To verify that the scope can handle the formatting of the drive, I booted the scope without the usb flash drive plugged in. After the scope was up and operating normally, I plugged in the usb drive and was able to browse the directories via the Save/Recall button.
Not really asking for any one to figure this out, just trying to document another data point for a relatively new scope.
I'd be interested to know if anyone else with a newer scope that came with firmware > 2.35 is having any success with the hack.
Thanks for info. Could you try to downgrade the firmware to the latest version available on website 2.35 and try it again?
Your reported firmware seems to be not released for field.
As BOB reported, I tried some really slow USB sticks (<5MB/s) and it is not working, strange.
-
Thanks for info. Could you try to downgrade the firmware to the latest version available on website 2.35 and try it again?
Your reported firmware seems to be not released for field.
As BOB reported, I tried some really slow USB sticks (<5MB/s) and it is not working, strange.
I'd like to try downgrading, but I'm a tad skittish about doing so without having a way to get the scope back to the firmware that came from the factory. I have not been able to find a cab file for the 2.36 firmware the scope shipped with.
I've tried a faster USB drive (> 20MB/s) with no change in results.
What are the symptoms of failure that people are seeing with slow drives (i.e. what does the scope do when it fails to boot from USB drive)? I don't recall seeing anyone state that explicitly in any of the messages I've read on this thread (quite possible I missed it if it is there).
-
Huh, mine is still running 2.35. What did they do in version 2.36 I wonder.
-
Huh, mine is still running 2.35. What did they do in version 2.36 I wonder.
Perhaps in 2.36 they've addressed the license hack? I think there's little doubt Agilent reads this forum.
-
Huh, mine is still running 2.35. What did they do in version 2.36 I wonder.
Perhaps in 2.36 they've addressed the license hack? I think there's little doubt Agilent reads this forum.
I doubt that. Arent there already confirmed people in this thread with brand new scopes running 2.36 with a successful hack?
-
I doubt that. Arent there already confirmed people in this thread with brand new scopes running 2.36 with a successful hack?
There are.
-
I doubt that. Arent there already confirmed people in this thread with brand new scopes running 2.36 with a successful hack?
There are.
Thought so. Thanks for confirming.
-
I doubt that. Arent there already confirmed people in this thread with brand new scopes running 2.36 with a successful hack?
There are.
I just read back through the thread and didn't see any evidence that someone has gotten the hack to work with a scope having 2.36 from the factory.
-
whats a good software to use for modifying the infiniiVisionCore.dll ?
tnx
j
-
I found "OpenFreely" as the hexeditor to modify infiniiVisionCore.dll. Does the date/time of the edited file have to be identical to the original? Right now the edited file has today's date.
tnx
j
How to hack the firmware
1. Unpack the firmware *.cab by 7zip
2. Unpack infiniiVisionSetup.cab ( e.g. with WinCE CAB Manager 3.0)
Find \Secure\infiniiVision\infiniiVisionCore.dll
3. Change at location 0x277e50 in infiniiVisionCore.dll
byte sequence 04 00 a0 e1 to byte sequence 00 00 a0 e3
4. Enable startup Overide by creating USB flash with following structure in root of USB drive (copy structure from Secure folder from point 2)
Edit in Startup folder file infiniivision.lnk to contains following sequence "62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"
Replace in infiniiVision folder infiniiVisionCore.dll with patched infiniiVisionCore.dll file
5. Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
6. Plug the USB drive to scope and turn it ON
7. There will be red message in letf top corner "Unfinalized Software" and "System Concerns detected: OS version is not correct. Please reload system firmware"
Applications needed:
WinCE CAB Manager http://www.ocpsoftware.com/products.php (http://www.ocpsoftware.com/products.php)
7Zip http://www.7-zip.org/ (http://www.7-zip.org/)
-
I found "OpenFreely" as the hexeditor to modify infiniiVisionCore.dll. Does the date/time of the edited file have to be identical to the original? Right now the edited file has today's date.
tnx
j
I'm using PsPad, but there are lot of other hex editors available.
The data and time is not important.
I doubt that. Arent there already confirmed people in this thread with brand new scopes running 2.36 with a successful hack?
There are.
Could you try to downgrade the firmware to 2.35 and try the hack?
Or do you have the LAN module?
-
Just confirming it works on my 2.35 2012A as well, had some boot issues until I noticed the startup link was wrong and I also partitioned my (11MB/s 32GB FAT32) stick to 4gig at the same time so I can't say for sure if it would have worked with larger than 7.7gig but it works now so I'm a HAPPY camper :D
I also didn't activate all features as I wasn't sure all worked on 2000-series.... didn't want to push my luck :)
Running fine with 62#\usb\infiniiVision\infiniivisionLauncher.exe -l MSO -l memMax -l MEMUP -l EMBD -l AUTO -l COMP -l SGM -l MASK -l EDK -l BW20 -l VID -l ADVMATH -l DVM
https://www.dropbox.com/s/nlypogw0866xnwi/20131207_212432.jpg (https://www.dropbox.com/s/nlypogw0866xnwi/20131207_212432.jpg)
Noticing now I forgot WAVEGEN but that license was purchased earlier and it's still activated so it clearly reads previously installed licenses.
THANK YOU for sharing this, have been waiting ages *HUGS* (and hopefully this isn't just an activation of the trial license so it stops in a month :D)
(also I was using the backside usb port, and noticed bootup time was a bit slower - cycled the panel LED's 4 times instead of normal 2 times)
-
I was try hack,
usb flash can't work with nomal format
i was try format usb flash with hirrent boot USB, it is work
this is flash format process
http://www.hiren.info/pages/bootcd-on-usb-disk (http://www.hiren.info/pages/bootcd-on-usb-disk)
thanks and best regards
-
Yes - regular FAT32 format under windows works great...
Just bought a new, faster, 8gig micro usb-stick (sandisc cruzer fit) and it works just fine, no problems what so ever...
Correction to previous post - it cycles the front panel LED's 6 times, so don't be too hasty and turn it off, give it a few seconds :)
-
silly me.
after many fails thinking it was the USB formating, or the USB drive, finally remember some post way back that suggested using the same firmware--- I was trying 2.35 on stick, with 2.12 (I think) on the scope. Once I realized that, worked on the next try following upgrade.
I looked high and low for some way to unpack the cab file (with proper file names and directories)-- the referenced program refused to install on all my computers here. Finally I just used 7zip, hunted through the folder structure and noticed the xml file that gave the renaming and directory structure. Used excel to concatenate a few "copy" and "mkdir" into a DOS batchfile that made quick work of putting everything where needed.
dsox2004 now shows 200 mhz
-
I noticed that the enhanced video (VID) trigger work on the 2000 series,
even though it's not sold by agilent, all the way up to 1080p/i...
Perhaps a coming feature?
Also - my scope is flashed with stock firmware 2.35, and booting the usb stick with 2.35 as well,
and I still get a popup the firmwares don't match, however after you click it away it won't re-appear and the calibration and hardware self tests pass just fine.
Maybe because the md5 crc or timestamp isn't matching anymore? Will look into it tomorrow...
-
I've changed crc (Microsoft PE file spec.) but it still complains about FW....
Looks like its a verisign signature missmatch problem.
-
I just got the LAN module for my DSO-X 3014A. I've seen references to loading the modified startup files on my USB key to the internal storage with the LAN module, but when I try FTPing or telneting to the scope I don't know the username or password.
Could someone please point me in the right direction for connecting or replacing the right startup files?
-
Oh, I guess I missed that part of this hack. The USB drive with the custom firmware resides on the USB drive so it has the be left connected to the scope all the time doesnt it?
-
I don't know the username or password.
Check page 12
-
Oh, I guess I missed that part of this hack. The USB drive with the custom firmware resides on the USB drive so it has the be left connected to the scope all the time doesnt it?
Yes. If the USB is removed the unit will reboot itself in few seconds.
-
I don't know the username or password.
Check page 12
Thank you! I was searching for "password" in the thread, not "pass". Happy to report I've been able to modify the built-in files and don't have to boot from USB key anymore.
-
I don't know the username or password.
Check page 12
Thank you! I was searching for "password" in the thread, not "pass". Happy to report I've been able to modify the built-in files and don't have to boot from USB key anymore.
I have the VGA/LAN module for my MSOX2024, any chance you could write out your steps to doing this? Not having to have the USB drive taking up the port would be very nice.
-
I don't know the username or password.
Check page 12
Thank you! I was searching for "password" in the thread, not "pass". Happy to report I've been able to modify the built-in files and don't have to boot from USB key anymore.
I have the VGA/LAN module for my MSOX2024, any chance you could write out your steps to doing this? Not having to have the USB drive taking up the port would be very nice.
Telnet to the scope, run "ProcessMgr.exe kill infiniivisionLauncher.exe" and execute "\Secure\infiniiVision\infiniivisionLauncher.exe" with parameters you would like to enable.
From my perspective the USB drive is the easiest way and there is no reason to have the hack inside scope ( except you are going to pretend it is genuine :-).
Also you cannot brick the scope this way.
-
I don't know the username or password.
Check page 12
Are you referring to this post?
Some "oil into the fire":
telnet login/pass:
infiniivision
skywalker1977
-
Can this be done over USB? What is the process to do it?
Telnet to the scope
-
I have the VGA/LAN module for my MSOX2024, any chance you could write out your steps to doing this? Not having to have the USB drive taking up the port would be very nice.
Certainly. The way I did it once knowing the telnet username and password (thanks abyrvalg!) was to copy modified files from a USB stick to the internal storage.
I'm assuming you can render your scope unbootable by messing with the internal filesystem. If you have a working boot USB stick you could theoretically boot from it and fix it, but hopefully it doesn't come to that. Obviously proceed at your own risk.
First make a working bootable USB stick to make sure the options you want work and you've modified the DLL correctly as described earlier in this thread.
Once you're sure that's working, move the USB stick back to your PC. I made a directory in the root of my USB stick to store the files I'm going to copy to internal flash for convenience. Let's call it "temp". Copy in the modified infiniiVisionCore.dll. Also make a new modified copy of infiniivision.lnk from the startup folder.
Unlike booting from the USB stick, your new modified infiniivision.lnk needs to refer to the internal storage version of infiniivisionLauncher.exe (so change the "\usb" back to "\Secure" in the infiniivision.lnk that you modified to make your bootable USB stick). I'm using the following on a DSO-X 3014, for example. If you've already made your bootable USB stick you are probably familiar with the options you can use here and can tailor to your liking:
196#\Secure\infiniiVision\infiniivisionLauncher.exe -l MSO -l DVM -l ADVMATH -l AERO -l AUDIO -l AUTO -l COMP -l EMBD -l Flex -l Mask -l MEMUP -l PWR -l SGM -l VID -l WAVEGEN -l EDK -l memMax -l BW20
Now you have the files you need in the temp directory of the USB stick.
Boot your scope from the USB stick (if you are running from internal storage you can't replace the DLL since it's in use. There are ways around that like killing the process, but by booting from the USB stick you're also proving to yourself that if you mess something up you still have a fallback plan to boot the thing). Once booted, telnet to the scope and use the username and password provided by abyrvalg (it seems like I always have to try logging in twice. Not sure if I'm that consistently typo-prone or if there's something funny going on).
Now you're at the command prompt. If you do a 'dir' you'll see the \usb directory, which is your USB stick, and the other internal flash directories like 'secure'. Note that even though you're booting from USB, the root of the USB stick is mounted at \usb (so you'd see \usb\infiniivision, \usb\startup, etc.) and the internal flash directories are at the root level.
Copy the modified DLL to replace the internal one. If you used the same temp directory name I did, a command like this should work:
copy \usb\temp\infiniiVisionCore.dll \Secure\infiniiVision
Then copy the startup shortcut to the startup directory. The file is read-only, so I removed the read-only flag on the destination file first. Not sure if that's necessary or not:
attrib -r \Secure\startup\infiniivision.lnk
copy \usb\temp\infiniivision.lnk \Secure\startup
That should do it. Power off the scope, pull out the USB stick, and turn it on again. Hope it boots (and even better, hope it boots with your additional license options enabled).
Like I said... you can break your scope so that it won't boot from internal memory if this goes wrong. Be careful! I don't know if there's a firmware recovery procedure on these scopes (luckily it's a topic I haven't had to research yet).
-
I can add to mwilson's excellent description that there is almost nothing to fear. The startup override functionality doesn't depend neither on infiniiVisionCore.dll nor on .lnk, so it will be possible to boot form USB even if these files are totally corrupt/deleted. And more - there is U-Boot functionality (explored by FrankBuss earlier in this thread) that works at early boot stages and doesn't depend on any files at all.
-
mwilson, can you please try this:
edit USB .lnk to 33#\windows\cmd.exe \usb\autorun.cmdat USB root create autorun.cmd with
copy \usb\temp\infiniiVisionCore.dll \Secure\infiniiVision
attrib -r \Secure\startup\infiniivision.lnk
copy \usb\temp\infiniivision.lnk \Secure\startup
\Secure\infiniiVision\infiniivisionLauncher.exe
(no need to say that files in \temp and all startup override stuff must be present too of course)
The last command (normal scope app startup) is there to prevent boot looping.
This can help people w/o LAN/telnet installing the hack - just boot from such prepared USB stick once.
-
mwilson, can you please try this:
edit USB .lnk to 33#\windows\cmd.exe \usb\autorun.cmdat USB root create autorun.cmd with
[...]
This can help people w/o LAN/telnet installing the hack - just boot from such prepared USB stick once.
Yep. Played around with this and it doesn't look like cmd.exe can take a file as an argument. However, you can execute .cmd files directly. So this method works if you make your startup .lnk something like:
18#\usb\temp\foo.cmd
So indeed folks can install modified files internally just by booting a properly prepared USB stick once. No need for the LAN module. (And presumably if something gets messed up, you can boot from the working USB stick and re-install the firmware as normal to get the internal filesystem back to factory condition.)
-
So is it better to try and do a "permanent" hack via the USB port instead of doing it via the network port?
-
So is it better to try and do a "permanent" hack via the USB port instead of doing it via the network port?
The end result is the same, so it doesn't really matter. The USB method we just discussed is executing the same commands you'd execute from the telnet session.
If you have the LAN module, I'd probably recommend the telnet approach because then you can actually see if the commands worked and adapt as necessary... but really, if you just put the right commands in the cmd file it'll work so it's probably a wash.
-
But as far as risk goes, you could potentially brick your scope using either method if it were going to happen correct?
-
But as far as risk goes, you could potentially brick your scope using either method if it were going to happen correct?
Yes, but to abyrvalg's point, as long as you have a bootable USB stick, anything you can do through telnet/commands you'd be able to undo. If you don't know what you broke, I'm guessing you can boot from your USB stick and just install the original firmware the normal way and it will restore the internal storage.
-
mwilson, can you please try this:
edit USB .lnk to 33#\windows\cmd.exe \usb\autorun.cmdat USB root create autorun.cmd with
Should that be "34#\windows\cmd.exe \usb\autorun.cmd"?
-
mwilson, can you please try this:
edit USB .lnk to 33#\windows\cmd.exe \usb\autorun.cmdat USB root create autorun.cmd with
Should that be "34#\windows\cmd.exe \usb\autorun.cmd"?
No, if you use the cmd exe and not directly call the cmd/bat file, the scope will restart.
-
16#\usb\autorun.cmd
-
mwilson, can you please try this:
edit USB .lnk to 33#\windows\cmd.exe \usb\autorun.cmdat USB root create autorun.cmd with
Should that be "34#\windows\cmd.exe \usb\autorun.cmd"?
Replying to my own post... ::) I didn't notice the space between the "exe" and the "\usb". Do spaces count for the command line length?
-
mwilson, can you please try this:
edit USB .lnk to 33#\windows\cmd.exe \usb\autorun.cmdat USB root create autorun.cmd with
Should that be "34#\windows\cmd.exe \usb\autorun.cmd"?
Replying to my own post... ::) I didn't notice the space between the "exe" and the "\usb". Do spaces count for the command line length?
The space does count. The # doesn't count, though; it's the delimiter between the character count and the command. So 33 is correct in the above example. Although I'm not convinced the system actually uses the number, but I haven't played around with it much to know for sure.
WinCE shortcut file definition is here: http://msdn.microsoft.com/en-us/library/ms861519.aspx (http://msdn.microsoft.com/en-us/library/ms861519.aspx)
(But note that as previously discussed the WinCE cmd.exe doesn't take a file argument like this, so the question of whether the number is correct for this particular example is rather academic...)
-
(But note that as previously discussed the WinCE cmd.exe doesn't take a file argument like this, so the question of whether the number is correct for this particular example is rather academic...)
Does adding a /C switch help? "CMD /C <command>" is the usual way (since DOS days, with COMMAND.COM) to get the command processor to accept a command as a parameter, and the CE docs suggest it's supported...
-
(But note that as previously discussed the WinCE cmd.exe doesn't take a file argument like this, so the question of whether the number is correct for this particular example is rather academic...)
Does adding a /C switch help? "CMD /C <command>" is the usual way (since DOS days, with COMMAND.COM) to get the command processor to accept a command as a parameter, and the CE docs suggest it's supported...
http://msdn.microsoft.com/en-us/library/aa453925.aspx (http://msdn.microsoft.com/en-us/library/aa453925.aspx)
-
All structure is created automatically by CAB Manager ( just press right mouse button on files and select Extract).
The structure which is in extracted folder subfolder Secure needs to be copied to USB flash.
Attribused does not matter.
LAN module is not necessary, but can be useful if you are gong to investigate further options.
-
A few previous posts said you need a fast usb stick to get this hack to work. I found the same issue and booting off slow sticks ends in a black screen and hang. During the boot and right before the hang I saw there were several infiniivisionLauncher.exe processes running. I only see one during a normal boot.
I came up with this way. The changes in the other posts are still needed. On the usb drive, in Startup\infiniivision.lnk:
17#\usb\autorun.cmdIn \usb\autorun.cmd:
dir /s \
\windows\processMgr.exe kill infiniivisionLauncher.exe
dir /s \
\windows\processMgr.exe kill infiniivisionLauncher.exe
dir /s \
\windows\processMgr.exe kill infiniivisionLauncher.exe
dir /s \
\windows\processMgr.exe kill infiniivisionLauncher.exe
dir /s \
\windows\processMgr.exe kill infiniivisionLauncher.exe
dir /s \
\windows\processMgr.exe kill infiniivisionLauncher.exe
dir /s \
\usb\infiniiVision\infiniiVisionLauncher.exe -l DIS -l SGMC -l CABLE
The "kills" get rid of any other infiniivisionLauncher.exe that may have started up. It could be the booting is taking too long and the scope decided to start the built in infiniivisionLauncher.exe as a back up. But I don't really know.
The "dir /s \" slow things down. I can't find a sleep or delay command, but then again I know absolutely nothing about windows. A delay is needed.
Other "-l" options can be used if you want.
The worst possible slowest 64MB USB stick I could find now works.
-
Any news/comments about the 2.36 FW shipping on newer scopes (as per https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg340097/#msg340097 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg340097/#msg340097))?
-
Any news/comments about the 2.36 FW shipping on newer scopes (as per https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg340097/#msg340097 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg340097/#msg340097))?
No, but the user who reported this firmware has only three post and seems to be no longer online. He did not tried the downgrade to 2.35.
According to number it is minor change.
Scope itself is quite robust if you are going to downgrade FW version, e.g you can downgrade from 2.35 only to the 2.30 and not to previous versions.
This firmware is not available on Agilent website which is weird.
Is there anyone else with firmware 2.36 or scope manufactured in Q3/2013 and later? Does not matter if 2000 or 3000 series.
-
There were several request for hack DSOX2k and MSOX2k. The hack of this scope is also possible, the description of hack is same which were published for DSO3k and MSOX3k.
Whole hack is tested with firmware 2.35 and is fully working.
The whole hack is on USB drive and there is no modification of fles inside scope, so there is no risk of bricking the scope.
When the USB flash is removed the scope use the purchased licenses and not the hacked firmware from USB flash.
After hacked files loading there is message informn about firmware issue. Ths does not affect the performance, only prevent some jerks to sell hacked scope as a fully licensed one.
In forum reported firmware 2.36 by one user has been not tested due to the poor availability of scope with this FW verson.
For hack we higly reccomends to use really fast USB flah drive.
There is also way how to pernamently load hacked firmware into the scope (batch file on USB drive will rewrite the files in internal scope flash with the hacked one)
-
The warning message about firmware issue remains on screen all the time, or only seen after boot?
Georg
P.S. I waiting for my DSOX3032.
-
The warning message about firmware issue remains on screen all the time, or only seen after boot?
Georg
P.S. I waiting for my DSOX3032.
Only after boot up, you need to press button to accept it. And the self test did not passed. But we did not encountered any issue with hacked software.
-
Any news/comments about the 2.36 FW shipping on newer scopes (as per https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg340097/#msg340097 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg340097/#msg340097))?
No, but the user who reported this firmware has only three post and seems to be no longer online. He did not tried the downgrade to 2.35.
I'm still following this thread, but haven't had anything to contribute to the discussion, so have been lurking.
I'm reluctant to downgrade the FW without a path back to the factory FW or a newer FW. I've been watching the agilent website for newer firmware (since 2.35 was released in june, I was hoping there'd be some update soon-ish).
A few weeks ago I wrote a python script that takes the 2.35 cab and explodes it and explodes the cab file within then uses the setup.xml file to populate the Secure directory with the right names and structure. Then the script modifies and creates all the files needed for the hack. Would not be hard to extend it to automate the population of a USB flash drive.
The script is currently in a private git repo on bitbucket.org. I haven't made it public since I have no way of verifying it's correctness and thus didn't want to inflict it on anyone. I can easily make it public if anyone is interested. It currently only works on Linux, put I don't think it would be difficult to port to Windows. I wrote it to avoid having to use the non-free cab program on windows since I'm much more of a Linux geek.
-
Only after boot up, you need to press button to accept it. And the self test did not passed. But we did not encountered any issue with hacked software.
It should pass all self tests and calibrations... at least they do pass fine for me...
-
My new DSO-X-3034A arrived today. It had firmware 2.35 installed. It's now 500MHz and fully optioned up thanks to this thread.
Thank you everyone that worked on this!!!
A few notes that might be helpful to others...
I had to add BW50 to the startup shortcut to upgrade from 350MHz to 500MHz. I thought the -l All would cover that but apparently not. So my infiniivision.lnk file is now ...
62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS -l BW50
The file structure of my startup drive is slightly different than a post I was comparing to in this thread. It was missing a few indents which threw me for a bit. The correct structure is ...
\
+-infiniiVision
+-fpga
+-upgrade
+-web
+-css
+-help
+-image
+-include
+-web-socket-js
+-lib
+-Lxi
+-Identification
+-navbar
+-Startup
infiniivisionStartupOverride.txt
I had to use a 4GB flash drive, an 8GB I tried at first didn't work.
When using WinCE CAB Manager I also had to turn on "Simulate Folder Names" when extracting the files to get the correct structure.
Thanks again!
-
This .lnk remove the * symbol in the about screen. There is more options but some of them are not working.
255#\usb\infiniiVision\infiniivisionLauncher.exe -l MSO -l MEMUP -l memMAX -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l EDK -l WAVEGEN -l AERO -l VID -l ADVMATH -l DVM -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC
-
I'm still following this thread, but haven't had anything to contribute to the discussion, so have been lurking.
I'm reluctant to downgrade the FW without a path back to the factory FW or a newer FW. I've been watching the agilent website for newer firmware (since 2.35 was released in june, I was hoping there'd be some update soon-ish).
Do you have the Ethernet option? Can you poke around in Telnet?
-
Do you have the Ethernet option? Can you poke around in Telnet?
Unfortunately, I do not have the Ethernet module and it's not in the budget to buy any upgrades until later in the year.
-
This .lnk remove the * symbol in the about screen. There is more options but some of them are not working.
255#\usb\infiniiVision\infiniivisionLauncher.exe -l MSO -l MEMUP -l memMAX -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l EDK -l WAVEGEN -l AERO -l VID -l ADVMATH -l DVM -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC
I've seen references to 255#, 256#, 62#. What do these prefix numbers mean?
-
Only after boot up, you need to press button to accept it. And the self test did not passed. But we did not encountered any issue with hacked software.
It should pass all self tests and calibrations... at least they do pass fine for me...
Interesting. After boot-up, you don't see a red-colored firmware error message? How did you do that?
-
Do you have the Ethernet option? Can you poke around in Telnet?
Unfortunately, I do not have the Ethernet module and it's not in the budget to buy any upgrades until later in the year.
Please do not use hacked scope for business, it is for home/ non commercial use only!!
-
This .lnk remove the * symbol in the about screen. There is more options but some of them are not working.
255#\usb\infiniiVision\infiniivisionLauncher.exe -l MSO -l MEMUP -l memMAX -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l EDK -l WAVEGEN -l AERO -l VID -l ADVMATH -l DVM -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC
I've seen references to 255#, 256#, 62#. What do these prefix numbers mean?
Read the whole thread. Briefly it is ammount of characters in link.
-
Hi guys,
So I have read the whole thread. I want to make sure I understand something correctly though.
You can use the shortcut's without modifying the dll? Is that correct?
Thanks all for your work on this.
-Matt
-
Hi guys,
So I have read the whole thread. I want to make sure I understand something correctly though.
You can use the shortcut's without modifying the dll? Is that correct?
Thanks all for your work on this.
-Matt
No, you need to modify InfiniivisionCore.dll, this will unlok the options which needs to be selected in the link file.
-
This .lnk remove the * symbol in the about screen. There is more options but some of them are not working.
255#\usb\infiniiVision\infiniivisionLauncher.exe -l MSO -l MEMUP -l memMAX -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l EDK -l WAVEGEN -l AERO -l VID -l ADVMATH -l DVM -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC
I've seen references to 255#, 256#, 62#. What do these prefix numbers mean?
Read the whole thread. Briefly it is ammount of characters in link.
I see that now in your message #282. However "wersi" used #62 with many switches after, totalling much more than 62 characters. I've been making changes without changing that parameters and the functions still seem to work. Perhaps the firmware error message goes away with the correct character count?
To deal with the firmware error message, I used the hex editor that now shows "all options intialized and enabled..." Same when the scope finishes booting. This sure does look like a factory issue that way!
-
There were several request for the digital probe schematic.The original probe cannot be dissassembled without damage.
So I just found schematic in the Agilent documents
http://cp.literature.agilent.com/litweb/pdf/5968-4632E.pdf (http://cp.literature.agilent.com/litweb/pdf/5968-4632E.pdf)
I saw lot of the probes on ebay and grabbers as well, pretty cheap.
The type is N6459 (8 channels) and N6450 (16 channels)
-
There were several request for the digital probe schematic.The original probe cannot be dissassembled without damage.
So I just found schematic in the Agilent documents
http://cp.literature.agilent.com/litweb/pdf/5968-4632E.pdf (http://cp.literature.agilent.com/litweb/pdf/5968-4632E.pdf)
I saw lot of the probes on ebay and grabbers as well, pretty cheap.
The type is N6459 (8 channels) and N6450 (16 channels)
I see many used Agilent "E" series logic probes available. Anyone know if these are pin-for-pin compatible with the Agilent "N" series for the DSOX/MSOX?
-
Did anyone look inside the lan/vga adapter?
Not just simple resistors?
-
This .lnk remove the * symbol in the about screen. There is more options but some of them are not working.
255#\usb\infiniiVision\infiniivisionLauncher.exe -l MSO -l MEMUP -l memMAX -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l EDK -l WAVEGEN -l AERO -l VID -l ADVMATH -l DVM -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC
I noticed that when the three relevant files are uploaded direct to the DSOX from the USB stick, the "*" in front of each option in in "About Oscilloscope" is removed as well when using prior characters strings as described in earlier posts.
-
I've dissembled a logic probe, but I didn't take a good camera yet.
ASAP, I will put the photos from it.
-
I also found this documentation some times ago.
the Probes with grabbers are not so expensive on ebay.
In the company where i work we have an old E9340A with that 16 channel probes and i mean that i have measured something between the grabbers and the input pins for the flat cable.
But this was some month ago and i can't remember me for the exact value, i think i have measured round about 90kohms.
But now something other:
while i was analysing the dll for the DSOX4000 series i found a different word CAKE in the source.
Is there someone with a DSOX4000 that can try this word in the Screensaver Usertext?
-
Did anyone look inside the lan/vga adapter?
Not just simple resistors?
Dave did a teardown:
EEVblog #145 - Agilent LAN/VGA Module Teardown (https://www.youtube.com/watch?v=hy1TYKetIpM#ws)
LAN goes straight to a MagJack. The VGA part has a bit more to it (screen buffer, driver and fpga for timing)
-
Until a few days ago, Newark showed the N6450-60001 16 ch. logic cable assembly for around ~ USD $600. I no longer see the cable assembly anywhere on-line without purchasing the full DSOX3MSO upgrade kit. Impeccable timing, isn't it? Can anyone else spot its availability?
-
I've been trying to get this to work for a while now - I've tried 3 different USB sticks (1G, 2G and 32G), I've got everything extracted:
infiniiVision/
Startup/
infiniivisionStartupOverride.txt
At the root of my stick. The Override.txt file just contains "True" on a single line. The .dll has been modified. The .lnk file has been altered per instructions.
With the stick in I can see it being accessed when the scope is starting up, after a second or two from reading from it though it moves immediately into it's normal boot cycle and then comes up clean on the internally installed firmware. Any suggestions?
I'm messing with this just to see how it all works - I actually have licenses installed for the things I really use but this is more intellectual curiousity now and it's frustrating when things don't work. ;-)
Thanks.
-
With the stick in I can see it being accessed when the scope is starting up, after a second or two from reading from it though it moves immediately into it's normal boot cycle and then comes up clean on the internally installed firmware. Any suggestions?
Which FW are you on?
-
In attachment is the USB folder structure including the .lnk files for fully enabled licenses and also for automatic copy to flash. Which will not require the presence of USB flash plugged.
You just need to unpack the InfiniiVisionSetup.CAB with the WinCE CAB MAnager ( just press right mouse button on files and select Extract and choose Simulate Folder Names)
Copy the files intoprepared folder structure inside Infiniivision folder.
And choose and rename if necessary the file in the Startup folder ( by default is set the full licence set for 3k series).
The scope should contains firmware 2.35.
Turn scope with this USB flash on.
-
With the stick in I can see it being accessed when the scope is starting up, after a second or two from reading from it though it moves immediately into it's normal boot cycle and then comes up clean on the internally installed firmware. Any suggestions?
Which FW are you on?
2.35.2013061800
-
Hi
I know that the DSOX200*A can be upgrade to DSOX201*A [DSOX2BW1*], and the DSOX201*A can be upgrade to DSOX202*A [DSOX2BW2*].
Now, I know that a DSOX2002A with the hack can become in a DSOX2022A, but its real BW is only 160MHz (-3dB).
Is this also the real BW for a DSOX202*A? The datasheet says 200MHz (-3dB warranted).
Please, can someone with a DSOX201*A or a DSOX202*A measure its bandwidth (without probe, straight to BNC, using a 50 Ohm Feed Through)?
Thanks.
Note: Also, I remember read in the forum that all have the same input stage.
The input stage is based on the LMH6518?
-
Until a few days ago, Newark showed the N6450-60001 16 ch. logic cable assembly for around ~ USD $600. I no longer see the cable assembly anywhere on-line without purchasing the full DSOX3MSO upgrade kit. Impeccable timing, isn't it? Can anyone else spot its availability?
I was looking for the logic cable assembly as well. I ended up buying the one below off ebay the other day for my DSOX3k. It shipped within 12 hours. I'll have it in my hands tomorrow and can report back.
http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160 (http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160)
-
Now, I know that a DSOX2002A with the hack can become in a DSOX2022A, but its real BW is only 160MHz (-3dB).
How did you test this? As Agilent are willing to sell a software license key to make a DSOX2002A into a DSOX2022A, I would presume that all of them are capable of the full warranted BW (200MHz -3dB point). It isn't like they are binning the front-end and putting the slow ones in the DSOX2002A models.
-
Until a few days ago, Newark showed the N6450-60001 16 ch. logic cable assembly for around ~ USD $600. I no longer see the cable assembly anywhere on-line without purchasing the full DSOX3MSO upgrade kit. Impeccable timing, isn't it? Can anyone else spot its availability?
I was looking for the logic cable assembly as well. I ended up buying the one below off ebay the other day for my DSOX3k. It shipped within 12 hours. I'll have it in my hands tomorrow and can report back.
http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160 (http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160)
Thnaks this type seems to have the same pinout and hopefully will be compatible.
-
Hi
I know that the DSOX200*A can be upgrade to DSOX201*A [DSOX2BW1*], and the DSOX201*A can be upgrade to DSOX202*A [DSOX2BW2*].
Now, I know that a DSOX2002A with the hack can become in a DSOX2022A, but its real BW is only 160MHz (-3dB).
Is this also the real BW for a DSOX202*A? The datasheet says 200MHz (-3dB warranted).
Please, can someone with a DSOX201*A or a DSOX202*A measure its bandwidth (without probe, straight to BNC, using a 50 Ohm Feed Through)?
Thanks.
Note: Also, I remember read in the forum that all have the same input stage.
The input stage is based on the LMH6518?
I tested the badwidth and upgrade on 3k series and it was accordng to spec. I used the "FreeElectron" Jim Williams pulse generator. See one of my post in this thread.
How did you measure and calculate BW?
Did you use the Agilent offer for free bandwith upgrade?
-
Just a quick check with a sweepgenerator my 2012A with BW20 drops off at ~250MHz.
Make sure you're using good probes if you're not using straight coax, the supplied ones for me was only 150MHz...
-
I tested the badwidth and upgrade on 3k series and it was accordng to spec. I used the "FreeElectron" Jim Williams pulse generator. See one of my post in this thread.
How did you measure and calculate BW?
Did you use the Agilent offer for free bandwith upgrade?
Since Agilent specifies that DSOX2000A response is Gaussian (0.35), yes the "FreeElectron" Jim Williams pulse generator is OK.
But I prefer the traditional method (sweep up to -3dB), because from what I've learned, the set can be a combination between flat and/or Gaussian.
Yes, I know that offer, farnell and rs-online, apply it directly.
Thanks.
-
Just a quick check with a sweepgenerator my 2012A with BW20 drops off at ~250MHz.
Make sure you're using good probes if you're not using straight coax, the supplied ones for me was only 150MHz...
Exactly, that's what I wanted to know.
Thanks. ;)
-
By the way, after ~4 days, Agilent continues without giving me an answer.
Anyone know if the trigger is digital for the 2000X series?
Thanks.
-
Until a few days ago, Newark showed the N6450-60001 16 ch. logic cable assembly for around ~ USD $600. I no longer see the cable assembly anywhere on-line without purchasing the full DSOX3MSO upgrade kit. Impeccable timing, isn't it? Can anyone else spot its availability?
I was looking for the logic cable assembly as well. I ended up buying the one below off ebay the other day for my DSOX3k. It shipped within 12 hours. I'll have it in my hands tomorrow and can report back.
http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160 (http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160)
Travisc, please provide us with an update as to whether or not your logic cable is working. Thank you!
-
Until a few days ago, Newark showed the N6450-60001 16 ch. logic cable assembly for around ~ USD $600. I no longer see the cable assembly anywhere on-line without purchasing the full DSOX3MSO upgrade kit. Impeccable timing, isn't it? Can anyone else spot its availability?
I was looking for the logic cable assembly as well. I ended up buying the one below off ebay the other day for my DSOX3k. It shipped within 12 hours. I'll have it in my hands tomorrow and can report back.
http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160 (http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160)
Or catch them through the forum at a good discount: https://www.eevblog.com/forum/buysellwanted/fs-hpagilent-logic-pods/msg189290/#msg189290 (https://www.eevblog.com/forum/buysellwanted/fs-hpagilent-logic-pods/msg189290/#msg189290)
Tested on a MSOX and work perfectly.
-
Until a few days ago, Newark showed the N6450-60001 16 ch. logic cable assembly for around ~ USD $600. I no longer see the cable assembly anywhere on-line without purchasing the full DSOX3MSO upgrade kit. Impeccable timing, isn't it? Can anyone else spot its availability?
I was looking for the logic cable assembly as well. I ended up buying the one below off ebay the other day for my DSOX3k. It shipped within 12 hours. I'll have it in my hands tomorrow and can report back.
http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160 (http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160)
Or catch them through the forum at a good discount: https://www.eevblog.com/forum/buysellwanted/fs-hpagilent-logic-pods/msg189290/#msg189290 (https://www.eevblog.com/forum/buysellwanted/fs-hpagilent-logic-pods/msg189290/#msg189290)
Tested on a MSOX and work perfectly.
Is it includng grabbers and the grounding extension?
-
Until a few days ago, Newark showed the N6450-60001 16 ch. logic cable assembly for around ~ USD $600. I no longer see the cable assembly anywhere on-line without purchasing the full DSOX3MSO upgrade kit. Impeccable timing, isn't it? Can anyone else spot its availability?
I was looking for the logic cable assembly as well. I ended up buying the one below off ebay the other day for my DSOX3k. It shipped within 12 hours. I'll have it in my hands tomorrow and can report back.
http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160 (http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160)
Travisc, please provide us with an update as to whether or not your logic cable is working. Thank you!
Just an update to the logic cable assembly I purchased off eBay. I received it today. I tested all 16 lines with my DSOX3 series scope and they worked fine. The quality of the cables, wires, and probes are excellent. The probes and connectors all have little Agilent logos on them. The parts were well packed, and the bags they came in had Agilent part and lot numbers on them. It's the real deal. I'm very happy with them.
-
Until a few days ago, Newark showed the N6450-60001 16 ch. logic cable assembly for around ~ USD $600. I no longer see the cable assembly anywhere on-line without purchasing the full DSOX3MSO upgrade kit. Impeccable timing, isn't it? Can anyone else spot its availability?
I was looking for the logic cable assembly as well. I ended up buying the one below off ebay the other day for my DSOX3k. It shipped within 12 hours. I'll have it in my hands tomorrow and can report back.
http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160 (http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160)
Travisc, please provide us with an update as to whether or not your logic cable is working. Thank you!
Just an update to the logic cable assembly I purchased off eBay. I received it today. I tested all 16 lines with my DSOX3 series scope and they worked fine. The quality of the cables, wires, and probes are excellent. The probes and connectors all have little Agilent logos on them. The parts were well packed, and the bags they came in had Agilent part and lot numbers on them. It's the real deal. I'm very happy with them.
Great. I just ordered the same set. Thanks for getting back to us!
-
So i ordered now the second last one.
The Original part costs around 900Euros.
http://www.home.agilent.com/myagilent/faces/partDetail.jspx?partNumber=N6450-60001 (http://www.home.agilent.com/myagilent/faces/partDetail.jspx?partNumber=N6450-60001)
-
There isnt by chance any way to enable 16 digital lines for the X-2000 series instead of the 8 is there?
-
There isnt by chance any way to enable 16 digital lines for the X-2000 series instead of the 8 is there?
From Dave's teardown, no. The buffer chips etc aren't loaded.
-
Inside N6459-61601 (logic analyzer probe cable)
(http://www.imageup.ru/img70/1625605/n6459_1.jpg)
(http://www.imageup.ru/img70/1625606/n6459_2.jpg)
-
Thank you for this photo.
-
Has anyone ordered a new DSOX-3034A from Newark or TEquipment.net in the US? I wonder if it is likely to have firmware 2.35 or 2.36 on it....
@travisc: you got your DSOX-3034A just last week; was that from a US distributor?
-
Has anyone ordered a new DSOX-3034A from Newark or TEquipment.net in the US? I wonder if it is likely to have firmware 2.35 or 2.36 on it....
@travisc: you got your DSOX-3034A just last week; was that from a US distributor?
I bought mine at Newark in the US.
-
I just tested, original Firmware 2.36 did not work for USB boot, just resulted in cyclic blinking of the buttons with no software being started.
Then, I "updated" to the latest firmware available from the Agilent homepage (2.35) - as suggested by the scope itself.
Now, USB boot works perfectly fine.
Stick is a SanDisk Extreme USB 3.0 16GB.
-
Yay!!!
Just got a customer return DSO-X3000 returned back from Agilent calibration date 2 Jan 2014, they upgraded it to firmware 2.36.
Downgraded to 2.35 from the Agilent website, edited the DLL and created a USB drive and now it's all options enabled!!
Got the 'WARNING: Unfinalised software' message but otherwise perfect!!
Very happy bunny indeed :)
Anybody now want a Rigol 2072 all options enabled brand new in box never used??!!
Helpful link...
https://dl.dropboxusercontent.com/u/2063383/DSOX3000%20hack.zip
-
I had to try about a dozen USB sticks till I finally got one that worked reliably.
Didn't work:
Kingmax 32GB USB3 (50% of the time it was ok)
SanDisk Cruser Edge 8GB
SanDisk Cruser Edge 16GB
pqi 16GB USB3
Verbatim 16GB
PNY 8GB
Worked:
Kingston 4GB microSD with adaptor
DaneElec 2GB SD with cheapo USB card reader
Integral 8GB (Argos £7 cheapest they sold) http://www.argos.co.uk/static/Product/partNumber/9093410.htm (http://www.argos.co.uk/static/Product/partNumber/9093410.htm)
In my experience cheaper slower smaller is better...?
-
Why the trigger jitter is not specified in the datasheet for the DSO-X series?
I can't find its value. :-//
Thanks.
-
I just tested, original Firmware 2.36 did not work for USB boot, just resulted in cyclic blinking of the buttons with no software being started.
Then, I "updated" to the latest firmware available from the Agilent homepage (2.35) - as suggested by the scope itself.
Now, USB boot works perfectly fine.
Stick is a SanDisk Extreme USB 3.0 16GB.
Thanks for testing!! There were several user who affraid to downgrade scope to 2.35. Was there any warnining message?
Prior downgrade I reccomneds to reset scope to factory default, this help during my downgrading experiment with firmwares prior 2.35.
-
USB boot loops on 2.36 because of file versions mix I guess. It's no a true boot actually, the OS (and all files in OS directories) from internal flash is used, just the scope app is started from USB, so a mix of 2.36 internal and 2.35 external files occurs.
Somebody with that dreaded 2.36 should pull it out via telnet or USB stick batch copy script for study.
-
Thanks for testing!! There were several user who affraid to downgrade scope to 2.35. Was there any warnining message?
Prior downgrade I reccomneds to reset scope to factory default, this help during my downgrading experiment with firmwares prior 2.35.
Neither problems nor warning messages at all. I expected a message like "you try to downgrade your scope" or "the latest firmware is already installed on your scope" but none of them appeared. I copied the cab file onto a USB stick, followed the original software "upgrade" procedure on the scope, then it copied files for 2-3 minutes, rebooted and the 2.35 version OS started without any hazzle. Also calibration is still fine. I think, it resets to factory default during the "upgrade" process, but I can't confirm.
-
Digging around in the software I found an interesting thing...
Dealer ex-demo scopes with all options enabled have a time limit of 9 months on those options.
-
The expiration date is built in the key, it is not related to the comandline parameter
-
It should be LAN module for 181 USD
http://www.home.agilent.com/myagilent/faces/partDetail.jspx?partNumber=75019-68705&imageStatus=NO&_afrLoop=1455775011571000&_afrWindowMode=0&_afrWindowId=null#%40%3F_afrWindowId%3Dnull%26_afrLoop%3D1455775011571000%26imageStatus%3DNO%26partNumber%3D75019-68705%26_afrWindowMode%3D0%26_adf.ctrl-state%3D39lnsndix_58 (http://www.home.agilent.com/myagilent/faces/partDetail.jspx?partNumber=75019-68705&imageStatus=NO&_afrLoop=1455775011571000&_afrWindowMode=0&_afrWindowId=null#%40%3F_afrWindowId%3Dnull%26_afrLoop%3D1455775011571000%26imageStatus%3DNO%26partNumber%3D75019-68705%26_afrWindowMode%3D0%26_adf.ctrl-state%3D39lnsndix_58)
-
It should be LAN module for 181 USD
http://www.home.agilent.com/myagilent/faces/partDetail.jspx?partNumber=75019-68705&imageStatus=NO&_afrLoop=1455775011571000&_afrWindowMode=0&_afrWindowId=null#%40%3F_afrWindowId%3Dnull%26_afrLoop%3D1455775011571000%26imageStatus%3DNO%26partNumber%3D75019-68705%26_afrWindowMode%3D0%26_adf.ctrl-state%3D39lnsndix_58 (http://www.home.agilent.com/myagilent/faces/partDetail.jspx?partNumber=75019-68705&imageStatus=NO&_afrLoop=1455775011571000&_afrWindowMode=0&_afrWindowId=null#%40%3F_afrWindowId%3Dnull%26_afrLoop%3D1455775011571000%26imageStatus%3DNO%26partNumber%3D75019-68705%26_afrWindowMode%3D0%26_adf.ctrl-state%3D39lnsndix_58)
Wait, so Im confused. That LAN module you linked to says that it was replaced by the DSOXLAN-FG, if I already have the DSOXLAN module in my MSOX2024A does that mean that there is a new/updated LAN/VGA module. The link for the DSOXLAN-FG module says: "This part is not available for direct sale but an instrument repair is orderable through our service center. Please contact Agilent to inquire about returning your instrument for repair."
-
I wonder what's changed, FG can't stand for Function Gen so what could it be?
-
I just contacted Agilent on the DSOXLAN-FG module and apparently those links that were posted were not supposed to be exposed to the general public. He explained that the DSOXLAN-FG is a part reference for the entire assembly that is sold to us as the DSOXLAN. He said there is nothing different about its merely an internal part number.
-
I just contacted Agilent on the DSOXLAN-FG module and apparently those links that were posted were not supposed to be exposed to the general public. He explained that the DSOXLAN-FG is a part reference for the entire assembly that is sold to us as the DSOXLAN. He said there is nothing different about its merely an internal part number.
Thanks for check, I just post it when I found it on website.
-
My DSOXLAN modul that I have ordered from Datatec a couple of weeks ago was marked with DSOXLAN FG.
@abyrvalg
Yes I'm also interested for a 2.36 Firmware packet to look inside the core dll
Also i have prepared a raw image with the Keysight Logo to replace the megazoom screensaver logo but until now i didn't had the time to change the data in the dll :)
-
Had version 2.36.
downgraded to 2.35 and now it works :)
-
Hi folks, I'm going to take advantage of the Agilent promo --- I have ordered a DSOX3k + LAN module. The items are back-ordered 4 wks, so it'll be a bit of a wait...but I expect it to be loaded with v2.36 firmware. Following what I've read here, I will telnet in, copy the files to a local USB, and share them here. Hopefully we find a way to make v2.36 work from USB boot with configured options! Thanks people for all the ideas shared so far! :)
-
Hi folks, I'm going to take advantage of the Agilent promo --- I have ordered a DSOX3k + LAN module. The items are back-ordered 4 wks, so it'll be a bit of a wait...but I expect it to be loaded with v2.36 firmware. Following what I've read here, I will telnet in, copy the files to a local USB, and share them here. Hopefully we find a way to make v2.36 work from USB boot with configured options! Thanks people for all the ideas shared so far! :)
Why not just downgrade?
-
Why not just downgrade?
Well, since we know that works already it is easy last resort. I think it will be fun to try 2.36; several people are curious to see the core dll, so I can help with that effort. And, eventually 2.36 might be on Agilents website for download.
-
Why not just downgrade?
Well, since we know that works already it is easy last resort. I think it will be fun to try 2.36; several people are curious to see the core dll, so I can help with that effort. And, eventually 2.36 might be on Agilents website for download.
I'm still trying to get the modified 2.35 version working on my scope. :(
-
Finally got it to work using a podunk 4G USB stick I got from Digikey for attending some training from ST Micro. Go figure.
-
Hi,
I just wonder if I miss something?
Base on the Quote from: plesa on November 03, 2013, 10:24:37 PM
Instead of moving the startup on the USB key just live on the local disk
How to hack the firmware
1. Unpack the firmware *.cab by 7zip
2. Unpack infiniiVisionSetup.cab ( e.g. with WinCE CAB Manager 3.0)
Find \Secure\infiniiVision\infiniiVisionCore.dll
2a. copy infiniiVisionCore.dll to infiniiVisionCore.old
3. Change at location 0x277e50 in infiniiVisionCore.dll
byte sequence 04 00 a0 e1 to byte sequence 00 00 a0 e3
To reverse the change infiniiVisionCore.old to infiniiVisionCore.dll
Restart ...
eurofox
-
Well only time will tell I suppose. We'll just have to hide and watch what they do.
-
Hi,
I just wonder if I miss something?
Base on the Quote from: plesa on November 03, 2013, 10:24:37 PM
Instead of moving the startup on the USB key just live on the local disk
<snip>
To reverse the change infiniiVisionCore.old to infiniiVisionCore.dll
Restart ...
eurofox
I believe that would work, and you could also overwrite the infiniivision.lnk file with the original. But, I haven't tried any of this yet...still waiting for gear to arrive.
In any case, you would want to make sure you have a failsafe USB boot key in the event something was corrupted on the local disk, and especially if you don't have the LAN module, as you might be unable to boot the scope and/or be "locked out" of it in some way and unable to resolve the problem.
-
Muahahaha! :-DD
Agilent DSOX2000/3000 Easteregg Spaceship Screensaver (https://www.youtube.com/watch?v=A4zTj5a7cGU#ws)
Here is it the Enterprise Screensaver.
I did take a look in the dsox4000 dll and there are a lot more debug information and resources.
I opened the 4000 infiniivision with a resource hacker and I was able to extract bitmaps and Winform dialogs.
After disassembling the dll I searched for the text TREK and found the reference to this in a subfunction with other references to ...Screensaver...
So i tried it on my scope and bingo.
Regards
Kai
Today i was at the embedded world fair here in Nürnberg/Germany and i could try the Screensaver Easteregg with the text TREK which will work as seen in my video.
After I started the Preview it will show some credits.
It was a little bit sad that i didn't have a possibility to make a video of this.
It would be nice if someone which have a DSOX4000 available take a video of this easteregg.
-
Hi folks, I'm going to take advantage of the Agilent promo --- I have ordered a DSOX3k + LAN module. The items are back-ordered 4 wks, so it'll be a bit of a wait...but I expect it to be loaded with v2.36 firmware. Following what I've read here, I will telnet in, copy the files to a local USB, and share them here. Hopefully we find a way to make v2.36 work from USB boot with configured options! Thanks people for all the ideas shared so far! :)
It's coming next Wednesday (March 5th)! :)
Edit: It has arrived! Niccceeeee! As expected, it has firmware v2.36 on it. The DSOXLAN module has shipped separately, so I need to wait few more days... Will update again when I have everything!
-
I just contacted Agilent on the DSOXLAN-FG module and apparently those links that were posted were not supposed to be exposed to the general public. He explained that the DSOXLAN-FG is a part reference for the entire assembly that is sold to us as the DSOXLAN. He said there is nothing different about its merely an internal part number.
My DSOXLAN modul that I have ordered from Datatec a couple of weeks ago was marked with DSOXLAN FG.
I can add that the DSOXLAN module that I bought (from ZoroTools) was labeled "DSOXLAN-FG"; it came in a legit Agilent box, sealed and well packaged.
-
My Agilent DSO-X 3034A arrived earlier in the month and it took until today to get a DSOXLAN module for it. The scope is running v2.36 firmware as has been the case for recent folks. It's been a pleasure to use so far, and I'm looking forward to unlock a little extra potential.
For the purpose of exploring v2.36, here is some details (for the complete file listing, see attached FileList.txt):
Directory of \Secure\infiniiVision
01/01/86 12:04a <DIR> web
01/01/86 12:04a <DIR> fpga
10/10/07 06:45p 46624 System.Drawing.dll
10/10/07 06:45p 214552 mscorlib.dll
05/05/13 09:21a 82432 Agilent.Cdf.Api.Licensing.dll
05/05/13 09:21a 160256 Agilent.Cdf.Api.Lxi.dll
05/05/13 09:21a 85504 Agilent.Cdf.Api.Security.dll
05/05/13 09:21a 28160 Agilent.Cdf.Api.SystemManagement.dll
05/05/13 09:21a 163840 Agilent.Cdf.Api.dll
05/05/13 09:21a 9216 Agilent.Cdf.Core.Lxi.Web.ComServer.Interop.dll
08/24/12 03:16p 238080 OpenNETCF.dll
05/16/13 08:43p 13312 WebPageData.dll
08/24/12 03:16p 398336 SetupConverter.exe
01/01/86 12:04a 1152032 splashImage.bin
08/24/12 03:17p 251392 dnssd_CE.dll
08/24/12 03:17p 355840 libcups2.dll
08/24/12 03:17p 83968 libcups2backend.dll
09/13/13 11:10a 215040 vncServer.exe
08/24/12 03:20p 21504 websockify.exe
09/13/13 11:17a 17312416 infiniiVisionCore.dll
09/13/13 11:10a 12104 infiniiVisionLauncher.exe
09/13/13 11:10a 180736 infiniiVisionWebCom.dll
The infiniiVisionCore.dll is the same size (in bytes) as the previous v2.35 release, however the two files are different.
The bytes previously mentioned to patch at location 0x277e50 are not there. My best guess (just by comparing, and noting the same sequence of bytes) is that they are now at 0x277e30.
I patched the bytes at 0x277e30, and setup the USB boot key as per the instructions here. I tried 3 different USB keys: SanDisk Cruzer 2GB, Kingston DataTraveler 4GB, Transcend 32GB. All were USB 2.0 drives, and formatted FAT32. None of these drives worked. During boot, groups of LEDs on front of the scope would flash in sequence and after a short while the scope would restart and try again. Removing the USB drive, the scope would boot as normal.
I am not sure if I patched the infiniiVisionCore.dll correctly as it is different to v2.35. I have uploaded the .dll here. (http://wikisend.com/download/130184/infinii236.zip) I hope a more knowledgeable person could look at it and provide some comments. If more files are needed, just let me know. @plesa @abyrvalg hoping you guys might be able to take a look.
Reading back through the thread, people have had success with:
"a podunk 4G USB stick I got from Digikey"
SanDisk Extreme USB 3.0 16GB
Kingston 4GB microSD with adaptor
DaneElec 2GB SD with cheapo USB card reader
Integral 8GB
Hoping I will not have to downgrade --- I will keep trying with other USB drives...
Sparky
-
Sparky, let's partition the problem a bit: try booting from USB w/o any patches first (original dll, no added params in .lnk) - the scope should start normally (but slower) using files on USB.
-
My Agilent DSO-X 3034A arrived earlier in the month and it took until today to get a DSOXLAN module for it. The scope is running v2.36 firmware as has been the case for recent folks. It's been a pleasure to use so far, and I'm looking forward to unlock a little extra potential.
For the purpose of exploring v2.36, here is some details (for the complete file listing, see attached FileList.txt):
Directory of \Secure\infiniiVision
01/01/86 12:04a <DIR> web
01/01/86 12:04a <DIR> fpga
10/10/07 06:45p 46624 System.Drawing.dll
10/10/07 06:45p 214552 mscorlib.dll
05/05/13 09:21a 82432 Agilent.Cdf.Api.Licensing.dll
05/05/13 09:21a 160256 Agilent.Cdf.Api.Lxi.dll
05/05/13 09:21a 85504 Agilent.Cdf.Api.Security.dll
05/05/13 09:21a 28160 Agilent.Cdf.Api.SystemManagement.dll
05/05/13 09:21a 163840 Agilent.Cdf.Api.dll
05/05/13 09:21a 9216 Agilent.Cdf.Core.Lxi.Web.ComServer.Interop.dll
08/24/12 03:16p 238080 OpenNETCF.dll
05/16/13 08:43p 13312 WebPageData.dll
08/24/12 03:16p 398336 SetupConverter.exe
01/01/86 12:04a 1152032 splashImage.bin
08/24/12 03:17p 251392 dnssd_CE.dll
08/24/12 03:17p 355840 libcups2.dll
08/24/12 03:17p 83968 libcups2backend.dll
09/13/13 11:10a 215040 vncServer.exe
08/24/12 03:20p 21504 websockify.exe
09/13/13 11:17a 17312416 infiniiVisionCore.dll
09/13/13 11:10a 12104 infiniiVisionLauncher.exe
09/13/13 11:10a 180736 infiniiVisionWebCom.dll
The infiniiVisionCore.dll is the same size (in bytes) as the previous v2.35 release, however the two files are different.
The bytes previously mentioned to patch at location 0x277e50 are not there. My best guess (just by comparing, and noting the same sequence of bytes) is that they are now at 0x277e30.
I patched the bytes at 0x277e30, and setup the USB boot key as per the instructions here. I tried 3 different USB keys: SanDisk Cruzer 2GB, Kingston DataTraveler 4GB, Transcend 32GB. All were USB 2.0 drives, and formatted FAT32. None of these drives worked. During boot, groups of LEDs on front of the scope would flash in sequence and after a short while the scope would restart and try again. Removing the USB drive, the scope would boot as normal.
I am not sure if I patched the infiniiVisionCore.dll correctly as it is different to v2.35. I have uploaded the .dll here. (http://wikisend.com/download/130184/infinii236.zip) I hope a more knowledgeable person could look at it and provide some comments. If more files are needed, just let me know. @plesa @abyrvalg hoping you guys might be able to take a look.
Reading back through the thread, people have had success with:
"a podunk 4G USB stick I got from Digikey"
SanDisk Extreme USB 3.0 16GB
Kingston 4GB microSD with adaptor
DaneElec 2GB SD with cheapo USB card reader
Integral 8GB
Hoping I will not have to downgrade --- I will keep trying with other USB drives...
Sparky
Read the whole thread. 2.36 is not possible to patch the same way. To hack the scope you need to downgrade the firmware to 2.35 as few members does.
-
plesa, do you know where is the problem exactly? USB startup override itself doesn't work anymore? Or some problems with patching?
-
Thanks Sparky for sharing the new dll version.
I copied the dll to my usb stick and i was able to start it but the dll hack at the right position is not working.
Also i didn't see any changes i the near of the Unfinalized Software output.
I will spend some more time today in the evening.
-
plesa, do you know where is the problem exactly? USB startup override itself doesn't work anymore? Or some problems with patching?
Currently I do not have the 2.36 but we have discussion and there is blocked USB booting capability. Thats why it can be really dangerous to try to patch it.
If someone has the dll extracted you can send it to me for investigation.
Also bellow is additional change in 2.35 which will enable enable multiple force trigerring by pressing the Force trigger (not need to press the single button).
find position 1F24B4 and change it from
013C A0E3 2700 83E3 0110 A0E3
04E0 9DE4 D160 01EA
to
08E0 8FE2 F041 2DE9 0CD0 4DE2
FEA2 FEEB F4FF FFEA
Try it only from usb, not from scope flash to prevent bricking your scope.
-
I didn't read all 28 of the pages on this thread but it seems that no one mentioned the fact that agilent has a promo on the X series that is buy one option and all other options are free. You can also jump one bandwidth up from your current purchased bandwidth. Looks like the promo ends march 31, perhaps longer too with new s scopes.
-
I didn't read all 28 of the pages on this thread but it seems that no one mentioned the fact that agilent has a promo on the X series that is buy one option and all other options are free. You can also jump one bandwidth up from your current purchased bandwidth. Looks like the promo ends march 31, perhaps longer too with new s scopes.
It is mentioned in different Agilent thread, it has fixed price.
http://www.home.agilent.com/agilent/editorial.jspx?cc=US&lc=eng&ckey=2430287&nid=-33573.970736.00&id=2430287 (http://www.home.agilent.com/agilent/editorial.jspx?cc=US&lc=eng&ckey=2430287&nid=-33573.970736.00&id=2430287)
For someone running Agilent WinXP instruments there is also running promo for the Win7 upgrade for spectrum analyzers.
-
Sparky, let's partition the problem a bit: try booting from USB w/o any patches first (original dll, no added params in .lnk) - the scope should start normally (but slower) using files on USB.
This is a good suggestion! I will give this a try, as I need to find a USB drive that can actually boot.
Thanks,
Sparky
-
Read the whole thread. 2.36 is not possible to patch the same way. To hack the scope you need to downgrade the firmware to 2.35 as few members does.
@plesa: I have indeed read the whole thread, but found no discussion about patching 2.36. I'm aware many people could not USB boot on 2.36 and simply downgraded to 2.35 as a "work around". As far as I read here, those with 2.36 were trying to boot from a patched 2.35 DLL and system files, but with 2.36 installed on their system. I thought that may have been causing it not to work.
I thought we could investigate the 2.36 DLL, and a few people requested to see the 2.36 DLL, so I posted it. I thought it would be interesting to determine how the 2.36 system was different and a new way to patch it.
-
Thanks Sparky for sharing the new dll version.
I copied the dll to my usb stick and i was able to start it but the dll hack at the right position is not working.
Also i didn't see any changes i the near of the Unfinalized Software output.
I will spend some more time today in the evening.
Thanks for testing, kilobyte. Did you try and boot with the un-patched DLL first? And it booted okay?
I assume you then tried booting with the patch at the new location of 0x277e30 ? Seems there are more checks in this firmware...
-
plesa, do you know where is the problem exactly? USB startup override itself doesn't work anymore? Or some problems with patching?
Currently I do not have the 2.36 but we have discussion and there is blocked USB booting capability. Thats why it can be really dangerous to try to patch it.
If someone has the dll extracted you can send it to me for investigation.
@plesa: I posted the 2.36 DLL in my large post above, but here is direct link (http://wikisend.com/download/130184/infinii236.zip).
I presume this "discussion" about 2.36 having blocked USB booting happened outside this thread...I did not read anything about that.
-
I didn't read all 28 of the pages on this thread but it seems that no one mentioned the fact that agilent has a promo on the X series that is buy one option and all other options are free. You can also jump one bandwidth up from your current purchased bandwidth. Looks like the promo ends march 31, perhaps longer too with new s scopes.
Yea its been mentioned a couple times in multiple threads, the only issue is many of us have already spent close to or more than the amount Agilent now gives all the options for. Unless there is going to be some plan for crediting those that have already bought hundreds in upgrades this upgrade "deal" just feels like spit in your face.
-
I didn't read all 28 of the pages on this thread but it seems that no one mentioned the fact that agilent has a promo on the X series that is buy one option and all other options are free. You can also jump one bandwidth up from your current purchased bandwidth. Looks like the promo ends march 31, perhaps longer too with new s scopes.
Yea its been mentioned a couple times in multiple threads, the only issue is many of us have already spent close to or more than the amount Agilent now gives all the options for. Unless there is going to be some plan for crediting those that have already bought hundreds in upgrades this upgrade "deal" just feels like spit in your face.
I get what you're saying, but not fully. The stuff you paid for still does what you paid for it to do, and it was enough of a deal that you willingly paid for those options.
I also get that you feel you're being treated unfairly because of the dramatic cost difference between what you paid per option vs. what someone will pay per option until this deal ends. Technology always gets cheaper, though maybe you didn't expect it to get SO cheap so quickly, I guess.
Either they are about to announce a new scope or line of scopes, or they're doing the rare "Can I More Money Overall If I Lower The Price And Sell More" test. This is what Steam Sales prove time & time again; that more net revenue is gained by selling at a lower price. Maybe Agilent is giving that a go.
I'd put my money on new hardware coming soon, though.
-
I didn't read all 28 of the pages on this thread but it seems that no one mentioned the fact that agilent has a promo on the X series that is buy one option and all other options are free. You can also jump one bandwidth up from your current purchased bandwidth. Looks like the promo ends march 31, perhaps longer too with new s scopes.
Yea its been mentioned a couple times in multiple threads, the only issue is many of us have already spent close to or more than the amount Agilent now gives all the options for. Unless there is going to be some plan for crediting those that have already bought hundreds in upgrades this upgrade "deal" just feels like spit in your face.
I get what you're saying, but not fully. The stuff you paid for still does what you paid for it to do, and it was enough of a deal that you willingly paid for those options.
I also get that you feel you're being treated unfairly because of the dramatic cost difference between what you paid per option vs. what someone will pay per option until this deal ends. Technology always gets cheaper, though maybe you didn't expect it to get SO cheap so quickly, I guess.
Either they are about to announce a new scope or line of scopes, or they're doing the rare "Can I More Money Overall If I Lower The Price And Sell More" test. This is what Steam Sales prove time & time again; that more net revenue is gained by selling at a lower price. Maybe Agilent is giving that a go.
I'd put my money on new hardware coming soon, though.
FWIW I still havent modded my MSOX2024. I havent needed any of the upgrades I hadnt already purchased. But seeing as how I have had my scope for less than a year and in two weeks for what I paid for 3 upgrades I could have gotten them ALL?! That stings a bit and angers many.
As far as new hardware goes, maybe. Doesnt help me at all though as now the resale value of these scope will be hurt badly as any upgrades wont be worth nearly as much seeing as how the entire suite can be bought for $500 or the thing can be modded for free. It would be interesting to see if they did come out with new scopes as arent 2000X and 3000X series only 3 years old? Seems fast to refresh two lines of oscilloscopes. But mayeb thats where all the competition has driven things.
-
WOW, all the opitions for 800$ on the 3000 X-Series?
Starting April 1, 2014 ehh... April Fools' Day? I hope it is not a joke.
Probably I will spent my money for that. I want to support Agilent when it makes such a good offer to their customer, I hope other companies will follow that good example.
BTW those options are a evil business, man I know it is about money but jeeeeee I personally hate the idea to put on the market something not at the fully potential.... just decide an honest price with everything there and let it go...
-
I didn't read all 28 of the pages on this thread but it seems that no one mentioned the fact that agilent has a promo on the X series that is buy one option and all other options are free. You can also jump one bandwidth up from your current purchased bandwidth. Looks like the promo ends march 31, perhaps longer too with new s scopes.
Yea its been mentioned a couple times in multiple threads, the only issue is many of us have already spent close to or more than the amount Agilent now gives all the options for. Unless there is going to be some plan for crediting those that have already bought hundreds in upgrades this upgrade "deal" just feels like spit in your face.
I get what you're saying, but not fully. The stuff you paid for still does what you paid for it to do, and it was enough of a deal that you willingly paid for those options.
I also get that you feel you're being treated unfairly because of the dramatic cost difference between what you paid per option vs. what someone will pay per option until this deal ends. Technology always gets cheaper, though maybe you didn't expect it to get SO cheap so quickly, I guess.
Either they are about to announce a new scope or line of scopes, or they're doing the rare "Can I More Money Overall If I Lower The Price And Sell More" test. This is what Steam Sales prove time & time again; that more net revenue is gained by selling at a lower price. Maybe Agilent is giving that a go.
I'd put my money on new hardware coming soon, though.
FWIW I still havent modded my MSOX2024. I havent needed any of the upgrades I hadnt already purchased. But seeing as how I have had my scope for less than a year and in two weeks for what I paid for 3 upgrades I could have gotten them ALL?! That stings a bit and angers many.
As far as new hardware goes, maybe. Doesnt help me at all though as now the resale value of these scope will be hurt badly as any upgrades wont be worth nearly as much seeing as how the entire suite can be bought for $500 or the thing can be modded for free. It would be interesting to see if they did come out with new scopes as arent 2000X and 3000X series only 3 years old? Seems fast to refresh two lines of oscilloscopes. But mayeb thats where all the competition has driven things.
I think they're just trying to pre-empt and kill off any sales of Tektronix's new competitor, the MDO3000. With the options so cheap now, you can get a fully unlocked Agilent for half the price of the comparable Tek, even if the Tek can now have comparable performance.
-
Sparky, let's partition the problem a bit: try booting from USB w/o any patches first (original dll, no added params in .lnk) - the scope should start normally (but slower) using files on USB.
@abyrvalg: I tried booting from 5 different USB drives. In each case, I used original dll, .lnk and other files from the scope. The only addition to the USB drive not from the scope is the infiniivisionStartupOverride.txt file, in the root directory.
With or without the USB drive plugged in, the scope boots in ~42sec. It takes ~31 sec for the "Agilent Technologies" logo to appear, and then another 11-12sec until the main screen appears. Note: I have the DSOXLAN module installed. Without the DSOXLAN module it boots to the main screen in about 35sec.
How long (in seconds) does it take the scope to boot on 2.35 when USB drive is plugged in? In my case, with or without USB drive the time is the same, which makes me think it is not booting from USB drive at all! When I had "patched" DLL on USB drive, it would not boot at all.
In my case, either none of the USB drives I have are bootable, or there is something else in 2.36 that prevents boot (maybe something in the dll, or elsewhere controlling start-up). Perhaps this is what plesa was referring to by "blocked USB booting capability". Perhaps startupOverride txt file does not work like previous?
-
Sparky, looks like your test is incorrect: if you are using 100% original .lnk then it points to internal folder (\Secure\infiniiVision), so you are starting the same process just a bit differently. You need to try .lnk with modified folder path, but no feature options (they'll cause troubles with unpatched dll):
44#\usb\infiniiVision\infiniivisionLauncher.exe
-
Sparky, looks like your test is incorrect: if you are using 100% original .lnk then it points to internal folder (\Secure\infiniiVision), so you are starting the same process just a bit differently. You need to try .lnk with modified folder path, but no feature options (they'll cause troubles with unpatched dll):
44#\usb\infiniiVision\infiniivisionLauncher.exe
Oh, of course! My bad! I will repeat and report back.
Update:
This time, my USB drives give different results when trying to boot.
- Two newest drives (Transcend 32GB "Ultra Speed" and Kingston 4GB "DataTraveler")
Scope attempts to boot for 62 and 72 sec, respectively, and then the system reboots and tries again. It appears the scope is really trying to read and boot from these drives, but a new protection method prevents it from doing so. Note, this is attempting USB boot with unpatched DLL, so there is something other than DLL blocking USB boot in this v2.36 firmware.
- Two oldest drives (SanDisk 2GB "Cruzer" and no-name 2GB)
These don't seem to do anything; the system boots in ~45 seconds. As far as I can tell, the scope couldn't read from these disks during boot and so it started normally.
-
I did a further test to check if the infiniivisionStartupOverride file contents had any effect. Using my Transcend drive which appears to be the "best bet" as far as boot capability goes, I changed the "True" to "False" in the override text file. I expected the scope to boot as normal in about 45sec. Surprisingly, it didn't! The system continued to try and boot for ~70sec, and then restarted.
Has anyone tested setting "False" in the text file, and did it lead to normal internal boot? I assume this is what should happen, but would be nice to confirm.
Seems like need to investigate what might be blocking USB boot capability...
Update: Upon further testing, the contents of override file is unimportant; only its existence is checked. Upon deleting the file, the scope boots as normal, which was the expected behavior. The presence of the override text file is preventing boot from USB.
-
re: USB boot override
With help from another member here, so far it is thought that file "\Windows\ProcessStartupFolder.exe" is possibly responsible for blocking USB boot capability.
In v2.35 ProcessStartupFolder.exe is 12744 bytes; in v2.36 it is a bit bigger.
Unfortunately I can't copy this file off the system; 'copy' and trying to dump the file with 'type' both result in errors. I also tried 'processMgr.exe kill' before copying and that didn't work. This may be why Agilent haven't posted the 2.36 update online --- it would be immediate way to obtain ProcessStartupFolder.exe and inspect it.
If anyone has further suggestions for copying this file off the scope let me know and I can try.
If there is no way forward I will likely downgrade to the v2.35 firmware this weekend.
-
Did you try to kill the InfinivisionLaucher as well?
Can you post the processes running on the 2.36?
-
Did you try to kill the InfinivisionLaucher as well?
Can you post the processes running on the 2.36?
Thanks for the suggestion. I just tried: killed both ProcessStartupOverride and InfiniiVisionLauncher but still got error on copy:
"Cannot copy \Windows\ProcessStartupFolder.exe to \usb"
-
Sparky, try attrib -s -h \Windows\ProcessStartupFolder.exe, then copy, maybe some attribute prevents copiing. If attrib fails, try without -s also.
If none will work, try pulling out \Windows\cmd.exe for study - maybe there is some restriction right in the shell itself.
-
Hi,
I got finally my scope and enable the trial, this ways I have all options enabled. ;
In 10 days I will have the permanent options enabled, I suppose everybody know about this promotion from Agilent. :)
eurofox
-
In 10 days I will have the permanent options enabled, I suppose everybody know about this promotion from Agilent. :)
Just the general stuff. What was it they charge for all the options? I remember something like €500?
-
In 10 days I will have the permanent options enabled, I suppose everybody know about this promotion from Agilent. :)
Just the general stuff. What was it they charge for all the options? I remember something like €500?
I think $500 for the 2000 and $800 for the 3000 range.
eurofox
-
DSOX2APPBNDL -> 9 for 1 _-_ 401 Euro + VAT instead of 2735 Euro + VAT
DSOX3APPBNDL -> 15 for 1 _-_ 641 Euro + VAT instead of 9900 Euro + VAT
DSOX4APPBNDL -> 16 for 1 _-_ 1202 Euro + VAT instead of 14779 Euro + VAT
-
Guys, thank you very much. I got my 2004A running with all features and 200MHz. Nice!
I had some troubles with cheap uSD card reader - scope did not mount any card even when booted up. But old 256MB USB drive did the job just fine!
BTW, it was already mentioned here, but I remind for those who are considering hacking their scope: you will get a warning text during boot, also in "About" page. Also you will get a prompt after boot up. Fortunately these texts are easy to change or even remove. In my case, I left the warning there, just changed the text with owner's information, in case the scope gets stolen (but it is possible to remove this text, just fill in with spaces or NULL characters). As for prompt after boot up, I did not dig deep in to removing it, just changed the text to something neutral, as you would have to press Back button anyway to get rid of language selection after normal boot (any way to switch off this annoying thing?).
Check pictures below:
https://dl.dropboxusercontent.com/u/68288580/agilent/IMG_20140322_130405_543.jpg
https://dl.dropboxusercontent.com/u/68288580/agilent/IMG_20140322_130427_395.jpg
https://dl.dropboxusercontent.com/u/68288580/agilent/IMG_20140322_130249_858.jpg
However, I have failed with one thing... I wanted to check how downloaded demo license works... So I downloaded a Segmented Memory Application and installed it on the scope (from internal boot). As expected, feature started working even without the hack (with indicated trial end date).
The problem is that SGM is no longer working from hacked boot, even though license is still valid.
What can I do to get this functionality back? Is it possible to disable license check? It is really one of those features that I should not have messed with...
Now... How do we:
1. disable license checking.
2. copy modded files in to internal memory? No LAN card here. Still, it looks like it is possible via USB-only.
-
Sparky, try attrib -s -h \Windows\ProcessStartupFolder.exe, then copy, maybe some attribute prevents copiing. If attrib fails, try without -s also.
If none will work, try pulling out \Windows\cmd.exe for study - maybe there is some restriction right in the shell itself.
I noticed only the "readonly" (R) attribute was set for ProcessStartupFolder.exe, and I tried to remove it, but resulted in an error (cannot set attribute...).
I tried also on \Windows\cmd.exe but same scenario --- cannot be copied...
Thanks everyone, and especially abyrvalg for the help to investigate the v2.36 firmware. It seems there is some interesting things going on with ProcessStartupFolder.exe, but unfortunately no way to inspect it.
Looks like I will begin the v2.35 downgrade soon...
-
What did 2.36 bring for updates anyway? Is there even any reason to try and keep it?
-
soory for jack up the main topic, but in previous posts some users were discussing the possibility of building a pcb with the ethernet connection. Has anyone ended up designing the module?
-
Sparky, you have the 2.36 app extracted already, so you can try booting it from USB after downgrade just for curiosity. Please report the results if any.
-
What did 2.36 bring for updates anyway? Is there even any reason to try and keep it?
As 2.36 hasn't been publicly released we don't know for sure, but it's possible it does not contain any enhancements or bug fixes; its purpose may be exclusively for blocking USB boot. (And because it hasn't been released, we can't get to ProcessStartupFolder.exe from a cab file.)
For reference, 2.35 brought the following:
Enhancements
For both the 2000X and 3000X families:
• Default cursors placement will no longer overlay cursors on the same value.
For the 3000X family:
• N2820A high sensitivity 2 channel current probe support has been expanded to allow for a greater range of user defined resistance.
• LIN error triggering has been added.
• WaveGen modulation frequency now has more granularity for user adjustment.
Defects Addressed
For the 2000X and 3000X family:
• Mask “Save on Error” capability now works for SINGLE acquisitions
• Scope will behave better in higher activity LAN networks
• A number of bitmaps behaviors have been improved for some tablets
For the 3000X family:
• LIN 2.0 decoding now better handles the Checksum field.
• An Arb file import error has been addressed; it no longer skips some time column data.
• For IC2 decoder search: previously, read packets were sometimes erroneously found during write searches.
-
Sparky, you have the 2.36 app extracted already, so you can try booting it from USB after downgrade just for curiosity. Please report the results if any.
I have done the downgrade to 2.35 --- it booted first attempt from USB drive loaded with 2.35 files. All options and 500MHz BW activated as expected.
I will try the 2.36 app on USB drive and report what happens.
-
I'm now running 2.35 from internal. I copied the 2.36 files to USB and it booted fine from USB drive. Same result as noted by kilobyte here (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg408031/#msg408031).
I have not tried booting the patched dll, but as mentioned by kilobyte it is not working. I wonder if kilobyte made any further discoveries?
-
Telnet connection to port 5024 on DSOX3032 doesn't woork.
LAN adapter is self made, other services: ping, WEB and telnet responds normally.
This behavior is common for software running from internal flash and from USB flash.
Georg
-
From what I can gather the soon to be released chargeable DSOX3APPBNDL offers all possible (published) licensable upgrades except for bandwidth and MSO functionality.
Two questions on running the hacked 2.35 firmware from USB.
Is any calibration maintained when running the hacked>?
Is it still possible to save screen images to the USB memory stick?
-
Is any calibration maintained when running the hacked>?
Is it still possible to save screen images to the USB memory stick?
Yes calibration is maintained, and
you can save/recall data to/from USB stick.
Georg
-
Just finished my LAN module.
Here's some pictures, I see some imperfections.
Module is working with some restrictions described in my previous post, only LEDs no lit.
Georg
-
Lan module looks great! It would be really good to make one. Do you have cad files available?
-
im wondering what are these units are calibrated for, its full hardware capability or for marketed bandwith?
-
im wondering what are these units are calibrated for, its full hardware capability or for marketed bandwith?
Must be full capability, because the higher bandwidths can be unlocked with the purchased bandwidth option, and it doesn't require the unit to be sent for (re)calibration.
-
CAD files please... Thank you in advance.
-
Great job you guys!
In my DSOX there is one problem with this hack - I have all the licenses excluding band. It's still 100MHz instead of 200MHz. My oscilloscope was originally 100MHz. Maybe thats the problem?
-
I have all the licenses excluding band. It's still 100MHz instead of 200MHz. My oscilloscope was originally 100MHz. Maybe thats the problem?
What command are you using in the startup .lnk file? You need to add "-l BW20" to the command line, the "-l All" license doesn't cover bandwidth.
-
This is how my file look like:
62#\usb\secure\infiniiVision\infiniivisionLauncher.exe -l MSO -l memMax -l MEMUP -l EMBD -l AUTO -l COMP -l SGM -l MASK -l EDK -l RML -l ASV -l SGMC -l BW20 -l DIS -l SCPIPS -l VID -l CABLE
Still no 200MHz band.
-
This is how my file look like:
62#\usb\secure\infiniiVision\infiniivisionLauncher.exe -l MSO -l memMax -l MEMUP -l EMBD -l AUTO -l COMP -l SGM -l MASK -l EDK -l RML -l ASV -l SGMC -l BW20 -l DIS -l SCPIPS -l VID -l CABLE
Still no 200MHz band.
You have 186 characters to the right of the "#", so I think the file should read:
186#\usb\secure\infiniiVision\infiniivisionLauncher.exe -l MSO -l memMax -l MEMUP -l EMBD -l AUTO -l COMP -l SGM -l MASK -l EDK -l RML -l ASV -l SGMC -l BW20 -l DIS -l SCPIPS -l VID -l CABLE
-
I just got in my email the upgrade code for all the options from Newark, when I go home after work I will upgrade my puppy X3000. It was $760 and not $800 as advertised on the Agilent website.
Thanks Agilent for giving me this opportunity.
Here again the link for the upgrade promotion:
http://www.home.agilent.com/agilent/editorial.jspx?cc=US&lc=eng&ckey=2430287&nid=-33573.970736.00&id=2430287 (http://www.home.agilent.com/agilent/editorial.jspx?cc=US&lc=eng&ckey=2430287&nid=-33573.970736.00&id=2430287)
-
I just got in my email the upgrade code for all the options from Newark, when I go home after work I will upgrade my puppy X3000. It was $760 and not $800 as advertised on the Agilent website.
Thanks Agilent for giving me this opportunity.
Here again the link for the upgrade promotion:
http://www.home.agilent.com/agilent/editorial.jspx?cc=US&lc=eng&ckey=2430287&nid=-33573.970736.00&id=2430287 (http://www.home.agilent.com/agilent/editorial.jspx?cc=US&lc=eng&ckey=2430287&nid=-33573.970736.00&id=2430287)
Got my upgrade on April 1st, not an April joke :-DD :-DD :-DD
-
Here are Gerber, drill and DXF files for LAN module builders.
I wish to see prettier modules than my!
Georg
-
Hey, Georg. Brilliant, very generous of you.
Thank you
Trev
-
Very cool Georg!
BTW it´s a shame Agilent didn´t design a digital output for a display (HDMI or a DisplayPort) there.
Since I am not expert on those interfaces do you think it is impossible or just tons of brain, spare time and FPGA jazz would do the trick?
I simply can´t stand to have a poor analog video output in such a beautiful 2014 model DSO. On top of that I know the internal display signals are already digital, so what a shame to convert them in analog ones... It is like to take cold beers, warm them up in a oven and finally serve them...
Maybe if someone else is interested it would be nice to put on the Georg board not only the LAN interface but also:
- the raw video digital signals coming from the mainboard, for possible future development
- JTAG?
- I2C?
- UART? (see also https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg260721/?topicseen#msg260721 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg260721/?topicseen#msg260721))
Let´s do an EEVBlog Hack board!
-
Huh, I wonder when a chinese manufacturer will come up with these boards...
-
If you want to see the gerber files, use http://www.gerber-viewer.com (http://www.gerber-viewer.com)
-
Huh, I wonder when a chinese manufacturer will come up with these boards...
Finally found one (a DSOXLAN) on eBay for a good price. Now I just hope the one they send me is in good condition. There are still 3 left if anyone else is looking.
http://www.ebay.com/itm/291108310383 (http://www.ebay.com/itm/291108310383)
I recently purchased a couple of 'real' DSOXLAN from a Chinese seller for less than half retail including free shipping. Seller had 8 of them that I had reported on in the 'Buy/Sell/Wanted' area, but all are gone now. I just got them in today and happily all has tested well with both of them. The $200 US is not too bad of a price for a 'factory' module, and you get the VGA as a bonus, something that would be very difficult to hack. Hopefully the seller will find a few more modules to sell.
-
Yay!!!
Just got a customer return DSO-X3000 returned back from Agilent calibration date 2 Jan 2014, they upgraded it to firmware 2.36.
Downgraded to 2.35 from the Agilent website, edited the DLL and created a USB drive and now it's all options enabled!!
Got the 'WARNING: Unfinalised software' message but otherwise perfect!!
Very happy bunny indeed :)
Anybody now want a Rigol 2072 all options enabled brand new in box never used??!!
Helpful link...
https://dl.dropboxusercontent.com/u/2063383/DSOX3000%20hack.zip
Shows "All options enabled" at power up.
Shows the following features enabled :
MSO, memMax, EMBD, AUTO, FLEX, PWR, COMP, SGM, MASK, AUDIO, DIS, EDK, WAVEGEN, AERO, VID, ADVMATH, DVM, ASV, CABLE, SCPIPS, RML, SGMC, TOM.
No bandwidth increase features shown.
-
Huh, I wonder when a chinese manufacturer will come up with these boards...
Finally found one (a DSOXLAN) on eBay for a good price. Now I just hope the one they send me is in good condition. There are still 3 left if anyone else is looking.
http://www.ebay.com/itm/291108310383 (http://www.ebay.com/itm/291108310383)
I recently purchased a couple of 'real' DSOXLAN from a Chinese seller for less than half retail including free shipping. Seller had 8 of them that I had reported on in the 'Buy/Sell/Wanted' area, but all are gone now. I just got them in today and happily all has tested well with both of them. The $200 US is not too bad of a price for a 'factory' module, and you get the VGA as a bonus, something that would be very difficult to hack. Hopefully the seller will find a few more modules to sell.
I was the one that bought the last of his stock, was a bit surprising how banged up the module is on the sides. Guess these things were passed around a lot in the lab they came from.
-
The last release of the firmware is 2.36 but on the Agilent website only the 2.35 is available.
Where can I get the 2.36?
eurofox
-
This is interesting http://cp.literature.agilent.com/litweb/pdf/DSOX3104A-01.pdf (http://cp.literature.agilent.com/litweb/pdf/DSOX3104A-01.pdf)
Service Note
December 5, 2012
DSOX3014A – Oscilloscope, Mixed Signal, 4 Channel, 100MHz
Serial Numbers: ALL
Corrupted firmware code renders the oscilloscope inoperable.
Situation:
At regular intervals, the scope compares the checksum of the firmware code running in RAM with the checksum in Flash. This allows the detection of inadvertent or unauthorized changes to the files. If the two checksums ever differ, an error message is displayed and the scope becomes inoperable. The error message will read:
The InfiniiVision software has been corrupted. Please contact Agilent Support for help.
Solution/Action:
Go to Agilent.com, reload all files associated with oscilloscope model affected and without opening the file, download it to the scope.
There's also a recommended hardware mod if the scope hisses http://cp.literature.agilent.com/litweb/pdf/DSOX3014A-03.pdf (http://cp.literature.agilent.com/litweb/pdf/DSOX3014A-03.pdf)
-
I was the one that bought the last of his stock, was a bit surprising how banged up the module is on the sides. Guess these things were passed around a lot in the lab they came from.
Yea, one of mine was a little rough, but the other was in very good condition. Both worked equally well and look about the same when plugged into the scope (outside condition is very good). I'm all for saving more than a couple hundred bucks on something you can't even see once plugged in anyway... Very happy with the purchase.
Still, I can't believe how UGLY they make the back of an otherwise nice looking scope look. What an awkward design approach to attach a module??? I understand the desire to lock the unit in place, but give me a break... They should have just skipped the locking loop and clips that protrude out of the back of the case and opted for a couple of torx screws to lock down the module flat to the rear surface. Anyone with a torx driver and enough time and wherewithal to remove the module is going to figure out how the get the whole scope anyway. It's even easier and faster to steal by just clipping the stupid loop with a pair of diagonal cutters, probably already sitting on the bench or nearby, and quickly unclip the module. What a DUMB and UGLY engineering idea, and a silly attempt to lock those modules down.
-
FPG and ALT options grant additional selections for the rear trigger output
utility -> options -> rear panel -> rear panel menu
EDIT: Maybe it's caused by something else anyway. I felt that the scope was not running stable (it would reboot) especially when browsing the serial decode menu so I dropped FPG, ALT and TOM. They're undocumented and at least FPG is not recognised by the N5406A / N5434A FPGA dynamic probe software for the other infiniivision scopes. The Trigger output choices are still available.
CABLE is nice though. The help menu worked, so here's the description:
(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=89344;image)
-
Has anyone bought the DSOX3APPBNDL ($800) to unlock all the options (except BW and MSO feature)?
If so, I wonder if the boot override infiniivisionLauncher options for BW and MSO still work correctly after installing DSOX3APPBNDL?
If anyone has done this, can you please test and post about it?
I'm contemplating buying the application bundle, but I don't want to loose BW and MSO ... and I can't afford everything at once!!
-
I bought the bundle. But unfortunately I do have the 1 GHz MSO version, so I can't try what you want to know without deleting the perpetual license file for the MSO.
I did notice that you can still install the undocumented options though so I imagine that the bandwidth and mixed signal options still work. You won't need all the other command line parameters anymore.
-
I just tried out the LAN functions today and noticed some weird errors with the hacked USB method. If I boot from the hacked drive I get hit with errors like these on web page access:
Parse error in script
Microsoft VBScript runtime error: '800a01ad'
Description: ActiveX component can't create object: 'infiniiVisionWebCom.ScopeInfo'
In file: scopeInfo.asp
On line: 4
Other network functions are fine like telnet, VNC, java and HTML5 based (http://xxx/rfp.html (http://xxx/rfp.html)) remote panels. So it looks like only dynamically generated pages are bad.
-
check if the file on your usb stick is read only (and remove that flag)
-
Didn't work, went into infiniiVision\web and checked them too, they aren't set to read only.
-
I bought the bundle. But unfortunately I do have the 1 GHz MSO version, so I can't try what you want to know without deleting the perpetual license file for the MSO.
I did notice that you can still install the undocumented options though so I imagine that the bandwidth and mixed signal options still work. You won't need all the other command line parameters anymore.
Thanks for your response Neganur! :) I agree with you --- if the undocumented options still work after the bundle license, then it is reasonable to assume the BW and MSO options will be okay, too.
You are most "unfortunate" to have the 1GHz MSO version, eh? :P
-
Anyone looking for a reasonable price DSOXLAN ($200 US) can check this site out. http://www.168electronics.com/agilent-dsoxlan-2000-30000-infiniivision-x-lanvga-module-p-66.html (http://www.168electronics.com/agilent-dsoxlan-2000-30000-infiniivision-x-lanvga-module-p-66.html) (no relationship with the seller)
I purchased two already from his eBay store and they both work perfectly. They are both a little bit tattered, like they were stored in a bin together and moved about a bit, but fully functional. I have not purchased any from his web store, but notice he accepts PayPal, so the buyer protection should be there.
-
Anyone looking for a reasonable price DSOXLAN ($200 US) can check this site out. http://www.168electronics.com/agilent-dsoxlan-2000-30000-infiniivision-x-lanvga-module-p-66.html (http://www.168electronics.com/agilent-dsoxlan-2000-30000-infiniivision-x-lanvga-module-p-66.html) (no relationship with the seller)
I purchased two already from his eBay store and they both work perfectly. They are both a little bit tattered, like they were stored in a bin together and moved about a bit, but fully functional. I have not purchased any from his web store, but notice he accepts PayPal, so the buyer protection should be there.
I just got an email back from the seller stating that his web store inventory was incorrect, that he does not have them available any longer.
-
picked up a new dso-x 2002 from frys for $1000 today, updated firmware to 2.35, applied usb with a transcend 4GB usb formatted as FAT16, worked fine.
neato
-
picked up a new dso-x 2002 from frys for $1000 today, updated firmware to 2.35, applied usb with a transcend 4GB usb formatted as FAT16, worked fine.
So you effectively now have a NEW FULLY LOADED MSOX2022A for $1000... yes, very neato
-
Does anyone have a rigol 2072a and dso 2000 series scope, and have info on which they prefer? Seems to me the agilent would be preferred, even at a cost premium.
-
They are just different. For general reliability go for Agilent. I chose so.
https://www.eevblog.com/forum/reviews/my-new-toy-)-agilent-dsox2002a-sex-on-a-stick!/msg216361/#msg216361 (https://www.eevblog.com/forum/reviews/my-new-toy-)-agilent-dsox2002a-sex-on-a-stick!/msg216361/#msg216361)
But that Rigol DS2000 has huge 56Mpoints memory, dedicated segmented memory (record) controls, it can have two channel arbitrary generator...
-
Muahahaha! :-DD
Agilent DSOX2000/3000 Easteregg Spaceship Screensaver (https://www.youtube.com/watch?v=A4zTj5a7cGU#ws)
Here is it the Enterprise Screensaver.
I did take a look in the dsox4000 dll and there are a lot more debug information and resources.
I opened the 4000 infiniivision with a resource hacker and I was able to extract bitmaps and Winform dialogs.
After disassembling the dll I searched for the text TREK and found the reference to this in a subfunction with other references to ...Screensaver...
So i tried it on my scope and bingo.
Regards
Kai
Today i was at the embedded world fair here in Nürnberg/Germany and i could try the Screensaver Easteregg with the text TREK which will work as seen in my video.
After I started the Preview it will show some credits.
It was a little bit sad that i didn't have a possibility to make a video of this.
It would be nice if someone which have a DSOX4000 available take a video of this easteregg.
yep. it works. just tried it
-
Agilent DSOX3000 and Tektronix DPO3000 are just different. I would choose Agilent because it must be easy and fast to use, but that Tektronix has some useful extra features. I like its two big multipurpose knobs.
-
Here is Agilent guys' point of view.
-
I rarely look at parallel busses or that many digital signals at once.
I guess I misread that... ;)
-
picked up a new dso-x 2002 from frys for $1000 today, updated firmware to 2.35, applied usb with a transcend 4GB usb formatted as FAT16, worked fine.
neato
I saw an open box (not sure if it's a return or not) Agilent DSOX2002A at the Fry's in Phoenix. I think they wanted $1049 for it. I looked at the shipping date on the box, and (if memory serves me right) it was shipped to Fry's in October of 2012, so it's been on the shelf for at least 18 months. It's not listed on the website as available in the store, but I saw it there. Thinking about seeing if they will discount it to $999 since it's been there so long, and if it's a return, who knows if it has problems because I am pretty sure that Fry's is not competent at testing this kind of equipment other than powering it on and saying "it's works fine".
Out of curiosity, which Fry's did you manage to scoop your scope up at?
Smalldog
-
I am considering making a LAN board from my DSOX2x. Getting the PCB from itead would leave me with 4-9 spares, so I wondered if anyone else is interested in this? The way it would work, I think, is that I would make a board complete with magjack (since trying to find the same one as someone else designed around can be problematic) and sell it on at cost. Modifying the blank panel cover would be your problem, although I might be amenable do that as well.
-
I am considering making a LAN board from my DSOX2x.
Where are you located?
-
Where are you located?
I am in the UK.
-
How much do you think it could cost at the end? possible with the shipment (to brazil). If I could afford it I'm interested (I've just bought too much gears, so I'm little in trouble about money next 2 months... :) ).
-
At a rough guess, the PCB would be about £3-4, the magjack about £8, (nearly double those for $US) plus shipping.
-
Quote from: Sbampato12 on Today at 05:04:38 PM (https://www.eevblog.com/forum/index.php?topic=15764.msg444991#msg444991)
How much do you think it could cost at the end? possible with the shipment (to brazil). If I could afford it I'm interested (I've just bought too much gears, so I'm little in trouble about money next 2 months... :) ).
Try quoting in Agilent's website. You may find it's not that worth the trouble to import it. Yes, it is more expensive than buying in the US, but the difference is less than the shipping and import taxes that you will have to pay...
Brainfart... Somehow I though you were talking about a new oscilloscope...
-
Hi. I am interested in a board.
-
I thought I saw the magjack at coolcomponents.co.uk? I ordered one but never got the board sorted or tested the magjack itself. This magjack was from the board posted earlier in this forum. It was cheap as well.
-
This magjack was from the board posted earlier in this forum
Yes, I couldn't find that one and the pins looked non-standard. But I've since discovered that the part number on the pdf is incorrect (I think) with a 2 where a 1 should be. So now I've found it and it costs about £4.50 plus VAT.
That makes things a lot easier and I am about to send the gerbers for that board to itead (thanks very much georgd for doing those). But first, could someone with a pukka one confirm that it is 1.6mm PCB, or are we talking thinner stuff?
-
Okay great. I am definitely up for a board thanks.
-
At a rough guess, the PCB would be about £3-4, the magjack about £8, (nearly double those for $US) plus shipping.
Please put me on your list...
-
But first, could someone with a pukka one confirm that it is 1.6mm PCB, or are we talking thinner stuff?
Yes, the PCB must 1.6 mm thick.
-
Yes, the PCB must 1.6 mm thick
Cheers :)
-
It's a bit late to worry about this now because itead have the gerbers, but there seems to be a problem with the LEDs on this board:
Module is working with some restrictions described in my previous post, only LEDs no lit
It seems to me the problem is that the magjack has bi-colour LEDs (i.e. two in reverse parallel) but the layout assumes single ended LEDs (common return). I checked the magjack on the hi-res photo someone posted (thanks!) and that also has bi-colours, so I think the pinout on this board is incorrect for the LED connections.
Not sure how this can be resolved without access to a real unit. Maybe someone with one could trace the connections for us?
-
Well as long as the network connection works I do no really care about the leds.
-
Particularly since they're round the back and usually not visible :). But it is the principle of the thing and would be nice to get it right.
-
Module is working with some restrictions described in my previous post, only LEDs no lit
I must correct statement in my previous post, LED are working.
Green for link and Yellow to activity indicator.
Reason for not working is mistake in pin position.
Please study attached images.
Georg
-
Can you expand on that pin mistake, please? I haven't worked out what it is and what it should be.
-
If there is any spare board, I would like one, with the magjack, if possible. These kind of things are hard to come by in Brazil.
-
I'd be interested aswell (I'm in .nl).
-
Finally got my back-ordered DSOX3034A, downgraded to 2.35 and "upgraded" successfully. An 8GB sandisk cruzer blade USB stick worked fine as boot medium. I did notice this issue though:
I just tried out the LAN functions today and noticed some weird errors with the hacked USB method. If I boot from the hacked drive I get hit with errors like these on web page access:
Parse error in script
Microsoft VBScript runtime error: '800a01ad'
Description: ActiveX component can't create object: 'infiniiVisionWebCom.ScopeInfo'
In file: scopeInfo.asp
On line: 4
Other network functions are fine like telnet, VNC, java and HTML5 based (http://xxx/rfp.html (http://xxx/rfp.html)) remote panels. So it looks like only dynamically generated pages are bad.
Anyone know a fix for this? Putting the hack in internal flash perhaps?
EDIT in case anyone is looking for info, putting the hacked files into internal flash does fix the issue with the web interface. /EDIT
-
If there is any spare board, I would like one, with the magjack, if possible. These kind of things are hard to come by in Brazil.
I'm sure something can be arranged :)
Thanks for the expressions of interest, everyone. It will take a while for the boards to come through, but once I have them and have figured out the actual costs I will ask for confirmed requirements from those interested.
-
Many thanks for getting this sorted. Just let me know when and how you want payment.
-
Does anybody know what a "(d)" following the license names means?
I got my scope back from repairs and most licenses were marked like that, see attached screenshot.
-
Activated distributor licence with time limit?
But why not display (d) after MSO, did you purchased MSO licence?
-
What was repaired on your scope? Was there a power supply malfunction?
For the (d) mark I recommend you to contact your Agilent authorized distributor.
-
I notice a license beginning on the second line that reads DIS(2015-1-27). Could that be a DIStributor License that ends on January 27, 2015?
-
> But why not display (d) after MSO, did you purchased MSO licence?
I added the MSO license today after getting it back.
Also, most of the other d's disappeared after I added the DSOX3APPBNDL license (i.e. for those options that were included in the license). I had done that before the repair, but apparently I needed to load the license file again.
> What was repaired on your scope?
It wouldn't boot most of the time (screen stayed dark, LEDs cycled), so I got it repaired on warranty.
Seems to be OK now, and I got a nice cal certificate for the state after repairs.
> I notice a license beginning on the second line that reads DIS(2015-1-27). Could that be a DIStributor License that ends on January 27, 2015?
I suppose so.
I had the trial licenses activated, which expired during the repair.
-
It wouldn't boot most of the time (screen stayed dark, LEDs cycled), so I got it repaired on warranty.
So they did not tell you the exact reason? How old was that scope?
-
> So they did not tell you the exact reason?
No, they didn't.
> How old was that scope?
Brand new.
-
It must have been a production failure. It happens. It would be worse, if the fault appeared three years and one month after purchase.
-
Just received my msox2024a via agilent's ebay certiprime store. Fantastic scope and of course even more fantastic with the license stuff from this thread (thanks much to the major contributors!).
Now, I'm look at the dsoxlan diy projects and I am going to run some protoboards soon, so figure I may as well roll my own lan adapter board.
My #1 question though is the center tap voltage requirement on the phy side. Looking at pictures/video of the real dsoxlan board I can see what appears to be a 11 ohm resistor (marked 110 on the video) and capacitor joined together to the 2 joined center taps of the amp magjack. This would imply the other end of the cap (likely a 0.01uf) is going to ground and the other end of the 11 ohm resistor is going to VCC (3.3V or ??).
The georgd board appears to have the center taps of his magjack going through a 1uf cap and then to GND on the edge connector?
So, if someone has a real dsoxlan board, what is the other end of the 11 ohm resistor connected to? GND (seems unlikely) or one of the edge pins or one of the regulators on the board?
cheers,
george.
-
hey
this is chenyi from china
My English is very poor,so I used Google to translate Chinese into English? I hope it does not affect your understanding.
I met a serious problem:
I am trying to update my oscilloscope's firmware(DSOX2012A) tonight,and i ignored the warning following behind:
//CAUTION: When upgrading your oscilloscope, download the .cab file, and load the complete file into the oscilloscope. Please do not “unpack” or “unzip” the .cab upgrade file; you could potentially only load a portion of the required files in the package. This could result in your oscilloscope becoming non-operational, requiring it to be sent to an Agilent service center to be repaired.//
i unziped the file,then the oscilloscope sure enough becoming non-operational. so i was wondering if there's anyone konws how to fix it. thank you for your Reply
-
Well, what exactly happens when you turn on your scope?
Did you try this?
1) Save the *.cab file on the USB flash disc.
2) Insert the USB flash disc into scope's USB port.
3) Turn on the scope.
4) The scope might boot up from the USB flash disc.
Please note that I do not know if this works. You are doing everything at your own risk!
-
Just received my msox2024a via agilent's ebay certiprime store. Fantastic scope and of course even more fantastic with the license stuff from this thread (thanks much to the major contributors!).
Now, I'm look at the dsoxlan diy projects and I am going to run some protoboards soon, so figure I may as well roll my own lan adapter board.
My #1 question though is the center tap voltage requirement on the phy side. Looking at pictures/video of the real dsoxlan board I can see what appears to be a 11 ohm resistor (marked 110 on the video) and capacitor joined together to the 2 joined center taps of the amp magjack. This would imply the other end of the cap (likely a 0.01uf) is going to ground and the other end of the 11 ohm resistor is going to VCC (3.3V or ??).
The georgd board appears to have the center taps of his magjack going through a 1uf cap and then to GND on the edge connector?
So, if someone has a real dsoxlan board, what is the other end of the 11 ohm resistor connected to? GND (seems unlikely) or one of the edge pins or one of the regulators on the board?
cheers,
george.
Anybody??
cheers,
george.
-
Sort of surprising considering how many very intelligent people buy and use this kind of tool.
I just assumed most of the people/companies who could readily afford that type of tool don't really need to be hacking options.
Yes, the vast majority have no need nor desire to hack their scope, nor would most even think to look for one. Agilent know that and rely on that. If a hack did eventually happen, I doubt they would bat much of an eyelid.
Sigh! Nothing like an "Electronic Rubik's Cube"! The sheer challenge of UN-doing the Done-up!.. :-DD
-
Does anybody know what a "(d)" following the license names means?
I got my scope back from repairs and most licenses were marked like that, see attached screenshot.
Unless numbers work in a completely different way in Germany; you have a higher firmware version than what is available on their site for us to upgrade to.
-
Well, what exactly happens when you turn on your scope?
Did you try this?
1) Save the *.cab file on the USB flash disc.
2) Insert the USB flash disc into scope's USB port.
3) Turn on the scope.
4) The scope might boot up from the USB flash disc.
Please note that I do not know if this works. You are doing everything at your own risk!
thanks for your relay,i've tried the method you told me?i failed . i posted the scope out to reload the firmware.Thanks again for your courtesy.
-
Unless numbers work in a completely different way in Germany; you have a higher firmware version than what is available on their site for us to upgrade to.
Yes, new scopes come with 2.36 which is not (yet?) available for download.
That has been discussed on this thread already.
Jürgen
-
It will take a while for the boards to come through, but once I have them and have figured out the actual costs...
The boards have turned up, and I've built one to verify that it works. It does :)
The pix show the bare board (no silkscreen or solder mask - it is really bare, not just figuratively) and the built one. The built one has a PTH cap because I didn't have a SMT one big enough. Built boards will go out with the right thing.
I can ship these for the following prices (which basically cover my costs). Note that the built units attract VAT since I have to buy the magjacks on a company account.
| Item | | Cost |
| Bare PCB to UK address | | £2.50 |
| Built PCB to UK address | | £9.60 |
| Bare PCB to US address | | £4 |
| Built PCB to US address | | £13.50 |
All prices use untracked shipping, and the US ones will take about 10 days. However, there is a possibility I've screwed up so I will ask for the actual cost once I've sent the items. If you're not in the US or UK I will quote you separately.
I have 9 of these PCBs to go, and my preference is to ship bare PCBs. If you want a built one it will take a little while to ship - I need to order the parts and build them first, and I am a bit busy at the moment, so they won't go out overnight.
PM me with your address and whether you want built or raw, and I'll take it from there.
-
Anybody??
Zucca!
Here just to start:
(http://s2.postimg.org/49xg7cv21/IMG_1375.jpg)
(http://s2.postimg.org/puxxh82ex/IMG_1376.jpg)
if we call
(http://s2.postimg.org/5l0m231a1/IMG_1375_crop.jpg)
and
(http://s2.postimg.org/3uhl0ljqx/IMG_1377.jpg)
Here is when I get continuity:
A with 0,3,4,7,10,14,16,17
B with 1,2
Good luck!
PS: My multimeter shows 10R , not 11...
-
Zucca, thanks!
I received boards back from the pcb house a few days ago, a panel that includes a lan board. I've trimmed it to fit/push into the edge connector, nice snug fit and all the pads line up perfectly. I need to order a magjack - next digikey order - this week.
Edit: Ok, just plugged the board into my dsox and measured power on Pin 1/2 per your annotated pictures and there is 3.3V on those 2 pins. So, that means the terminator power feed in the magjack have a cap to ground (likely 0.01uF) and a series resistor fed from 3.3V which makes perfect sense.
Now I know how to wire the magjack termination. The PCB layout I did has a variety of options including its own terminator regulator (just in case) since I sent it out to fab before anyone (thanks again Zucca) responded to my request.
I've got to figure out the LED polarity on the magjack still. If you have time or get a chance, could you ohm out the LED connections (on the magjack) all the way to the edge connector? TIA.
cheers,
george.
-
For the LED, If this
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg445541/#msg445541 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg445541/#msg445541)
was not helpful, surely I will. Datasheet?
-
For the LED, If this
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg445541/#msg445541 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg445541/#msg445541)
was not helpful, surely I will. Datasheet?
I've seen that post (I've read all this thread a few times). What wasn't clear was WHICH end of the LED (anode or cathode) was wired to the edge connector. The pictures don't show the internal traces (of course) so I can't tell the anode/cathode connection.
cheers,
george.
-
Unbeliveable...
Like at work, also in my spare time I have to cover the holes left by someone else. "Do it right or not do it", that´s should be the first teaching to our children.
I´m not irritated at all, just surprised :o.
Here the Datasheet:
http://www.trpconnector.com/pdfs/6605758.pdf (http://www.trpconnector.com/pdfs/6605758.pdf)
Now it looks like the 5-6605758-2 has already the 250R for the LED inside.
Here we go (see datasheet for the Dx pins):
D1 and D3 to pin 1/2 (3.3V, see posts above).
D2 and D4 see below:
(http://s22.postimg.org/hi43ax4oh/IMG_1376_crop.jpg)
Moreover IMO there are some filtering caps between D1,D3 and ground.
-
Thanks Zucca, that clears things up nicely. I'll put it into a schematic in the next few days and post it up. At least it will then be clear and in one place how the magjack is wired.
Yes, the -2 has the 250 ohm resistors inside. My PCB had work either way, since digikey appears to stock some flavours of the 5-6605758 but not all of them.
cheers,
george.
-
So, I have my LAN board working nicely thanks to Zucca's clarifications of some of the signals. I'll post up a schematic in the next day or three, but here's some pics.
First pic is my lan board (most of the resistor options etc are to cover any cathode/anode polarity issues with the LEDs - before Zucca provided the additional details, and if a regulator would be needed for the termination network in the magjack). This is a picture prior to cutting out a slot in the edge connector and trimming the excess board material. This PCB was on a 'panel', so it was cut from a large rectangular panel of various other test boards etc.
After trimming it was a perfect fit into the edge connector in my dsox scope.
(http://www.taskled.com/leds/aglanpcb.jpg)
I carefully measured the length of the board so that it would fit snugly into the pocket with the plan to cut a hole for the magjack to stick out. By choosing the length 'just right' the original plastic clip/panel snaps nicely into place and supports the magjack end of the board and prevents it moving in any direction. Worked out nearly factory :)
(http://www.taskled.com/leds/aglan.jpg)
LEDs work, board works and I can access it via the webpage for full control. I used telnet to update the 2 required files that open up the licenses inside the scope. This halves the boot time (compared to the USB drive) but more importantly allows the webpage access to work. As someone else in this thread found, if you boot from a USB drive the webpage stuff doesn't work and reports an error.
Of course (as per the other DIY lan boards), the scope doesn't recognise it, so it doesn't appear in the utility->I/O menu, but all the configuration stuff can be done via the webpage server. In my case I put it at a static IP (starts off working since it gets an IP from a DHCP service on the network.
cheers,
george.
-
< snip >
...This halves the boot time (compared to the USB drive) but more importantly allows the webpage access to work. As someone else in this thread found, if you boot from a USB drive the webpage stuff doesn't work and reports an error.
cheers,
george.
Thank you georges80 for mentioning this information about the webpage! I encountered the webpage errors two days ago and the situation was just as described earlier in this thread, and it was inconvenient because I could not grab screenshots quickly to the PC. It's good to know that editing the files on the local system will let the web browser access work as needed. I have to do this update soon!
-
Hi all
I built a board up kindly provided by dunkemhigh. It seems to get an IP address, I can ping it but when I try to load the webpage it just reboots instantly. Is this a known issue when booting from a usb stick?
Thanks
Trev
-
When running from a USB drive and I try to access the webpage interface I do NOT get a reboot. What I get is an error message from the browser (firefox, IE etc, doesn't matter, same error message).
The solution (maybe there are others) is to transfer the license patches INTO the scope, i.e. the two files (as per mwilson's posts) get written to the scope and then boot from the scope. Does you lan card work ok (accesses the webpage correctly) if you boot from the scope (remove the USB drive)?
Another test to make sure your lan card is working is to telnet to the scope (login/password have been posted earlier in this thread -> infiniivision/skywalker1977 if I remember correctly). Telnet works just fine even if you have booted from a USB drive.
cheers,
george.
-
So, I made my own LAN card and of course it isn't recognised/displayed in the I/O settings like all the other DIY lan cards. I remember seeing a comment by Plesa about pin 78 appearing maybe like a 'detect' pin. Looking at the pictures Zucca posted, there's a 0 ohm resistor and from his measurements it make pin 78 ground potential.
Plesa mentioned he had issues when he connected pin 78/80 (he used kapton on other pins of his vga/lan card). Anyhow, I figured I'd try to connect pin 78 to pin 80 on my DIY lan board. I get no errors (that he reported), BUT I now have the dsox2000 recognising that there is a LAN card plugged in. Menu now has all the Lan Configuration menu stuff active. The IP address (static in my case) is being populated correctly as per my router setup as soon as I plugged in the lan cable.
I'll post up more details in a bit - just got this working and now need to play with it a little :)
cheers,
george.
-
Well done bro! I knew there was potential in you... I'm glad I was a part of this project. The next step would be setting up a HDMI interface there... but it is not as important as a LAN! Well... Who cares now about a external monitor interface...
-
Zucca, thanks for the pics and your connection info, definitely was what I needed to get my lan board running.
Here's the 'patch' to make the dsox recognise the lan card:
(http://www.taskled.com/leds/lan_rec.jpg)
and this is proof :)
(http://www.taskled.com/leds/lan_recs.jpg)
cheers,
george.
-
I am so happy that LAN adapter is fully functional!
Even most wanted feature for me: SCPI over port 5024.
Here is screenshoots taken by VNC.
Many thanks for all contributors in this project.
Georg
-
Here's the 'patch' to make the dsox recognise the lan card:
Blinding work, that man :-+
-
The mod georges80 made to the existing rear panel plug is what I had in mind, but when it came to putting knife to plastic I had a change of heart - it is rather final if one should screw up.
So, instead, I milled a but of PCB to the right size and affixed that to the LAN PCB with a couple of right-angle brackets. If I'd though to do this before sending off the gerbers I would have included the holes in the PCB, but they came out not too badly free-hand.
I used PCB pillars as extensions to have something to grip to pull the card out. They also make it easier to align the card when fitting it, but it now occurs to me that a flat blade could be inserted into the top and bottom cutout (where the clips on the real thing latch), so ejecting it isn't the problem I thought it might be. So at some point I'll remove the pillars and have the screw heads sitting flush.
So, not as pretty as either of the other DIY mods, but it's a bit easier and not fatal if you get it wrong.
-
I ordered a 3D Printer... can´t wait to start to play with and fix all those above described problems about enclosures. I´m quite surprised nobody is already came up with a sketchup .stl file.
-
surprised nobody is already came up with a sketchup .stl file
Don't know about anyone else, but I haven't because I have no experience of designing enclosures for 3D printing. I want to get this done reasonably quickly and then move on to using the scope, rather than spend the next 6 months learning how not to spend as much as the scope cost on making a plastic box to fit in it. But feel free to show us how it's done, optionally offering to sell us said boxes :-+
-
I am in need of some help for booting from a USB Stick on my DSO-X 2002A, that I just bought used.
It came with Firmware 2.35 is installed.
Options:
- EDK, Wavegen is permanently activated
- LAN/VGA Module is installed.
After reading this thread, I followed the instructions.
First the scope did not want to boot from a USB stick, but after formatting the stick with FAT16 it is booting ok.
After the bootup I am getting the message "All Options enabled"
But when I look in the "About Oscilloscope" window, the options are not installed
Instead I see: BW20, VID, CABLE, SCPIPS
The first picture below is normal bootup
the following three pictures are from the USB bootup.
Can someone explain to me, what I might have done wrong.
In addition to the bootup from the USB stick, do I need to do anything else?
Thanks for any advise
-
Another dunkemhigh LAN board soldered up and installed :-) It gets recognized by the scope (georges80 hack by shortening the two pins), but during boot it does give an error 'System concers detected -LAN/VGA option module fault'. I guess this is because there's no VGA things happening on the board. Do yours also show the error after booting?
-
No LAN/VGA errors/warning when I boot my scope up. The only 'warning' is the license hack. I have installed the license hack into my scope - rather than booting from a USB flash drive (not sure if that makes any difference). Try booting yours without the USB flash drive (if that's how you are booting)... just as a test.
cheers,
george.
-
My scope is not hacked :-) No usb drives here.
-
Hmm - well, I get no lan/vga errors/concerns/warnings. Maybe check that the card is inserted well and there's no shorts or issues with the edge connector/card mating.
cheers,
george.
-
I just applied the pin 78/80 mod to my PCB, and additionally copied the dll to internal flash so I don't need the USB stick. On boot I still get the message "Booting from USB" although it boots without a USB stick! No LAN/VGA error message, and dropping into the I/O menus I can see and set the LAN parameters fine.
I feel a bit guilty that mine works but two I sent to other people don't. Maybe another recipient could pop up and say if theirs works...
-
weird.. double checked my soldering and measured all the values. All values OK and no shorts. Reseated the board, but still the 'concern' remains.. hmmm..
Pulling out the multimeter, I do measure some strange values at the magjack.. when looking at the card from the bottom, with the magjack to the left, I measure the following on the row of 6 pins :
highest pin (closest to capacitor, let's call it pin 1) to pin 2 = 0.4 ohms.
pin 1 to pin 3 also 0.4 ohms!
pin 1 to pin 4 also 0.4 ohms!
pin 1 to pin 5 also 0.4 ohms,
pin 1 to pin 6 0.1 ohms.
but i didnt make any shorts on the bottom side while soldering.. maybe the casing of the magjack is shorting the traces together on the upper side of the board? There's no solder mask here.. No.. between pins and magjack = OL.
-
I measure:
1 - 2 = 6R
1 - 3 = 5R8
2 - 3 = 6R7
1,2,3 - 4,5,6 = 0R
6 - 5 = 6R
6 - 4 = 5R8
5 - 4 = 6R7
This is a standalone magjack (same order as the one you have). Yours is shorting somehow - if there is nothing external doing it it has to be a bum magjack. If you can confirm that I'll send you this spare.
-
Will desolder The magjack andere check it next monday!
-
No LAN/VGA errors/warning when I boot my scope up. The only 'warning' is the license hack. I have installed the license hack into my scope - rather than booting from a USB flash drive (not sure if that makes any difference). Try booting yours without the USB flash drive (if that's how you are booting)... just as a test.
cheers,
george.
I thought when you installed the hack directly to the scope it didnt give the warning and booted as normal?
-
I get the same values when I measure my board. Magjack code is : RJMG163218101NR
weird.. double checked my soldering and measured all the values. All values OK and no shorts. Reseated the board, but still the 'concern' remains.. hmmm..
Pulling out the multimeter, I do measure some strange values at the magjack.. when looking at the card from the bottom, with the magjack to the left, I measure the following on the row of 6 pins :
highest pin (closest to capacitor, let's call it pin 1) to pin 2 = 0.4 ohms.
pin 1 to pin 3 also 0.4 ohms!
pin 1 to pin 4 also 0.4 ohms!
pin 1 to pin 5 also 0.4 ohms,
pin 1 to pin 6 0.1 ohms.
but i didnt make any shorts on the bottom side while soldering.. maybe the casing of the magjack is shorting the traces together on the upper side of the board? There's no solder mask here.. No.. between pins and magjack = OL.
-
pins 1 and 6 are shorted on the PCB, so the 0R1 is expected there. 1 and 6 are also the center tap of the two channel magnetics, so you will see some connection between all pins when it's mounted on the PCB. But 0R4 is rather low.
The datasheet for the magjack is here:
http://www.farnell.com/datasheets/71713.pdf (http://www.farnell.com/datasheets/71713.pdf)
-
No LAN/VGA errors/warning when I boot my scope up. The only 'warning' is the license hack. I have installed the license hack into my scope - rather than booting from a USB flash drive (not sure if that makes any difference). Try booting yours without the USB flash drive (if that's how you are booting)... just as a test.
cheers,
george.
I thought when you installed the hack directly to the scope it didnt give the warning and booted as normal?
No, the hack will give a warning error regardless of USB boot or internal flash boot. Basically the scope likely must checksum/crc or somehow sign the files to determine if something has been 'altered/damaged/changed'.
cheers,
george.
-
pins 1 and 6 are shorted on the PCB, so the 0R1 is expected there. 1 and 6 are also the center tap of the two channel magnetics, so you will see some connection between all pins when it's mounted on the PCB. But 0R4 is rather low.
The datasheet for the magjack is here:
http://www.farnell.com/datasheets/71713.pdf (http://www.farnell.com/datasheets/71713.pdf)
The magjack magnetics on the phy side are just transformers and I'd expect very low DC resistance. I tested a 1gig magnetics that I have on one of my boards and they basically read near zero ohms (the lead resistance of my fluke 87III has more resistance).
Also, I've noticed on the original DIY design that the center tap of the transformer (on the phy side) is going to a capacitor and then ground.
From measurements by Zucca the agilent unit has 3.3V tied to the center tap pins (via a 10 ohm resistor and a cap, likely 0.1uf, to ground). i.e. the center tap is powered to 3.3V. This is common with the magnetics (some use 0V) - all depends on the actual phy in use. In this case 3.3V to the center taps is the 'correct' voltage. Not sure if that has any bearing in this case since your unit works from your reports.
cheers,
george
Edit: Fix stupid typo - grrr...
-
I've received the pcb from dunkemhigh (thank a lot!), but I haven't got the MagJack yet.
But I already did the jumper on 78-80 pins, and connected it to scope, and got a LAN options avaliable. :-+ :-+
Only waiting the magjack...
-
Another dunkemhigh LAN board soldered up and installed... but during boot it does give an error 'System concers detected -LAN/VGA option module fault'.
I also received two of the dunkemhigh boards and I am getting the same error on boot 'System concerns detected - LAN/VGA option module fault'. I installed the recommended magjack, pair of 220R and single 1uf components on both boards, but I get the same error on each. Anyone figure this out yet? Any suggestions?
-
As per my post #563 I don't believe the cap to ground on the center tap of the magnetics is correct. The original LAN/VGA board has 3.3V going through a 10 ohm resistor to the center taps. Also a cap to ground on the center tap side (just a bit of filtering). The key though is that the center tap is at 3.3V potential.
I'd give that a try and see if it helps. Presumably the scope is doing some checks via the Phy during boot up and sensing something isn't quite right. Given NOTHING is wired to any other pins the detected problem seems more than likely just a LAN issue.
My board (I layed out my own 'version') reports no lan/vga erros and works perfectly. I used the same magjack as the agilent lan/vga board and used the 10 ohm/0.1uf cap to get 3.3V to the two center taps.
cheers,
george.
-
Thanks George. I had read your posts, but was under the impression that others had the dunkemhigh board working fine with just the two 220R and a 1uf. It seems that way from other reports about the board anyway.
I'm not sure how to assure that the jack has 3.3 volts to the center tap without actually measuring voltages on the jack while the board is installed and running. And I'm worried about leaving it installed and running in my expensive scope given the error, and then probing around on top of that with power to the scope and board. I'm hoping someone else who has this board can give a more definitive answer about the correct component values, and if another component should be added or not. Alternatively, if someone knows what voltages should be applied to what edge connector pins on the card, I could then check the center taps with the card uninstalled and powered by my bench power supply.
I appreciate your help and comments, but I'm a bit apprehensive, especially remembering that Dave burnt his scope up once on a bad LAN card and had to return it to Agilent to be repaired.
-
The 3.3V comes from the edge connect. Go back a few pages in this thread and you'll find the pinout that Zucca posted and voltages he measured.
I soldered a few flying leads to various points on my board and plugged it in to measured and verify the 3.3V pin on the edge connector and it was correct as per Zucca's post.
Seems like quite a few folk have had similar problems to yours - so that's why I'm wondering if the incorrect center tap voltage is the issue.
I'm pretty sure (could be wrong...) that the dunkemhigh board has the center tap pins tied together and ONLY to a cap that is grounded on the other end - i.e. there is no DC bias being injected into the center tap.
cheers,
george.
-
I wonder if the board works for me due to the cap I used, which is visible in the photo here: previous EEVblog post (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg457798/#msg457798). Doesn't seem likely, but maybe I should try and break it...
-
Weird, I haven't got it work yet, wonder why dunkemhigh's board is working. Maybe I should send mine to dunkemhigh to compare in his scope?
-
Maybe I should send mine to dunkemhigh to compare in his scope?
If you wanted to do that, I'd be happy to try it.
-
OK, I'll send it to you :-)
-
OK, I'll send it to you :-)
Great, I guess I will wait to see what dunkemhigh finds out first.
-
The 3.3V comes from the edge connect. Go back a few pages in this thread and you'll find the pinout that Zucca posted and voltages he measured...
I'm pretty sure (could be wrong...) that the dunkemhigh board has the center tap pins tied together and ONLY to a cap that is grounded on the other end - i.e. there is no DC bias being injected into the center tap.
Thanks, I see those posts and will try and check it out when I get a chance.
It seems several of us are having the same issue with the board. Hopefully WVL_KsZeN can get his board back to dunkemhigh quickly and the problem found.
-
So far, I've found how to set up version 2.35 on a USB drive - but not 2.37 which is the only version Agilent provides anymore. I'd like to try the mods described earlier on my 02.35.201... version DSO 3014A but they don't work with the 2.37 image (I'm sure the infiniiVisionCore.dll locations to change have moved, among other things).
Does anyone have ideas on how to either modify the 2.37 image to enable options -or- where I might find a copy of the 2.35 version?
Many thanks to all -
-
Oh wow, so theres a 2.37 now? When did that come out? Last I had heard of was 2.36. And I have to say, you guys that have been working on the LAN card have been doing an awesome job, but seriously, all that work has made me very glad I just bought the VGA/LAN card when I did and jumped on it when I was able to get a good deal! Keep it up though as Im sure it will help lots of people out there!
-
Here the 2.37
http://www.home.agilent.com/agilent/software.jspx?ckey=2014548&lc=eng&cc=US&nid=-33573.970736&id=2014548 (http://www.home.agilent.com/agilent/software.jspx?ckey=2014548&lc=eng&cc=US&nid=-33573.970736&id=2014548)
Released on the 21st May 2014
-
If someone needs the old 2.35 please send me a pm.
I have uploaded the cab file on my webspace.
-
Oh wow, so theres a 2.37 now? When did that come out? Last I had heard of was 2.36....
Some info for all: firmware v2.36 was never available for download from Agilent; it only ever came pre-installed on new units or refurbs. The previously downloadable version was v2.35.
I've attached the release notes for v2.37 --- there are a few enhancements, especially for power application measurements.
Previous attempts by members in the forum, myself included, were unsuccessful to get v2.36 working with the USB boot for patching options; other than USB boot not working, it appeared changes in "ProcessStartupFolder.exe" were involved, but this file could not be read from flash. Anyone want to look at v2.37. I will post back some findings after I look at the new firmware.
-
For those interested, I have uploaded (http://wikisend.com/download/321628/infiniiVision.rar) the "infiniiVisionCore.dll" from firmware releases 2.35, 2.36 and 2.37. The file is ~50kB larger in 2.37 than the previous two versions (which are the same size, but different).
Since 2.36 did not allow USB boot it would be surprising if 2.37 allowed it again... I have not tested installing 2.37 and seeing if a downgrade to 2.35 is possible...
From previous investigation, it seems \Windows\ProcessStartupFolder.exe in 2.36 may have been modified to prevent booting from USB drive. I made a lot of attempts to copy ProcessStartupFolder.exe from internal flash when I had 2.36 installed, but it was not possible.
Is there any way to obtain this file from the 2.37 CAB? I could not find it in infiniiVisionSetup.cab, so perhaps it is in another file (NK.BIN.COMP?)
-
After getting a request from someone here what I did:
1) Upgrade from 2.35 to 2.37: OK!
2) Test SCPI on port 5024 with FW 2.37 (require LAN Module): OK!
Welcome to Agilent MSOX3054A InfiniiVision - MY5113XXXX
>>*idn?
AGILENT TECHNOLOGIES,MSO-X 3054A,MY5113XXXX,02.37.2014052001
3) downgrade from 2.37 to 2.35: FAILED!
See screenshot below, forgive me for the focus
(http://s18.postimg.org/ihfa8xhq1/Downgrade_failed.jpg)
-
3) downgrade from 2.37 to 2.35: FAILED!
Erk! That's a bit of a one-way trip. We should all be grateful you've tested that, at the expense of not being able to muck about with your kit now :(
-
3) downgrade from 2.37 to 2.35: FAILED!
Erk! That's a bit of a one-way trip. We should all be grateful you've tested that, at the expense of not being able to muck about with your kit now :(
Smart done from Agilent :-DD :-DD :-DD
-
Once original Agilent Option Licenses are installed in a scope, there is no need to reinstall them each time the firmware is updated. The new firmware keeps all your existing licenses intact. With this being the case, I’m curious… Has anyone loaded the hacked 2.35 firmware internally to their scope (not just booted from USB), then updated to the 2.37 firmware. If so, were any or all the upgraded options kept, as they would be in a scope with original Agilent licenses?
If so, this would be a good scenario for anyone with 2.35 or lower, as the options could be loaded and then the scope updated as future firmware and features are released. It would not be good for newer scopes already loaded with firmware later than 2.35.
-
were any or all the upgraded options kept, as they would be in a scope with original Agilent licenses?
In my case I paid $$$ for the options and I did not hack the scope. Of course I was not worried at all to test the upgrade to 2.37, since I was sure the options were still there no matter what.
Good Luck for all your hacked scopes, in my experience it is just a matter of time so be patience, don´t give up with the reverse engineering and don´t lose hope.
-
I’m curious… Has anyone loaded the hacked 2.35 firmware internally to their scope (not just booted from USB), then updated to the 2.37 firmware. If so, were any or all the upgraded options kept, as they would be in a scope with original Agilent licenses?
Because the hack isn't really "installing" licenses, it's modifying the actual oscilloscope software to make it think certain licenses are enabled, the firmware upgrade will replace that oscilloscope software with a non-modified version, so the scope will no longer think the licenses are enabled. (For example, I did install the modified 2.35 to the internal memory but whenever I wanted to undo it to try a different method or experiment I simply re-installed the 2.35 firmware from Agilent and all the hacked license features were gone.)
-
Because the hack isn't really "installing" licenses, it's modifying the actual oscilloscope software to make it think certain licenses are enabled, the firmware upgrade will replace that oscilloscope software with a non-modified version, so the scope will no longer think the licenses are enabled...
OK, that make sense. I guess keeping 2.35 installed is a good idea, at least until something is able to be done with 2.37 (or later). Don't see any compelling reason to go to 2.37 anyway.
-
How to hack the firmware
1. Unpack the firmware *.cab by 7zip
2. Unpack infiniiVisionSetup.cab ( e.g. with WinCE CAB Manager 3.0)
Find \Secure\infiniiVision\infiniiVisionCore.dll
3. Change at location 0x277e50 in infiniiVisionCore.dll
byte sequence 04 00 a0 e1 to byte sequence 00 00 a0 e3
4. Enable startup Overide by creating USB flash with following structure in root of USB drive (copy structure from Secure folder from point 2)
Edit in Startup folder file infiniivision.lnk to contains following sequence "62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"
Replace in infiniiVision folder infiniiVisionCore.dll with patched infiniiVisionCore.dll file
5. Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
6. Plug the USB drive to scope and turn it ON
7. There will be red message in letf top corner "Unfinalized Software" and "System Concerns detected: OS version is not correct. Please reload system firmware"
Applications needed:
WinCE CAB Manager http://www.ocpsoftware.com/products.php (http://www.ocpsoftware.com/products.php)
7Zip http://www.7-zip.org/ (http://www.7-zip.org/)
These steps can be used in the 2.37 firmware?
-
How to hack the firmware
1. Unpack the firmware *.cab by 7zip
2. Unpack infiniiVisionSetup.cab ( e.g. with WinCE CAB Manager 3.0)
Find \Secure\infiniiVision\infiniiVisionCore.dll
3. Change at location 0x277e50 in infiniiVisionCore.dll
byte sequence 04 00 a0 e1 to byte sequence 00 00 a0 e3
4. Enable startup Overide by creating USB flash with following structure in root of USB drive (copy structure from Secure folder from point 2)
Edit in Startup folder file infiniivision.lnk to contains following sequence "62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"
Replace in infiniiVision folder infiniiVisionCore.dll with patched infiniiVisionCore.dll file
5. Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
6. Plug the USB drive to scope and turn it ON
7. There will be red message in letf top corner "Unfinalized Software" and "System Concerns detected: OS version is not correct. Please reload system firmware"
Applications needed:
WinCE CAB Manager http://www.ocpsoftware.com/products.php (http://www.ocpsoftware.com/products.php)
7Zip http://www.7-zip.org/ (http://www.7-zip.org/)
These steps can be used in the 2.37 firmware?
No.
-
These steps can be used in the 2.37 firmware?
No. The structure and length of the new firmware cab is different.
-
How to hack the firmware
1. Unpack the firmware *.cab by 7zip
2. Unpack infiniiVisionSetup.cab ( e.g. with WinCE CAB Manager 3.0)
Find \Secure\infiniiVision\infiniiVisionCore.dll
3. Change at location 0x277e50 in infiniiVisionCore.dll
byte sequence 04 00 a0 e1 to byte sequence 00 00 a0 e3
4. Enable startup Overide by creating USB flash with following structure in root of USB drive (copy structure from Secure folder from point 2)
Edit in Startup folder file infiniivision.lnk to contains following sequence "62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"
Replace in infiniiVision folder infiniiVisionCore.dll with patched infiniiVisionCore.dll file
5. Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
6. Plug the USB drive to scope and turn it ON
7. There will be red message in letf top corner "Unfinalized Software" and "System Concerns detected: OS version is not correct. Please reload system firmware"
Applications needed:
WinCE CAB Manager http://www.ocpsoftware.com/products.php (http://www.ocpsoftware.com/products.php)
7Zip http://www.7-zip.org/ (http://www.7-zip.org/)
These steps can be used in the 2.37 firmware?
No.
My firmware is 2.37 I can drop to 2.35?
-
These steps can be used in the 2.37 firmware?
No. The structure and length of the new firmware cab is different.
My firmware is 2.37 I can drop to 2.35 firmware?
-
My firmware is 2.37 I can drop to 2.35 firmware?
You should go back and read the last couple of pages...
After getting a request from someone here what I did:
1) Upgrade from 2.35 to 2.37: OK!
2) Test SCPI on port 5024 with FW 2.37 (require LAN Module): OK!
3) downgrade from 2.37 to 2.35: FAILED!
-
A quick analysis of 2.37 shows that Startup Override functionality is disabled in ProcessStartupFolder.exe: it still looks for infiniivisionStartupOverride.txt file, but instead of executing lnk/exe files it runs "ipconfig.exe /all > ipconfig.txt" (what is it? a "tampered" mark?), then "rebootInfiniiVision.exe", which surprisingly results in reboot >:D 2.36 has the same problem I guess.
We should focus on downgrade I think.
-
So i did some tests with the "Unfinalized Software" Hack on the 2.37 Firmware.
On my Scope is currently the version 2.35 with the most options enabled by DSOAPP Bundle except the MSO Function.
I extracted the cab file of the 2.37 with this tool MSCEInf - CAB Analyzer (No Setup needed and free)
And searched for the same code location and it has moved to 0x27A9A0, changed the 4 byte to 00 00 A0 E3 and put the whole Infiniivision folder to the usb stick.
The Scope boots the 2.37 and the additional features are enabled. (see Screenshots)
A quick analysis of 2.37 shows that Startup Override functionality is disabled in ProcessStartupFolder.exe: it still looks for infiniivisionStartupOverride.txt file, but instead of executing lnk/exe files it runs "ipconfig.exe /all > ipconfig.txt" (what is it? a "tampered" mark?), then "rebootInfiniiVision.exe", which surprisingly results in reboot >:D 2.36 has the same problem I guess.
We should focus on downgrade I think.
:wtf: Nice find!
Maybe it's posible the change the exe with an older one that supports usb booting
-
My firmware is 2.37 I can drop to 2.35 firmware?
You should go back and read the last couple of pages...
After getting a request from someone here what I did:
1) Upgrade from 2.35 to 2.37: OK!
2) Test SCPI on port 5024 with FW 2.37 (require LAN Module): OK!
3) downgrade from 2.37 to 2.35: FAILED!
Thank you for your reply, post too long, not scrutiny. Sorry.
-
So i did some tests with the "Unfinalized Software" Hack on the 2.37 Firmware.
On my Scope is currently the version 2.35 with the most options enabled by DSOAPP Bundle except the MSO Function.
I extracted the cab file of the 2.37 with this tool MSCEInf - CAB Analyzer (No Setup needed and free)
And searched for the same code location and it has moved to 0x27A9A0, changed the 4 byte to 00 00 A0 E3 and put the whole Infiniivision folder to the usb stick.
The Scope boots the 2.37 and the additional features are enabled. (see Screenshots)
A quick analysis of 2.37 shows that Startup Override functionality is disabled in ProcessStartupFolder.exe: it still looks for infiniivisionStartupOverride.txt file, but instead of executing lnk/exe files it runs "ipconfig.exe /all > ipconfig.txt" (what is it? a "tampered" mark?), then "rebootInfiniiVision.exe", which surprisingly results in reboot >:D 2.36 has the same problem I guess.
We should focus on downgrade I think.
:wtf: Nice find!
Maybe it's posible the change the exe with an older one that supports usb booting
You cracked the 2.37 firmware?
1.I use 4G USB format it FAT16
2.Change at location 0x27A9A0 in infiniiVisionCore.dll byte sequence 04 00 a0 e1 to byte sequence 00 00 a0 e3
3 Edit in Startup folder file infiniivision.lnk to contains following sequence "62#usbinfiniiVisioninfiniivisionLauncher.exe -l All -l SCPIPS"
4.Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
5.5.Plug the USB drive to scope and turn it ON
But I can not hack it , The LED lamp has been circulating blinking, screen also continue to restart.
who can send me the USB file zip. my E-mail: yocheng@163.com Thank you very much!
-
Thank you for your reply, post too long, not scrutiny. Sorry.
You never know what you might be missing by not reading...
-
So i did some tests with the "Unfinalized Software" Hack on the 2.37 Firmware.
...
The Scope boots the 2.37 and the additional features are enabled. (see Screenshots)
Nice work!
-
A quick analysis of 2.37 shows that Startup Override functionality is disabled in ProcessStartupFolder.exe: it still looks for infiniivisionStartupOverride.txt file, but instead of executing lnk/exe files it runs "ipconfig.exe /all > ipconfig.txt" (what is it? a "tampered" mark?), then "rebootInfiniiVision.exe", which surprisingly results in reboot >:D 2.36 has the same problem I guess.
We should focus on downgrade I think.
@abyrvalg: How did you located the file ProcessStartupFolder.exe in the 2.37 download? I looked but could not find it in any .cab file, so I assume it is compressed with other /Windows/* files, perhaps in a .BIN file but I don't know. If you could provide some idea, I would appreciate it so I can understand how it all fits together.
ProcessStartupFolder.exe is one file I could not copy from the scope when I was on 2.36 firmware. We suspected that it was fundamental to changing the USB boot process, and now thanks to your efforts we have good idea what is happening!
-
Tools to extract the firmware/kernel.
-
Hello guys!
I seemed to have a FW problem with the oscilloscope and had to upgrade the firmware unfortunately before I found this forum...
Now I have 2.37 fw revision.
I tried to downgrade by tricking the process into thinking the 2.35 files are 2.37 indeed by changing strings in INFINI~1.028
I have recalculated the MD5 for the infiniVIsionSetup.cab too to set it in the recipe.xml
I unpacked the .cab files with 7zip and packed them back with CABPACK.
It did not work, I get error message about the file loading unsuccessful.
I am not sure though if it was a wrong packing method I used, or something else.
Did anybody approach the downgrade process from this angle?
-
Looks like the problem is here:
2.35 infiniiVisionCore.dll: infiniiVisionInstallService.exe --minimumVersion 2.20.00.00
2.37 infiniiVisionCore.dll: infiniiVisionInstallService.exe --minimumVersion 2.36.00.00
-
Hello guys!
I seemed to have a FW problem with the oscilloscope and had to upgrade the firmware unfortunately before I found this forum...
Now I have 2.37 fw revision.
I tried to downgrade by tricking the process into thinking the 2.35 files are 2.37 indeed by changing strings in INFINI~1.028
I have recalculated the MD5 for the infiniVIsionSetup.cab too to set it in the recipe.xml
I unpacked the .cab files with 7zip and packed them back with CABPACK.
It did not work, I get error message about the file loading unsuccessful.
I am not sure though if it was a wrong packing method I used, or something else.
Did anybody approach the downgrade process from this angle?
You can buy the DSOX3APPBNDL and it will unlock almost the same like any hack....
http://www.home.agilent.com/en/pd-2401593-pn-DSOX3APPBNDL/application-bundle-for-infiniivision-3000-x-series-oscilloscopes (http://www.home.agilent.com/en/pd-2401593-pn-DSOX3APPBNDL/application-bundle-for-infiniivision-3000-x-series-oscilloscopes)
Included options
DSOX3ADVMATH Advanced math measurement application
DSOX3AERO A/D trigger and decode (MIL-STD 1553/ARINC 429)
DSOX3AUDIO Audio serial trigger and analysis (I²S)
DSOX3AUTO Automotive trigger and analysis (CAN/LIN)
DSOX3COMP Computer trigger and analysis (RS232/UART)
DSOX3EMBD Embedded trigger and analysis (I²C/SPI)
DSOX3FLEX FlexRay trigger and analysis
DSOX3MASK Mask limit testing
DSOX3MEMUP Memory upgrade to 4 Mpts
DSOX3PWR Power measurements
DSOX3SGM Segmented memory acquisition
DSOX3VID Video trigger and analysis
DSOX3WAVEGEN Integrated 20 MHz function/arbitrary waveform generator
DSOXDVM Integrated digital voltmeter
DSOXEDK Educator’s training kit
-
Update: not 100% sure, but it looks like this version is checked against the FileVersion field of VS_VERSION_INFO resource of infiniivisionLauncher.exe inside the cab. This exe looks similar for 2.35 and 2.37, just the version string, timestamps and digital signature differs. Anyone to try putting a 2.37 launcher into 2.35 cab and updating? Somebody from Agilent? >:D
-
So I did the update to 2.37 and tried how to downgrad to V2.35.
The first step was a modified cab based on V2.35 and Infiniivision.cab from 2.37 to change the Windows folder with the ProcessStartupFolder.exe
The 2.37 Firmware has loaded the Firmware Update successfully but it takes a couple of minutes before the scope reboots.
This is the simples way to restore the \windows folder to an older version because ist write protected.
The next Step was to rename the 2.37 to 2.35 in the infiniiVisionLauncher and infiniiVisionCore and replaced these files directly over telnet from usb to the \sercure folder.
after a reboot i tried to load a V2.35 Firmware but this didn't works maybe the timestamp was also checked. :(
After I replaced the newest files in the \secure\infiniivision folder direcly with the 2.35 Files I was able to load the old v2.35 setup.
So its posible to go back to the V2.35 with the help of telnet access.
Because i did this with try&error i don't have more details at the moment. For the moment I'm happy that my scope is run with V2.35 again an working Usb Startup. :phew:
btw It's easy the change the Splash Screen \windows\compileImageForSplashScreen.exe \usb\SplashImage.png \Secure\InfiniiVision\splashImage.bin
-
kilobyte, good news!
If someone with telnet access wants to experiment with cab versioning, there seems to be a quick way to test is it accepted w/o installing it: run infiniiVisionInstallService.exe --validateOnly --minimumVersion 2.36.00.00 \usb\your_cab_file
I don't have a scope to try, use infiniiVisionInstallService.exe --help to get more info on that
-
So i did some tests with the "Unfinalized Software" Hack on the 2.37 Firmware.
On my Scope is currently the version 2.35 with the most options enabled by DSOAPP Bundle except the MSO Function.
I extracted the cab file of the 2.37 with this tool MSCEInf - CAB Analyzer (No Setup needed and free)
And searched for the same code location and it has moved to 0x27A9A0, changed the 4 byte to 00 00 A0 E3 and put the whole Infiniivision folder to the usb stick.
The Scope boots the 2.37 and the additional features are enabled...
Thanks kilobyte! I'm in the same boat as you --- have 2.35 and most options enabled by DSOAPP bundle, except BW and MSO. I was able to reproduce your finding by modifying 2.37 as you instruct, and the MSO and BW options activated. Thanks for the updated memory location to edit.
Tools to extract the firmware/kernel.
Thank you abyrvalg! I appreciate the nice instructions :)
-
I tested the Version 2.37 installed on my usb-stick.
Warning: It change the Telnet Password!
-
It is weird with 2.37 installed on scope telnet password remain unchanged.
-
Telnet password is set at every startup by /windows/createUserAccounts.exe program, which lives inside nk.bin.comp - no way to change it.
-
I don't have any problems with Telnet login.
But here the first login fail and the second login is working with putty.
-
Weird, I haven't got it work yet, wonder why dunkemhigh's board is working. Maybe I should send mine to dunkemhigh to compare in his scope?
The board is here and in my scope. It works exactly the same as my board does - that is, there is no discernable problem. I don't get any warning on boot, and I can do the full remote control stuff without error.
This kind of suggests that mys scope is somehow different from everyone elses. I guess I could flog it with a $200 markup like that chap flogging E4's :)
-
I don't have any problems with Telnet login.
But here the first login fail and the second login is working with putty.
I used kitty but same thing: first no, second yes no problem. I remember I powered the scope down disconnect the AC main and redo the test, it started no problem immediately. As far I remember in my case the problem was just the first telnet after the upgrade to 2.37. It could be I'm wrong...
-
Weird, I haven't got it work yet, wonder why dunkemhigh's board is working. Maybe I should send mine to dunkemhigh to compare in his scope?
The board is here and in my scope. It works exactly the same as my board does - that is, there is no discernable problem. I don't get any warning on boot, and I can do the full remote control stuff without error.
This kind of suggests that mys scope is somehow different from everyone elses. I guess I could flog it with a $200 markup like that chap flogging E4's :)
Well, that explains why I couldnt find any error.. still, not being the only one with the error there must be something we're overlooking? :-//
When I'm home, I'll write down the serial of my scope, maybe by comparing we can figure out if it's a hardware thing? Too bad I dont know anybody with an original module to try and see if that works or not..
-
I have the solution for the brocken web Interface when the firmware is startet from usb-stick:
Copy the file "/infiniivision/upgrade/infiniiVisionWebCom.dll" from the USB-stick to "/infiniivision" on the stick.
The Webinterface works fine now.
-
The Webinterface works fine now.
Smart work, that man :-+
-
... I ... wonder why dunkemhigh's board is working. Maybe I should send mine to dunkemhigh to compare...
The board is here and in my scope. It works exactly the same as my board does - that is, there is no discernable problem. I don't get any warning on boot, and I can do the full remote control stuff without error.
This kind of suggests that my scope is somehow different from everyone else...
Well, that explains why I couldnt find any error.. still, not being the only one with the error there must be something we're overlooking? :-//
When I'm home, I'll write down the serial of my scope, maybe by comparing we can figure out if it's a hardware thing? Too bad I dont know anybody with an original module to try and see if that works or not..
I too have been unsuccessful in getting either of my dunkemhigh boards to work.
Before going after serial numbers, perhaps it is a difference between the different scopes models themselves (2000A vs 3000A, or even 100MHz vs 500MHz). There should be no difference between DSOX and MOSX, as both models are the same, only the MSOX has been software enabled on the later.
What models are successful users of dunkemhigh LAN boards using them in?
And what models are unsuccessful users of dunkemhigh LAN boards using them in?
I'm using an MSOX3054A, and I have no issues when using an actual Agilent DSOXLAN module.
I believe dunkemhigh has a 2000A. Is anyone with a 3000A successful in using a dunkemhigh LAN card?
-
I believe dunkemhigh has a 2000X
Yes, it is a DSO-X 2004A. Maybe that A is significant.
-
I believe dunkemhigh has a 2000X
Yes, it is a DSO-X 2004A. Maybe that A is significant.
I think they are all "A" models... My model number has now been appended with the "A".
-
Mine is an msox2024a and my home made lan board works perfectly.
I've mentioned this before...
The dunkemhigh board has one issue that doesn't follow the original design. The original agilent lan board has the magjack center taps connected together and to 3.3V via a 10ohm resistor (and bypass cap). The dunkemhigh magjack (from what I can see and correct me if I'm wrong) has the center tap of each isolation transformer connected together then via a capacitor to ground, no 3.3V connection.
Maybe the 3000 series is more fussy and the phy detects a problem.
It would be worth tying the center taps to a 10 ohm resistor to the 3.3V on the edge connector to see if that fixes anything.
cheers,
george.
-
I've mentioned this before...
Indeed, and it would be cool if someone could try that. Obviously, it's not much use me doing it... :)
I am not about to complain, but if that is the problem I can't see why mine doesn't suffer, at least some times. It would be conceivable that my board/jack has something different (a short of open, maybe), but I've tried a different board that fails for someone else yet works perfectly for me.
-
Dunkemhigh - yes, that's why I mentioned maybe that the 3000 series is more fussy...
At this point yours is a 2000 series and works fine and mine is also a 2000 series and works fine. I DID early on disconnect the 3.3V to the center taps and on my 2000 series it still worked fine... I did put it back to 3.3V to be 'correct'.
Does anyone with a 3000 series have a working diy lan board?
cheers,
george.
-
Hi
I am new in the forum. I designed a LAN board for my DSOX2004 using the gerber files posted in this theme. The LAN connector is different and i made some changes on the board. My problem is the same like with most of the people here - center tap of the isolation transformers. I tried everything, but i can't find where exactly is the 3.3V pin on the edge connector. I saw the pictures here with description of the pins but it didn't work for me. Anyway the PCB is working, but during boot procedure a get a message - "System concerned .... LAN Failure" or something like that.
If somebody knows which pin exactly is 3.3V i will appreciate it :)
(Sorry for the bad english)
-
On my scope from first day, if USB stick unplugged, I also see error message, but LAN module work and recognized by scope! "System concern detected..." hide the LAN error message.
Did you tried to communicate with scope over LAN?
-
Hi
I am new in the forum. I designed a LAN board for my DSOX2004 using the gerber files posted in this theme. The LAN connector is different and i made some changes on the board. My problem is the same like with most of the people here - center tap of the isolation transformers. I tried everything, but i can't find where exactly is the 3.3V pin on the edge connector. I saw the pictures here with description of the pins but it didn't work for me. Anyway the PCB is working, but during boot procedure a get a message - "System concerned .... LAN Failure" or something like that.
If somebody knows which pin exactly is 3.3V i will appreciate it :)
(Sorry for the bad english)
Look at Zucca's post ->
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg458172/#msg458172 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg458172/#msg458172)
"B" in the drawing is the signal that needs to go to 3.3V. All the info is in that post.
cheers,
george.
-
First of all - thanks for the answers. The communication with the scope is OK. I tried few things from my browser and it works fine. Only the starting process of the scope is slower than normaly (maybe with 20-30sec). This i think is because of the tests that the system makes during boot for the LAN card. If LAN card is not responding properly the test is made few more times. Again - its not a big problem, but the boot of the scope is relatively slow and now is even slower.
When i try to connect the center taps together and connect them to 1,2 pin (shown on ZUCCA's pictures) i get the same error. I will try few more things and if i clear the error the PCB files will be changed and i will update my version of the project (altium files). By the way the connector that i use is:
http://www.tme.eu/bg/details/rj45-trafo-lt/syediniteli-rj/amphenol/lmj2018814100dl2t1b/ (http://www.tme.eu/bg/details/rj45-trafo-lt/syediniteli-rj/amphenol/lmj2018814100dl2t1b/)
-
I'm looking out for a DSOX2xx4 or DSO3xx4 that I could buy and 'upgrade'. Seems a new one may have 2.37 which may prevent me from doing the USB boot feature - not sure?
I've read the whole thread, but there are a few of basic things I'm not clear on.
1. What are folks using to telnet into the scope? I know it can be done if there's a LAN card fitted but what if there's no LAN card? Is it done using the connection to the serial port header on the PCB or can you connect via the USB using an USB-Serial cable?
2. What are the port settings for the serial connection - BAUD rate etc?
3. If you get to the point that you can boot from USB, it seems that the USB stick needs to stay in the scope. Is there a second USB port or does that mean you can't save stuff to the USB drive?
Thanks,
-
First of all - thanks for the answers. The communication with the scope is OK. I tried few things from my browser and it works fine. Only the starting process of the scope is slower than normaly (maybe with 20-30sec). This i think is because of the tests that the system makes during boot for the LAN card. If LAN card is not responding properly the test is made few more times. Again - its not a big problem, but the boot of the scope is relatively slow and now is even slower.
When i try to connect the center taps together and connect them to 1,2 pin (shown on ZUCCA's pictures) i get the same error. I will try few more things and if i clear the error the PCB files will be changed and i will update my version of the project (altium files). By the way the connector that i use is:
http://www.tme.eu/bg/details/rj45-trafo-lt/syediniteli-rj/amphenol/lmj2018814100dl2t1b/ (http://www.tme.eu/bg/details/rj45-trafo-lt/syediniteli-rj/amphenol/lmj2018814100dl2t1b/)
Do your magjack LEDs work? Seems you have the pinout in your schematic back to front (anode/cathode flipped). e.g. you have pin 12 as the cathode, but the datasheet has pin 12 as the anode (same mistake in your schemetic for the 2nd LED).
The anode end of both LEDs (connect together) and feed from the 3.3V on the card edge.
I use the same magjack style (AMP part number) and it works perfectly without any errors. Boot up time is 37 seconds to where it says Agilent etc and 45 seconds to being fully booted and displaying a trace etc (msox2024a). I did copy the patched firmware to the internal memory to speed boot time versus a USB stick.
The center taps should connect together and connect to a capacitor (1uF seems fine) and resistor (10 ohms). The other end of the capacitor goes to ground. The other end of the resistor goes to 3.3V on the card edge.
I'll have to draw up a schematic of my lan vga diy card since it does work perfectly without any errors (at least on my msox2024a).
cheers,
george.
-
Yes, you are right - the leds are not connected properly. Maybe PCB design for 1 hour is not good idea :D
I will make some cuts on the board when i have spare time and i will try to clear thigs up. Thanks for the answer.
-
Just for the record, my scope is an (unhacked) mso-x 2024a, so it's not a case of the 3000 being more fussy.
-
Just for the record, my scope is an (unhacked) mso-x 2024a, so it's not a case of the 3000 being more fussy.
Thanks. That kind of kills the 2000A vs 3000A theory...
-
Just an idea: maybe it depends on sw version?
There is an FPGA in VGA part of original board, so it can be configured and then checked (or not checked, depending on sw inside the scope).
-
Just an idea: maybe it depends on sw version?
There is an FPGA in VGA part of original board, so it can be configured and then checked (or not checked, depending on sw inside the scope).
Good thinking, it may well be a VGA related fault and not necessarily the LAN. After all, the reported error is "LAN VGA option module fault". Perhaps on some scope versions the logic says; if there exists a LAN module, the VGA must exist also, let's check...
I never proceeded further with my card after receiving the error, as I'm very afraid of damaging my expensive scope. But after Antonsio reported he receives the same error and then has good communication with his board, it got me thinking that perhaps the communication with my dunkemhigh board may work just fine also. Your comments only further support the reason why the error may appear and the LAN still work. I will have to test and report back...
-
So, folk that have lan/vga problems with the diy board, what is your firmware version on your scope and what model do you have?
Mine works perfect with no error lan/vga error messages (with my diy lan card):
MSOX2024A and firmware version 2.35.2013061800 as reported on the 'about scope' screen. Also with licenses 'enabled' and loaded into the scope (versus usb flash drive).
cheers,
george.
-
DSO-X 2004A, firmware 02.35.2013061800
Also licenses enabled and loaded into the scope, but I still get the message about booting from USB, and the 'About' screen even says (in red) "Booting from USB device".
It's possible I screwed up somewhere :-//
-
MSOX 3054A, firmware 02.35.2013061800
Error with dunkemhigh board, but fine with Agilent DSOXLAN.
No need for other mods, as I already have MSO, max BW for my model, and the DSOX3APPBNDL.
I really don't think that the difference is in the loadable firmware, but could it be hidden in the fixed code of some other piece of hardware in a later (or earlier) revision scope? My scope was new in Nov 2011.
-
I also think that this error may not be related to LAN only. I've tried everything to clear up the error, but nothing work. Anyway - the LAN connection is ok (which is the main point). Instead of this error i've seen something else, which i think is important. When i push in the edge connector the LAN PCB without any component and any pin from 1 to 80 connected together i get strange boot image - one of the colors maybe is missing. We tried everything with my colleague ( he have a DSOX 3024A , not hacked ) and on his scope we get same boot display with "color distortion". Finaly we thought maybe this is related to empty pins for the VGA connection. We cleared them and now everything is ok. The module is installed "tightly" without box and when i need LAN i just remove the original cover (shown in the attached photos) :)
-
3. If you get to the point that you can boot from USB, it seems that the USB stick needs to stay in the scope. Is there a second USB port or does that mean you can't save stuff to the USB drive?
Can't give you a definitive answer on your first two questions, sorry, but there are three USB ports: a host (A) and device (B) at the rear, and host (A) at the front.
-
3. If you get to the point that you can boot from USB, it seems that the USB stick needs to stay in the scope. Is there a second USB port or does that mean you can't save stuff to the USB drive?
Thanks,
Is any calibration maintained when running the hacked>?
Is it still possible to save screen images to the USB memory stick?
Yes calibration is maintained, and
you can save/recall data to/from USB stick.
Georg
-
Thanks for the confirmation on multiple USB ports. I was really trying to understand what I needed to do to get the dll file onto the USB drive, I think am I missing something here.
Is it possible to set up a batch file on the USB drive that issues the command to copy the file onto the drive?
-
Dear All,
this is my first post on eevblog forum.
I use firmware 2.35 on a dsox2002a. The trick works only if NO trial license is enable ! With trial license, either it does not work, or only some license are activated, although the scope reports "all license activated" at startup.
Hope this can help.
-
kilobyte's way is working for me!
Thank you :)
I'm using an intenso aluline 8gb stick. Formated as Fat32
Is it possible to upgrade the bandwith on my model (3012)?
-
Follow this link, as I see your problem is exactly same:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg414813/#msg414813 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg414813/#msg414813)
Goeorg
-
Thanks georgd!
It's working!
By the way:
I've got a few requests about sending a ready hacked zip package. Do it by your own! :-/O
-
Hi George,
Possible to post your working schematic? - I'm just laying out this board and it would seem a good idea not to reinvent the ... schematic :)
Thanks, Alan
-
This is the final schematic of my working lan card. I'm using an Digikey 1419-1021-ND for the magjack.
cheers,
george.
-
:-+Thanks to kilobyte for help, and now my oscilloscope has cracked.
-
Thanks George, I'll post up my layout when it's back and verified. I'll try the Amphenol part first and then revert to the TRP part if there are problems.
Alan
-
Yeesh. I think Agilent/Keysight *wants* people to just hack these scopes.
Tried buying the "ultimate" software bundle, which is cheap enough that for me, at least, hacking the scope isn't really worth the bother.
You would think that you could just put a scope S/N and credit card number into their website and get back a license key. Noooooooo.
If you go the Keysight website to get the bundle, you have to pick a distributor to get a quote from. Then you get to call the distributor, and they will ship "stock" from their warehouse. Once you get whatever they ship in the mail, then presumably you use that to go to their website, put in a S/N,, and get back a license key.
:phew:
-
If you go the Keysight website to get the bundle, you have to pick a distributor to get a quote from. Then you get to call the distributor, and they will ship "stock" from their warehouse. Once you get whatever they ship in the mail, then presumably you use that to go to their website, put in a S/N,, and get back a license key.
All you need from the certificate that the distributor sends you is your "Agilent order Number" and "Agilent Certificate Number" and most distributors can give you that over the phone or email it to you after payment is made. Make sure that you ask first. I have done this for several machines with no problems. From time to order to time of feature installation was just minutes. Compare that with a company that sells modules you have to install...
If you have a favorite Agilent Distributor already, then you can even skip right to order placement and have all your licenses installed almost as fast as I could type this reply.
Agilent requires you to go through a distributor, because they do not bypass the people that make them sales. Also, you can sometimes get a discount with a distributor that you would not get through a direct purchase. At the same time, Agilent does allow direct purchase of small parts that would be a hassle for you and the distributor to go through channels if you had to.
Thank you Agilent for making the process as easy as possible...
-
How interesting, I just noticed that Keysight extended their bundle offer for the option pack until 12-6-2014.
And yes, if you ask your distributor for an additional discount, you probably get it.
At least in Germany they offered it.
-
How interesting, I just noticed that Keysight extended their bundle offer for the option pack until 12-6-2014.
And yes, if you ask your distributor for an additional discount, you probably get it.
At least in Germany they offered it.
Forget asking Newark (Element14). At least here in the US... they said it was already discounted and that they do not offer the bundle at a lower price... hahaha, I got it elsewhere at a good discount.
-
Shh.... I bought it at Newark....
-
All you need from the certificate that the distributor sends you is your "Agilent order Number" and "Agilent Certificate Number" and most distributors can give you that over the phone or email it to you after payment is made. Make sure that you ask first.
No such luck here. Still no email and no physical certificate. Emailed Techni-Tool with a WTF?
-
Ok I've got a DSO-X 3032A on my desk, it's running 2.37 so I'm trying kilobytes method. I'm using the same USB sticks that I've used on previous 2000 and 3000 series scopes so I know they work ok, but I'm having problems. It just keeps rebooting when I power it up with USB stick is in place (with the folder structure on it obviously).
Contents of the USB stick are here:
https://dl.dropboxusercontent.com/u/2063383/3000%20usb%20stick.zip
Free ESD safe bench mat to the first person to help me get this damn thing booting with the options enabled.
-
Do you have a LAN Module available?
Because you need to Replace first some Files to downgrade the Firmware.
Without these Steps it is not possible to change the ProcessStartupFolder.exe in the Windows directory
BR
Kai
-
don't remember if it matters, but the path in your .lnk file is not in double quotes, i.e. 64#"\usb....Launcher.exe" (remember to increase the character count)
-
Do you have a LAN Module available?
Because you need to Replace first some Files to downgrade the Firmware.
Without these Steps it is not possible to change the ProcessStartupFolder.exe in the Windows directory
BR
Kai
Ahhh.. reading back over the previous few pages again (and again, and again) it looks like the scope must be 2.35 in flash to be able to boot 2.37 from the USB stick.
I mistakenly thought your mod allowed me to boot a modified 2.37 from USB when the scope had 2.37 in flash.
I guess I need to get a LAN module and do some more reading then...
-
Do you have a LAN Module available?
Because you need to Replace first some Files to downgrade the Firmware.
Without these Steps it is not possible to change the ProcessStartupFolder.exe in the Windows directory
BR
Kai
Ahhh.. reading back over the previous few pages again (and again, and again) it looks like the scope must be 2.35 in flash to be able to boot 2.37 from the USB stick.
I mistakenly thought your mod allowed me to boot a modified 2.37 from USB when the scope had 2.37 in flash.
I guess I need to get a LAN module and do some more reading then...
Right. I've got DSOXLAN module plugged in and have managed to get telnet access. Read through the previous few pages and it looks like there's a significant chance of me bricking this thing if I'm not careful.
If my understanding is correct I need to create a hybrid upgrade CAB based on parts of the 2.35 and 2.35 CABs, specfically replacing the naughty ProcessStartupFolder.exe to enable subsequent downgrade to 2.35.
However, it's not going anywhere so far....
I tried the instructions and tools in TOOLS.ZIP posted by abyrvalg some time ago, trying to find ProcessStartupFolder.exe. The "dosetup.py" Python program fails and produces no output apart from 3 traceback error messages, and the "bincompress.exe" program just moans about "Not an 0x000fff file" or something similar. Not a good start.
Any suggestions or pointers?
-
At one time in the past I gave up on my MSOX3104A. I was really afraid that something would go wrong and Agilent would not honor any warranty on this expensive scope. So I bought the option pack in the discounted bundle and it works really well. Sometimes it is not worth the time or effort, as long as the full option pack is so cheap. Unless - of course - we use it to learn and we are willing to take the risk.
On my MSO7104B the "fix" was so much easier and thanks to this forum, it works well with all options enabled.
-
So I did the update to 2.37 and tried how to downgrad to V2.35.
The first step was a modified cab based on V2.35 and Infiniivision.cab from 2.37 to change the Windows folder with the ProcessStartupFolder.exe
The 2.37 Firmware has loaded the Firmware Update successfully but it takes a couple of minutes before the scope reboots.
This is the simples way to restore the \windows folder to an older version because ist write protected.
The next Step was to rename the 2.37 to 2.35 in the infiniiVisionLauncher and infiniiVisionCore and replaced these files directly over telnet from usb to the \sercure folder.
after a reboot i tried to load a V2.35 Firmware but this didn't works maybe the timestamp was also checked. :(
After I replaced the newest files in the \secure\infiniivision folder direcly with the 2.35 Files I was able to load the old v2.35 setup.
So its posible to go back to the V2.35 with the help of telnet access.
Been for a walk on the beach and I've come back this this with a clear head...
I've done the following:
1) Taken the 2.35 CAB file and extracted the infiniiVisionSetup.cab file
2) Upacked the 2.37 CAB file and replaced its infiniiVisionSetup.cab file with the one I extracted above
3) Used a program called CABPACK to create a new hybrid CAB file from the unpacked 2.37 with its new 2.35 component
The intention is to put this on a USB stick and then do a firmware upgrade, hopefully this is the same thing kilobyte did in the first part of the process he describes above.
I'm a little reluctant to try this, mainly because my new hybrid CAB file is 19 meg in size and the original 2.35 and 2.37 CAB files were 22 meg!!
Might have to have a bottle of vodka to hand before I push the button on this...
-
Select MSZIP in the compression type of CABPACK then the file should have near the same size.
The step with a hybrid CAB is not nessesary.
When i did the downgrad on my scope i have tried out different things.
This step is only needed if you need the latest firmware on the scope with USB Boot (issues with different dll versions are posible??)
TO downgrade it must be enough to replace these two file with files from 2.35
infiniiVisionLauncher.exe
infiniiVisionCore.dll
after a reboot it should be possible to load the 3000XSeries.02.35.2013061800.cab
I have to test this on my scope again but this should be the easiest way and should work.
And while downgrade there should be no infiniivisionStartupOverride.txt on the usb drive :phew:
-
Wooo well done Mr Kilobyte!!
From the Agilent 2.35 upgrade CAB I extracted the files you said:
infiniiVisionLauncher.exe
infiniiVisionCore.dll
Put them on a USB stick, booted the 2.37 scope and got telnet access (infiniivision, skywalker1977)
Killed the running version (a step you didn't mention, probably because it was obvious to you!):
processmgr kill infiniiVisionLauncher.exe
Change to application directory
cd \secure\infiniivision
Copy those two old files:
copy \usb\infiniiVisionLauncher.exe
copy \usb\infiniiVisionCore.dll
Reboot and get firmware concerns message, scope still thinks it has 2.37, no problem.
Put Agilent 2.35 upgrade CAB onto USB stick and up(down)grade as normal. Lots of waiting, scope then reboots with 2.35 up and running.
Then reboot with USB stick with modified 2.37 files to get all options including MSO and full bandwidth.
Many, many thanks sir. I owe you something nice from under my desk!!
-
Many, many thanks sir. I owe you something nice from under my desk!!
That took a weird turn...
-
How interesting, I just noticed that Keysight extended their bundle offer for the option pack until 12-6-2014.
And yes, if you ask your distributor for an additional discount, you probably get it.
At least in Germany they offered it.
sigh.. did this earlier today; really needed the wavegen. TestEquity gave me the package for $450ish. Not too bad since I got the scope on ebay, certified refurbished from Agilent for around $2k two years ago.
-
Wooo well done Mr Kilobyte!!
...
Reboot and get firmware concerns message, scope still thinks it has 2.37, no problem.
Put Agilent 2.35 upgrade CAB onto USB stick and up(down)grade as normal. Lots of waiting, scope then reboots with 2.35 up and running.
Then reboot with USB stick with modified 2.37 files to get all options including MSO and full bandwidth.
Many, many thanks sir. I owe you something nice from under my desk!!
This process worked for me too, my scope that was shipped with 2.37 is now running 2.35. Now I just have to get to work and build the USB stick. Not sure why I am doing this as I bought the app bundle, still I can go from 350MHz to 500MHz. I think it just must be the curiosity...
-
I am really close of purchasing a new DSOX2004A (without any options) in the next couple of days.
However I am not sure about the following. Can please somebody confirm:
- Is it still hackable? By reading this thread I think so - I just need to add a LAN board. Am I correct?
- The DSOX2004A (default is 70 Mhz) can be 'enhanced' to 200 Mhz?
- Any idea where to get the logic probes then (item # N6459-60001, I did not find a price for it). Are there any other (maybe older) logic probes from Agilent usable?
Thanks!
-
So you are saying that the bundle stayed intact after downgrading?
We also purchased a bundle. I was thinking about downgrading too, just for the logic analyzer. Although we would use it very seldom it would be nice to have the option to it.
If your bundle remained intact I will make the downgrade too.
This process worked for me too, my scope that was shipped with 2.37 is now running 2.35. Now I just have to get to work and build the USB stick. Not sure why I am doing this as I bought the app bundle, still I can go from 350MHz to 500MHz. I think it just must be the curiosity...
-
I am really close of purchasing a new DSOX2004A (without any options) in the next couple of days.
However I am not sure about the following. Can please somebody confirm:
- Is it still hackable? By reading this thread I think so - I just need to add a LAN board. Am I correct?
- The DSOX2004A (default is 70 Mhz) can be 'enhanced' to 200 Mhz?
- Any idea where to get the logic probes then (item # N6459-60001, I did not find a price for it). Are there any other (maybe older) logic probes from Agilent usable?
Thanks!
Yes I hacked a 2.37 scope using just a LAN card and telnet. Logic pods are easily bought on ebay for $200 or so. If anybody wants to borrow the LAN card for a day you can, just pay shipping both ways.
-
Thanks Toploser!
-
I am hoping I can get a good Black Friday deal on an Agilent Keysight DSOX2000/3000.
But the shipping costs can eat up all the savings. As intl. shipping costs are not only calculated by weight but also volume of the box, can somebody please measure the size of the original Agilent/Keysight box (should be identical on 2000/3000 series) and post it here? Thanks!!
-
Outer dimension of DSOX3000 box is 24 x 34 48 cm.
Georg
-
Grrrr :-- Zoro raised the price by exactly 5% this morning ...
Oh, and thank you for the measurements George.
-
Yes I hacked a 2.37 scope using just a LAN card and telnet. Logic pods are easily bought on ebay for $200 or so. If anybody wants to borrow the LAN card for a day you can, just pay shipping both ways.
Is there somebody in USA that can offer to borrow a LAN card as TopLoser ? Of course I will pay the shipping both ways.
If yes, I will order an oscilloscope.
Guys, please help here !
David
-
any body try with dsox2000 ver 2.38?
thanks
-
Hi
Where I get full instructions for DSOX2000 Lan update?
thanks
-
any body try with dsox2000 ver 2.38?
thanks
Thanks for the head´s up about the new FW. I will install the 2.38 FW soon (BTW I have not a hacked scope).
Here the link for the new FW
http://www.keysight.com/main/software.jspx?id=2014548&nid=-11143.0.00&lc=eng&cc=US (http://www.keysight.com/main/software.jspx?id=2014548&nid=-11143.0.00&lc=eng&cc=US)
Here what´s new:
New Features for 2000A and 3000A
Software is now Keysight Technologies branded.
–
Trigger Rate SCPI query has been added - TRIGger:FREQuency? <gate time in sec>
–
New bit rate measurement has been added.
New Features for 3000A
N2804A/N2805A 100MHz/300MHz differentia
l probe support has been added.
–
N7020A Power Rail probe support has been added.
Bug Fixes
AER/TER behavior is improved.
–
*STB behavior is improved
See attachments for details.
-
The new Splash screen looks a bit boring.
I found the old Agilent Splash screen looks nicer but its simple to change this.
The new Bit-rate measurement is a nice new feature.
I can Start the Modified V2.38 (another Address must be used) from USB with V2.35 on the Scope.
Ok i tested it here the Telnet Downgrade Method back to 2.35 is still working.
-
I can Start the Modified V2.38 (another Address must be used) from USB with V2.35 on the Scope.
kilobyte: Thanks for the testing and reporting here on v2.38!
Could you mention the updated addresses at which the bytes need to be changes?
Thanks!
-
I have change the Data At 0x27AF78 to 00 00 A0 E3
-
I modified the keysight logo to a more known brand >:D
A real HP/Agilent/Keysight product now ;)
I wrote a little tool to extract the Bitmap data and the location from the dll, not finished yet but it works with 4byte aligned Bitmap data.
-
Wow, I love it. :-+ :-+
-
I modified the keysight logo to a more known brand >:D
This is very impressive!
It would be great to have this on my scope.
-
Hi!
Does anybody know where can I find the 2.35 firmware? The keystone website only lets you download the latest one (2.38)
Thanks!
-
I wrote a little tool to extract the Bitmap data and the location from the dll, not finished yet but it works with 4byte aligned Bitmap data.
master of disaster... congrats...
(http://www.chiark.greenend.org.uk/scopes/images/teklogo.jpg) on 1st April?
also this one would be good...
(http://cdn.ninjamarketing.it/wp-content/uploads/2014/04/oshw-logo-400-px.png)
-
Is there somewhere a comparision of the DSOX3000A board differences between the 100/200 and the 350/500 Mhz version available (e.g. high res pictures of the front end of both versions)? I could not find any.
It is always said that Agilent/Keysight will swap boards if you want to upgrade from 100/200 to 350/500 Mhz. I am wondering if there is really a significant difference or if they just inject some software instead of swapping boards.
-
Wooo well done Mr Kilobyte!!
From the Agilent 2.35 upgrade CAB I extracted the files you said:
infiniiVisionLauncher.exe
infiniiVisionCore.dll
Put them on a USB stick, booted the 2.37 scope and got telnet access (infiniivision, skywalker1977)
Killed the running version (a step you didn't mention, probably because it was obvious to you!):
processmgr kill infiniiVisionLauncher.exe
Change to application directory
cd \secure\infiniivision
Copy those two old files:
copy \usb\infiniiVisionLauncher.exe
copy \usb\infiniiVisionCore.dll
Reboot and get firmware concerns message, scope still thinks it has 2.37, no problem.
Put Agilent 2.35 upgrade CAB onto USB stick and up(down)grade as normal. Lots of waiting, scope then reboots with 2.35 up and running.
Then reboot with USB stick with modified 2.37 files to get all options including MSO and full bandwidth.
Can you send me the 2.15 cab file ?my email address is dian.zi.mi@163.com
-
It is always said that Agilent/Keysight will swap boards if you want to upgrade from 100/200 to 350/500 Mhz. I am wondering if there is really a significant difference or if they just inject some software instead of swapping boards.
Yes, they have to actually swap boards, the 300/500MHz was a different front end. Although wait a few days and that could be changing... ;)
-
wait a few days and that could be changing... ;)
Oh I hate it when you do this.
-
I'm curious too.
Maybe it has something to do with the two scopes that i can see on the dropcam livestream?
The looks very very similar. :)
I'll let it be a surprise.
-
I'm curious too.
Maybe it has something to do with the two scopes that i can see on the dropcam livestream?
The looks very very similar. :)
I'll let it be a surprise.
Mmmmh; Dave says "the 300/500MHz was a different front end." I am wondering what that means, especially to my already existing 200 Mhz version...
-
wait a few days and that could be changing... ;)
Oh I hate it when you do this.
Maybe to do with the new 3000T series...
http://uk.farnell.com/keysight-technologies/dsox3012t/oscilloscope-2-ch-100mhz-5gsps/dp/2449632 (http://uk.farnell.com/keysight-technologies/dsox3012t/oscilloscope-2-ch-100mhz-5gsps/dp/2449632)
-
Mmmmh; Dave says "the 300/500MHz was a different front end." I am wondering what that means, especially to my already existing 200 Mhz version...
I was given wrong information on that unfortunately.
The new 3000T still has different front end hardware between the 100/200 and 350/500 versions.
-
Bingo!
https://translate.google.com/translate?sl=auto&tl=en&js=y&prev=_t&hl=en&ie=UTF-8&u=http%3A%2F%2Fwww.hw.cz%2Fprodukty%2Fosciloskopy-keysight-dsox3000t-graficky-trigger-pro-kazdeho-inzenyra.html&edit-text= (https://translate.google.com/translate?sl=auto&tl=en&js=y&prev=_t&hl=en&ie=UTF-8&u=http%3A%2F%2Fwww.hw.cz%2Fprodukty%2Fosciloskopy-keysight-dsox3000t-graficky-trigger-pro-kazdeho-inzenyra.html&edit-text=)
-comes with a touchscreen
-4Mpts memory
-greatly extended match functions
-correlated signal analysis (time and frequency domain)
and the datasheet aswell : Datasheet (https://mega.co.nz/#!M8MEVCjS!m44W76kvGf3Iz0ddv_JUb49vVNBkCTkJL7TuTmp2dmk)
-
woah, a proper full bandwidth 1mV front end. What took them so long :P
-
woah, a proper full bandwidth 1mV front end. What took them so long :P
No, it's still magnified : "2. Specifications are valid after a 30-minute warm-up period and ± 10 °C from firmware calibration temperature. 1 mV/div and 2 mV/div are a magnification of 4 mV/div setting. For vertical accuracy calculations, use full scale of 32 mV for 1 mV div and 2 mV/div sensitivity setting."
-
hmm you're right - further down in the characteristics it states the all familiar sentence that you quote. But I don't know what to make of this table then (page 7):
(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=128593;image)
vertical setting steps of 1, 2, 5 mV and the noise stays basically the same in those three settings. Is the noise not amplified?
I guess they had to come up with something to compare it to the Tek scope? Poor move Agilent : /
-
It's just a digital amplification (only scaling on the display), so of course the noise in Vpp stays the same.
-
Yeah I guess I still hoped it had real amplification. Magnified pixels again, boo!
-
Hi!
Does anybody know where can I find the 2.35 firmware? The keystone website only lets you download the latest one (2.38)
Thanks!
Thanks to those who sent me the firmware in PM. I had version 2.36 in the scope, after downgrading to 2.35 I can use the usb hack without problems. Thanks!
-
Last year I was lucky enough to pick up a demo version of a 3034a. All the options where there when I got the unit and are listed with an astrix (*). I haven't updated the firmware yet, due to the fear of loosing my beloved/free options. Anyone know if an update will remove them?
-
Last year I was lucky enough to pick up a demo version of a 3034a. All the options where there when I got the unit and are listed with an astrix (*). I haven't updated the firmware yet, due to the fear of loosing my beloved/free options. Anyone know if an update will remove them?
The astrix (*) means that the options are either in DEMO MODE or the scope is a STORE DEMO, and thus in demo mode. There has been posts indicating that the store demo units have a runtime of 120 days, but I cannot say for sure. In either case, updating the firmware should not remove the demo, but again, I cannot say for sure...
-
The astrix (*) means that the options are either in DEMO MODE or the scope is a STORE DEMO, and thus in demo mode. There has been posts indicating that the store demo units have a runtime of 120 days, but I cannot say for sure. In either case, updating the firmware should not remove the demo, but again, I cannot say for sure...
Not necessarily. It could be in distributor mode. If the first item in the list is "All", it's a good bet. My scope has been this way for well over a year. The really cool part is if they put new features in future firmware that require licenses, a distributor scope will automatically turn them on when you upgrade the firmware.
(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=130718)
-
Thank you both.
Last year I was lucky enough to pick up a demo version of a 3034a. All the options where there when I got the unit and are listed with an astrix (*). I haven't updated the firmware yet, due to the fear of loosing my beloved/free options. Anyone know if an update will remove them?
The astrix (*) means that the options are either in DEMO MODE or the scope is a STORE DEMO, and thus in demo mode. There has been posts indicating that the store demo units have a runtime of 120 days, but I cannot say for sure. In either case, updating the firmware should not remove the demo, but again, I cannot say for sure...
Is there a way I can check the runtime? I would presume this would have been reset at their factory when it was "refurbished".
The astrix (*) means that the options are either in DEMO MODE or the scope is a STORE DEMO, and thus in demo mode. There has been posts indicating that the store demo units have a runtime of 120 days, but I cannot say for sure. In either case, updating the firmware should not remove the demo, but again, I cannot say for sure...
Not necessarily. It could be in distributor mode. If the first item in the list is "All", it's a good bet. My scope has been this way for well over a year. The really cool part is if they put new features in future firmware that require licenses, a distributor scope will automatically turn them on when you upgrade the firmware.
(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=130718)
I also have the "All" (no astrix).
(http://i.imgur.com/At0JUB7.png) (http://i.imgur.com/At0JUB7.png)
If I read you correctly, you have performed an update and still kept the options. In your opinion, the case would be the same for me?
-
If I read you correctly, you have performed an update and still kept the options. In your opinion, the case would be the same for me?
You should be fine. Whether they are time limited or not, I don't know. It may be the case that you got lucky and they forgot to clear the licenses out of your scope before sending it to you.
-
If I read you correctly, you have performed an update and still kept the options. In your opinion, the case would be the same for me?
You got a nice catch then with ALL functions enabled. Upgrading firmware should not disable any legitimate features, demo, distributor, or purchased. I see from the screenshot that your firmware is quite old. You'll have a great incentive to upgrade to the latest firmware, with many new capabilities, improved measurements, and bug fixes... Great Score!
One other nice thing to know about your scope, is that it has the 500MHz front end. :-+
-
Im happy to report the update went as expected.
Thank you for the confidence boost.
(http://i.imgur.com/DqepazH.png) (http://i.imgur.com/DqepazH.png)
-
Im happy to report the update went as expected.
Thank you for the confidence boost.
(http://i.imgur.com/DqepazH.png) (http://i.imgur.com/DqepazH.png)
Excellent! :-+
Now you can check out your new and free ARB you didn't have yesterday...
-
Hello everyone,
Explanations are mixed between different versions. I'm afraid to get a stupidity. :-BROKE
Someone could explain step by step how to change the latest version (2.38)?
And how to load the modified version?
Does anyone want to change the firmware new scope DSOX/MSOX 3000T ?
Thank you in advance.
-
For the data that have to be modified see here
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg569677/#msg569677 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg569677/#msg569677)
And for Firmware Downgrade see TopLosers summary here
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg537981/#msg537981 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg537981/#msg537981)
Does anyone want to change the firmware new scope DSOX/MSOX 3000T ?
Maybe if you like to buy me one of these... ;D
I already have a dsox3024a at home so i didn't buy a new one in the next time.
I hope they release a firmware package to have a look into.
-
I still have many questions. :scared:
For the data that have to be modified see here
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg569677/#msg569677 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg569677/#msg569677)
is the infiniiVisionCore.dll (v2.35) file needs to be changed ?
you change address : 0x0x27AF78 , data : 0x00 00 A0 E3 ?
From the Agilent 2.35 upgrade CAB I extracted the files you said:
infiniiVisionLauncher.exe
infiniiVisionCore.dll
Where you find the version 2.35? (it is not available on the official website)
this is the original file?
Put them on a USB stick, booted the 2.37 scope and got telnet access (infiniivision, skywalker1977)
Killed the running version (a step you didn't mention, probably because it was obvious to you!):
processmgr kill infiniiVisionLauncher.exe
Change to application directory
cd \secure\infiniivision
Copy those two old files:
copy \usb\infiniiVisionLauncher.exe
copy \usb\infiniiVisionCore.dll
Reboot and get firmware concerns message, scope still thinks it has 2.37, no problem.
I understood.
Put Agilent 2.35 upgrade CAB onto USB stick and up(down)grade as normal. Lots of waiting, scope then reboots with 2.35 up and running.
Then reboot with USB stick with modified 2.37 files to get all options including MSO and full bandwidth.
you downgrade to version 2.35. This is Original firmware 2.35?
After I upgrade to Version 2.38. This is not the original firmware 2.38, what do I need to change?
-
I still have many questions. :scared:
Where you find the version 2.35? (it is not available on the official website)
3000 series 2.35 CAB here:
https://dl.dropboxusercontent.com/u/2063383/3000XSeries.02.35.2013061800.cab
Use this CAB file as a source of the two files that will replace the ones on your scope. Then use it to downgrade your scope to 2.35
No need to edit or modify the contents of any of the files yet. That will come later when you have downgraded to 2.35.
-
Dear all,
I confirmed that it is possible to launch the 2.38 version from USB stick, with 2.35 firmware inside. Anyway, I have a question about changing the splash screen : I found the new one more, humm... serious.
I have of course read the whole thread, but it did not work. I have no LAN adapter, so I try to do this with the USB key.
What I did :
put 21#\usb\img.cmd in the Startup\infiniiVision.lnk file of the usb key.
create an img.cmd file, at the root of the USB key, with :
\Windows\compileImageForSplashScreen.exe \usb\img.png \Secure\infiniiVision\splashImage.binBut nothing append... Any clue ? Thanks !
-
Hi,
I did a test on my scope and it should work.
My Steps:
1. create a bat file in usb root dir (create_splashscreen.bat)
2. I've insert the following text \windows\compileImageForSplashScreen.exe \usb\splashImage.png \Secure\InfiniiVision\splashImage.bin
3. rename the existing infiniivision.lnk (like infiniivision2.lnk)
4. create a new infiniivision.lnk with 28#\usb\create_splashscreen.bat
Plug the flashdrive into the scope and power up.
Now It takes some time.
Interesting effect is that the hacked Infiniivision Software will be loaded too.
After a reboot with an unplugged usb stick it should show up the new spalshscreen (It's a stupid idea to use a scope screenshot as a splashscreen ;D)
If you want to try it with my files you can download it here http://kaibareis.de/dsox/Splashscreen_change.zip (http://kaibareis.de/dsox/Splashscreen_change.zip)
Best Regards
Kai
-
Thank you !
Your script works, mine does not... the only differences are some case in path name (Windows vs windows and infiniivision vs Infiniivision). I'll dig into that...
-
Try changing .cmd extensions to .bat
-
Please, is anyone able to provide me with the 2.35 files for DSOX2000 series?
Thanks!!!!
Solved - 2000 firmware seems to be identical to the 3000 Firmware, thus Toplosers link above is fine.
-
I modified the keysight logo to a more known brand >:D
A real HP/Agilent/Keysight product now ;)
I wrote a little tool to extract the Bitmap data and the location from the dll, not finished yet but it works with 4byte aligned Bitmap data.
I upgraded to firmware 2.38, but the Keysight brand too ugly, want to switch back to Agilent, such as the picture red circle place. I would like to ask how to operate?
-
I still have many questions. :scared:
Where you find the version 2.35? (it is not available on the official website)
3000 series 2.35 CAB here:
https://dl.dropboxusercontent.com/u/2063383/3000XSeries.02.35.2013061800.cab
Use this CAB file as a source of the two files that will replace the ones on your scope. Then use it to downgrade your scope to 2.35
No need to edit or modify the contents of any of the files yet. That will come later when you have downgraded to 2.35.
Hello everyone, I have readed all the post and I have some questions:
I have got a MSOX-2014A with old firmware 2.20.2012110802. I found only the above firmware but I don't know if 3000xSeries is the same that 2000xSeries.
First i will update the scope to 2.35 firmware and then i will continue all the process that you wrote, right?
Thanks for your work !!!
-
First i will update the scope to 2.35 firmware and then i will continue all the process that you wrote, right?
YES
-
Does anyone want to change the firmware new scope DSOX/MSOX 3000T ?
The 3000T looks to be not hackable.
The nk.bin.comp is encrypted (Verisign DIGITAL ID) and it looks like the infiniivisioncore.dll is integrated in the nk.bin.comp file.
I modified the keysight logo to a more known brand >:D
A real HP/Agilent/Keysight product now ;)
I wrote a little tool to extract the Bitmap data and the location from the dll, not finished yet but it works with 4byte aligned Bitmap data.
I upgraded to firmware 2.38, but the Keysight brand too ugly, want to switch back to Agilent, such as the picture red circle place. I would like to ask how to operate?
It's a bit complicated but i will create a short guide and some necessary file how to change the logo.
-
kilobyte, how difficult would you think it would be to add USB mouse support to the 2000A/3000A ? Is it a matter of adding a driver to the embedded 6CE?
Even though the GUI probably has no click-able items, I'd love to be able to use the mouse-wheel. Unfortunately, only very few keys on the keyboard have any function outside of the text entry mode (ESC, arrow keys)
-
Hello.
Can someone confirm the firmware 3000XSeries.02.35.2013061800.cab is compatibility for my MSOX 2014A?
If NO, where can I download?
KILOBYTE, I readed that you has got it in your website but I don't find it.
Thanks.
-
Does anyone want to change the firmware new scope DSOX/MSOX 3000T ?
The 3000T looks to be not hackable.
The nk.bin.comp is encrypted (Verisign DIGITAL ID) and it looks like the infiniivisioncore.dll is integrated in the nk.bin.comp file.
I modified the keysight logo to a more known brand >:D
A real HP/Agilent/Keysight product now ;)
I wrote a little tool to extract the Bitmap data and the location from the dll, not finished yet but it works with 4byte aligned Bitmap data.
I upgraded to firmware 2.38, but the Keysight brand too ugly, want to switch back to Agilent, such as the picture red circle place. I would like to ask how to operate?
It's a bit complicated but i will create a short guide and some necessary file how to change the logo.
Look forward to your tutorial :-+
-
The 3000T looks to be not hackable.
The nk.bin.comp is encrypted (Verisign DIGITAL ID) and it looks like the infiniivisioncore.dll is integrated in the nk.bin.comp file.
Hi,
I bought a DSOX3014T and I'm ready to make tests for crack.
I checked too, the files are encrypted (Verisign DIGITAL ID).
Can you modify the file may be for 30 days license? :-/O
what do you think?
-
If the 30 day period would mean 30x24 = 720 scope working hours, this would be fine for many peoples.
I did not check the PCB pictures (andy maybe something similar was mentioned in the 49 pages above), but somewhere there probably will be a real time clock running. What if this clock is being stopped? Or running very sloooooooooow by changing its crystal?
Then at least the off-time of the scope would not count, which could be sufficent in many cases.
-
If the 30 day period would mean 30x24 = 720 scope working hours, this would be fine for many peoples.
I did not check the PCB pictures (andy maybe something similar was mentioned in the 49 pages above), but somewhere there probably will be a real time clock running. What if this clock is being stopped? Or running very sloooooooooow by changing its crystal?
Then at least the off-time of the scope would not count, which could be sufficent in many cases.
Even if this could work, and the software are great tools, you still missing the MSO and BW upgrade...
-
The 30 day trial option that comes with the scope is a kind of a "hack" from Agilent's side to give you the options without generating the licences and compromising the private keys used for signing the licenses. At least it was so in fw 2.38...
The scope uses some variables in its "secure storage" (which seems to be encrypted part of the flash).
When starting it checks if the demo was never used before. Then when you start it it remembers when the demo should expire, how many days you have left and current date.
When the scope starts up it checks the time difference between stored "current date" and current time and figures out how many days have passed.
It also checks if you are past the "demo expiry date"
It also remembers the "current date" if you manually set the clock. So dialing forward to 2176 or something like that ans starting the demo, dialing clock back... will not trick it.
So... 30 days trial period does not mean 720 working hours it means 30 realtime days (counted in seconds if I remember correctly)
if infinivision.dll is in the nk.bin.comp and this is encrypted/signed and verified somewhere in the boot process this means that hacking will be very difficult with high potential to brick the scope...
Oh... and the "Unfinalized software" message does not come from any signature and/or checksum failure... it is a side of patching the dll. You basically modify a function to always return false. The true value of that function is otherwise stored in the "secure storage"... :)
-
Soo glad to see this thread is still alive and kicking and people are still working on hacking these scopes! Thank you to everyone! Now we just need to get it all consolidated in one tutorial thread/post and itll be complete!
-
Firmware revision 2.39 has been released March 10, 2015.
The release notes do not report new features or bug fixes. Instead only two enhancements are listed:
- Bit rate measurement units have been improved.
- Reference memory skew behavior is improved in some situations.
The update seems rather minor and obscure...I wonder if it contains undocumented changes to the protection mechanisms, or blocking firmware downgrades etc.
-
3000T nk.bin.comp decryptor with source. No "illegal numbers" inside, they key is derived from file data.
-
More info on kernel/encryption/etc: there are two WinCE images in the scope - main one (nk.bin.comp) and recovery (recover.nk.bin.comp). It is unknown yet when recovery gets activated (this functionality is in bootloader which is not available for study). As far as I can see, recovery asks for USB stick with .ksx/.agx (firmware) file and installs it.
nk.bin.comp is signed and encrypted - can't modify it straight way. recover.nk.bin.comp is neither signed nor encrypted - can be modified.
nk.bin.comp decryption/verification takes place at install time (by LoadP500Flash.exe flasher), signature is not written into flash, so bootloader doesn't verify anything.
Conclusion: modify LoadP500Flash.exe in recovery to bypass sig check, flash modded recovery, enter recovery mode (how?), flash modded main via modded recovery... PROFIT.
-
Uboot is released under GPL license.
In the following post tnt wrote:
[url=https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg253106/#msg253106]https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg253106/#msg253106 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg253106/#msg253106)
[/url]
Not quite true. I addressed a request to Agilent directly to get the source for the GPL software distributed with the scope (u-boot mostly) and I received the source package back. I also posted a link to it in the first topic about this scope, probably more than a year ago.
Georg
-
Looks like telnet password is changed too. It is generated from instrument id now (still possible to get it, but I don't have a 3000T to try anyway)
-
Has anyone tried 2.39 ?
I want to buy an oscilloscope and the vendor has this version.
David.
-
I managed to get this hack to work with 200mhz bandwidth on my scope but has any one ever figured out how to load the hack to the internal flash?
-
I managed to get this hack to work with 200mhz bandwidth on my scope but has any one ever figured out how to load the hack to the internal flash?
I run it in the internal flash. The procedure *IS* documented way back in this loooong thread.... You'll need to look for it just like I did. Speeds up the boot time versus from a flash drive.
cheers,
george.
-
Dear all,
The hack works with 2.39 firmware, the new address in the dll is 0x27B0F4, and the values are always 00 00 A0 E3.
In the picture attached, the bandwidth did not work, because I had BW50, that I changed for BW20, which works fine now.
Edit : when I said "the hack", it means "booting on USB device on a scope with regular firmware 2.35 installed".
-
Blinding work, thanks :-+
-
I managed to get this hack to work with 200mhz bandwidth on my scope but has any one ever figured out how to load the hack to the internal flash?
I run it in the internal flash. The procedure *IS* documented way back in this loooong thread.... You'll need to look for it just like I did. Speeds up the boot time versus from a flash drive.
cheers,
george.
this forum thread is a mess to find stuff! I will try to find it. I haven't even figured out how to do the update yet. still running 2.35
-
I'll try to summarize, but only from the point where you have a device with regular 2.35 firmware. If you have a newest version, you have to search this topic (access to scope file system with lan, and fake the firmware version to allow downgrade, then the scope will be able to boot on usb key).
What you need :
* the python script attached to this post (I am *NOT* the author of this useful script. Linux users : replace \ by /...)
* the 2.39 firmware from Agilent
Steps :
* extract Agilent .cab firmware with you favorite program
* extract infiniiVision.cab file : you have now an infiniiVision folder
* chdir to infiniivision folder, copy dosetup.py to this folder
* python dosetup.py (linux users should chande \ by / in _setup.xml file !!!)
* then chdir to Secure/infiniiVision
* open infiniiVisionCore.dll with hex editor, and at @0x27B0F4, change 04 00 a0 e1 by 00 00 a0 e3, then save (could be a good idea to make a backup before...)
* copy all the infiniiVision and Startup directories to an USB key
* add the infiniivisionStartupOverride.txt (attached to this post) at the root dir of your usb key
* edit Startup/infiniivision.lnk file to your needs (add the options that you want - mine is attached, for 2000 serie).
I hope this is clear (and accurate) and will help.
-
I'll try to summarize, but only from the point where you have a device with regular 2.35 firmware. If you have a newest version, you have to search this topic (access to scope file system with lan, and fake the firmware version to allow downgrade, then the scope will be able to boot on usb key).
What you need :
* the python script attached to this post (I am *NOT* the author of this useful script. Linux users : replace \ by /...)
* the 2.39 firmware from Agilent
Steps :
* extract Agilent .cab firmware with you favorite program
* extract infiniiVision.cab file : you have now an infiniiVision folder
* chdir to infiniivision folder, copy dosetup.py to this folder
* python dosetup.py (linux users should chande \ by / in _setup.xml file !!!)
* then chdir to Secure/infiniiVision
* open infiniiVisionCore.dll with hex editor, and at @0x27B0F4, change 04 00 a0 e1 by 00 00 a0 e3, then save (could be a good idea to make a backup before...)
* copy all the infiniiVision and Startup directories to an USB key
* add the infiniivisionStartupOverride.txt (attached to this post) at the root dir of your usb key
* edit Startup/infiniivision.lnk file to your needs (add the options that you want - mine is attached, for 2000 serie).
I hope this is clear (and accurate) and will help.
This was pretty good instructions. Only thing for me was, the script didn't work. I didn't need to use it though, it does work with the new firmware.
I haven't been able to find the post where someone installs it to internal flash. Maybe i just don't understand what to do.
-
I haven't been able to find the post where someone installs it to internal flash. Maybe i just don't understand what to do.
Read this. (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg347345/#msg347345)
-
Hello Guys,
I'm lost with this. I try to read and read again this topic but I'm not able to find the way to do.
So I've got a DSO-X2002A 2.30 and I've hacked it with your help since 1 year and a half. But my USB key is crashed.
I remember that I've downloaded the firmware 2.35 from agilent website (unavailable now) extract it with WinCECAB and modify few hexadecimal word somewhere.
I don't remember a script or something like that.
If someone is able to summarize the way to do with USB key (without flash it inside the scope)
Because what tell cassopieia doesn't work for me. Python script work!
But Scope never boot!
Many Thanks
-
Does someone has a link to 2.35 version official firmware?
For DSO-X 2002A
-
Does someone has a link to 2.35 version official firmware?
For DSO-X 2002A
https://dl.dropboxusercontent.com/u/2063383/2000XSeries.02.35.2013061800.cab
-
OK !!! 8)
Thanks a lot.
I'm upgrading to 2.35 version and I will try again the cassiopieia summary!
I hope it was the problem.
|O |O |O |O
It wasn't the problem.
So now I've got a 2.35 version but the USB key doesn't want to boot.
Does someone has an idea?
Thx
-
Dear all,
The hack works with 2.39 firmware, the new address in the dll is 0x27B0F4, and the values are always 00 00 A0 E3.
In the picture attached, the bandwidth did not work, because I had BW50, that I changed for BW20, which works fine now.
Edit : when I said "the hack", it means "booting on USB device on a scope with regular firmware 2.35 installed".
Do you need to downgrade the 2.39 ? Or will it boot direct from USB with 2.35 modified ?
David.
-
Dear all,
The hack works with 2.39 firmware, the new address in the dll is 0x27B0F4, and the values are always 00 00 A0 E3.
In the picture attached, the bandwidth did not work, because I had BW50, that I changed for BW20, which works fine now.
Edit : when I said "the hack", it means "booting on USB device on a scope with regular firmware 2.35 installed".
Do you need to downgrade the 2.39 ? Or will it boot direct from USB with 2.35 modified ?
David.
You need to downgrade the scope to 2.35. You can then boot the modified 2.39 from USB.
-
Which files are at root of USB stick?
Only infiniivisionstartupoverride.txt and directories "startut" and "infiniivision" ??
-
Which files are at root of USB stick?
Only infiniivisionstartupoverride.txt and directories "startut" and "infiniivision" ??
Correct
-
Please could you check this?
I've made something wrong but I don't understand what.
This is an archive of the USB Stick Root.
Thanks again
https://www.wetransfer.com/downloads/51b0840e5968daab35aeac63c9dafc6020150326133429/79eaa210a732573f595c7f0971a5d47320150326133429/1fe488 (https://www.wetransfer.com/downloads/51b0840e5968daab35aeac63c9dafc6020150326133429/79eaa210a732573f595c7f0971a5d47320150326133429/1fe488)
-
Please could you check this?
I've made something wrong but I don't understand what.
This is an archive of the USB Stick Root.
Thanks again
https://www.wetransfer.com/downloads/51b0840e5968daab35aeac63c9dafc6020150326133429/79eaa210a732573f595c7f0971a5d47320150326133429/1fe488 (https://www.wetransfer.com/downloads/51b0840e5968daab35aeac63c9dafc6020150326133429/79eaa210a732573f595c7f0971a5d47320150326133429/1fe488)
Contents seem fine. Keep trying different USB sticks. I find that only 1 out of 10 work for me, and I have tried LOTS of different ones from LOTS of different manufacturers. Don't format it NTFS, use FAT.
-
SUPER!!!!
You are right.
Manufacturer of USB key is important.
THANKS A LOT to you and all people who create this and help to do.
:-+ :-+
-
If somebody on this forum has an extra bare board or assembled card for the LAN module, please PM. I prefer bare board with silkscreen and soldermask.
You know sometimes when you have a PCB house making the PCBs for you they sent you more than one.
David.
-
If somebody on this forum has an extra bare board or assembled card for the LAN module, please PM. I prefer bare board with silkscreen and soldermask.
You know sometimes when you have a PCB house making the PCBs for you they sent you more than one.
David.
pm sent...
cheers,
george.
-
This is the final schematic of my working lan card. I'm using an Digikey 1419-1021-ND for the magjack.
Did you release the layout files or gerbers for this?
-
This is the final schematic of my working lan card. I'm using an Digikey 1419-1021-ND for the magjack.
Did you release the layout files or gerbers for this?
I thought I did... The design is in PADS, so not sure how useful that is to most. Gerbers and pads file attached. Obviously there's no guarantee etc etc...
cheers,
george.
-
Has anyone used the FPGA programming port on the unit? My unit's flash is completely erased (was corrupted). When I turn the unit on, nothing at all happens.
-
So its posible to go back to the V2.35 with the help of telnet access.
Hi!
There is easier way to downgrade.
I have flashed 2.39 a long before I found this site. But now I have 2.35 with just PC and USB-key ;)
All has beed checked today on my MSO-X 2012 (originally it was standard 100MHz + MEMUP update with 2.39 firmware).
1. downgrade to 2.37 (it just works)
2. unpack 2000XSeries.02.37.2014052002.cab (ex with WinRAR)
3. extract file infiniiVisionLauncher.exe from infiniiVisionSetup.cab (2.37) (ex with WinCE CAB Manager)
4. unpack 2000XSeries.02.35.2013061800.cab (ex with WinRAR)
5. open infiniiVisionSetup.cab (from 2.35) file in WinCE CAB Manager, find infiniiVisionLauncher.exe on list and delete it
6. add infiniiVisionLauncher.exe (from 2.37 cab) to file list and set all properties like in old file (flags: uncheck all; location: \Secure\InfiniiVision; Hard-coded path checked)
7. file->save and exit WinCE CAB Manager
8. calc MD5 of edited infiniiVisionSetup.cab and update it in recipe.xml file
9. compress all files (ex with CabPack) from 2.35 firmware with edited infiniiVisionSetup.cab
10. flash new file
After this I reflashed scope once again with untouched 2.35 to update modified file but I don't know if it was necessary.
Also I don't know if there is possibility to downgrade directly from 2.39.
Now I have 2.35 in scope and 2.39 from USB (and I didn't need to use python script).
Starting scope from USB key:
NOT WORKS:
- Kingston DTSE9 (8GB)
- silicon power touch 830 (8GB)
- PQI connect 201 (16GB)
- all my no-name keys... (1GB..16GB)
WORKS:
- LEEF Spark 32GB
And I would like to thank everyone on this forum for files/instructions/descriptions.
-
Has anyone used the FPGA programming port on the unit? My unit's flash is completely erased (was corrupted). When I turn the unit on, nothing at all happens.
How did you manage to do this? What FPGA programming port do you mean? Are you sure the u-boot bootloader is corrupted, too? If not, you could enter commands with the serial port (see this post (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg260895/#msg260895) for the pins) and flash it again over network. Otherwise you really need to find and use some JTAG port.
-
What a lucky me.
I bought a DSO-X-2014A to replace my DSO-X2012A, I got the cheapest price on the internet for it (first part of been lucky)
I was nervous about it having the latest firmware and have to do the hack using the lan, thanks to georges80 for the board, but.....the unit came with software 2.36 ! I was able to downgrade to 2.35 using only the cab file, and since I already had the usb hacked software for my 2012A it was so easy to convert the new one ! Wooooooraleeee.
O0 :clap: :clap: :clap:
David.
-
Has anyone used the FPGA programming port on the unit? My unit's flash is completely erased (was corrupted). When I turn the unit on, nothing at all happens.
How did you manage to do this? What FPGA programming port do you mean? Are you sure the u-boot bootloader is corrupted, too? If not, you could enter commands with the serial port (see this post (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg260895/#msg260895) for the pins) and flash it again over network. Otherwise you really need to find and use some JTAG port.
Unfortunately it is fully erased. It was really badly corrupted. The RS232 port no longer outputs anything. The u-boot is basically completely gone. But there is another port on the PCB which I assume is the JTAG port of the FPGA...
-
Hugoneus, check this post for CPU JTAG https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg274963/#msg274963 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg274963/#msg274963)
Another possibility is BootROM USB flash loader mode:
ST's flash utility http://www.st.com/web/en/catalog/tools/PF257557 (http://www.st.com/web/en/catalog/tools/PF257557)
This mode should be activated by pulling BOOT_SEL pin (K18, check the picture) low at power on, but no reports on this so far. The PCB picture in JTAG post looks like there is a track in inner layer going to this pin, perhaps you can look closer. If it is tied straight to VCC then bad luck, otherwise try shorting it to GND and turning the scope on with USB cable attached to PC - does something pops up?
Also SPEAr600 RM says that ROM enters USB boot if normal (flash) boot fails regardless of BOOT_SEL state. But this requires primary bootloader in flash to be corrupted "correctly" so ROM doesn't recognize it (briefly shorting some flash DATA lines at power up is common way to simulate this state).
-
A quick look into xloader_image.bin shows that UBOOT image is loaded from SPI flash rather than from NAND. SOIC8 U3204 25Pxxx (hard to read) near the CPU must be it.
In worst case you can desolder it and program xloader_image.bin (at 0) and u-boot_image.bin (at 0x10000) manually - this should be enough to get u-boot up running.
-
Hi, I am loving this thread.
Does anybody have a link to download 2.37 or can I PM them for an email please :-)
-
Does anybody have a link to download 2.37 or can I PM them for an email please :-)
https://www.dropbox.com/s/y4y3d2xmj2gmgdb/2000XSeries.02.37.2014052002.cab?dl=0 (https://www.dropbox.com/s/y4y3d2xmj2gmgdb/2000XSeries.02.37.2014052002.cab?dl=0)
-
Does anybody have a link to download 2.37 or can I PM them for an email please :-)
https://www.dropbox.com/s/y4y3d2xmj2gmgdb/2000XSeries.02.37.2014052002.cab?dl=0 (https://www.dropbox.com/s/y4y3d2xmj2gmgdb/2000XSeries.02.37.2014052002.cab?dl=0)
Thank you very much, so are a good man :) :clap: :-+
-
Looks like telnet password is changed too. It is generated from instrument id now (still possible to get it, but I don't have a 3000T to try anyway)
Yes, the telnet password has been changed.
I have a 3000T, what to do to get the password?
-
It is possible to extract the programm files from an 3000T (Telnet)? can i run the 3000T-Software an an 3000 scope?
-
probably not, IIRC there's a bigger FPGA on the T model. I wouldn't mind paying an upgrade fee for the touch though. I keep grabbing the trigger level dial instead of the entry knob >.>
-
firmware 2.39 is successful crack without usb device and the band is 200Mhz.you can crack all option by the update the firmware(it is have changed some parameter of original firmware file).
-
Can you gentlemen do as unlock? DSOX2002A instructions with pictures ? ??? Because I do not fully understand how to do it safely . ;D
Thank you 8)
-
Today I requested budget for DSOX2024 used, and leave a document fragment.
.........Options
DSOX2MASK Mask Limit Testing
DSOX3VID DSOX3VID Video Triggering and Analysis
(this is not a std option availble for
DSOX2000 series but a special version)
-
I'm about to buy a DSOX2004A but before making a purchase I'd like to know if it's still possible to make the hack in recent firmware or is required to hack the hardware?
-
I'm in the same situation, I would buy DSOX2002A.
-
Is the 3000T series hackable? I read many posts but the answer doesn't seem clear to me.
-
I've been reading this thread since I got my new MS0-X-3052A about a week ago. I am mostly a hobbyist in my electronics interests and have no commercial use for this equipment. As such I feel fine about using the hacks discussed in this thread.
I wouldn't actually mind paying a fair price to get the scope's features enabled, but I have not found the licenses at anywhere near a reasonable price. So here I am.
The scope I got is apparently been sitting on some shelf for quite a while. It came with FW version 2.10, and it's manufacture date is 2012. It's a fine machine, and I got it for a very good price from eBay. It is completely new and in original packaging, and I'm happy with the purchase. After making my first pass at reading this thread I decided that I needed to upgrade the FW to version 2.35, as this seems to be the most preferred around here. I downloaded a copy from a link provided in https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg616147/#msg616147 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg616147/#msg616147) comment. I installed the upgrade, and it went just fine. So the scope now has FW version 2.35.
Next I proceeded to building a USB stick with the hack discussed earlier in the thread. Thanks to all the people involved in this ongoing project. This is one of the best threads on such a technical subject that I've ever seen, and I'm quite impressed with the fact that it is still active.
So my first version of the USB setup was a total mess, and of course it didn't work at all. Then I hunkered down and figured out the layout of the file system that is required, and I found that all the ones described herein have at least a few minor inaccuracies, and some are outright wrong. I started with the _setup.xml file found in the CAB FW file. I converted a copy of this file in stages into a set of commands for building the directory tree required for the USB stick, and populating it with the files appropriately renamed. The structure of the directories is most closely correctly given in the https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg364171/#msg364171 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg364171/#msg364171) post. It has just one minor inaccuracy. The web-socket-js folder should be inside the include folder. Thus:
\
+-infiniiVision
+-fpga
+-upgrade
+-web
+-css
+-help
+-image
+-include
+-web-socket-js
+-lib
+-Lxi
+-Identification
+-navbar
+-Startup
infiniivisionStartupOverride.txt
should be:
\
+-infiniiVision
+-fpga
+-upgrade
+-web
+-css
+-help
+-image
+-include
+-web-socket-js
+-lib
+-Lxi
+-Identification
+-navbar
+-Startup
infiniivisionStartupOverride.txt
I'm not actually sure how important this is, but I added this information in case it helps anybody.
Another minor problem I found was the case difference between some file names and references to them. One in particular seemed like a potential deal breaker is the one pointing to the infiniivisionLauncher.exe file in the infiniivision.lnk file in the Startup folder. Either the file was originally spelled with "vision" and the link with "Vision" or the other way around. I can't remember which at the moment. I'm aware that WinCE is most likely case insensitive like Windows, but I remember back in the ancient time when I was a Windows programmer I ran into a variety of exceptions to this rule. So I think some care should be taken here to match the cases properly. As a matter of fact some experimenting I did with testing this match led to USB stick configurations that behaved quite differently as I tried to boot the scope.
At any rate, I am now at the stage that I can produce USB sticks that will either seem to do nothing as I boot the scope, or else they hang it in a boot flashing-lights loop. I don't think I have yet successfully booted from a USB stick, partly because I haven't seen any error messages when I boot the scope. I also have not seen the list of enabled licenses change. Finally, I can always remove the USB stick after a successful boot without the scope rebooting, which seems to indicate that the scope must have booted from the internal FW.
In the meantime I've also enabled the 30 day trial, which may be affecting me in some way I don't understand yet.
I'll keep playing with this stuff until I get it to work. I think my next step is to setup some way to allow me to telnet to the scope. Then I can play with the internal code, which I have not yet done.
This is a lot of fun. Thanks to all participants!
-
Try lots and lots of different USB sticks, it's hit and miss which types work. For me it's been seriously hit and miss which sticks work with any particular scope. Never found one particular make that works with all scopes.
-
I also initially thought that different sticks behaved differently. However, it seems to me that if I populate a stick in the proper order right after I format it, I get much more consistent behavior. Here's what I do now all the time:
- I always format the stick before populating it.
- I copy the infiniivisonStartupOverride.txt file onto the stick first. I often get the hanging loop behavior if I don't do this.
- Next I copy the Startup folder. This also helps avoid the loop-di-loops, although to a lesser extent.
- The last thing I copy onto the stick is the infiniiVision folder.
-
I can send you a link to a doenload for a known good and working file structure for a 3000 series scope if you think that would take out one more variable?
-
Sure! I think I've got it right, but I don't really have a way to verify this. It would help either eliminate one avenue, or fix the problem altogether.
I appreciate your offer, and I will look forward to the link.
-
Try lots and lots of different USB sticks, it's hit and miss which types work. For me it's been seriously hit and miss which sticks work with any particular scope. Never found one particular make that works with all scopes.
My success rate with USB stick was 5 working like charm and one type not. All working units were Kingston. But there were people with USB stick from same vendor, exactly same type only small difference in size (eg 32G and 32G) and the boot does not work at all.
So it is really strange behavioral.
-
For me, the best rates were with Sandisk ones. And Kingston but the OLD ones, relly old (the first 'generation' of DataTravelers).
-
Sure! I think I've got it right, but I don't really have a way to verify this. It would help either eliminate one avenue, or fix the problem altogether.
I appreciate your offer, and I will look forward to the link.
https://dl.dropboxusercontent.com/u/2063383/Agilent%20DSOX3000%20237%20cracked.zip
-
Sure! I think I've got it right, but I don't really have a way to verify this. It would help either eliminate one avenue, or fix the problem altogether.
I appreciate your offer, and I will look forward to the link.
https://dl.dropboxusercontent.com/u/2063383/Agilent%20DSOX3000%20237%20cracked.zip
Thanks for the link. As it turns out, my USB setup was exactly the same as the one in the link. Not :o by this!
So my results are still the same, meaning: I may have a working hack, but I can't tell for sure because of the 30 day trial being active. On the other hand I may be playing the game of "Find the Right USB Stick", since I can in some circumstances get the loop-di-loop behavior.
Thanks a bunch anyway. You have helped me eliminate some variables here!
-
A question for the experienced among you: How can I tell whether I'm successfully loading the system from USB or from built in FW? I thought that when the system is loaded from the USB, one cannot unplug the USB drive without causing a system reboot. Is this always the case?
My startup is very clean and no different from the internal FW system startup. The only difference I can see is that under File Explorer menu I get a mounted USB as well as the usual "\Agilent Flash" folder, and the default open folder right after startup is the USB folder.
Any ideas?
-
My startup is very clean and no different from the internal FW system startup.
Since you are booting a hacked firmware image, you should be getting a warning after boot from the scope:
"System concerns detected:" etc etc
So, if you aren't getting the warning in the middle of the screen after booting (prior to then touching any button/knob), then you haven't booted the hacked version from the external USB flash drive.
cheers,
george.
-
I was afraid you might say that. :(
So I guess when I get the looping effect during startup then the system is actually trying to boot from the USB drive and failing. Since I am using verified bootable tree in my USB stick, then the only possibility left to explain the failure is the type of USB stick I'm using.
I think I'll order a bunch of different ones today!
-
:) ;) SUCCESS!!! ;) :)
I Have a fully functional scope booting from USB stick. I get no error messages during the boot, I just have to wait for the looping to start, and after approximately 6 or 7 loops, I get a message saying "booting from USB stick" on the second splash screen. This message is displayed in small red letters on the top left of the screen. Once the boot completes, I get an additional message in the center of the display. this one says "All options enabled" on the first line and "Press any key to continue" on the second line. The message goes away when I press a key.
The next thing I checked was the "About Oscilloscope" screen. Here I found a surprise. I have been populating the USB stick with the software I got from TopUser a few comments back. I had assumed the stuff to be derived from FW version 2.35. But Here I see the system version being 2.37. That's way cool. I may try to build a stick based on 2.39 later...
I went through some changes to my command line specification in infiniivision.lnk file. I ended up with the following command which enables the largest number of licenses:
86#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS -l CABLE -l TOM -l SGMC
Most of the enabled licenses have a '*' displayed next to them, but there is no expiration date indicated.
So here's what made the stuff work for me: I reformatted one of my USB sticks (on my Apple MacBook Pro) so the single partition present on the stick was modified from "MS-DOS (FAT)" which is FAT32 to "exFAT" which I believe is FAT16. I then loaded the files onto this stick in the order which I described in one of my earlier posts. That did the job. The USB stick I'm using is a very small one made by SanDisk, and it's a 8GB size.
That's way cool!
Thanks to all for the invaluable help.
-
:) ;) SUCCESS!!! ;) :)
I Have a fully functional scope booting from USB stick. I get no error messages during the boot, I just have to wait for the looping to start, and after approximately 6 or 7 loops, I get a message saying "booting from USB stick" on the second splash screen. This message is displayed in small red letters on the top left of the screen. Once the boot completes, I get an additional message in the center of the display. this one says "All options enabled" on the first line and "Press any key to continue" on the second line. The message goes away when I press a key.
The next thing I checked was the "About Oscilloscope" screen. Here I found a surprise. I have been populating the USB stick with the software I got from TopUser a few comments back. I had assumed the stuff to be derived from FW version 2.35. But Here I see the system version being 2.37. That's way cool. I may try to build a stick based on 2.39 later...
I went through some changes to my command line specification in infiniivision.lnk file. I ended up with the following command which enables the largest number of licenses:
86#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS -l CABLE -l TOM -l SGMC
Most of the enabled licenses have a '*' displayed next to them, but there is no expiration date indicated.
So here's what made the stuff work for me: I reformatted one of my USB sticks (on my Apple MacBook Pro) so the single partition present on the stick was modified from "MS-DOS (FAT)" which is FAT32 to "exFAT" which I believe is FAT16. I then loaded the files onto this stick in the order which I described in one of my earlier posts. That did the job. The USB stick I'm using is a very small one made by SanDisk, and it's a 8GB size.
That's way cool!
Thanks to all for the invaluable help.
Confirmed. This actually works. Thank you! I formatted my 8GB Samsung USB Stick as exFat in Windows and followed your instructions. My 4GB did not seem to work for booting. Needed to upgrade from an earlier FW to 2.35 (link in a post above) to be able to boot from my USB stick. It even boots up reasonably fast, which is nice.
-
I managed to successfully show the booting from USB message on my (temporary) DSO X 2000. It then booted and showed all options enabled. Is there a way to save this, so USB is not needed for every boot and the options are permanent?
Thanks.
-
Do these hacks work on the DSOX3000T series?
-
Do these hacks work on the DSOX3000T series?
No
-
So its posible to go back to the V2.35 with the help of telnet access.
Hi!
There is easier way to downgrade.
I have flashed 2.39 a long before I found this site. But now I have 2.35 with just PC and USB-key ;)
All has beed checked today on my MSO-X 2012 (originally it was standard 100MHz + MEMUP update with 2.39 firmware).
1. downgrade to 2.37 (it just works)
2. unpack 2000XSeries.02.37.2014052002.cab (ex with WinRAR)
3. extract file infiniiVisionLauncher.exe from infiniiVisionSetup.cab (2.37) (ex with WinCE CAB Manager)
4. unpack 2000XSeries.02.35.2013061800.cab (ex with WinRAR)
5. open infiniiVisionSetup.cab (from 2.35) file in WinCE CAB Manager, find infiniiVisionLauncher.exe on list and delete it
6. add infiniiVisionLauncher.exe (from 2.37 cab) to file list and set all properties like in old file (flags: uncheck all; location: \Secure\InfiniiVision; Hard-coded path checked)
7. file->save and exit WinCE CAB Manager
8. calc MD5 of edited infiniiVisionSetup.cab and update it in recipe.xml file
9. compress all files (ex with CabPack) from 2.35 firmware with edited infiniiVisionSetup.cab
10. flash new file
After this I reflashed scope once again with untouched 2.35 to update modified file but I don't know if it was necessary.
Also I don't know if there is possibility to downgrade directly from 2.39.
Now I have 2.35 in scope and 2.39 from USB (and I didn't need to use python script).
Starting scope from USB key:
NOT WORKS:
- Kingston DTSE9 (8GB)
- silicon power touch 830 (8GB)
- PQI connect 201 (16GB)
- all my no-name keys... (1GB..16GB)
WORKS:
- LEEF Spark 32GB
And I would like to thank everyone on this forum for files/instructions/descriptions.
I can confirm that this downgrade procedure worked on a msox-3054A from 2.37 to 2.35, used the 2000x 2.37-firmware provided somewhere in this thread, and 3000x 2.35 firmware.
Then went on with cassiopeia's guide to boot modded 2.39 firmware from a 4GB kingston usb-stick, worked first try. :-+
-
Sorry guys I haven't read the full thread but I wondered if this worked on the MSOX3054A? Is the MSOX3054A a good buy (refurbished)?
Does the hack offer all that is included in dsox3appbndl?
Thanks, I'm still reading and trying to decide if this is as good a deal as it seems.
-
Sorry guys I haven't read the full thread but I wondered if this worked on the MSOX3054A? Is the MSOX3054A a good buy (refurbished)?
Does the hack offer all that is included in dsox3appbndl?
Thanks, I'm still reading and trying to decide if this is as good a deal as it seems.
Farnell are doing a very good deal on the MSOX3054 if you go to the trade counter, I think it's £2800+VAT. Even on the website they are 60% off list price or something crazy.
-
Sorry guys I haven't read the full thread but I wondered if this worked on the MSOX3054A? Is the MSOX3054A a good buy (refurbished)?
Does the hack offer all that is included in dsox3appbndl?
Thanks, I'm still reading and trying to decide if this is as good a deal as it seems.
Farnell are doing a very good deal on the MSOX3054 if you go to the trade counter, I think it's £2800+VAT. Even on the website they are 60% off list price or something crazy.
It's 3K + vat on the website, any way of getting 2800+ without actually travelling there in person?
-
Sorry guys I haven't read the full thread but I wondered if this worked on the MSOX3054A? Is the MSOX3054A a good buy (refurbished)?
Does the hack offer all that is included in dsox3appbndl?
Thanks, I'm still reading and trying to decide if this is as good a deal as it seems.
Farnell are doing a very good deal on the MSOX3054 if you go to the trade counter, I think it's £2800+VAT. Even on the website they are 60% off list price or something crazy.
It's 3K + vat on the website, any way of getting 2800+ without actually travelling there in person?
No, it's a promotion to increase trade counter footfall. Can't help you out because I'm not around this week and I'm not sure when the promotion ends, could be today. Call trade counter and ask, they're open till 5:30. Tell them Mr B sent you!
EDIT: Ooops it's Saturday today, thought it was Friday...
-
I'm looking for the 2.35 firmware for a 2000 series scope. I only found 2.35 for a 3000 scope. Can someone please post it, because I have built myself a LAN adapter and need to downgrade my current 2.38 firmware so I can boot from USB. That would be awesome.
-
Please, is anyone able to provide me with the 2.35 files for DSOX2000 series?
Thanks!!!!
Solved - 2000 firmware seems to be identical to the 3000 Firmware, thus Toplosers link above is fine.
Swonkie, maybe you didn't read carefully :)
-
Thank you - indeed I didn't see that.
The operation was successful. My thanks to everybody who contributed valuable information to this thread.
I now have two of these unpopulated boards left (ordered from a PCB pool service, so they have soldermask and are cut to the correct shape already):
https://github.com/aewallin/DSOXLAN (https://github.com/aewallin/DSOXLAN)
(Thanks aewallin, although I wish you provided all the required files, ready to order. I also had to fix the soldermask layer over the connector.)
The LAN adapter works, but the scope shows a warning message on boot. Although, if you plan to patch the firmware, you will get a firmware related warning anyway and the LAN adapter warning won't show up anymore.
If anyone is interested in getting one of the PCBs and can suggest a way for me to ship it, without having to spend a lot of money or time, pm me.
I could also send the resistors and capacitor required, if that would help, but you have to order the magjack yourself (see link above).
-
Hi,
I am one of the happy recipients of Swonkies PCB. Unfortunately it's not working as expected. I used a RJ45 jack which has no LEDs so I left out the 220Ohms resistors and only soldered the 1nF cap and the 10Ohms resistor. The card is recognized by the device and I can configure the LAN settings as required. My router also seems to somewhat detect the scope as it is shown in the list with the configured IP address. But I cannot ping it and also the web ui does not return anything. Also telnetting into port 80 does not work.
Would be great if someone has an idea what could be wrong. Maybe I need to emulate the LEDs of the jack?
Thanks,
Campus
-
If LAN settings is available it looks like on scope side it is OK. Did you tried Wireshark to detect the traffic on LAN? It is too long, since I made testing of masked pins on LAN module.
-
Hmm, nmap returns no open port and the Message Analyzer shows that the scope never answers any packet. I've seen lots of SYN requests for a new http connection but no reply. Looks like the scope cannot send any packets.
-
LEDs aren't needed to make the card work - they are just pretty flashing lights...
Are you sure the PCB is seated well into the edge connector in the scope - it's pretty fine pitch. Contacts on the PCB clean and shiny?
My DIY lan card works just fine on my msox2024a with the latest firmware, so your card should work ok if it's all soldered well and making good contact on the main board.
cheers,
george.
-
LEDs aren't needed to make the card work - they are just pretty flashing lights...
I was also assuming that and because of that I did not solder the 220 Ohm resistors.
Are you sure the PCB is seated well into the edge connector in the scope - it's pretty fine pitch. Contacts on the PCB clean and shiny?
PCB is clean and looks nice and and seems to fit quite exact into the connector. I also tried several times pulling and adding the board again but no change in result.
My DIY lan card works just fine on my msox2024a with the latest firmware, so your card should work ok if it's all soldered well and making good contact on the main board.
Do you know which pins of the RJ45 are used for sending or receiving? Maybe I could beep them back to the contacts of the pcb.
One other thing I noticed is that https://github.com/aewallin/DSOXLAN lists a 100nF instead of the 1nF shown in the pcb layout. Is that an error or does it not matter that much?
Thanks,
Campus
-
The resistors are only for the LEDs.
My schematic is attached.
cheers,
george.
-
Check if the pcb is installed 'all the way to the end', I've had no response with one scope, that 'missed the last 1mm'.
A little more force, and it worked like a charm....
(please do not make any force that could damage the scope pcb or connector...)
-
Hi,
so far no luck here. I checked the connectors on the pcb under a microscope and can see little traces from the connecting pins so the physical layout seems to be ok. Then I replaced the 1nF cap with a 100nF cap as shown in Georges pdf. Then I added some leds and the missing resistors to complete the board. The leds light up but no change in behavior. The card is visible in the network which means arp displays the correct scope MAC address for the configured ip address. But I cannot receive any ip or ping packet back from the scope. I also tried different cables and machines in the network.
In my case both LEDs are always on and never blink or turned off. Is that normal behavior?
Thanks a lot to all of you helping me out with this issue,
Campus
-
Both LEDs off with cable unplugged. One LED lit when cable plugs in then the other LED flashes with various network traffic (just any traffic). My scope has a static IP. Various other devices on my network are also static IP. PC's/laptops/tablets/phones etc are all dynamic IP.
Here's the configuration of my scope in case it helps at all (below).
Anyhow, One LED should be flashing with traffic, not both solid permanently, so you have something not quite right in the hardware (imo).
cheers,
george.
-
Hi Campus. I would heartily recommend putting WireShark to work here. It would save a lot of guesswork and can usually show the problem area for further investigation.
I am keen to see if you can get this working as I would be very interested in doing the same myself. Is Georges80 the person producing the boards and if so are you planning on producing any more?
-
Hi,
I got the pcb from Swonkie who made a small batch of them. I now believe the reason why it's not working is the mag jack. According to the datasheet of the Digikey 1419-1021-ND (http://www.trpconnector.com/pdfs/6605758.pdf (http://www.trpconnector.com/pdfs/6605758.pdf)) the RJ45 pins are re-routed inside the jack, so pin 1 on the pcb is not pin 1 on the RJ45 side. My replacement jack is a simple 1-to-1 jack where each pin goes through directly (http://www.reichelt.de/Modularkabel-stecker-etc-/MEBP-8-8S/3/index.html?&ACTION=3&LA=2&ARTICLE=11372&GROUPID=848&artnr=MEBP+8-8S&SEARCH=Modularkabel%2C+-stecker+etc (http://www.reichelt.de/Modularkabel-stecker-etc-/MEBP-8-8S/3/index.html?&ACTION=3&LA=2&ARTICLE=11372&GROUPID=848&artnr=MEBP+8-8S&SEARCH=Modularkabel%2C+-stecker+etc)).
So I guess I need to find a place where I can get a jack with the same mapping.
-
I now believe the reason why it's not working is the mag jack.
That's what I would suggest too - compare the exact pinouts of your magjack to the suggested one.
As I said in the PM, I have used the board with a 1nF capacitor and it works very reliably.
By the way, telnet is on the default port 23, not on port 80.
-
Hi again,
I finally found a distributor in Europe who ships a pin compatible mag jack. :-+ When it has arrived I will give it a try and report back whether it works.
@Swonkie: I know that telnet runs on port 23. When saying "telnetting into port 80" I meant redirecting telnet into port 80 because it's the easiest way to check whether a port is open. I could then manually make a HTTP request to check the web server response.
@Kintekobo: I analyzed the network traffic but never saw any reply packet coming from the scope.
-
Hi again,
today I received a compatible Mag Jack and I replaced the existing jack and also removed the no longer required LED resistors. And I couldn't believe it but it worked immediately. DHCP works and also static IP works. This is really cool. Thanks a lot to george80 and Swonkie and all the others helping me with this problem.
Has some of you any experience with the performance of the different client UIs available? Is the Java-based client more responsive than the HTML5 one? I don't have Java installed and could not test it so far.
Thanks again,
Campus
-
Hi folks!
Can I unlock DSOX3104A with FW 2.41?
Mark.
-
I just downloaded the v2.41 firmware from Keysight --- a lot has changed as far as "infiniiVisionSetup.cab" is concerned:
- The file "infiniiVisionCore.dll" no longer exists! :-\
- "/Secure/Startup/infiniivision.lnk" is empty (rather than contain default link to infinivisionlauncher.exe, which itself exists)
- "/Secure/Startup" directory is missing many files present in firmware v2.39 and earlier
- There is a new "/Secure/help" folder containing what looks like language packs
Did anyone look into changes in the boot process or allowing options in firmware v2.41? infiniiVisionCore.dll was large file at 16.5MB ...there's no new files anywhere near that size.
I attached the release notes for v2.41. The enhancements/fixes over v2.40 are pretty minor, but 2.40 introduces some networking improvements:
+ negative duty cycle measurement
+ Ax+B operator now allows negative A
+ DVM handles channel invert more appropriately
Does anyone have the v2.40 firmware update from Keysight? I would like to take a look; unfortunately no longer available on Keysight website...
Any thoughts about the changes to the firmware, potential to downgrade etc.??
-
Hi folks!
Can I unlock DSOX3104A with FW 2.41?
Mark.
Buy IDA Pro and it can be possible. Downgrade to 2.3x seems to be better option :)
The changes between latest version 2.41 and 2.35 are minor.
-
A quicker way is to do a binary compare and identify if and where the to-be-patched location has been moved to.
-
...
I attached the release notes for v2.41. The enhancements/fixes over v2.40 are pretty minor, but 2.40 introduces some networking improvements:
+ negative duty cycle measurement
+ Ax+B operator now allows negative A
+ DVM handles channel invert more appropriately
It might not matter much to others, but in 2.41 I'm happy they finally seem to have fixed the bug where the scope issues multiple netbios name queries back to a host connecting to the SCPI port. If there wasn't a netbios listener on the host, the scope would hang for about 8 seconds each time. Netbios has nothing to do with SCPI, or TCP connections for that matter.
That only took 2 1/2 years to fix.
It would be nice to have the REAL list of issues fixed and other changes in each release, and not some fluffy little list deemed harmless for public consumption. Without an option to downgrade, I want to know ALL the changes when I risk a one-way upgrade.
EDIT: minor typo.
-
Does anyone know if the options will expire if I set the clock forwards before starting the built-in trial? I set mine to 2115, started the trial, then set the clock back to 2015. Someone mentioned it earlier in the thread but I didn't see an answer, maybe wishful thinking... :-//
-
Setting the clock has no impact on built-in trials.
-
Does anyone know if the options will expire if I set the clock forwards before starting the built-in trial? I set mine to 2115, started the trial, then set the clock back to 2015. Someone mentioned it earlier in the thread but I didn't see an answer, maybe wishful thinking... :-//
This works on 6k series ( non X). But not on 3kX and 2kX series scopes.
-
A quicker way is to do a binary compare and identify if and where the to-be-patched location has been moved to.
Hi nctnico, perhaps you are replyig to me? If so regarding patch location in v2.41, the binary file infiniiVisionCore.dll is missing from the .cab file. Perhaps a big restructure of the firmware? I didn't find any other .dll file which could have replaced it.
Does anyone have a copy of firmware v2.40?
-
Hi, just found this great thread.
I do have a DSO-X2014A with FW 2.41, no LAN module.
Are there any way to downgrade to 2.37?
Please advise, thx
-
Could you please help me to hack my DSO-X 2012A with firmware 02.10. I asked plesa and he said I need 2.35 firmware version to get. Is there anybody who has this firmware and successfully hacked this series and could help with this procedure?
-
There are untouched firmware files:
https://www.dropbox.com/s/mt6w8fj6oqer51g/2000XSeries.02.35.2013061800.cab?dl=0 (https://www.dropbox.com/s/mt6w8fj6oqer51g/2000XSeries.02.35.2013061800.cab?dl=0)
https://www.dropbox.com/s/y4y3d2xmj2gmgdb/2000XSeries.02.37.2014052002.cab?dl=0 (https://www.dropbox.com/s/y4y3d2xmj2gmgdb/2000XSeries.02.37.2014052002.cab?dl=0)
https://www.dropbox.com/s/c4u6zukxjthj76a/2000XSeries.02.39.2015022602.cab?dl=0 (https://www.dropbox.com/s/c4u6zukxjthj76a/2000XSeries.02.39.2015022602.cab?dl=0)
And read this:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/585/ (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/585/)
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/735/ (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/735/)
-
When I'm trying to load FW 2.35, 2.37, or 2.39 instead of current fw 2.41 on DSOX2014
I do get this "Error: The file did not load correctly" after a while
I did try the 'Secure Erase' as sugested in another thead for the same error but lower fw, it did not help.
Would it be possible to go back from 2.41 if I had a LAN card?
-
Hi all
It looks like I might have to send my scope in for repair under warranty. Bit concerned that they might upgrade the firmware whilst it is there. Has anyone been able to downgrade from the latest firmware to 2.35 successfully?
Thanks
Trev
-
I did an update to 2.41 on my scope.
The good news: Still the same telnet login :), Star Trek Screensaver still working and a hacked infiniivision with all options can be started over telnet.
The bad news: The infiniivision exe & dll is now in the \windows folder. So it's not possible to change the files because this folder is "read only".
I tried also infiniiVisionInstallService.exe from an older version to load an older firmware version but the exe doesn't run.
I think the only way to downgrade is to try directly \windows\loadP500Flash -u ceImage1 %TEMP%\nk.bin.comp with the high risk to brick the scope. :-BROKE
At the moment I won't risk to brick my scope because i have the license bundle on it and the only option that is missing is the MSO option which is rarely used.
-
Still I cant get my oscilloscope boot from usb that has hacked 2.39. I get black background and agilent logo only only, it takes I while, longer then normal boot but it boots into 2.35. My structure on the usb looks like this:
L:\
????Agilent Flash
? ????config
? ????wfmMem
????Secure
? ????infiniiVision
? ? ????fpga
? ? ????upgrade
? ? ????web
? ? ????css
? ? ????help
? ? ????image
? ? ????include
? ? ? ????web-socket-js
? ? ????lib
? ? ????Lxi
? ? ? ????Identification
? ? ????navbar
? ????Startup
????Temp
Is it correct ?
-
Do you have infiniivisionStartupOverride.txt file in root?
Upgrade to 2.35 firmware and try multiple USB sticks.
-
Yes I do. It's different from the normal boot because it takes a bit longer time and the logo with mountains doesn't show up.
I managed to make it work with a help of my friend. :-+ I wonder why nobody made and posted a link to a usb image to make it easier for people. Is it forbidden or what ?
-
Did build a LAN interface and it does work :) Still on FW2.41 I can use the scope over WEB
If I go for the "Firmware Version" and browse the the filter are Keysight X-Series files(*.ksx) or Agilent X-Series files (*.agx), so here it will not work with 2.37 cab file
I can telnet on port: 5024 no password required and I can controll the scope in respec to "Oscilloscopes Programmer's Guide" like :SINGLe or :RUN
If I telnet on port 23 I'm required to enter user/ pass and the infiniivision / skywalker1977 are incorrect
Any hint?
-
The first login on telnet will fail every time on my scope.
The second login should work.
-
Thx kilobyte, you are right the login / pass needs to be typed twice :)
So now I have access for the promt
Pocket CMD v 6.00
\> dir
Directory of \
01/01/98 12:00p <DIR> Network
01/26/16 01:27a <DIR> Application Data
01/26/16 01:27a <DIR> profiles
01/26/16 01:27a <DIR> Documents and Settings
01/26/16 01:27a 23 Control Panel.lnk
01/26/16 01:27a <DIR> My Documents
01/26/16 01:27a <DIR> Program Files
01/26/16 01:27a <DIR> Temp
01/26/16 01:27a <DIR> Windows
Found 9 file(s). Total size 23 bytes.
1 Dir(s) 15499264 bytes free
I can kill infiniivisionLauncher and start it again ...
processMgr.exe kill infiniivisionLauncher.exe
infiniiVisionLauncher -l All
When the soft restarts I still only have the few original options
I also tried FTP standard port as well and it only gives access for 2 folders called webdata and webupdate ... both empty
Any idea how to move on from here?
-
Ok... got a bit futher 8)
So basic the scope do have FW2.41 installed
I hava a USB stict with the modified FW2.37
From telnet
\windows> cd \usb
\usb> cd infiniiVision
\usb\infiniiVision> processMgr.exe kill infiniivisionLauncher.exe
\usb\infiniiVision> infiniiVisionLauncher -l All
Our command line is -l All
*** Installing License: All Licenses
-
Wiljan, can I just confirm that over Telnet with FW 2.41 you are able to enable all licenses? You have to telnet and do the procedure each time you power up but it does work?
-
Wiljan, can I just confirm that over Telnet with FW 2.41 you are able to enable all licenses? You have to telnet and do the procedure each time you power up but it does work?
Yes I have FW2.41 flashed in scope and a USB stick with FW2.37 modified.
I have to Telnet into the scope and run the FW2.37 from USB each time if I want all licenses enabled.
-
That is awesome!
-
Awesome indeed, might have to bump up the price of that MSO-X-3054 I've got posted for sale now!
-
Ok... got a bit futher 8)
So basic the scope do have FW2.41 installed
I hava a USB stict with the modified FW2.37
From telnet
\windows> cd \usb
\usb> cd infiniiVision
\usb\infiniiVision> processMgr.exe kill infiniivisionLauncher.exe
\usb\infiniiVision> infiniiVisionLauncher -l All
Our command line is -l All
*** Installing License: All Licenses
I have a 2.41 scope too, and I took your directions and wrapped it up into a VBScript to do this automatically. Note: I am NOT a VBScript programmer, in fact it's a technology that I've spent a good deal of my career avoiding, mostly but not always successfully. However, if you want to script up a nasty macro key pusher to an async telnet interface, sometimes needs must.
First, I formatted a USB stick as exFAT and copied the contents of the zip file in this post https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg535755/#msg535755 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg535755/#msg535755)
I renamed the infiniivisionStartupOverride.txt file on the root of the usb stick with .old on the extension so the scope doesn't just loop at bootup, and I can just leave the USB stick permanently plugged in.
You will need to make sure Windows has its Telnet client installed, you do this from Control Panel -> Programs -> Programs and Features -> Turn Windows features on or off, and select the Telnet client.
Copy the attached file to your computer and remove the .txt extension.
You can run the x3000a.vbs directly from the command line or make up a shortcut, but either way you need to specify on the command line the IP address or hostname of the scope, for example
x3000a.vbs a-mx3054a-12345
or
x3000a.vbs 192.168.50.123
Note that because it's a dumb key pusher, it has limitations. Firstly you might need to alter the delays for your particular PC, and secondly if you change focus to a different app or window, it'll start pumping in characters into that window rather than the telnet session, so I'd let it do its stuff until someone better than me can come up with something better. You could also significantly reduce the "WScript.Sleep 45000", but I left it like that because there is some useful feedback to the end user.
-
Great work, thanks for this script.
-
Thx Howardlong, script works here as well :) I made a small bat file with the IP address included
I have been thinking when having 2.41 on scope and loaded 2.37 from usb stick.
If it would be save to flash the 2.37 (and if that not possible since it's already loaded than take the FW2.35) first and then 2.37 ?
-
Ok... got a bit futher 8)
So basic the scope do have FW2.41 installed
I hava a USB stict with the modified FW2.37
From telnet
\windows> cd \usb
\usb> cd infiniiVision
\usb\infiniiVision> processMgr.exe kill infiniivisionLauncher.exe
\usb\infiniiVision> infiniiVisionLauncher -l All
Our command line is -l All
*** Installing License: All Licenses
This can be easily ported to Python and RPi2 platform which can be powered from scope itself. And run on startup or by Cron.
-
Indeed, this morning I finally found a use for one my original RPi's that's been stuck in a drawer.
It all sits in the probe compartment and runs automatically at scope boot up.
The RPi is powered from a hub that's connected to the rear USB port. This hub also has the USB stick with the 2.37 code.
I wrote an "expect" script (attached) and added it to the rc.local so it runs on boot up.
Quick setup
Install Rasbian Jessie
sudo apt-get install telnet
sudo apt-get install expect
Place the attached x3000a.txt script in your /home/pi directory, and rename it to x3000a.
To run it immediately from your /home/pi directory, run the following (setting your scope's IP address or host name as appropriate):
expect x3000a 192.168.50.123
Next steps (running automatically at power up)
Power your RPi from one of the USB ports so it powers up and boots when the scope initially boots.
Raspberry pi configuration changes in GUI:
set to cli only (Note that you can always go back into the gui with startx from the command line)
wait for network
I recommend using a static IP address on the RPi and the scope so this will work without a DHCP server if you're off your LAN (a straight through CAT5 patch cable between Pi and scope works in this case). It looks like some well meaning individual chose to change how static addresses are set up in RPi, rendering hundreds of pages on the subject obsolete. It's now in /etc/dhcpcd.conf.
Add to the bottom of /etc/dhcpcd.conf file your Pi's static IP address details:
interface eth0
static ip_address=192.168.50.123/24
static routers=192.168.50.1
static domain_name_servers=192.168.50.1
To make it work automatically at boot* add the following to your /etc/rc.local file before the "exit 0", setting the IP address to your scope's, and note the "&" on the end, it is not a typo!
/usr/bin/expect /home/pi/x3000a 192.168.50.123 &
*I strongly recommend getting it to work from the command line first with a monitor before setting it up to work "headless" at boot time in case some of the timings don't work out for you.
One caveat: remove any USB stick in the front before boot, that appears as \usb with the rear one \usb2.
Edit: added some clarifications and one correction to a typo on the static IP address config.
-
Indeed, this morning I finally found a use for one my original RPi's that's been stuck in a drawer.
It all sits in the probe compartment and runs automatically at scope boot up.
The RPi is powered from a hub that's connected to the rear USB port. This hub also has the USB stick with the 2.37 code.
I wrote an "expect" script (attached) and added it to the rc.local so it runs on boot up.
In brief:
Install Rasbian Jessie
sudo apt-get install telnet
sudo apt-get install expect
Raspberry pi configuration in GUI (Note that you can always go back into the gui with startx from the command line)
set to cli only
wait for network
Place the attached x3000a.txt script in your /home/pi directory, and rename it to x3000a.
I recommend using a static IP address on the RPi and the scope so this will work without a DHCP server if you're off your LAN. It looks like some well meaning individual chose to change how static addresses are set up in RPi, rendering hundreds of pages on the subject obsolete. It's now in /etc/dhcpcd.conf
add to the bottom of /etc/dhcpcd.conf file
interface wlan0
static ip_address=192.168.50.123/24
static routers=192.168.50.1
static domain_name_servers=192.168.50.1
To make it work at boot, add the following to your /etc/rc.local file before the "exit 0", setting the IP address to your scope's:
/usr/bin/expect /home/pi/x3000a 192.168.50.123 &
One caveat: remove any USB stick in the front before boot, that appears as \usb with the rear one \usb2.
You are pretty fast, well done!! :-+
-
Edit: the following only applies if your scope already has 2.41 installed.
Interestingly, the telnet kill-and-launch-from-USB method (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg850610/#msg850610)works with a USB key made with the current 2.41 3000XSeries.02.41.2015102200.cab (http://www.keysight.com/main/software.jspx?ckey=2014548&lc=eng&cc=GB&nid=-32540.1150205&id=2014548) firmware directly downloaded from Keysight extracted with the Python script too.
But, with 2.41, there is apparently no need to add any additional files to the USB root, patch a dll, or change any .lnk file.
In short, copy just the infiniiVision directory generated by the dosetup.py script to the USB root.
dosetup.py is in the agilent.zip attachment in this post (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg636470/?topicseen#msg636470).
Here are modified instructions to prepare a clean FAT32 formatted USB stick (my modifications in bold italics), and assumes that you have Python 2.7 installed in the default C:\Python27 in Windows.
* extract Agilent .cab firmware with you favorite program (I used 7zip)
* extract infiniiVisionSetup.cab file : you have now an infiniiVisionSetup folder
* chdir to infiniivisionSetup folder, copy dosetup.py to this folder
* c:\Python27\python dosetup.py (linux users should chande \ by / in _setup.xml file !!!)
* then chdir to Secure/infiniiVision
* copy all the infiniiVision and Startup directories directory to an USB key (ie, there should be a single infiniiVision directory on the root of the USB key with a bunch of files and directories within it)
To run:
- Insert only the prepared USB stick, remove any other sticks
- Boot the scope up as normal, connected to your LAN
- Run either the Linux escape script here (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg854828/#msg854828) or for Windows the vbscript here (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg854288/#msg854288).
Notes:
- You get a "WARNING: Unfinalized Software" in red on the splash screen when it's loading from the USB stick.
- "System concerns detected: OS version is not correct. Please reload system firmware." once booted can be ignored.
- It appears that settings get lost on starting, and it's reset back to defaults, although you can still load up stored setups.
- For 2.39, it looks like you still need to use a hacked dll (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg635700/#msg635700), but not for 2.41.
- Boot time to the native 2.41 is 40s, and a further 18s is needed to start the liberated 2.41: it is much longer for older versions as they boot the large DLL from USB rather than flash
-
Thx Howardlong, script works here as well :) I made a small bat file with the IP address included
I have been thinking when having 2.41 on scope and loaded 2.37 from usb stick.
If it would be save to flash the 2.37 (and if that not possible since it's already loaded than take the FW2.35) first and then 2.37 ?
I haven't figured out how to downgrade a 2.41 scope's flash, it doesn't seem to like it from USB stick or via the web interface as far as I can see, operator error excepted of course!
-
This has turned out to be even easier than I thought on a 2.41 scope, you don't even need a USB stick, just a telnet connection.
A VBscript "x3000aV2.vbs.txt" is attached. Remove the ".txt' from the file name. Setup a shortcut to x3000aV2.vbs with the IP address or hostname of your scope as the first parameter. You will need Windows' Telnet client installed (in Windows Features).
It turns out that the \secure folder is still there but hidden, the script runs the following from telnet:
cd \secure\infiniivision
processmgr kill infiniivisionlauncher.exe
infiniivisionlauncher -l all
-
Thanks for your hard work Howard! I have one possibly stupid question, is this all possible without a DSOXLAN or home-made equivalent?
-
Thanks for your hard work Howard! I have one possibly stupid question, is this all possible without a DSOXLAN or home-made equivalent?
No, because you cannot connect to telnet over USB :( Homemade DSOXLAN adapter will work.
-
Thanks for your hard work Howard! I have one possibly stupid question, is this all possible without a DSOXLAN or home-made equivalent?
I don't know what's available on the board itself other than a serial line that I am sure will work with u-boot. Whether it offers a serial terminal in Windows CE, I don't know, but Windows isn't Linux so I wouldn't be at all surprised if that's not available. The last time I did anything seriously with Windows CE was about 1997 when it first came out! I do have two Windows CE 6.0 dev boards here gathering dust, if I get chance I'll try to blow off the cobwebs.
-
Do these hacks work on the DSOX3000T series?
No
Did someone manage to make these hacks work on the DSOX3000T series now? ::)
-
I followed the instructions HowardLong put up using the Lan connector and the VB script. Interestingly my scope is a 3024A but when I did the -l all option it downgraded me to 100Mhz. I had to change the command to "-l BW20 l-all"
This then worked. When I reboot after the script the network card needs its configuration reset to auto as all the options are lost. Within a few seconds though all is back up again.
Regarding the DIY Lan card. After reading through this thread I picked up the bit about the DIY lan cards and found the difference between the center tap configurations. My original card had a 1uF connected to ground and was rebooting the scope. It seems the more successful versions have the 10R and 1nF circuit connected to the center tap. I modded my card to that configuration and the card does work but I get the message indicating the card is faulty upon boot. My wiring is the same has georges80 circuit but maybe its because its a 3000 series and not the 2000? Has anyone got a 3000 series scope working with a diy lan card and do not get the error message?
-
I followed the instructions HowardLong put up using the Lan connector and the VB script. Interestingly my scope is a 3024A but when I did the -l all option it downgraded me to 100Mhz. I had to change the command to "-l BW20 l-all"
This then worked. When I reboot after the script the network card needs its configuration reset to auto as all the options are lost. Within a few seconds though all is back up again.
Doh! Schoolboy error, sorry. My 3054A dropped to 350MHz. "-l bw50" added after the "-l all" fixed it. Sorry for missing that.
-
What you created is fantastic, thank you.
Howard, did you buy the proper LAN adapter? Does the scope forget its network setting when you execute the script?
-
What you created is fantastic, thank you.
I merely follow in the footsteps of giants. Almost all of the work was already done.
Howard, did you buy the proper LAN adapter? Does the scope forget its network setting when you execute the script?
I do have a proper Keysight DSOXLAN. I don't know where it's getting the LAN data from, it's showing nonsense but I can still telnet into the address I originally set up in the standard boot. It prints too, so I guess there's something else going on which is cosmetic only as far as I can see, but stand to be corrected.
I have a CE 6.0 dev environment up now, and an ARM demo board running it which it doesn't matter if I brick, I can always bring that back to life. I can create my own .exe's that run fine on the scope, in console mode at any rate. To their credit Agilent/Keysight threw out the standard Windows UI and copied pretty faithfully their awesome Ui from their previous vxWorks scopes, so I'm not even sure yet if they use the Windows GDI, the consistent API that sits between programmer and graphics device.
The problem of the IP address and the way the scope starts up in default mode I feel maybe related, perhaps it's simple and just needs to be started in a particular directory to pick up the settings, I don't know.
-
Okay, I think I have gotten to the bottom of the DIY Lan cards.
From reading back through this thread ( again ) I noticed that some people who did not see the error message regarding the LAN card were running hacked software.
I find that after I did the mod to correct the centre tap of the transformers and shorted pins 78/80 my lan card works perfectly but I get the error message on first boot for firmware 2.41 ( unhacked ). But when I run Howards script, the scope reboots with all licenses and does not display the error.
So I think the error is software related and not hardware. Not sure if anyone else can prove this but I feel comfortable the LAN card is working fine on 3000x scopes
-
What would be the best firmware version to upgrade a DSOx2000 scope with current firmware version 1.21.2011072803? The only firmware on Keysight's page is 2.41 and that firmware does not seem to be hack-able.
-
Everything is hackable, question is only time and effort including 2.41.
The best will be 2.36 or 2.36 booted from USB stick.
-
What would be the best firmware version to upgrade a DSOx2000 scope with current firmware version 1.21.2011072803? The only firmware on Keysight's page is 2.41 and that firmware does not seem to be hack-able.
2.41 is easily liberated but you need a LAN card and be able to double click an icon on your desktop once the scope's booted to the second splash screen with the black background. Depending on your setup that may or may not be easily feasible: as I work in mixed signal I always have a PC permanently at the bench so it's not a big deal.
-
I don' have a LAN card for my scope. I did some digging through this thread it looks like 2.35 is the best version. I will probably start by booting from a USB drive since its a bit safer see if it works out. I found the original 2.35 firmware in the thread I still need to find what needs to be modified to get the hack to work.
Also I saw a teardown of the agilent MSO probes, it doesn't look like there is any circuitry in them so would any header extension get MSO capability once the MSO function is unlocked?
-
I don' have a LAN card for my scope. I did some digging through this thread it looks like 2.35 is the best version. I will probably start by booting from a USB drive since its a bit safer see if it works out. I found the original 2.35 firmware in the thread I still need to find what needs to be modified to get the hack to work.
Also I saw a teardown of the agilent MSO probes, it doesn't look like there is any circuitry in them so would any header extension get MSO capability once the MSO function is unlocked?
There is step by step description in this thread.
For MSO just the header will do the job, no identification of genuine probe.
Check ebay for original MSO probe.
-
There *IS* circuitry in the MSO probe - it's a 90k (nominal) resistor in series with the signal and INSIDE each of the flying lead (grey plastic ends) where the little ground pins go. So you can't just take a header and wires and call it done.
cheers,
george.
-
There *IS* circuitry in the MSO probe - it's a 90k (nominal) resistor in series with the signal and INSIDE each of the flying lead (grey plastic ends) where the little ground pins go. So you can't just take a header and wires and call it done.
cheers,
george.
That is correct. I also suspect that the wires in the ribbon cable itself may be resistive/lossy. If all you're doing is low speed stuff it's certainly possible you could sling something together, but georges80 is correct, the probes are not just a ribbon cable.
-
Hi,
I haven't checked but some of the cables and probes from the old logic analyzer might work. I am think 1650, 1660 series instruments. They have a similar divider.
Regards,
Jay_Diddy_B
-
Certainly those from the old 54622d and 54642d work.
-
There *IS* circuitry in the MSO probe - it's a 90k (nominal) resistor in series with the signal and INSIDE each of the flying lead (grey plastic ends) where the little ground pins go. So you can't just take a header and wires and call it done.
cheers,
george.
That is correct. I also suspect that the wires in the ribbon cable itself may be resistive/lossy. If all you're doing is low speed stuff it's certainly possible you could sling something together, but georges80 is correct, the probes are not just a ribbon cable.
The weaved cable signal wires are resistive/lossy. They are nominal 190 ohm wires on mine. The ground wires in the weave ARE zero ohms.
I did some research/discovery of the cables, since I used them with an adapter I made to allow me to use them into the msox2000 analog front end for serial decoding. The 2000 series performs serial decode using the 4 channel analog inputs unlike the 3000 that uses the LA inputs.
cheers,
george.
Edit to correct that the signal wires are resistive. (The ground wires are NOT).
-
The weaved cable wires are not resistive/lossy. They are just nominal 0 ohm wires.
george.
The weaved cable are resistive and forms lossy transmission line, patendted by HP enginner:
http://www.google.com/patents/US4777326 (http://www.google.com/patents/US4777326)
My cable has 120 cm long an has 180 Ohms.
Georg
-
Has anyone figured out howmtomtalemthe pod thingy apart on these? I have an old wone that's missing a couple of final probe leads, I don't mind taking it apaaaaarrt (TM) and measuring it if it's easy enough, but an obvious non-destructive disassembly alluded me last time I looked.
-
Hi Howard and the group,
I am not entirely sure which 'thingy-ma-bob' you are talking about. If you are talking about this part:
(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=204770;image)
These photographs will help you unlock the secrets.
(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=204772;image)
(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=204774;image)
Regards,
Jay_Diddy_B
-
The weaved cable wires are not resistive/lossy. They are just nominal 0 ohm wires.
george.
The weaved cable are resistive and forms lossy transmission line, patendted by HP enginner:
http://www.google.com/patents/US4777326 (http://www.google.com/patents/US4777326)
My cable has 120 cm long an has 180 Ohms.
Georg
Yes, you are correct, around 190 ohms for the data wire on the cable and zero ohms for the interleaved ground wires. Even more magic than I thought to maintain good impedance match along the cable.
...and thus an even better reason to source the correct cables for the scope if one purchased the none msox version.
cheers,
george.
-
The weaved cable wires are not resistive/lossy. They are just nominal 0 ohm wires.
george.
The weaved cable are resistive and forms lossy transmission line, patendted by HP enginner:
http://www.google.com/patents/US4777326 (http://www.google.com/patents/US4777326)
My cable has 120 cm long an has 180 Ohms.
Georg
Yes, you are correct, around 190 ohms for the data wire on the cable and zero ohms for the interleaved ground wires. Even more magic than I thought to maintain good impedance match along the cable.
...and thus an even better reason to source the correct cables for the scope if one purchased the none msox version.
cheers,
george.
Genuine cable N6459 has input resistance 90k.
-
The CABLE is around 180 ohms on the 'signal' lines, and zero ohms on the ground lines.
The test PIN/HEADS are 90K. i.e. the part that unclips from (as in Jay's picture).
We're talking two different parts....
cheers,
george.
-
http://www-d0.fnal.gov/trigger/stt/commiss/agilent/agilentprobing.pdf (http://www-d0.fnal.gov/trigger/stt/commiss/agilent/agilentprobing.pdf)
Page 9:
The Standard Probing System
The standard probing system
consists of IC clips, probe leads,
probe housing and probe cable.
Because it is passive, the standard
probing system is smaller,
lighter, and much easier to use
than active probing systems. This
passive probing system is similar
to a probing system used on a
high frequency oscilloscope. It
consists of an isolation network
(as shown in figure 3) at the
probe tip and a shielded resistive
transmission line.
-
Hi group,
This document shows a picture of this special cable:
http://cp.literature.agilent.com/litweb/pdf/5968-8153EN.pdf (http://cp.literature.agilent.com/litweb/pdf/5968-8153EN.pdf) page 14.
Here is the picture:
(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=204925;image)
The part number: 01650-61607 suggests that has been used since the 1650 series of LAs.
Some of the connections will measure low resistance, other higher resistance. There is a mixture of low resistance and resistance wire connections.
The manual describes the Logic inputs as 1GSa/s sample rate and 50 MHz toggle rate.
Regards,
Jay_Diddy_B
-
This is the cable I'm talking about with the woven cable:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg367778/#msg367778 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg367778/#msg367778)
There are two central rivets hidden beneath the label which is the reason I'm reticent to go medieval on it.
-
I am trying to unlock Agilent 54831D Infiniium MSO. It is running Windows XP.
Did someone did this?
Can someone show me the way? Thanks.
-
I am trying to unlock Agilent 54831D Infiniium MSO. It is running Windows XP.
Did someone did this?
Can someone show me the way? Thanks.
Is it Windows 95 or XP?
-
It is Windows XP.
-
It is Windows XP.
You might want to look at this thread https://www.eevblog.com/forum/testgear/agilent-hp-54831d-advice/ (https://www.eevblog.com/forum/testgear/agilent-hp-54831d-advice/)
User Blacknoise was very helpful.
-
Thank you a lot. I will contact him.
-
Howardlong and friends: you guys simply kick a**.
The posts here were fantastic.
-
I recently scored a cheap dsox2004a in ebay and upgraded the software to 2.35. I've read through the thread (a few times) but I'm stuck unpacking the cab file... I can extract it fine but I don't have a way to do the numerous copies necessary to create the /Secure file structure. I tried installing cab manager 3.0 but the website it gone and all the installers I can find are just bloatware... I work in linux mostly but can run Windows 8.1 in a vm. Does anyone have a python script to unpack the files using _setup.xml?
Thanks,
Elliot
-
Hi Elliot,
you can use this tool here http://www.codeppc.com/telechargements/msceinf/msceinf.htm (http://www.codeppc.com/telechargements/msceinf/msceinf.htm) to extract the cab file
-
Thanks kilobyte! Didn't see this so I ended up just hacking up a python script (after spending over an hour trying to get the damn cab manager installed). Inline below in case it's useful for anyone else. Just takes a single arg which is the extracted infiniiVisionSetup.cab directory. Looks like its all working now! :-+
#!/usr/bin/python
#
# Parse xml into cab file system
#
import sys
import os
import shutil
from xml.etree import ElementTree
# Dir name
dir = None
# get root
root = sys.argv[1]
if root is None:
os.exit ("Must specify root")
with open (root + "/_setup.xml", 'rt') as f:
tree = ElementTree.parse (f)
for node in tree.iter():
if node.attrib.get ('type') is not None:
# Check if we should get new base dir
if node.attrib.get ('type')[0] == '\\':
dir = node.attrib.get ('type')
dir = dir.replace ("\\", "/")
dir = dir[1:]
print "mkdir %s" % dir
if not os.path.exists (dir):
os.makedirs (dir)
# Check if we found a destination dir
else:
if node.attrib.get ('translation') == 'install':
dest = dir + '/' + node.attrib.get ('type')
# print "Dest: %s" % dest
# Check if we have a source
if node.tag == 'parm' and dir is not None:
src = root + "/" + node.attrib.get ('value')
print "cp %s %s" % (src, dest)
shutil.copyfile (src, dest)
-
Man its been forever since I last checked this thread! Gotta scan through it and see whats new and whats changed in the game!
-
As someone whom had to pay the price for the "NEW" official MSO cable for the DSOX2000, which I hope actually works (as you cannot access the digital lines from the serial key enabled) I wanted to upload a picture of the latest shipping cable. Note it does come with a licensed entitlement that you have to register but I did not try it without the key.
Note that it is not braided cable, but I am unwilling to pull it apart until I make sure I can decode SPI/I2C while watching the digital channels for timing.
(http://s24.postimg.org/jxklzgar9/2000_XMSO.jpg)
-
Note that if you have a DSOX2000 series scope the $700 cable is not worth your time, even if the cost isn't an issue and you need a MSO for slow speed serial will be better off writing a sketch on an Arduino Uno. The MSO functionality on this series is less capable than anything else that dares to claim to be an MSO. Despite all of the marketing fluff you can't even have the digital channels on while decoding serial and you cannot decode serial on the digital lines.
This means that if you wanted to check your chip select timing on a SPI bus you are SOL. Apparently the "hardware serial decoding" is done by something with less horsepower than an AVR. As I do lots of slow speed serial work I will be putting the cable in a box next to my bus pirate as a reminder to remind myself the the glory days of HP/Agilent are gone. :--
And yes it is my fault I thought it was a good thing they quit reselling Rigol at this price point, and was willing to wait 45 days for them to ship me a breakout cable and a sheet of paper. But that delay removes any ability to return the main unit to a retailer.
-
Thank you for sharing that mongo. Good to know... I've been looking for a used one online but based on your review I will abandon all hope for the digital lines.
-
Hi mongo,
I'll follow up with you on the message you sent us, I'm sorry that the MSO isn't living up to what you need.
Some history on this, when we started shipping the 2000 X-Series scopes there was no decoding at all. After a lot of customer feedback, we enabled serial decoding with the 2.30 firmware release, but the caveat was that the 2000 X-Series only have one of the MegaZoom ASICs. The digital lines and serial decoding use the same block in the ASIC, so it's a physical impossibility to enable the decoding and the digital channels simultaneously. The 3000T and up have two ASICs, which is why we support that in those scopes. It makes us sad, too.
-
For the avoidance of doubt, the older 3000A also supports full decode on analogue and digital channels. :-+
-
For the avoidance of doubt, the older 3000A also supports full decode on analogue and digital channels. :-+
Yes, correct.
It's also worth noting that if you are looking at a new scope, the MSO is free until September.
-
LOL anyone else find it odd that a Keysight/Agilent rep comments in a thread about hacking their device to get upgrades for free? Ha ha
-
I appreciate Daniel's presence and his valuable input. Hope he does not take your comment seriously.
-
I appreciate Daniel's presence and his valuable input. Hope he does not take your comment seriously.
What?! Take what seriously exactly?
-
Daniel's presence here and on the forum as a whole is indeed appreciated: he has a thicker skin than me that's for sure. Sometimes, things are just better left unsaid though if you know what I mean :-+
<