EEVblog Electronics Community Forum

Products => Test Equipment => Topic started by: eevblogfan on April 08, 2013, 07:22:59 am

Title: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: eevblogfan on April 08, 2013, 07:22:59 am
hey

I know it's stupide/newbie question but I'll ask it anyway ,

as all knows , you buy the base unit witch in terms of HW it has all , but licence is the big deal witch cost you a-lot , the question is : have anyone tried to write he's own version ? have anyone successfully hack the scope andupgraded the BW to say 200Mhz instead of 70 or so on ? or enable the memory function gen etc ?? 

P.S: I don't know if it's related to here or perhaps projects (?) so please move me if I am wrong  :palm:

thank you in advance :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EEVblog on April 08, 2013, 08:38:59 am
Nope, no one has done it yet.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: eevblogfan on April 08, 2013, 08:41:44 am
what a buger :(

since I don't know FPGA and al that sort of stuff I can't even try by my own  :'(

it'll be funny if ther's someone who does know how and will manage to do that  :-DD
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: poorchava on April 08, 2013, 09:30:34 am
Since only thing you need to do to activate all the options is to input correct code. So everything is in there. But I'm pretty sure that Agilent uses some sort assymetric public key crypto system. And I'm also quite sure that whichever chip in the scope does that, is probably tamper-protected to prevent key extraction.

And if you find a way to break/bruteforce that sort of crypto be ready for either of those things to happen:
-get a job in CIA/FBI/etc
-get shot by CIA/FBI/etc
-make it public and get a Nobel prize (and then get shot by CIA/FBI/etc)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: _Sin on April 08, 2013, 09:40:04 am
License hacks were fairly trivial on the earlier scopes as the keys used were accidentally exposed in a firmware update. They're apparently using new keys now, so current scopes aren't vulnerable, but the older ones still are, even with the newly released features.

There was quite a discussion about it in the original thread about these scopes.

Of course you don't get the probes if you hack increased b/w or MSO features, and they frequently give away the wavegen + dvm features - the serial decode and memory options are more attractive.


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Someone on April 08, 2013, 12:18:58 pm
License hacks were fairly trivial on the earlier scopes as the keys used were accidentally exposed in a firmware update. They're apparently using new keys now, so current scopes aren't vulnerable, but the older ones still are, even with the newly released features.
Really? I thought most of the options were only embedded in the newer firmware releases?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: _Sin on April 08, 2013, 02:52:05 pm
License hacks were fairly trivial on the earlier scopes as the keys used were accidentally exposed in a firmware update. They're apparently using new keys now, so current scopes aren't vulnerable, but the older ones still are, even with the newly released features.
Really? I thought most of the options were only embedded in the newer firmware releases?

Sure, but putting a newer firmware on an older scope does not alter the keys.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Someone on April 09, 2013, 12:24:06 am
License hacks were fairly trivial on the earlier scopes as the keys used were accidentally exposed in a firmware update. They're apparently using new keys now, so current scopes aren't vulnerable, but the older ones still are, even with the newly released features.
Really? I thought most of the options were only embedded in the newer firmware releases?

Sure, but putting a newer firmware on an older scope does not alter the keys.
But why would they offer a trial matching the keys on a firmware version that doesnt have that option embedded? As far as I can tell the old firmware simply doenst have some of the options, so they might need to continue offering the trials of the options that were available in the leaked key against it for that odd customer who hasnt done a firmware update, but why would they release trials or licenses for the new options against the old keys? since you'd have to have the new firmware installed to use them.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mikeselectricstuff on April 09, 2013, 12:45:54 am
I don't understand why the keys would be persistent in the scope - surely new firmware = (potentially) new keys, if you want a newer option one an old scope you need to update the FW anyway.

I think I'd be looking at how easy it is to load a modified firmware image - finding the "If <something> then <enable funtion>" code and patching it out shoudn't be that hard.     
 
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ve7xen on April 09, 2013, 01:26:09 am
I don't understand why the keys would be persistent in the scope - surely new firmware = (potentially) new keys.
I guess if the trusted keys were part of a user-initiated update process they would be much easier to manipulate than if they're stored in some memory that is at least never written from the code, or possibly write-protected or write-once?

If they're doing secure boot from a read-only bootloader it's probably pretty hard to circumvent, depending on how secure their 'read only' is. If the code can be modified relatively easily and the 'scope will accept it, well it's kind of pointless, but why make things easy ;).
Title: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: zibadun on April 09, 2013, 01:45:03 am
Actually the private key used to generate the code does not need to be present in the scope at all. Checking validity of the code can be done with a different (public) key. Knowing that key will not help with generating a new code.  All this assuming a correctly implemented public key system. Did they bother to do this or  used the same key for both encryption and validation?  I guess time will tell ;)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: _Sin on April 09, 2013, 06:10:31 am
I don't understand why the keys would be persistent in the scope - surely new firmware = (potentially) new keys, if you want a newer option one an old scope you need to update the FW anyway.

If they did, every single scope in the field would need new licenses issuing for every enabled feature.

And it's not clear how they would field upgrade scopes without exposing any new keys in the same way as the old keys were (the leak happened because they left the utility which initialises the scope, including the keys, inside the firmware package).

So it may actually involve not only issuing new keys, and new licenses, but recalling every scope so it can be done at the factory...

I guess they're happier just to ignore the small number of people who have both an original scope, and the desire to hack around with it. They're not cheap devices, I doubt it's a huge problem for them.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: eevblogfan on April 09, 2013, 06:23:26 am
hey

can you use the 30 day trail and hack the scope to think the 30 day's weren't pass ?

thank you in advance :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: _Sin on April 09, 2013, 06:34:01 am
But why would they offer a trial matching the keys on a firmware version that doesnt have that option embedded? As far as I can tell the old firmware simply doenst have some of the options, so they might need to continue offering the trials of the options that were available in the leaked key against it for that odd customer who hasnt done a firmware update, but why would they release trials or licenses for the new options against the old keys? since you'd have to have the new firmware installed to use them.

The don't issue licenses against firmware versions, they issue licenses against a key, which is stored securely on the scope and (so far) is not updated. Old scopes have one key, which was accidentally published, and new scopes have a different key which AFAIK is still secure.

They likely won't change the keys in a firmware update, and doing so securely would be expensive and awkward for both them and customers (see my previous reply to Mike on why I think that is the case).

They can determine which key your scope uses, presumably just using the serial number, which they need to have in order to issue a license anyway, as it's part of the license string (which is what prevents a license for one scope being any use on another).

Certainly to date, an old scope uses the old keys even with the latest firmware, and so licenses for the new features *need* to be issued with those keys.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mikeselectricstuff on April 09, 2013, 09:09:00 am
I don't understand why the keys would be persistent in the scope - surely new firmware = (potentially) new keys, if you want a newer option one an old scope you need to update the FW anyway.

If they did, every single scope in the field would need new licenses issuing for every enabled feature.

That assumes that installed licenses are stored as-is, and validated at startup, which isn't the only way to do it.
One approach would be that 'feature enable' flags are stored in NVRAM or system-writable flash, and get set by entering the license key. So the key is only needed for the process of activating a new feature, and can live in the firmware. Key updates would only affect the process of  issuing new licenses, which would  be manageable fairly easily, by saying that any new  licenses must be installed under the latest FW version.
 Obviously this assumes a suitably secure nonvolatile store  - NVSRAM in a BGA would be pretty effective.
It also assumes you can't load unauthorised firmware, but if you could, you could patch out the checks so that's no worse.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: _Sin on April 09, 2013, 10:12:22 am
You'd need to store more than a flag, as the license may also contain an expiry date, and the storage would need to be flexible to store any number of licenses, whereas by only storing the key and the serial#, it's fixed, and quite small. By storing the license and validating, it can be as large as there is ordinary flash storage and forward compatible with any new software feature.

And I'm not really making assumptions here - it's been established that license hacking in this way works, so implementation details aside, this is how it is done.

So yes, they could have implemented the system differently, but they didn't. It wouldn't have mattered if they hasn't released their own keys.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on April 10, 2013, 04:18:39 pm
Ha, I almost created the same thread when I started looking at the 2000/3000 X-Series. After quite a bit of searching I was able to find a couple threads that made it sound they had not been hacked. Sort of surprising considering how many very intelligent people buy and use this kind of tool. Oh well, maybe someday. Until then, I guess Agilent just gets more money from me. :(
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: marmad on April 10, 2013, 04:35:07 pm
Sort of surprising considering how many very intelligent people buy and use this kind of tool.

I just assumed most of the people/companies who could readily afford that type of tool don't really need to be hacking options.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mikeselectricstuff on April 10, 2013, 04:56:06 pm
You'd need to store more than a flag, as the license may also contain an expiry date, and the storage would need to be flexible to store any number of licenses, whereas by only storing the key and the serial#, it's fixed, and quite small. By storing the license and validating, it can be as large as there is ordinary flash storage and forward compatible with any new software feature.
True, but I'd guess storing an expiry date still takes less space than a license key, so probably not much difference. Just need to allocate enough fixed locations for the number of envisaged future options, as opposed to the maximum number of keys installable at one time.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: grego on April 10, 2013, 05:00:00 pm
Sort of surprising considering how many very intelligent people buy and use this kind of tool.

I just assumed most of the people/companies who could readily afford that type of tool don't really need to be hacking options.

What marmad said.

We don't need a philosophical argument here but remember that Agilent maintains its cutting edge because its profitable.  If it wasn't profitable they wouldn't be in that market.  I never understood this really - it's not like Agilent has a lock on the market - if you don't like or can't afford their equipment buy something else.  There's plenty of manufacturers out there.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on April 10, 2013, 05:22:41 pm
Sort of surprising considering how many very intelligent people buy and use this kind of tool.

I just assumed most of the people/companies who could readily afford that type of tool don't really need to be hacking options.
Thats what I would assume as well, but the mere concept of "hacking" did not come about from those trying to save money, but for the challenge of undoing what was done and beating a system. Then they typically just give it to the rest.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on April 10, 2013, 05:24:23 pm
Sort of surprising considering how many very intelligent people buy and use this kind of tool.

I just assumed most of the people/companies who could readily afford that type of tool don't really need to be hacking options.

What marmad said.

We don't need a philosophical argument here but remember that Agilent maintains its cutting edge because its profitable.  If it wasn't profitable they wouldn't be in that market.  I never understood this really - it's not like Agilent has a lock on the market - if you don't like or can't afford their equipment buy something else.  There's plenty of manufacturers out there.
You cant understand the natural desire to get more for less? Everyone wants that, we just dont always get it.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: marmad on April 10, 2013, 05:44:04 pm
Thats what I would assume as well, but the mere concept of "hacking" did not come about from those trying to save money, but for the challenge of undoing what was done and beating a system. Then they typically just give it to the rest.

In general that might be true - but in this context - hacking test and measurement gear (which means you might brick the equipment which you use - i.e. much different possible ramifications than mere software hacking), I think the motives would likely be closer to getting bandwidth, options, etc. that you'd like to have for your own use - but can't readily afford to pay for.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on April 10, 2013, 06:27:30 pm
Thats what I would assume as well, but the mere concept of "hacking" did not come about from those trying to save money, but for the challenge of undoing what was done and beating a system. Then they typically just give it to the rest.

In general that might be true - but in this context - hacking test and measurement gear (which means you might brick the equipment which you use - i.e. much different possible ramifications than mere software hacking), I think the motives would likely be closer to getting bandwidth, options, etc. that you'd like to have for your own use - but can't readily afford to pay for.
Well I was referring to the real first hacking, back in the hardware, phreaking, etc days before there was "software", but yes I understand your point.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hypernova on April 11, 2013, 08:28:52 am
There's no real need to hack them anyway given you can just dial back the clock.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: eevblogfan on April 11, 2013, 09:10:44 am
really ?

can I use the 30 day trail and after 30 days "just" dial the clock back in time and the trail will be accessible again ?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EEVblog on April 11, 2013, 09:25:07 am
You'd need to store more than a flag, as the license may also contain an expiry date

In that case you know the date from the info screen, so you might be able to use that as a baseline to search in the firmware  :-//
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EEVblog on April 11, 2013, 09:28:14 am
Sort of surprising considering how many very intelligent people buy and use this kind of tool.
I just assumed most of the people/companies who could readily afford that type of tool don't really need to be hacking options.

Yes, the vast majority have no need nor desire to hack their scope, nor would most even think to look for one. Agilent know that and rely on that. If a hack did eventually happen, I doubt they would bat much of an eyelid.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: marmad on April 11, 2013, 09:57:50 am
Yes, the vast majority have no need nor desire to hack their scope, nor would most even think to look for one. Agilent know that and rely on that. If a hack did eventually happen, I doubt they would bat much of an eyelid.

Honestly, it seems as if even Rigol is not that worried about it (with the DS2000, DS4000, DG4000 series models all being identical inside). It appears as if they've expanded and released better-designed and built lines of test equipment after all of the publicity (and sales) surrounding the DS1000 hack - so I'm guessing it didn't financially damage the company.  ;)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mikeselectricstuff on April 11, 2013, 12:51:56 pm
really ?

can I use the 30 day trail and after 30 days "just" dial the clock back in time and the trail will be accessible again ?
AFAIK one thing they have done is made it not possible to set the clock back to before the release date fo the current firmware. Not sure if they have done anything else to prevent re-trials. Might also be interesting to see if you can request the same trial more than once.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hypernova on April 11, 2013, 12:54:34 pm
really ?

can I use the 30 day trail and after 30 days "just" dial the clock back in time and the trail will be accessible again ?

Yep, the licenses get deleted once they expire but if you dial the clock back you can install them again. So just dial the clock as far back to the build date of the FW you are on after you install and you are golden, of course the only draw back is that you can't install FW updates that comes later than the trial expiration date.

The reinstall trick doesn't work with the internal 30day full trial since there's no install file, I lost them when I dialed the clock forward so they are gone forever for me. I suspect that if you dial forward to 2099 first before activating them and then dial back it might work.

Quote
Might also be interesting to see if you can request the same trial more than once.

Tried that, no go. They keep a record of your applications on their server.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Fsck on April 11, 2013, 12:57:31 pm
I think only the hobbyists and work for yourself types would ever bother hacking their equipment, and the % of buyers who would do such a hack are probably a negligible (not 0, but not too important) fraction of their sales.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Tooms on April 11, 2013, 01:02:17 pm
really ?

can I use the 30 day trail and after 30 days "just" dial the clock back in time and the trail will be accessible again ?

The reinstall trick doesn't work with the internal 30day full trial since there's no install file, I lost them when I dialed the clock forward so they are gone forever for me. I suspect that if you dial forward to 2099 first before activating them and then dial back it might work.

Quote
Might also be interesting to see if you can request the same trial more than once.

Tried that, no go. They keep a record of your applications on their server.

I have just got an new scope(demo model) with some active trials in it, i dont have the keys so is there any way to export them out for backup ?


Tooms
Title: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: zibadun on April 11, 2013, 01:05:26 pm
really ?

can I use the 30 day trail and after 30 days "just" dial the clock back in time and the trail will be accessible again ?

Yep, the licenses get deleted once they expire but if you dial the clock back you can install them again. So just dial the clock as far back to the build date of the FW you are on after you install and you are golden, of course the only draw back is that you can't install FW updates that comes later than the trial expiration date.

The reinstall trick doesn't work with the internal 30day full trial since there's no install file, I lost them when I dialed the clock forward so they are gone forever for me. I suspect that if you dial forward to 2099 first before activating them and then dial back it might work.

Quote
Might also be interesting to see if you can request the same trial more than once.

Tried that, no go. They keep a record of your applications on their server.

This worked for me only once, setting the clock back and run self cal.  The second time they've expired looks like for good. I've tried a couple of different "procedures" but no joy..
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hypernova on April 11, 2013, 01:12:35 pm
really ?

can I use the 30 day trail and after 30 days "just" dial the clock back in time and the trail will be accessible again ?

Yep, the licenses get deleted once they expire but if you dial the clock back you can install them again. So just dial the clock as far back to the build date of the FW you are on after you install and you are golden, of course the only draw back is that you can't install FW updates that comes later than the trial expiration date.

The reinstall trick doesn't work with the internal 30day full trial since there's no install file, I lost them when I dialed the clock forward so they are gone forever for me. I suspect that if you dial forward to 2099 first before activating them and then dial back it might work.

Quote
Might also be interesting to see if you can request the same trial more than once.

Tried that, no go. They keep a record of your applications on their server.

This worked for me only once, setting the clock back and run self cal.  The second time they've expired looks like for good. I've tried a couple of different "procedures" but no joy..

Which one stopped working? The built in one with all features or the downloaded one?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hypernova on April 11, 2013, 01:18:43 pm
really ?

can I use the 30 day trail and after 30 days "just" dial the clock back in time and the trail will be accessible again ?

The reinstall trick doesn't work with the internal 30day full trial since there's no install file, I lost them when I dialed the clock forward so they are gone forever for me. I suspect that if you dial forward to 2099 first before activating them and then dial back it might work.

Quote
Might also be interesting to see if you can request the same trial more than once.

Tried that, no go. They keep a record of your applications on their server.

I have just got an new scope(demo model) with some active trials in it, i dont have the keys so is there any way to export them out for backup ?


Tooms

None that I know of, but since you got a demo unit are you sure it's not full licenses? Demo unit usually come fully activated since they aren't meant to stay in your possession for long. When I bought my 3014A the dealer gave me a demo unit before he got the stock in and that one was fully activated.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: zibadun on April 11, 2013, 01:30:15 pm

Which one stopped working? The built in one with all features or the downloaded one?

The built in trial that came with the scope.  What's a "downloaded one"? 
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hypernova on April 11, 2013, 01:38:38 pm

Which one stopped working? The built in one with all features or the downloaded one?

The built in trial that came with the scope.  What's a "downloaded one"? 

Ones that you can apply for on the website, they email you an .lic file, if those expire you just dial the clock back and reinstall.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Tooms on April 11, 2013, 02:06:16 pm

None that I know of, but since you got a demo unit are you sure it's not full licenses? Demo unit usually come fully activated since they aren't meant to stay in your possession for long. When I bought my 3014A the dealer gave me a demo unit before he got the stock in and that one was fully activated.

it has the trial for all options for around 90 days and then they will expire.

I can see in the papirs that i got that they install the demo licenser there is having a runtime of 120 days and there is about 90 days left now, but i dont have the key files and was hoping that i can export them some how.

Thanks
Tooms

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hypernova on April 11, 2013, 02:10:27 pm

None that I know of, but since you got a demo unit are you sure it's not full licenses? Demo unit usually come fully activated since they aren't meant to stay in your possession for long. When I bought my 3014A the dealer gave me a demo unit before he got the stock in and that one was fully activated.

it has the trial for all options for around 90 days and then they will expire.

I can see in the papirs that i got that they install the demo licenser there is having a runtime of 120 days and there is about 90 days left now, but i dont have the key files and was hoping that i can export them some how.

Thanks
Tooms



Well, logic dictates that there must be hidden SCPI commands that access what you need. Either way even if you can extract them you have to return the demo unit anyway, and those licenses are locked to the serial of the scope.

Unless you mean you bought an ex-demo?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Tooms on April 11, 2013, 02:18:27 pm

None that I know of, but since you got a demo unit are you sure it's not full licenses? Demo unit usually come fully activated since they aren't meant to stay in your possession for long. When I bought my 3014A the dealer gave me a demo unit before he got the stock in and that one was fully activated.

it has the trial for all options for around 90 days and then they will expire.

I can see in the papirs that i got that they install the demo licenser there is having a runtime of 120 days and there is about 90 days left now, but i dont have the key files and was hoping that i can export them some how.

Thanks
Tooms


Well, logic dictates that there must be hidden SCPI commands that access what you need. Either way even if you can extract them you have to return the demo unit anyway, and those licenses are locked to the serial of the scope.

Unless you mean you bought an ex-demo?

yes i have bought an ex-demo msox3024a there is as good as new but cheaper


Tooms
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hypernova on April 11, 2013, 02:52:41 pm

None that I know of, but since you got a demo unit are you sure it's not full licenses? Demo unit usually come fully activated since they aren't meant to stay in your possession for long. When I bought my 3014A the dealer gave me a demo unit before he got the stock in and that one was fully activated.

it has the trial for all options for around 90 days and then they will expire.

I can see in the papirs that i got that they install the demo licenser there is having a runtime of 120 days and there is about 90 days left now, but i dont have the key files and was hoping that i can export them some how.

Thanks
Tooms


Well, logic dictates that there must be hidden SCPI commands that access what you need. Either way even if you can extract them you have to return the demo unit anyway, and those licenses are locked to the serial of the scope.

Unless you mean you bought an ex-demo?

yes i have bought an ex-demo msox3024a there is as good as new but cheaper

Well then become drinking buddies with the dealer, they probably have the files then.

How much did you pay? My 3014A after taxes came in at 6333K USD (190k NTD at 30/1 exchange rate), this is with the SEGMEM and MEMUP options, I also got the Front Panel Cover for free.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Tooms on April 11, 2013, 03:55:38 pm
Quote
Quote
yes i have bought an ex-demo msox3024a there is as good as new but cheaper
Well then become drinking buddies with the dealer, they probably have the files then.
How much did you pay? My 3014A after taxes came in at 6333K USD (190k NTD at 30/1 exchange rate), this is with the SEGMEM and MEMUP options, I also got the Front Panel Cover for free.

it is an less then 3 month old MSOX 3024A with the LAN/VGA, wavegen, volt meter options and 3 year warrent for the price of 5985$ (with the danish sales tax of 25%)

I also got an front cover and bag for free with the unit and as it is an demo unit then i have all the options for 90 days

it was via the locale agilent partner in Denmark so it is easy for me if there is an issue with


The options that i think i will get leter on for it is I2C, RS232 and maybe the power analyzer option.


Tooms
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mikeselectricstuff on April 11, 2013, 04:27:46 pm
Quote
Well, logic dictates that there must be hidden SCPI commands that access what you need.
Why? There is no legitimite reason to need to read license data out.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: _Sin on April 11, 2013, 09:58:28 pm
True, but I'd guess storing an expiry date still takes less space than a license key, so probably not much difference. Just need to allocate enough fixed locations for the number of envisaged future options, as opposed to the maximum number of keys installable at one time.

For one or two licenses perhaps storing a flag+date would be more compact, but once you need space for several licenses then storing just the key (which is fairly compact and applies to all licenses) ought to be smaller.

The other possible issue I can think of with your suggested scheme is that it means that the scope firmware necessarily contains the ability to write to the secure storage area, which would provide an additional attack surface for a hack attempt. You can either use an exploit in the firmware to flip a flag, or use the knowledge of how the secure-store is written to in order to write it directly.

With their existing scheme, the software only needs to be able to verify a hash using the securely stored key value, and never needs to write anything, so the mechanism to do so can be left out entirely. The full key information required to author the hash in the first place doesn't even need to be present at all.

Until some muppet leaves the scope initialisation tool in the firmware package.

Of course as you said earlier, the firmware itself could be an easier target than the licenses, for the scopes where the key information is unknown. If the only license check is in the software, it could be as simple as changing a branch or two. The only thing to work out would be what verification of the firmware code is done, and how to defeat it. But fiddling with that seems far more likely to lead to a possibly bricked scope, so it's not something I'd necessarily try unless I either had money to burn or a really pressing need for a feature I couldn't afford to buy...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mikeselectricstuff on April 11, 2013, 10:52:23 pm
Of course another entirely practical, and more secure solution would  be for every scope to have a unique key. When they issue a license they just look it up on their internal database of keys vs. serial number. They already program unique serial numbers in, so adding a unique key would be minimal additional hassle.
The only additional effort would be to link the license issuing system with the production key generator.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Rufus on April 11, 2013, 11:37:03 pm
With their existing scheme, the software only needs to be able to verify a hash using the securely stored key value, and never needs to write anything, so the mechanism to do so can be left out entirely.

As far as I can tell the existing scheme does not store any key, the public key(s) are in the firmware. Which key to use is determined by something in secure storage. Secure storage holds that something, the scope model and serial number. It looks like licences are pretty much stored as received.

Until some muppet leaves the scope initialisation tool in the firmware package.

I very much doubt it was left. I suspect initially the secure storage was encrypted or signed with the same key used to generate licences. The desire to have the scope model number change to reflect installation of MSO and bandwidth options meant the scope had to re-write secure storage and needed to have the private key. Embedding the initialisation tool was an easy kludge to achieve that. The muppet was the one that wanted to change the model number, or the software guy who didn't tell him it was a gaping security hole. That's my theory anyway.

Has anyone recently installed MSO or bandwidth options with a license? Did the model number change?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hypernova on April 12, 2013, 01:01:43 am
Quote
Well, logic dictates that there must be hidden SCPI commands that access what you need.
Why? There is no legitimite reason to need to read license data out.

There has to be some means to fiddle with the license state when they prep the ex-demo for release at least, granted there might only be overwrite commands available.

"5985$"
Wow, that's an awesome deal!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: _Sin on April 12, 2013, 05:41:24 am
Has anyone recently installed MSO or bandwidth options with a license? Did the model number change?

Neither changes the model number - not with the firmware revision which contained the initialisation tool, nor the very latest.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: amyk on April 12, 2013, 11:53:42 am
Of course as you said earlier, the firmware itself could be an easier target than the licenses, for the scopes where the key information is unknown. If the only license check is in the software, it could be as simple as changing a branch or two. The only thing to work out would be what verification of the firmware code is done, and how to defeat it. But fiddling with that seems far more likely to lead to a possibly bricked scope, so it's not something I'd necessarily try unless I either had money to burn or a really pressing need for a feature I couldn't afford to buy...
Someone who can afford the scope might be more likely to have EEPROM programmers and the like as well, meaning recovery from accidental bricking may not be too difficult. Unless there's some storage that can't be rewritten with external hardware somehow...

Mike makes it look too easy. :D (http://youtu.be/Qjw0NDeP-0Q)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tnt on June 11, 2013, 07:39:47 pm
Just to make it clear:

 * Licenses are stored pretty much as the XML files (same fields) and are loaded/checked from the "Secure NV" on startup
 * There is several public keys used to check the license signature, which key is used is dependent of the serial number of the scope. The secret key for the first public key, which is used for all early scope serials, has been leaked by Agilent themselves as a mistake and so it's trivial to generate your own licenses for those scope. That's been common knowledge forever ... it's explained in the original thread somewhere pretty early. Nobody published an easy tool, probably because :
  - "why risk it": since it deals with "encryption keys" it might have some legal implications that a fw diff doesn't have
  - "why risk agilent fixing the problem": if the problem is not widespread, why bother dedicating resources to fix it thoroughly, their current "work around" works well enough and is safe for all previously issued licenses.

In the worst case, if license code was fixed, attacking the firmware should be possible (despite code signing), but I'm certainly not about to risk bricking a 7k$ piece of test gear ...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Rufus on June 11, 2013, 09:06:55 pm
Just to make it clear:
(...)
In the worst case, if license code was fixed, attacking the firmware should be possible (despite code signing), but I'm certainly not about to risk bricking a 7k$ piece of test gear ...
Your last sentence pretty much sums up all I went through. Happy ending though.

Is anything actually signed or just strong named or whatever they call it?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mikeselectricstuff on June 21, 2013, 08:57:58 pm
Just to make it clear:

 * There is several public keys used to check the license signature, which key is used is dependent of the serial number of the scope. The secret key for the first public key, which is used for all early scope serials, has been leaked by Agilent themselves as a mistake and so it's trivial to generate your own licenses for those scope.
I wonder how hard it is to change the serial number.... 8)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mikeselectricstuff on June 22, 2013, 09:45:12 am
My warranty is fixed to the serial number. I am never gonna change it.  :(
If you can change it, you can change it back
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: shadowless on June 23, 2013, 01:38:20 pm
Hey guys,

I am the first one to try the firmware on my 2000x scope and it worked for me. I took the risk of bricking my scope but well I was rewarded with a fully enabled scope.

I don't have a 3000x so I can't say that but I am sure it works on that too since he tested it himself.

So it is a good news for 2000x and 3000x owners.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: rkupka on June 23, 2013, 03:32:18 pm
which FW version is this modified firmware based on ?
What is going to happen if I flash this new modded one and afterwards I flash brand new FW when Agilent releases it ?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: eevblogfan on June 23, 2013, 04:39:23 pm
Hey

can you tell me Why is the BW limit only does 20Mhz and don't ask me if I want 100Mhz , Full BW or 20Mhz ?

Ps , Is it software related ? , Ie , can you add that into new version of your file ?

and is that possible to somehow add say in the coupling menu to say put 50 Ohm impidance ? ( I suspect not right ? , becouse ther's no Hw whos support that ... )

thank you :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on June 23, 2013, 05:33:34 pm
I think that there is no 50ohm input at DSOX2000. DSOX2000 and DSOX3000 have quite different motherboards.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: con-f-use on June 24, 2013, 10:21:10 am
I am the first one to try the firmware on my 2000x scope and it worked for me. I took the risk of bricking my scope but well I was rewarded with a fully enabled scope.

I might have seen it work as well. Just so you know.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: rkupka on June 24, 2013, 03:19:27 pm
Confirmed. Works as expected.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on June 24, 2013, 03:30:06 pm
Pretty darn cool. Ill wait till someone releases such a fix for free through. I dont like the idea of having to pay for cracks/hacks.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on June 24, 2013, 06:46:30 pm
Does the hacked firmware void the warranty??
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on June 24, 2013, 06:59:45 pm
Does the hacked firmware void the warranty??
More than likely, however like Jailbreaking or something, if you can get the original firmware back on there before you send it in for servicing theyll probably never know you were ever running a customer firmware.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mwsoft on June 24, 2013, 07:46:12 pm
Pretty darn cool. Ill wait till someone releases such a fix for free through. I dont like the idea of having to pay for cracks/hacks.

Uhm... how much djvinc charges for this firmware? It's really uncool...

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on June 24, 2013, 08:32:22 pm
Pretty darn cool. Ill wait till someone releases such a fix for free through. I dont like the idea of having to pay for cracks/hacks.

Uhm... how much djvinc charges for this firmware? It's really uncool...
Nevermind, apparently Im not allowed to post the details. PM them for the pricing.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mwsoft on June 24, 2013, 09:19:28 pm
Uhm... how much djvinc charges for this firmware? It's really uncool...
The firmware is an initiative that requires a contribution, for many reasons I can't explain easily on this topic. Happy to tell on PM though.

Well, "contribution" should work like "If you like my work - please donate".
It should be all about pride and accomplishment... Making this kind of hacking for living is just low...

I'm surprised, that people on this forum are willing to pay for this - curious what Dave thinks about it  8)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: marmad on June 24, 2013, 10:12:52 pm
Nevermind, apparently Im not allowed to post the details. PM them for the pricing.

Not allowed by whom?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bored@Work on June 24, 2013, 10:14:53 pm
Uhm... how much djvinc charges for this firmware? It's really uncool...
The firmware is an initiative that requires a contribution, for many reasons I can't explain easily on this topic. Happy to tell on PM though.

Oh come on, the reason is you want the money.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EEVblog on June 24, 2013, 11:03:33 pm
Well, "contribution" should work like "If you like my work - please donate".
It should be all about pride and accomplishment... Making this kind of hacking for living is just low...
I'm surprised, that people on this forum are willing to pay for this - curious what Dave thinks about it  8)

I will of course not allow this forum to be used as a basis to peddle anything potentially illegal, either content or services.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mikeselectricstuff on June 24, 2013, 11:19:23 pm
Well, "contribution" should work like "If you like my work - please donate".
It should be all about pride and accomplishment... Making this kind of hacking for living is just low...
I'm surprised, that people on this forum are willing to pay for this - curious what Dave thinks about it  8)

I will of course not allow this forum to be used as a basis to peddle anything potentially illegal, either content or services.
Requiring payment (or not) doesn't affect the legality. Possibly the sentence though.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EEVblog on June 25, 2013, 01:00:55 am
FYI: djvinc's account and posts have been deleted at his request.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benemorius on June 25, 2013, 02:08:23 am
Well, now that that's cleaned up, who can provide us with one of the modified firmwares so we can compare it against the original to see what was changed?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: shadowless on June 25, 2013, 02:35:33 am
Well, "contribution" should work like "If you like my work - please donate".
It should be all about pride and accomplishment... Making this kind of hacking for living is just low...
I'm surprised, that people on this forum are willing to pay for this - curious what Dave thinks about it  8)

I will of course not allow this forum to be used as a basis to peddle anything potentially illegal, either content or services.

Dave what about the Rigol Hack? Is that legal?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EEVblog on June 25, 2013, 04:32:17 am
Dave what about the Rigol Hack? Is that legal?

How long is a piece of string?
How far do you want to open the can of worms?
IMO there is a big difference between sending a simple existing serial command down the existing provided interface, and reverse engineering and bypassing an encrypted software feature set.
Argue away...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: shadowless on June 25, 2013, 01:41:13 pm
Dave what about the Rigol Hack? Is that legal?

How long is a piece of string?
How far do you want to open the can of worms?
IMO there is a big difference between sending a simple existing serial command down the existing provided interface, and reverse engineering and bypassing an encrypted software feature set.
Argue away...

Really Dave? Read the first page of Hantek /tekway hack.  Extensive reverse engineering was done.  You have to by past software by renaming. 

Perhaps consider taking down your potentially illegal Rigol hack video in the process :)

"I dont know" in your own tone :)  Argument is not my thing, they are all just mind chatter between individuals trying to affirm their own belief.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Rufus on June 25, 2013, 03:14:56 pm
Perhaps consider taking down your potentially illegal Rigol hack video in the process :)

"I dont know" in your own tone :)  Argument is not my thing, they are all just mind chatter between individuals trying to affirm their own belief.

Legality aside there is a moral distinction between providing a platform where discussion of hacks/cracks is not censored and providing a platform where hacks/cracks are offered for sale.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: shadowless on June 25, 2013, 03:43:20 pm
Perhaps consider taking down your potentially illegal Rigol hack video in the process :)

"I dont know" in your own tone :)  Argument is not my thing, they are all just mind chatter between individuals trying to affirm their own belief.

Legality aside there is a moral distinction between providing a platform where discussion of hacks/cracks is not censored and providing a platform where hacks/cracks are offered for sale.

If you own an Agilent perhaps you with think otherwise :) If Dave provide us a free hack I will very happy. Who wants to pay if we can get it free.  If you have strong moral discipline, then don't even think about hacking, it is never morally correct.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on June 25, 2013, 04:22:03 pm
Nevermind, apparently Im not allowed to post the details. PM them for the pricing.

Not allowed by whom?
Not "not allowed" specifically. Perhaps it was a bad choice of words. I was asked not to. And no, it was not by Dave.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: BravoV on June 25, 2013, 04:25:59 pm
Nevermind, apparently Im not allowed to post the details. PM them for the pricing.

Not allowed by whom?
Not "not allowed" specifically. Perhaps it was a bad choice of words. I was asked not to. And no, it was not by Dave.

So is it official now that "Agilent" hack is not allowed here in this forum, while other Chinese's stuff is ok ?  ???
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on June 25, 2013, 04:29:49 pm
Nevermind, apparently Im not allowed to post the details. PM them for the pricing.

Not allowed by whom?
Not "not allowed" specifically. Perhaps it was a bad choice of words. I was asked not to. And no, it was not by Dave.

So is it official now that "Agilent" hack is not allowed here in this forum, while other Chinese's stuff is ok ?  ???
Certainly not. Like I said I was not asked by Dave. As far as I care, he's the only one that makes anything "official" here. Rights of ownership. I just obliged the individual that asked me to edit my post. It's pretty simple to guess who might have asked that and for what reasons. I just dont want to be any further involved in the situation.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Spikee on June 25, 2013, 09:41:23 pm
How many people use this hacked firmware?

And who is willing to release the files here (for free of course) .
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tinhead on June 25, 2013, 10:44:07 pm

Really Dave? Read the first page of Hantek / Tekway hack.  Extensive reverse engineering was done.


you forgot two things:
- in Europe not a big deal, i own it so i can do what ever i wish to do (as long i do on my own device)
- at time of publishing there was no GPL code released, making these DSO illegal in EU, you can't sue someone
  for hacking on not-existing (because illegal) gear.


Well, "contribution" should work like "If you like my work - please donate".


ehm, i give you some stats. I do have "please donate if you like" link, i mentioned it few times here and there (as well poeple who donated did it too) and honestly i did got together less than 300USD - in almost 3yrs. Not that i'm begging now for money, but simply telling the truth about donations.

I have no idea how many hours i spend total on these DSOs, but alone the fact that i reversed the PCB and drew schematics of already 3 hardware revisions was worth more than what i got as donation.

Right, i got now from someone almost brand new Hantek DSO for free (as he bought Rigol DS2202) and another guy was thinking about giving me his Voltcraft DSO for few months. But that's not result of donation but simply people who knows that i fucked up my company :\

Making this kind of hacking for living is just low...

Hardware reversing costs not only time but as well some lab resources, they need to be paid. So it's not for living.
In my case it was a bit different story, i was running my own business in last 10yrs, so for sure i had a chance to pay what was necessary. But other might not have that luck, so yes i understood why "djvinc" asked for money.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mickpah on June 26, 2013, 01:07:37 am
Hi
I've been following a number of these threads. I own some of the test gear in question but not all.

I understand the name hacker comes from the early days of computing when it was done as a challenge or for bragging rights. Personally, that is the way I look at it.
Whether the results are used by other is a personal decision really, googling turns up so much of this stuff anyway
My only concern if that Dave gets caught in the middle some legal thing or suppliers don't send stuff for review. We have a good thing here, open helpful discussion , a bit of fun and no nazi moderators. Lets not stuff it up

my opinion only flame away
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benemorius on June 26, 2013, 10:22:52 am
Does anyone have the old firmware which leaked the private keys? Obviously Agilent removed it from the web site. If someone can supply me with it I think I can create a license key generator.

You can indeed, but it will only work on very old scopes because the newer ones (according to serial number) are using new keys. Now, if you've figured a way to change the serial number to use the old key or otherwise get around that, then do please elaborate.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jirikv on June 26, 2013, 10:36:44 am
I found only this:
http://translate.google.cz/translate?sl=auto&tl=en&prev=_t&hl=cs&ie=UTF-8&u=http://zavelos.ru/forum/25389-pomogite-vyitashhit-resurs-iz-dll&act=url (http://translate.google.cz/translate?sl=auto&tl=en&prev=_t&hl=cs&ie=UTF-8&u=http://zavelos.ru/forum/25389-pomogite-vyitashhit-resurs-iz-dll&act=url)

http://www.sendspace.com/file/q9gluq (http://www.sendspace.com/file/q9gluq)

and more discussion here and on following pages:

https://www.eevblog.com/forum/blog/new-agilent-scopes/150/ (https://www.eevblog.com/forum/blog/new-agilent-scopes/150/)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Rasz on June 26, 2013, 12:18:33 pm
The way I see it cracking something for profit = illegal.
Hacking something because you are curious and want to really own what you paid for = real spirit of hacking.

In many EU countries (including mine) there are provisions in copyright law that let users copy/share/do whatever they want _as long as its not for profit_.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Rufus on June 26, 2013, 02:29:27 pm
I'd still like to get the first key though, if anyone has it.

The file containing it is linked two posts up.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mwsoft on June 26, 2013, 03:39:46 pm
Quote from: tinhead
ehm, i give you some stats. I do have "please donate if you like" link, i mentioned it few times here and there (as well poeple who donated did it too) and honestly i did got together less than 300USD - in almost 3yrs. Not that i'm begging now for money, but simply telling the truth about donations.

Well, I know you are somewhat on "the other side", but... $300 isn't that bad. I think about "contribution" for hacking more like a tip, bonus, not real profit...
It was your choice to spend so many hours on this without thinking about future profits like him :)

Quote from: tinhead
Hardware reversing costs not only time but as well some lab resources, they need to be paid. So it's not for living.
[...] But other might not have that luck, so yes i understood why "djvinc" asked for money.

Well, when we are talking in general, I think there are two possible scenarios:
1) Someone already have skills, somewhat equipped lab. Then he buys a product for normal usage and start to tinker with it for pleasure / hobby.
2) Someone targets potentially hackable product, start to learn new skills, "invest" money for lab equipment or even additional people and in the end starts to sell the solution.

First scenario maybe is illigal in some countries, but usually morally acceptable.
But the second one? It's just organized crime...  O0 Just like groups in Europe which hack cars immobilizers. Today you can buy this kind of device for 2003-2010 Volkswagen cars for about €400. You just plug it in OBD port, wait 10 seconds and start car with big screwdriver  :palm: I guess they also spend many hours and many euros for that... ;)

Anyway - let's say 20 people payed him $140. Scope cost is covered (I don't think he had any other real expenses). And what after that? You think he will stop charging money for his solution?  :-DD
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tinhead on June 26, 2013, 05:33:50 pm
I'd still like to get the first key though, if anyone has it.

The file containing it is linked two posts up.

I eventually figured out how to download it from that Russian site yesterday, but it doesn't seem to be a complete archive. I'll have another look later.

i have that file still localy and remote on hotfile

https://hotfile.com/dl/131446259/df706bb/3000XSeries.01.10.2011031600.cab.html

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jirikv on June 26, 2013, 05:35:12 pm
I'd still like to get the first key though, if anyone has it.

The file containing it is linked two posts up.

I eventually figured out how to download it from that Russian site yesterday, but it doesn't seem to be a complete archive. I'll have another look later.

You dont need download from Russian site. I already reupload the file:
http://www.sendspace.com/file/q9gluq (http://www.sendspace.com/file/q9gluq)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benemorius on June 26, 2013, 10:10:48 pm
first you need the network module...

Indeed. It begs the question - has anyone whacked in a magjack and gotten the scope to use it yet? Early on I remember there was some effort to inspect the network module to see which pin to pull up/down to tell the scope it had a LAN port hooked up but I don't see whether anyone actually did it.

Or maybe if the scope will detect the LAN/VGA being inserted hot, one could just boot up the scope and run over the connector with a weak pullup/pulldown while watching the network menu to see if it activates. Then again, I wouldn't be surprised if rebooting is required after inserting a module.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on June 27, 2013, 02:25:00 am
Indeed. It begs the question - has anyone whacked in a magjack and gotten the scope to use it yet? Early on I remember there was some effort to inspect the network module to see which pin to pull up/down to tell the scope it had a LAN port hooked up but I don't see whether anyone actually did it.
There is a Xilinx XC3S100 FPGA on the board. Looks like it is for the VGA output (together with an ADV7125 triple DAC and a CY7C1325 RAM on the back), because the ethernet connection is just two wires, as Dave mentioned in one of his videos and as you can see in my photo of it:

http://i.imgur.com/OSoJtll.jpg (http://i.imgur.com/OSoJtll.jpg)

But I wouldn't be surprised, if they implemented some kind of protection in the FPGA. It has lots of LEs to implement even a small microcontroller in it for a simple verification protocol.

Quote
Or maybe if the scope will detect the LAN/VGA being inserted hot, one could just boot up the scope and run over the connector with a weak pullup/pulldown while watching the network menu to see if it activates. Then again, I wouldn't be surprised if rebooting is required after inserting a module.

This could damage the scope, too expensive for me to try it.

In general, I think it is ok to buy the network module. Then hack it :) but of course, don't sell or buy hacks for it.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benemorius on June 27, 2013, 06:40:17 am
I don't know if we're talking about the same network module, but the only one I know of is the LAN/VGA module which costs $400 USD so buying it is completely out of the question.

At one point I guess I had a brain fart and thought it was under $200, and I was half-seriously toying with the idea of trying to talk myself in to considering it. I looked up the price to get an exact figure for consideration and shat my pants so hard they probably felt the shockwave in china. I still haven't figured out how to cope with the fact that my primary high-end scope is lacking some very basic functionality that even won hung lo scopes usually have.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on June 27, 2013, 06:42:29 am
It's fair to buy it, if you are going to hack the rest :P
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mikeselectricstuff on June 27, 2013, 07:47:31 am

But I wouldn't be surprised, if they implemented some kind of protection in the FPGA. It has lots of LEs to implement even a small microcontroller in it for a simple verification protocol.

I'd say that would be highly unlikely. I really don't think they are too bothered about people making their own LAN interface. It would also be sensible  to keep the LAN and VGA functions seperate in case they wanted to do different permutations in the future.
My money is it's just a mag-jack and a pin pulled. May not even be the latter if the Ethernet Phy can detect presence of the  jack.
 
 
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tnt on June 27, 2013, 10:42:00 am
- at time of publishing there was no GPL code released

Not quite true. I addressed a request to Agilent directly to get the source for the GPL software distributed with the scope (u-boot mostly) and I received the source package back. I also posted a link to it in the first topic about this scope, probably more than a year ago.

Cheers,

   Sylvain
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on June 27, 2013, 03:59:30 pm
I don't know if we're talking about the same network module, but the only one I know of is the LAN/VGA module which costs $400 USD so buying it is completely out of the question.

At one point I guess I had a brain fart and thought it was under $200, and I was half-seriously toying with the idea of trying to talk myself in to considering it. I looked up the price to get an exact figure for consideration and shat my pants so hard they probably felt the shockwave in china. I still haven't figured out how to cope with the fact that my primary high-end scope is lacking some very basic functionality that even won hung lo scopes usually have.
I was able to talk AgilentUsed (their eBay selling account) down to $170 for one. Though that was with my MSOX2024A purchase, but maybe it could be done separately or if someone is planning on buying a 2000 X-series from them...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: djghost on July 01, 2013, 07:00:27 am
Hi,

Agilent released a version of the 2000x/3000x firmware : v2.35, with minor enhancements.

For those who wonder / try to solve the puzzle, this new version 2.35 is hackable.
Have fun !
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: shadowless on July 03, 2013, 08:28:06 pm
Wow i saw the Rigol 2000 thread and they are hacking license like nobody's business and reverse engineering I2C info like crazy.

https://www.eevblog.com/forum/testgear/sniffing-the-rigol's-internal-i2c-bus/msg256453/#msg256453 (https://www.eevblog.com/forum/testgear/sniffing-the-rigol's-internal-i2c-bus/msg256453/#msg256453)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mwsoft on July 04, 2013, 09:53:50 am
I don't have this scope, but just out of curiosity - I've downloaded X2000 firmaware.

Where is the catch?
It seems, that modification should be really easy:
1. Unpack update file
2. Unpack infiniiVisionSetup.cab
3. Locate infiniivision.lnk file -> INFINI~1.027
4. Open it, add our precious command line switch, count number of characters and correct value in the beginning of file
5. Pack all files back to infiniiVisionSetup.cab
6. Compute MD5 check sum of infiniiVisionSetup.cab and replace it in recipe.xml
7. Pack all files back into update file

Am I missing any additional checksums/signatures somewhere?
The only (and most important) problem for me, it that I can't figure out what this command line switch is. I'm quite new to IDA and PE executables.
infiniiVisionLauncher.exe just passes command line arguments to infiniiVisionCore.dll, and this file is 16,5MB jungle  |O
Nothing obvious popes out right away...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: djghost on July 04, 2013, 10:23:05 am
the cab file is signed, so if you try this you brick your scope  :-\
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mwsoft on July 04, 2013, 11:06:22 am
Silly me :) I didn't realized that CAB files can be signed, like exe/msi etc. :)

But what about uboot? Which commands are implemented?
Maybe it will be possible, to modify lnk file via directly digging into file system (loading page from nand, modifying in RAM and writing back).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on July 04, 2013, 08:50:35 pm

But I wouldn't be surprised, if they implemented some kind of protection in the FPGA. It has lots of LEs to implement even a small microcontroller in it for a simple verification protocol.


I can confirm that the LAN is working when only the ethernet pins are used. Tested with LAN/VGA module when the rest of pins were covered by Kapton tape.
The oscilloscope does not recognize installed module but the telnet, VNC and LXI are working properly. The IP is configurable only through LXI.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on July 04, 2013, 09:11:18 pm
So we can make a LAN plugin ourselves.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Norleif on July 04, 2013, 10:18:52 pm
So if I put together a PCB with a magjack and plug it into the scope, presumably it has a default IP?
From there, it remains to break out the RS232 lines to the CPU and add that magic command line option and everything is up for grabs?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on July 05, 2013, 02:34:52 pm
I have an idea to try: there is a kind of install batch script - recipe.xml inside the fw update cab. Replace update commands with a single command that starts infiniiVision.exe with that magic parameter, pack that xml into a .cab and try "updating" from it.
Code: [Select]
<?xml version="1.0"?>
<install>
<killProcess>infiniivisionLauncher.exe</killProcess>
<installStep>
        <!-- replace /magicparameter with right one -->
<command>\Secure\infiniiVision\infiniivisionLauncher.exe /magicparameter</command>
</installStep>
</install>

Anyone willing to try? It shouldn't do any harm in any case - no write commands like original "loadP500Flash" there. A quick test can be made without any parameters - it should restart the scope app
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on July 05, 2013, 07:25:58 pm
So if I put together a PCB with a magjack and plug it into the scope, presumably it has a default IP?
From there, it remains to break out the RS232 lines to the CPU and add that magic command line option and everything is up for grabs?

Yes, you will need just the PCB and MagJack. If you need the status LEDs working you will need few passives.
Default configuration is automatic IP adress from DHCP, so you need just running DHCP on your computer.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benemorius on July 05, 2013, 08:38:59 pm
So if I put together a PCB with a magjack and plug it into the scope, presumably it has a default IP?
From there, it remains to break out the RS232 lines to the CPU and add that magic command line option and everything is up for grabs?

Yes, you will need just the PCB and MagJack. If you need the status LEDs working you will need few passives.
Default configuration is automatic IP adress from DHCP, so you need just running DHCP on your computer.

Thank you!! Do you already have a pinout for the magjack and LEDs? I think there should be sufficient high resolution photos elsewhere to reconstruct it but it sounds like you can save me the trouble with little inconvenience.

I intend to draw up a PCB for this and post the gerbers if no one beats me to it. I guess I'll need to open my scope to get the mechanical dimensions unless someone can provide that as well. That's not a huge deal, but I guess my only hesitation is that if I'm going to make a PCB then I'd much prefer that it be complete with the activation pin to tell the scope to enable the LAN configuration, assuming that even exists.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mikeselectricstuff on July 05, 2013, 09:03:34 pm
I think before doing a PCB it would be worth checking to see if there is a pullup/pulldown used for option detect. (or at least make sure all the pads are broken out to allow experimentation)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on July 06, 2013, 12:24:44 am
I think before doing a PCB it would be worth checking to see if there is a pullup/pulldown used for option detect. (or at least make sure all the pads are broken out to allow experimentation)

I'm waiting for used MagJack datasheet, after that I will make some schematic.
If following pins connected LAN is working including LEDs
 43   LAN Green

45   GND
47   LAN
49   LAN
51   GND
53   GND
55   LAN
57   LAN
59   GND
61   GND
63   LAN Yellow
65   GND

46   GND   
48   LAN LED Common   0.2uF to GND
50   LAN LED Common   0.2uF to GND
52   GND   
54   GND   

and everything working, including status LEDs.
I tried to connect also pins
78   GND
80   GND
Where seems to be identification and it resulted in LAN/VGA error on startup.
It is not big deal that the IP cannot be modified from scope itself and needs to be modified through LXI, I think.

The pitch of contacts is 0,8mm, does anyone some tips for protoboard with such a contact spacing?

I just find Dave video related to module:
http://www.eevblog.com/2011/02/17/eevblog-145-agilent-lanvga-module-teardown/ (http://www.eevblog.com/2011/02/17/eevblog-145-agilent-lanvga-module-teardown/)



Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on July 09, 2013, 09:06:18 pm
The magjack pinout.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Norleif on July 10, 2013, 02:21:03 am
Nice pinout of the module. If we only knew the TX+, TX÷, RX+ and RX÷ on those LAN pins we're getting there. If someone has access to a genuine module and a calliper, we could get the proper dimensions for that card-edge connector too. Looking at Dave's video it seems there is a key slot in the middle somewhere.

I just got a MSOX3024A (+ free WaveGen and DVM), but I haven't started playing with it beyond installing the latest official FW. Haven't even activated the full-feature trials.
I'm hoping that if I wait, I don't have to reset the date as often to keep them working... Or did I miss something here?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: KTP on July 10, 2013, 03:02:30 am
Nice pinout of the module. If we only knew the TX+, TX÷, RX+ and RX÷ on those LAN pins we're getting there. If someone has access to a genuine module and a calliper, we could get the proper dimensions for that card-edge connector too. Looking at Dave's video it seems there is a key slot in the middle somewhere.

I just got a MSOX3024A (+ free WaveGen and DVM), but I haven't started playing with it beyond installing the latest official FW. Haven't even activated the full-feature trials.
I'm hoping that if I wait, I don't have to reset the date as often to keep them working... Or did I miss something here?

wait...what?  I have an MSOX3024A also (and have not touched my 30 day trials either).  Do we have an unofficial trial date reset h**k?

(I don't think memup to 4Meg is part of the 30 day trials though...)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jmole on July 10, 2013, 03:24:09 am
I've got access to an official LAN/VGA module. Will high-res photos of the boards help at all? I can't do anything electrical to the boards, as they're not mine and I can't afford to F it up.

Going on vacation for a week and a half or so, but I should be able to get some 25MP pics when I'm back in the last week of July.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on July 10, 2013, 03:56:27 am
Nice pinout of the module. If we only knew the TX+, TX÷, RX+ and RX÷ on those LAN pins we're getting there. If someone has access to a genuine module and a calliper, we could get the proper dimensions for that card-edge connector too. Looking at Dave's video it seems there is a key slot in the middle somewhere.

I just got a MSOX3024A (+ free WaveGen and DVM), but I haven't started playing with it beyond installing the latest official FW. Haven't even activated the full-feature trials.
I'm hoping that if I wait, I don't have to reset the date as often to keep them working... Or did I miss something here?

I have a the genuine module, so the PCB dimensions are not problem, if someone is going to  make PCB.
Don not forget that we will also need a plastic container, otherwise there will be no mechanical support of the PCB in the scope.
Today I will finish the schematic with passives.

Currenly I have unpacked image and need to modify the registry file default.fdf. For this I tried script fdf2reg.pl from mkrom 1.36, but it only decode few lines of registry file and end up with error message.
If someone know different way how to extract registry from RAM based file it will be helpful.
Registry contains the commads for automatic startup of the appplication. The modifiing the recipe.xml, seem to be the dead end and not working.

For accessing the scope we need to know the telnet password or disable the telnet autentication in the registry and build up the whole image.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ve7xen on July 10, 2013, 04:30:08 am
I've got access to an official LAN/VGA module. Will high-res photos of the boards help at all? I can't do anything electrical to the boards, as they're not mine and I can't afford to F it up.

Going on vacation for a week and a half or so, but I should be able to get some 25MP pics when I'm back in the last week of July.
If you can get photos as straight on as you can (or scans) alongside a ruler they should be usable for duplicating the board shape. The board photos might be enough to figure out the pinout. I'd guess it's two layers?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on July 10, 2013, 04:37:45 pm
Another owner of the VGA/LAN module. I have a high end digital caliper too for dimensioning. Let me know if you guys need that info.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on July 10, 2013, 04:51:33 pm
Why so complicated? Drill a hole in the scope for a magjack, mount it with some hot glue and solder some wires to it :) While you have it open: solder some more wires for the UART connector, maybe even a MAX3232 converter board, because it is 3.3V digital level UART, and then a standard d-sub 9 connector for the case.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benemorius on July 10, 2013, 06:34:50 pm
Who's getting complicated?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tru on July 10, 2013, 07:35:34 pm
Why so complicated? Drill a hole in the scope for a magjack, mount it with some hot glue and solder some wires to it :) While you have it open: solder some more wires for the UART connector, maybe even a MAX3232 converter board, because it is 3.3V digital level UART, and then a standard d-sub 9 connector for the case.
You're kidding right, you own one of these scopes? These scopes aren't budget range, they are £1061 upwards. I don't know who here is willing to drill such a beautiful and expensive machine, but I wouldn't do to mine!   >:D

Best method is to route or saw a pcb of same dimensions as LAN module and then etch, that's why we are waiting for needed pinouts of LAN module connector, so it's nothing to do with complications.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benemorius on July 10, 2013, 07:56:19 pm
Well, to be fair, only the little plastic cover for the expansion port would need a hole drilled in it. That may be what I choose to do since I don't have a 3d printer to make a case for my LAN module.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Norleif on July 11, 2013, 11:06:30 pm
Hmm... In addition to the MagJack on the cheat PCB we might drop in some pin headers (for wiring to the secret UART), a MAX3232 and a DSUB9 connector instead of the VGA port. It might even fit in the original LAN module case :P

I only wish FrankBuss would elaborate on how to utilize that UART...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benemorius on July 11, 2013, 11:39:09 pm
Hmm... In addition to the MagJack on the cheat PCB we might drop in some pin headers (for wiring to the secret UART), a MAX3232 and a DSUB9 connector instead of the VGA port. It might even fit in the original LAN module case :P

I only wish FrankBuss would elaborate on how to utilize that UART...

 :-+ Great idea. (or maybe ft232 and usb instead...)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on July 12, 2013, 07:48:06 am
I only wish FrankBuss would elaborate on how to utilize that UART...

The serial port location:

http://i.imgur.com/yYMV75t.jpg (http://i.imgur.com/yYMV75t.jpg)

All you need are some jumper wires, if you don't want to drill a hole. Fits nicely through the USB connector hole 8)

http://i.imgur.com/9gnsuQh.jpg (http://i.imgur.com/9gnsuQh.jpg)

You can then stop the u-boot with space (can be difficult, you have to be fast, use something like HTerm which has a useful "repeat" function to send a sequence automatically until you stop it, or just hold down space while you boot it). Then you can boot the image from network like this:

Code: [Select]
set serverip 192.168.11.108
dhcp 0x4000000 nk.bin;bootm 0xf8050000

Where 192.168.11.108 is your own server, where TFTP is running and providing nk.bin. You should see something like this:

Code: [Select]
BOOTP broadcast 1
DHCP client bound to address 192.168.11.106
Using smsc device
TFTP from server 192.168.11.108; our IP address is 192.168.11.106
Filename 'nk.bin'.
Load address: 0x4000000
Loading: **#################################################################
#################################################################
...

You get the nk.bin from the nk.bin.comp from the firmware update cab-file with the bincompress.exe tool, which is included in the evaluation version of the WindowsCE development environment. Use http://www.t-hack.com/wiki/index.php/NK.BIN_toolset (http://www.t-hack.com/wiki/index.php/NK.BIN_toolset) to take a look at the content of nk.bin and to modify it.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mikeselectricstuff on July 12, 2013, 07:50:41 am
I only wish FrankBuss would elaborate on how to utilize that UART...

The serial port location:

http://i.imgur.com/yYMV75t.jpg (http://i.imgur.com/yYMV75t.jpg)

All you need are some jumper wires, if you don't want to drill a hole. Fits nicely through the USB connector hole 8)
..or an IDC ribbon cable with  IDC D connector, as found on old PCs.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on July 12, 2013, 09:12:31 am
Sorry, was the wrong command line, it still boots from the flash. Found my notes again, this is the right sequence:

Code: [Select]
set serverip 192.168.11.108 ; dhcp 0x361000 nk.nb0 ; go 0x362000

You need cvrtbin.exe from http://www.t-hack.com/wiki/index.php/NK.BIN_toolset (http://www.t-hack.com/wiki/index.php/NK.BIN_toolset) to create nk.nb0 from nk.bin. Use it like this:

Code: [Select]
cvrtbin.exe -r -a 0x80361000 -w 32 -l 0x01248688 nk.bin

The addresses and length is what viewbin.exe shows, just in case it is different for a newer firmware.

In case you wonder about the 0x80361000 and 0x361000 difference: this is because of physical and virtual memory addresses. Fortunately the mapping is really easy in this case.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on July 12, 2013, 09:17:31 am
..or an IDC ribbon cable with  IDC D connector, as found on old PCs.
Right, would be even better, because less danger that it gets lose. You can then cut all the wires except the two you need to thread through some holes.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on July 20, 2013, 08:16:50 am
There is one trick which can help.

Create following structure on USB drive and the scope will run link or whole firmware from USB flash drive.
1. Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
2. Create "Startup" directory where you can store link for execution
3. (Optional) Copy the folder "infiniiVision" from infiniiVisionSetup.cab. It can be unpacked e.g with WinCE CAB Manager 3.0). It will make the boot sequence little bit longer but allow you to boot up firmware from USB without flashing it ( tested with 2.35 and  2.30)

I can confirm that scope is hackable without the LAN/VGA module or taking the scope apart. If someone will be still interested in manufacturing LAN module I can post schematic.
Please do not ask me for details related to hacking the scope, I will not share them.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benemorius on July 20, 2013, 11:04:31 am
There is one trick which can help.

Create following structure on USB drive and the scope will run link or whole firmware from USB flash drive.
1. Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
2. Create "Startup" directory where you can store link for execution
3. (Optional) Copy the folder "infiniiVision" from infiniiVisionSetup.cab. It can be unpacked e.g with WinCE CAB Manager 3.0). It will make the boot sequence little bit longer but allow you to boot up firmware from USB without flashing it ( tested with 2.35 and  2.30)

I can confirm that scope is hackable without the LAN/VGA module or taking the scope apart. If someone will be still interested in manufacturing LAN module I can post schematic.
Please do not ask me for details related to hacking the scope, I will not share them.

What path to use in the startup link to load from USB?

I don't know when I'll get around to it but I'm still quite interested in making a PCB for the LAN module.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on July 20, 2013, 12:39:55 pm
The usb drive's root is seen as \usb folder in rootfs, so just add an \usb\ prefix to the path on usb drive
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on July 20, 2013, 12:50:40 pm
Can someone with opened scope please check where the BOOT_SEL pin (K18) of SPEAr600 goes? Look here for the drawing http://www.st.com/web/en/resource/technical/document/datasheet/CD00248440.pdf (http://www.st.com/web/en/resource/technical/document/datasheet/CD00248440.pdf) pg.93
Grounding this pin at power up should activate USB download mode in cpu's bootrom - an unlimited access to the internals, regardless of fw versions etc, it's in metal
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on July 20, 2013, 01:46:29 pm
Can someone with opened scope please check where the BOOT_SEL pin (K18) of SPEAr600 goes? Look here for the drawing http://www.st.com/web/en/resource/technical/document/datasheet/CD00248440.pdf (http://www.st.com/web/en/resource/technical/document/datasheet/CD00248440.pdf) pg.93
Grounding this pin at power up should activate USB download mode in cpu's bootrom - an unlimited access to the internals, regardless of fw versions etc, it's in metal

How should someone check where the pin goes? The chip is a BGA chip, maybe even with buried vias, if there is a via for this pin at all.

u-boot provides commands to load files over the serial port with y-modem and kermit, maybe even from USB, and you have unlimited access to all internals from it, if you want to dig this deep in the hardware.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on July 20, 2013, 02:38:37 pm
What path to use in the startup link to load from USB?

I don't know when I'll get around to it but I'm still quite interested in making a PCB for the LAN module.

Folder Startup with file infiniivision.lnk which should contains "45#\usb\infiniiVision\infiniivisionLauncher.exe"

OKI, and do you have any plan for mechanical construction?
Otherwise you can break the DSOX internal connector.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on July 20, 2013, 02:48:20 pm
FrankBuss,
Dave's teardown video shows that CPU has vias to all pins. Sure, u-boot is enough for now, even that simpler infiniivisionStartupOverride.txt way is enough, but times can change (fixes), but bootrom will still be there forever. Also there is probability that BOOT_SEL is accessible somewhere on lan/vga/gpib slot, who knows. Why not to check?

SPEAr flasher http://www.st.com/web/en/catalog/tools/PF257557 (http://www.st.com/web/en/catalog/tools/PF257557)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on July 20, 2013, 07:45:01 pm
FrankBuss,
Dave's teardown video shows that CPU has vias to all pins. Sure, u-boot is enough for now, even that simpler infiniivisionStartupOverride.txt way is enough, but times can change (fixes), but bootrom will still be there forever. Also there is probability that BOOT_SEL is accessible somewhere on lan/vga/gpib slot, who knows. Why not to check?

SPEAr flasher http://www.st.com/web/en/catalog/tools/PF257557 (http://www.st.com/web/en/catalog/tools/PF257557)

Thats sounds interesting. It suppose that it should be possible to acces such a pin without dissasembling the scope at least for service purpose, when the UART is not accessible.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on July 20, 2013, 08:43:05 pm
Thats sounds interesting. It suppose that it should be possible to acces such a pin without dissasembling the scope at least for service purpose, when the UART is not accessible.
I doubt it. Usually such complex systems are programmed once, probably with JTAG on the same connector with the UART signals for u-boot and then the other programming over network, then you do all service tasks over network or USB. Developers at Agilent might have bare boards or with an open case lying on their work desks anyway, with all internal connections accessible.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benemorius on July 20, 2013, 11:03:34 pm
The usb drive's root is seen as \usb folder in rootfs, so just add an \usb\ prefix to the path on usb drive
Folder Startup with file infiniivision.lnk which should contains "45#\usb\infiniiVision\infiniivisionLauncher.exe"

Thanks. That was the first thing I tried. Is there any output on the UART about this process? Any change I make from the default \Secure path results in a failure to boot. Without any error messages, I'm left to just guessing as to why.

I can only come up with three possibilities:

1) my installed firmware version 2.00 works differently (seems unlikely since I can indeed cause a boot failure by entering a wrong path or a successful boot by entering \Secure)

2) it doesn't like the filesystem on my flash drives (seems unlikely too since it reads them fine from the save/restore UI and I even tried formatting one from a real windows machine)

3) the installed firmware 2.00 doesn't want to load a different/newer firmware version 2.35 from USB (I don't yet know how the boot process flows but this also seems unlikely. I had the 2.00 firmware cab somewhere but I can't find it now to try it.)


Quote
OKI, and do you have any plan for mechanical construction?
Otherwise you can break the DSOX internal connector.

Not yet but if nothing else I'm pretty sure I can modify the existing plastic cover to support the rear of the PCB. I haven't really taken a close look yet. I use my scope often so I'm not in a hurry to take it down/apart until I'm actually ready to do this.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on July 20, 2013, 11:19:09 pm
benemorius,
try the same version as inside the scope (or update the scope). There are hardcoded paths to some data files in various places, there are dlls in windows folder (inside nk.bin.comp), so you are trying to start a mix of both versions actually
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on July 20, 2013, 11:28:12 pm
Thanks. That was the first thing I tried. Is there any output on the UART about this process? Any change I make from the default \Secure path results in a failure to boot. Without any error messages, I'm left to just guessing as to why.
No, the UART doesn't show much activity after booting. Maybe the DLLs are missing? I think it searches it in the same directory where the exe file is, and then in \windows, but not in \secure\infiniivision. The easiest way would be to write a cmd-file, which copies the \secure\infiniivision directory to the USB stick, if cmd files can be started with this concept too.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benemorius on July 20, 2013, 11:29:06 pm
benemorius,
try the same version as inside the scope (or update the scope). There are hardcoded paths to some data files in various places, there are dlls in windows folder (inside nk.bin.comp), so you are trying to start a mix of both versions actually
Ok thanks. That must be it. I didn't know if this method interrupted the boot process late enough for that to be possible or not. The firmware I need is probably on my desktop that I haven't unpacked yet since moving so it will have to wait until I have more time to play.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benemorius on July 20, 2013, 11:31:28 pm
The easiest way would be to write a cmd-file, which copies the \secure\infiniivision directory to the USB stick, if cmd files can be started with this concept too.
Hey, that's probably worth trying. :D
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benemorius on July 21, 2013, 12:27:39 am
The easiest way would be to write a cmd-file, which copies the \secure\infiniivision directory to the USB stick, if cmd files can be started with this concept too.
Hey, that's probably worth trying. :D

The files are copying, but they aren't making it to the flash drive. (see below) I'd guess it's mounted read only and the writes are going to a ramdisk somewhere. I'm not nearly familiar enough with windows to have a clue as to how to get it mounted properly for writing.

Still, I do wonder what prevents me from using this to overwrite exe or dll files with modified ones now.

Code: [Select]
$cat copy.cmd
dir \ > \usb\root.txt
dir \Secure > \usb\secure.txt
dir \Secure\infiniiVision > \usb\infiniiVision.txt
md \zzz
copy "\Secure\infiniiVision\*" \usb\zzz 1> \usb\out.txt 2>\usb\error.txt
dir \usb\zzz >\usb\zzz.txt
Code: [Select]
$cat out.txt error.txt
Copied 10 file(s).
$ls -a zzz
. ..
$cat zzz.txt

    Directory of \usb\zzz

File not found.

    0 Dir(s) 357945344 bytes free


$cat root.txt

    Directory of \

01/01/98  12:00p    <DIR>              Network
01/01/98  12:00p    <DIR>              Agilent Flash
01/01/98  12:00p    <DIR>              usb
01/01/98  12:00p    <DIR>              Secure
10/29/11  07:03p    <DIR>              Application Data
10/29/11  07:03p    <DIR>              profiles
10/29/11  07:03p    <DIR>              Documents and Settings
10/29/11  07:03p                    23 Control Panel.lnk
10/29/11  07:03p    <DIR>              My Documents
10/29/11  07:03p    <DIR>              Program Files
10/29/11  07:03p    <DIR>              Temp
10/29/11  07:03p    <DIR>              Windows

    Found 12 file(s). Total size 23 bytes.
    1 Dir(s) 27090944 bytes free


$cat secure.txt

    Directory of \Secure

11/14/11  09:38a    <DIR>              infiniiVision
11/14/11  09:38a    <DIR>              Startup
11/14/11  09:38a    <DIR>              cal
11/14/11  09:38a    <DIR>              help
11/14/11  09:38a    <DIR>              bin
11/15/11  09:26a    <DIR>              System

    Found 6 file(s). Total size 0 bytes.
    1 Dir(s) 17625088 bytes free


$cat infiniiVision.txt

    Directory of \Secure\infiniiVision

11/14/11  09:38a    <DIR>              web
11/14/11  09:38a    <DIR>              fpga
10/10/07  07:45p                214552 mscorlib.dll
08/04/11  10:02p               1089536 Agilent.Cdf.Api.dll
03/07/11  01:57p                238080 OpenNETCF.dll
08/04/11  10:02p                  9728 WebPageData.dll
03/07/11  01:57p                398336 SetupConverter.exe
08/05/11  12:38p               1152032 splashImage.bin
10/13/11  04:49p                218624 vncserver.dll
10/13/11  04:55p              14748832 infiniiVisionCore.dll
10/13/11  04:49p                 11112 infiniiVisionLauncher.exe
10/13/11  04:49p                180224 infiniiVisionWebCom.dll

    Found 12 file(s). Total size 18261056 bytes.
    1 Dir(s) 17625088 bytes free


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on July 21, 2013, 01:30:26 am
I don't think the USB drive is write protected, because you can see the logs. "dir /s \" can be interesting too. Maybe update to the the latest firmware 2.35.

One problem in your script: "md \zzz" should be "md \usb\zzz", but I guess you have already created the directory. Also check that it's empty. Sometimes files are write protected in Windows, which you can change with "attrib -r filename" and which you can see with "attrib" (on a Windows machine). Maybe wait a bit longer if the USB drive needs more time to write the files. Windows should mount USB drives without caching, so usually no need to unmount it.

Writing to the \secure directory and subdirectories is possible too. And with the USB startup trick there is no danger to brick the scope, if you have made backups of the files first, because the scope resets, if the application crashes on start, and then it would go into an infinite reset loop. But with the startup file you can restore a non-working executable again.

You could test writing with something non-critical, like replacing the startup image:

Code: [Select]
copy \secure\infiniivision\splashImage.bin \secure\infiniivision\splashImage.bin.org
\windows\compileImageForSplashScreen \usb\yourimage.png \secure\infiniivision\splashImage.bin

yourimage.png works with 800x480 pixels, 24 bit color, no transparency.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benemorius on July 21, 2013, 02:32:13 am
I don't think the USB drive is write protected, because you can see the logs.
Doh! I didn't think that one through at all, did I? :palm:

Assuming I didn't make another gross error, what sort of foolery could cause this behavior of allowing the shell to write files but not the copy binary? I haven't come across any mechanism that could do this in unixland - at least nothing that would output "10 files successfully copied" rather than "permission error" or something.

Quote
One problem in your script: "md \zzz" should be "md \usb\zzz", but I guess you have already created the directory.
Whoops. You're right. I guess it was accidentally changed in one of the many iterations between the first try and the last one which I copied here. It must have been right at first because the directory has in fact been created.

Quote
Also check that it's empty. Sometimes files are write protected in Windows, which you can change with "attrib -r filename" and which you can see with "attrib" (on a Windows machine). Maybe wait a bit longer if the USB drive needs more time to write the files. Windows should mount USB drives without caching, so usually no need to unmount it.
It is indeed empty according to the filesystem. I haven't checked whether any file data was written but I believe a correct FAT implementation should create the file entry before writing any data so worst case should be a 0 byte file reported by the filesystem. I waited about 15 seconds after it should have finished but next time I'll wait longer just in case. I didn't expect a write cache to be enabled either.

Quote
Writing to the \secure directory and subdirectories is possible too. And with the USB startup trick there is no danger to brick the scope, if you have made backups of the files first, because the scope resets, if the application crashes on start, and then it would go into an infinite reset loop. But with the startup file you can restore a non-working executable again.

You could test writing with something non-critical, like replacing the startup image:

Code: [Select]
copy \secure\infiniivision\splashImage.bin \secure\infiniivision\splashImage.bin.org
\windows\compileImageForSplashScreen \usb\yourimage.png \secure\infiniivision\splashImage.bin

yourimage.png works with 800x480 pixels, 24 bit color, no transparency.
I'll test writing next time too and see what happens. I really need to get back to work right now though. I've been distracted long enough already.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benemorius on July 22, 2013, 03:17:51 am
Sigh... it wasn't Murphy this time. It was Heisenberg.

It would seem that the problem was a sort of programatical measurement problem. The copy command works just fine as long as you don't try to observe it. :palm:

functions as intended:
Code: [Select]
copy "\Secure\infiniiVision\*" \usb\zzz
does not function as intended; output in error.txt says it copied files, but they're nowhere to be found:
Code: [Select]
copy "\Secure\infiniiVision\*" \usb\zzz 1>\usb\out.txt 2>\usb\error.txt
As much as I'd like to figure out why, I've got better things to play around with now that I can finally upgrade my firmware.

Incidentally, sucking the firmware out this way and running it from USB worked just fine. :-+

Writing to flash is also uneventful. I haven't overwritten any system or application files yet other than the splashscreen but I'm sure it will work for any file not in use. The registry seems off-limits since windows seems to refuse to copy any file that's open and apparently there's no way around that. :-//

Here's the output of `dir /s /a \` (firmware 2.00)
I snipped out my license files because they're named by guid but they are indeed in that directory and yes you can back them up and reuse them. You just have to rename from *.xml to *.lic and copy the license guid from the filename and put it back in the xml where it belongs. None of the other differences matter. As far as I know, this is the only way to recover the license file for a license that came on the scope from the factory (like a bandwidth upgrade for example)
Code: [Select]

    Directory of \

01/01/98  12:00p    <DIR>              Network
01/01/98  12:00p    <DIR>              Agilent Flash
01/01/98  12:00p    <DIR>              usb
01/01/98  12:00p    <DIR>              Secure
10/30/11  03:35a    <DIR>              Recycled
10/30/11  03:35a    <DIR>              Application Data
10/30/11  03:35a    <DIR>              profiles
10/30/11  03:35a    <DIR>              Documents and Settings
10/30/11  03:35a                    23 Control Panel.lnk
10/30/11  03:35a    <DIR>              My Documents
10/30/11  03:35a    <DIR>              Program Files
10/30/11  03:35a    <DIR>              Temp
10/30/11  03:35a    <DIR>              Windows

    Found 13 file(s). Total size 23 bytes.

    Directory of \Agilent Flash

10/30/11  01:47a    <DIR>              tmp
10/30/11  01:47a    <DIR>              wfmMem
10/30/11  01:47a    <DIR>              setups
10/30/11  01:47a    <DIR>              config
10/30/11  01:47a    <DIR>              data
10/30/11  01:47a    <DIR>              masks
10/30/11  01:47a    <DIR>              arb
10/30/11  03:30a    <DIR>              webupdate
10/30/11  01:47a    <DIR>              LxiMdns

    Found 9 file(s). Total size 0 bytes.

    Directory of \Agilent Flash\setups

10/30/11  01:47a                     0 setup_0.scp
10/30/11  01:47a                     0 setup_1.scp
10/30/11  01:47a                     0 setup_2.scp
10/30/11  01:47a                     0 setup_3.scp
10/30/11  01:47a                     0 setup_4.scp
10/30/11  01:47a                     0 setup_5.scp
10/30/11  01:47a                     0 setup_6.scp
10/30/11  01:47a                     0 setup_7.scp
10/30/11  01:47a                     0 setup_8.scp
10/30/11  01:47a                     0 setup_9.scp

    Found 10 file(s). Total size 0 bytes.

    Directory of \Agilent Flash\config

10/30/11  01:47a                   418 labelList.txt
10/30/11  03:30a                155537 setup.scp

    Found 2 file(s). Total size 155955 bytes.

    Directory of \Agilent Flash\masks

10/30/11  01:47a                     0 mask_0.msk
10/30/11  01:47a                     0 mask_1.msk
10/30/11  01:47a                     0 mask_2.msk
10/30/11  01:47a                     0 mask_3.msk

    Found 4 file(s). Total size 0 bytes.

    Directory of \Agilent Flash\arb

10/30/11  01:47a                     0 arb_0.csv
10/30/11  01:47a                     0 arb_1.csv
10/30/11  01:47a                     0 arb_2.csv
10/30/11  01:47a                     0 arb_3.csv

    Found 4 file(s). Total size 0 bytes.

    Directory of \Secure

11/14/11  09:38a    <DIR>              infiniiVision
11/14/11  09:38a    <DIR>              Startup
11/14/11  09:38a    <DIR>              cal
11/14/11  09:38a    <DIR>              help
11/14/11  09:38a    <DIR>              bin
11/15/11  09:26a    <DIR>              System

    Found 6 file(s). Total size 0 bytes.

    Directory of \Secure\infiniiVision

11/14/11  09:38a    <DIR>              web
11/14/11  09:38a    <DIR>              fpga
10/10/07  07:45p                214552 mscorlib.dll
08/04/11  10:02p               1089536 Agilent.Cdf.Api.dll
03/07/11  01:57p                238080 OpenNETCF.dll
08/04/11  10:02p                  9728 WebPageData.dll
03/07/11  01:57p                398336 SetupConverter.exe
08/05/11  12:38p               1152032 splashImage.bin
10/13/11  04:49p                218624 vncserver.dll
10/13/11  04:55p              14748832 infiniiVisionCore.dll
10/13/11  04:49p                 11112 infiniiVisionLauncher.exe
10/13/11  04:49p                180224 infiniiVisionWebCom.dll

    Found 12 file(s). Total size 18261056 bytes.

    Directory of \Secure\infiniiVision\web

11/14/11  09:38a    <DIR>              Lxi
11/14/11  09:38a    <DIR>              help
11/14/11  09:38a    <DIR>              image
11/14/11  09:38a    <DIR>              lib
11/14/11  09:38a    <DIR>              navbar
03/07/11  02:10p                   222 ClickFix.js
09/30/11  03:22a                  1797 CookieUtils.js
10/10/11  10:02p                349976 InfiniiVision_Quick_Reference.html
09/08/11  10:07p                 19999 appletInstall.jar
04/27/11  10:02p                 26521 appletScpi.jar
07/30/11  10:01p                915251 appletVnc.jar
04/27/11  10:03p                   465 appletsVersion.asp
03/07/11  02:10p                  1472 constant.asp
03/07/11  02:10p                  4117 doModifyConfig.asp
03/07/11  02:10p                  3900 doSave.asp
08/28/11  11:39p                  4084 download.asp
08/18/11  10:01p                   269 enumConst.asp
09/30/11  03:22a                  3635 getImage.asp
03/07/11  02:10p                  1413 home.html
03/07/11  02:10p                   840 homeBottom.asp
03/07/11  02:10p                  3539 homeMiddle.asp
03/07/11  02:10p                 12275 homeTop.asp
06/27/11  10:02p                  1156 index.asp
03/07/11  02:10p                  2975 infoCal.asp
03/07/11  02:10p                  3747 infoLicense.asp
03/07/11  02:10p                  4144 infoNav.html
04/27/11  10:02p                  9940 infoVersion.asp
03/07/11  02:10p                   781 information.html
03/07/11  02:10p                  1175 lanInfo.asp
03/07/11  02:10p                 30473 modifyConfig.asp
03/07/11  02:10p                 25393 navigation.asp
03/07/11  02:10p                  8858 networkStatus.asp
06/16/11  10:02p                  5154 pwdPrompt.asp
06/15/11  11:37a                  3287 pwdVerify.asp
10/05/11  11:35p                  9268 recall.asp
06/15/11  11:37a                  4516 remoteApplet.asp
05/26/11  10:05p                 18473 remoteFrontPanel.asp
09/12/11  10:53a                 12763 remoteSCPICommands.asp
08/18/11  10:01p                 26044 save.asp
06/15/11  11:37a                  1206 saveFrame.asp
10/05/11  11:35p                  4387 saveRecall.asp
03/07/11  02:10p                  2138 scopeInfo.asp
03/07/11  02:10p                  4137 style.css
04/27/11  10:03p                  2347 toolbarHelp.asp
03/07/11  02:10p                  2769 top.asp
04/27/11  10:03p                  1067 utils.js
03/07/11  02:10p                 11491 viewConfig.asp

    Found 47 file(s). Total size 1547464 bytes.

    Directory of \Secure\infiniiVision\web\Lxi

11/14/11  09:38a    <DIR>              Identification

    Found 1 file(s). Total size 0 bytes.

    Directory of \Secure\infiniiVision\web\Lxi\Identification

03/07/11  02:10p                   710 Default.asp
03/07/11  02:10p                 12270 LXIIdentification.xsd

    Found 2 file(s). Total size 12980 bytes.

    Directory of \Secure\infiniiVision\web\help

03/07/11  02:10p                  1308 helpBrowserWebControl.asp
03/07/11  02:10p                  1460 helpGetImage.asp
03/07/11  02:10p                  4666 helpHome.asp
03/07/11  02:10p                  6869 helpHomeAdv.asp
03/07/11  02:10p                  1216 helpInfoCal.html
03/07/11  02:10p                  1359 helpInfoOptions.html
03/07/11  02:10p                  1713 helpInfoVersion.asp
03/07/11  02:10p                  7834 helpModifyConfig.asp
03/07/11  02:10p                  2740 helpNav.asp
03/07/11  02:10p                  1337 helpRecall.asp
03/07/11  02:10p                  5275 helpRemoteFrontPanel.asp
03/07/11  02:10p                  1299 helpRemoteSCPICommands.asp
03/07/11  02:10p                  1242 helpSave.asp
03/07/11  02:10p                  1290 helpSaveRecall.asp
03/07/11  02:10p                  1213 helpStyle.css
03/07/11  02:10p                   102 helpVar.asp
03/07/11  02:10p                  8319 helpViewConfig.asp

    Found 17 file(s). Total size 49242 bytes.

    Directory of \Secure\infiniiVision\web\image

03/07/11  02:10p                  2192 agilent.gif
03/07/11  02:10p                   892 down-over.gif
03/07/11  02:10p                   892 down.gif
03/07/11  02:10p                    43 filltrans.gif
03/07/11  02:10p                  1581 instrumentBanner.gif
03/07/11  02:10p                 25781 instrumentImage.jpg
03/07/11  02:10p                  1064 keyboard.gif
03/07/11  02:10p                    94 line-heading.gif
03/07/11  02:10p                  2576 lxi.jpg
03/07/11  02:10p                 26492 m2XX2A.jpg
03/07/11  02:10p                 28410 m2XX4A.jpg
03/07/11  02:10p                 27057 m3XX2A.jpg
03/07/11  02:10p                 29031 m3XX4A.jpg
03/07/11  02:10p                  6716 popupMenu.jpg
03/07/11  02:10p                  4062 popupMenu_wvga.jpg
03/07/11  02:10p                  3850 softkey.jpg
03/07/11  02:10p                  2558 softkey_wvga.jpg
03/07/11  02:10p                   893 up-over.gif
03/07/11  02:10p                   893 up.gif
03/07/11  02:10p                  1535 web-enable.gif

    Found 20 file(s). Total size 166612 bytes.

    Directory of \Secure\infiniiVision\web\lib

03/07/11  02:10p                176653 edtftpj.jar
03/07/11  02:10p               1897479 plugin.jar

    Found 2 file(s). Total size 2074132 bytes.

    Directory of \Secure\infiniiVision\web\navbar

03/07/11  02:10p                405062 PantherTabs.psd
03/07/11  02:10p                    48 bluebar.gif
03/07/11  02:10p                  1455 config-down.gif
03/07/11  02:10p                  1881 config-over.gif
03/07/11  02:10p                  1862 config.gif
03/07/11  02:10p                  1430 help-down.gif
03/07/11  02:10p                  1858 help-over.gif
03/07/11  02:10p                  1834 help.gif
03/07/11  02:10p                  1425 image-down.gif
03/07/11  02:10p                  1894 image-over.gif
03/07/11  02:10p                  1856 image.gif
03/07/11  02:10p                  1663 printpage-down.gif
03/07/11  02:10p                  2132 printpage-over.gif
03/07/11  02:10p                  2110 printpage.gif
03/07/11  02:10p                  1450 remote-down.gif
03/07/11  02:10p                  1861 remote-only.gif
03/07/11  02:10p                  1899 remote-over.gif
03/07/11  02:10p                  1453 saverecall-down.gif
03/07/11  02:10p                  1910 saverecall-over.gif
03/07/11  02:10p                  1885 saverecall.gif
03/07/11  02:10p                  1541 status-down.gif
03/07/11  02:10p                  1964 status-over.gif
03/07/11  02:10p                  1972 status.gif
03/07/11  02:10p                  1446 utilities-down.gif
03/07/11  02:10p                  1910 utilities-over.gif
03/07/11  02:10p                  1858 utilities.gif
03/07/11  02:10p                  1453 welcome-down.gif
03/07/11  02:10p                  1924 welcome-over.gif
03/07/11  02:10p                  1865 welcome.gif

    Found 29 file(s). Total size 452901 bytes.

    Directory of \Secure\infiniiVision\fpga

08/29/11  09:50p                283776 FPGA2000A.bin
08/29/11  09:50p                480148 FPGA3000A.bin
06/10/10  07:46a                 72668 gpibFPGA.bin
10/24/10  09:51p                 72668 lanFPGA.bin

    Found 4 file(s). Total size 909260 bytes.

    Directory of \Secure\Startup

11/15/11  09:26a                    53 infiniivision.lnk

    Found 1 file(s). Total size 53 bytes.

    Directory of \Secure\cal

11/15/11  09:31a                    76 sernum.dat
11/15/11  08:22a                 27244 framecal.dat
11/15/11  08:22a                 75031 callog.txt
11/15/11  08:22a                   772 factorycal.dat

    Found 4 file(s). Total size 103123 bytes.

    Directory of \Secure\System

11/15/11  09:26a    <DIR>              Licensing

    Found 1 file(s). Total size 0 bytes.

    Directory of \Secure\System\Licensing

11/15/11  09:26a    <DIR>              Store

    Found 1 file(s). Total size 0 bytes.

    Directory of \Secure\System\Licensing\Store

<*snip*>

    Found 14 file(s). Total size 8167 bytes.

    Directory of \Application Data

09/07/06  10:00a                    69 desktop.ini

    Found 1 file(s). Total size 69 bytes.

    Directory of \profiles

10/30/11  03:35a    <DIR>              default

    Found 1 file(s). Total size 0 bytes.

    Directory of \Documents and Settings

10/30/11  03:35a                 53248 default.vol

    Found 1 file(s). Total size 53248 bytes.

    Directory of \My Documents

09/07/06  10:00a                    69 desktop.ini

    Found 1 file(s). Total size 69 bytes.

    Directory of \Program Files

09/07/06  10:00a                    69 desktop.ini
10/30/11  03:35a    <DIR>              Agilent
10/30/11  03:35a                    19 Command Prompt.lnk

    Found 3 file(s). Total size 88 bytes.

    Directory of \Program Files\Agilent

10/30/11  03:35a    <DIR>              IO Libraries Suite

    Found 1 file(s). Total size 0 bytes.

    Directory of \Program Files\Agilent\IO Libraries Suite

10/30/11  03:35a    <DIR>              bin
10/30/11  03:35a    <DIR>              Drivers

    Found 2 file(s). Total size 0 bytes.

    Directory of \Program Files\Agilent\IO Libraries Suite\bin

10/30/11  03:35a                 13312 portmap.exe

    Found 1 file(s). Total size 13312 bytes.

    Directory of \Program Files\Agilent\IO Libraries Suite\Drivers

10/30/11  03:35a                102400 AgilentLan488Server32.dll

    Found 1 file(s). Total size 102400 bytes.

    Directory of \Windows

10/30/11  03:35a                   206 FTPD.tmp
10/30/11  03:35a    <DIR>              StartUp
10/30/11  03:35a    <DIR>              Fonts
10/30/11  03:35a    <DIR>              Favorites
10/30/11  03:35a                    52 System.mky
10/30/11  03:35a                   276 SystemLog.xml
10/30/11  03:35a                     0 ApplicationLog.xml
10/30/11  03:35a                    52 default.mky
10/30/11  03:35a                     0 initobj.dat
10/30/11  03:35a    <DIR>              Recent
10/30/11  03:35a    <DIR>              Programs
10/30/11  03:35a    <DIR>              Desktop
10/30/11  03:35a    <DIR>              www
10/13/11  11:34p                 61440 nk.exe
10/13/11  11:19p                246784 kernel.dll
10/13/11  11:36p                643072 coredll.dll
10/13/11  11:34p                  4096 oalioctl.dll
10/13/11  11:36p                640000 k.coredll.dll
10/13/11  11:20p                 59392 fpcrt.dll
10/13/11  11:20p                 59392 k.fpcrt.dll
10/13/11  11:36p                244736 filesys.dll
10/13/11  11:21p                 10240 romfsd.dll
10/13/11  11:36p                676864 gwes.dll
10/13/11  11:21p                209920 mgtt_o.dll
10/13/11  11:21p                  4096 device.dll
10/13/11  11:21p                 14336 udevice.exe
10/13/11  11:21p                 63488 devmgr.dll
10/13/11  11:21p                  7168 regenum.dll
10/13/11  11:21p                 14336 busenum.dll
10/13/11  11:21p                 48128 pm.dll
10/13/11  11:20p                 14848 servicesEnum.dll
10/13/11  11:20p                 28160 servicesd.exe
10/13/11  11:36p                 11264 services.exe
10/13/11  11:20p                  4096 servicesStart.exe
10/13/11  11:20p                 37888 notify.dll
10/13/11  11:21p                 90112 exfat.dll
10/13/11  11:21p                 11776 diskcache.dll
10/13/11  11:36p                 54784 fatutil.dll
10/13/11  11:36p                 54784 k.fatutil.dll
10/13/11  11:20p                 55808 shell.exe
10/13/11  11:20p                 10752 shellcelog.dll
10/13/11  11:20p                  7168 toolhelp.dll
10/13/11  11:20p                  7168 k.toolhelp.dll
10/13/11  11:21p                 38912 zlib.dll
10/13/11  11:36p                 38912 console.dll
10/13/11  11:36p                 70144 cmd.exe
10/13/11  11:36p                 12288 net.exe
10/13/11  11:36p                388096 commctrl.dll
10/13/11  11:36p                 88576 commdlg.dll
10/13/11  11:20p                  9728 prnport.dll
10/13/11  11:20p                  9728 k.prnport.dll
10/13/11  11:36p                  5120 prnerr.dll
10/13/11  11:36p                  5120 k.prnerr.dll
10/13/11  11:20p                 15872 pcl.dll
10/13/11  11:20p                 15872 k.pcl.dll
10/13/11  11:20p                131584 fsdmgr.dll
10/13/11  11:21p                 21504 mspart.dll
10/13/11  11:20p                 23552 ceddk.dll
10/13/11  11:20p                 23552 k.ceddk.dll
10/13/11  11:36p                  4608 netmui.dll
10/13/11  11:20p                 22016 cxport.dll
10/13/11  11:20p                 55296 iphlpapi.dll
10/13/11  11:20p                 55296 k.iphlpapi.dll
10/13/11  11:20p                 39424 ws2.dll
10/13/11  11:20p                 39424 k.ws2.dll
10/13/11  11:20p                  9216 ws2instl.dll
10/13/11  11:20p                  9216 wspm.dll
10/13/11  11:20p                  9216 k.wspm.dll
10/13/11  11:20p                 10752 nspm.dll
10/13/11  11:20p                 10752 k.nspm.dll
10/13/11  11:20p                 52736 ws2k.dll
10/13/11  11:20p                 33792 ws2serv.dll
10/13/11  11:20p                 32256 ssllsp.dll
10/13/11  11:20p                 32256 k.ssllsp.dll
10/13/11  11:20p                 97280 schannel.dll
10/13/11  11:20p                 97280 k.schannel.dll
10/13/11  11:20p                 56320 credsvc.dll
10/13/11  11:20p                 40448 ipseccfg.exe
10/13/11  11:20p                132608 afd.dll
10/13/11  11:20p                  4608 dnsapi.dll
10/13/11  11:20p                  4608 k.dnsapi.dll
10/13/11  11:20p                 13824 netapi32.dll
10/13/11  11:20p                135168 ndis.dll
10/13/11  11:36p                215552 netui.dll
10/13/11  11:20p                 22528 ndisuio.dll
10/13/11  11:20p                 29184 dhcp.dll
10/13/11  11:20p                335360 tcpstk.dll
10/13/11  11:20p                152576 redir.dll
10/13/11  11:20p                 39936 netbios.dll



<*continued in next post due to 20k character forum post limit*>

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benemorius on July 22, 2013, 03:20:40 am
Code: [Select]
<*continued from last post due to 20k character forum post limit*>

10/13/11  11:20p                163840 wldap32.dll
10/13/11  11:20p                 27136 lpcd.dll
10/13/11  11:20p                  6656 lpcrt.dll
10/13/11  11:20p                 13824 ping.exe
10/13/11  11:20p                 14848 ipconfig.exe
10/13/11  11:20p                 11264 ndisconfig.exe
10/13/11  11:20p                 14848 route.exe
10/13/11  11:20p                 21504 netstat.exe
10/13/11  11:20p                 11776 tracert.exe
10/13/11  11:21p                 29184 serial.dll
10/13/11  11:21p                 25088 usbd.dll
10/13/11  11:21p                 18944 usbhid.dll
10/13/11  11:34p                 20992 usbmsc.dll
10/13/11  11:34p                 21504 usbdisk6.dll
10/13/11  11:21p                 14848 usbprn.dll
10/13/11  11:21p                 29184 hidparse.dll
10/13/11  11:21p                  9216 kbdhid.dll
10/13/11  11:21p                  5120 conshid.dll
10/13/11  11:36p                  6144 MouHid.dll
10/13/11  11:21p                  7168 mmtimer.dll
10/13/11  11:21p                  7168 k.mmtimer.dll
10/13/11  11:36p                 34816 eventlog.dll
10/13/11  11:36p                  6144 eventlogMsgs.dll
10/13/11  11:21p                  4608 uiproxy.dll
10/13/11  11:20p                 12800 secur32.dll
10/13/11  11:20p                 12800 k.secur32.dll
10/13/11  11:20p                194560 kerberos.dll
10/13/11  11:20p                194560 k.kerberos.dll
10/13/11  11:20p                 44032 msasn1.dll
10/13/11  11:20p                 44032 k.msasn1.dll
10/13/11  11:36p                278528 crypt32.dll
10/13/11  11:36p                278528 k.crypt32.dll
10/13/11  11:20p                 24576 cryptdll.dll
10/13/11  11:20p                 24576 k.cryptdll.dll
10/13/11  11:20p                  6656 winsock.dll
10/13/11  11:20p                  6656 k.winsock.dll
10/13/11  11:20p                  6144 credprov.dll
10/13/11  11:20p                 41472 spnego.dll
10/13/11  11:20p                 41472 k.spnego.dll
10/13/11  11:22p                478720 ole32.dll
10/13/11  11:22p                198144 oleaut32.dll
10/13/11  11:22p                 99328 dcomssd.dll
10/13/11  11:22p                  8704 dllhost.exe
10/13/11  11:22p                327168 rpcrt4.dll
10/13/11  11:22p                355840 imaging.dll
10/13/11  11:36p                142848 mlang.dll
10/13/11  11:36p                136192 shlwapi.dll
10/13/11  11:36p                 12800 IECEExt.dll
10/13/11  11:23p                754176 msxml3.dll
10/13/11  11:22p                201728 shdocvw.dll
10/13/11  11:36p                486400 wininet.dll
10/13/11  11:23p                 19456 jsproxy.dll
10/13/11  11:36p                313856 urlmon.dll
10/13/11  11:36p                342528 vbscript.dll
10/13/11  11:36p                103424 httpd.dll
10/13/11  11:36p                 78848 asp.dll
10/13/11  11:23p                 51712 httpdadm.dll
10/13/11  11:23p                 20992 telnetd.dll
10/13/11  11:23p                 50688 ftpd.dll
10/13/11  11:23p                 10240 timesvc.dll
10/13/11  11:36p                289792 ceshell.dll
10/13/11  11:36p                266240 explorer.exe
10/13/11  11:23p                 11264 shcore.dll
10/13/11  11:36p                 17408 control.exe
10/13/11  11:23p                  7680 ctlpnl.exe
10/13/11  11:36p                155136 cplmain.cpl
10/13/11  11:36p                 52224 intll.cpl
10/13/11  11:36p                 49152 wceldcmd.exe
10/13/11  11:23p                 12800 unldcmd.exe
10/10/07  11:58p                 67088 mscoree.dll
10/11/07  12:01a                945176 mscoree3_5.dll
10/11/07  12:02a                256536 netcfagl3_5.dll
10/11/07  12:02a                168480 netcfd3dm3_5.dll
10/10/07  11:56p                 22904 cgacutil.exe
10/13/11  11:34p                 45568 SH600_NandFlash.dll
10/13/11  11:34p                 12288 SH600_gpio.dll
10/13/11  11:34p                  9216 SH600_spi.dll
10/13/11  11:34p                  9728 SH600_i2c.dll
10/13/11  11:34p                  8192 SH600_ADC.dll
10/13/11  11:34p                 29184 P500_gmacndis.dll
10/13/11  11:35p                 73216 SH600_ehci.dll
10/13/11  11:34p                 57344 SH600_ohci.dll
10/13/11  11:35p                 74240 ehci.dll
10/13/11  11:35p                  4096 AgtFlashHelper.dll
10/13/11  11:34p                 45568 Ssh600_nandflash.dll
10/13/11  11:35p                 11776 p500_uboo.dll
10/13/11  11:35p                 36864 TMCP500_CE6_DeviceSideUsb.dll
10/13/11  11:35p                 13312 sh600_serial2.dll
10/13/11  11:35p                  6656 MapMemoryIntoUserSpace.dll
10/13/11  11:35p                  8704 GpibOverSPI_P500_CE6.dll
10/13/11  11:35p                223232 baldwin_ddi.dll
10/13/11  11:35p                126976 loadP500Flash.exe
10/13/11  11:35p                 11776 ubootEnvironment.dll
10/13/11  11:35p                  8192 ProcessStartupFolder.exe
10/13/11  11:35p                 14336 CeCreateUserAccounts.exe
10/13/11  11:35p                 36864 ConfigureNetworkNative.exe
10/13/11  11:35p                  7168 processMgr.exe
10/13/11  11:35p                  3584 rebootInfiniiVision.exe
10/13/11  11:36p                  7168 regsvr32.exe
10/13/11  11:36p                 37888 infiniiVisionInstallHelper.exe
10/13/11  11:36p                129536 infiniiVisionInstallService.exe
10/13/11  11:36p                 36352 libmspack.dll
10/13/11  11:36p                 24576 ubootTools.exe
10/13/11  11:36p                 10240 compileImageForSplashScreen.exe
10/13/11  11:16p                188416 eGalaxTouch.exe
10/13/11  11:16p                100352 DrawTest.exe
10/13/11  11:16p                 93696 Calbration.exe
10/13/11  11:16p                 88064 UpdateEEPROM.exe
10/13/11  11:16p                 17920 USBTouch.dll
10/13/11  11:19p                 19167 ceconfig.h
10/13/11  11:36p                208590 wince.nls
10/13/11  11:36p                170825 default.fdf
10/13/11  11:36p                  8763 initdb.ini
09/07/06  10:00a                   134 close.2bp
09/07/06  10:00a                   134 ok.2bp
09/07/06  10:00a                  1030 stdsm.2bp
09/07/06  10:00a                   838 viewsm.2bp
09/07/06  10:00a                  2038 stdsm.bmp
09/07/06  10:00a                  1654 viewsm.bmp
09/07/06  10:00a                176120 rsaenh.dll
09/07/06  10:00a                  8779 sysroots.p7b
10/13/11  11:20p                 50688 ntlmssp.dll
10/13/11  11:20p                 79360 ntlmssp_svc.dll
09/07/06  10:00a                289940 arialbd.ttf
09/07/06  10:00a                228180 arialbi.ttf
09/07/06  10:00a                209248 ariali.ttf
09/07/06  10:00a                118868 arialk.ttf
09/07/06  10:00a                160724 arial.ttf
09/07/06  10:00a                169464 cour.ttf
09/07/06  10:00a                135848 tahoma.ttf
09/07/06  10:00a                   961 httpd_default.htm
09/07/06  10:00a                  1231 httpd-admin.htm
09/07/06  10:00a                  4035 httpd-home.htm
09/07/06  10:00a                  1710 httpd-logging.htm
09/07/06  10:00a                  3281 httpd-netint.htm
09/07/06  10:00a                  1816 httpd-newwebfinished.htm
09/07/06  10:00a                  1482 httpd-newwebsite.htm
09/07/06  10:00a                  3058 httpd-newwebvdirs.htm
09/07/06  10:00a                  1234 httpd-sites.htm
09/07/06  10:00a                  1385 httpd-ssl.htm
09/07/06  10:00a                  1292 httpd-users.htm
09/07/06  10:00a                  8470 httpd-vroot.htm
09/07/06  10:00a                  2811 httpd-vrootlist.htm
09/07/06  10:00a                  3587 httpd-website.htm
09/07/06  10:00a                  1728 httpd-i-authlevel.htm
09/07/06  10:00a                  2992 httpd-i-authoverview.htm
09/07/06  10:00a                  2313 httpd-i-authtypes.htm
09/07/06  10:00a                  2005 httpd-i-dirbrowse.htm
09/07/06  10:00a                  1972 httpd-i-home.htm
09/07/06  10:00a                  2069 httpd-i-logging.htm
09/07/06  10:00a                  2460 httpd-i-overview.htm
09/07/06  10:00a                  1030 httpd-i-permissions.htm
09/07/06  10:00a                  1772 httpd-i-setpaths.htm
09/07/06  10:00a                  1978 httpd-i-ssl.htm
09/07/06  10:00a                  2446 httpd-i-upload.htm
09/07/06  10:00a                  2570 httpd-i-userlists.htm
09/07/06  10:00a                  3601 httpd-i-vdirs.htm
09/07/06  10:00a                  1831 httpd-i-webadmin.htm
09/07/06  10:00a                  4908 httpd-i-website.htm
09/07/06  10:00a                    69 appdata.ini
09/07/06  10:00a                   144 desktopdirectory.ini
09/07/06  10:00a                    69 favorites.ini
09/07/06  10:00a                    69 fonts.ini
09/07/06  10:00a                    69 mydocuments.ini
09/07/06  10:00a                    69 programfiles.ini
09/07/06  10:00a                    69 programs.ini
09/07/06  10:00a                    69 recent.ini
09/07/06  10:00a                    69 startup.ini
09/07/06  10:00a                    24 explore.lnk
09/07/06  10:00a                 10786 WindowsCE.jpg
09/07/06  10:00a                    19 cmd.lnk
09/07/06  10:00a                    23 control.lnk
09/07/06  10:00a                   739 copyrts.txt
09/07/06  10:00a                  3116 asterisk.wav
09/07/06  10:00a                  3388 close.wav
09/07/06  10:00a                  2970 critical.wav
09/07/06  10:00a                  2682 default.wav
09/07/06  10:00a                  3946 empty.wav
09/07/06  10:00a                  9204 exclam.wav
09/07/06  10:00a                  5656 infbeg.wav
09/07/06  10:00a                  1778 infend.wav
09/07/06  10:00a                  2088 infintr.wav
09/07/06  10:00a                   834 menupop.wav
09/07/06  10:00a                   360 menusel.wav
09/07/06  10:00a                  3388 openprog.wav
09/07/06  10:00a                  1836 question.wav
09/07/06  10:00a                  8508 startup.wav
09/07/06  10:00a                  2712 windmax.wav
09/07/06  10:00a                  2866 windmin.wav
09/07/06  10:00a                  3388 recstart.wav
09/07/06  10:00a                  3388 recend.wav
10/10/07  11:45p                 16936 GAC_CustomMarshalers_v3_5_0_0_cneutral_1.dll
10/10/07  11:46p                349744 GAC_Microsoft.VisualBasic_v8_1_0_0_cneutral_1.dll
10/10/07  11:46p                 34360 GAC_Microsoft.WindowsCE.Forms_v3_5_0_0_cneutral_1.dll
10/10/07  11:46p                185920 GAC_Microsoft.WindowsMobile.DirectX_v3_5_0_0_cneutral_1.dll
10/10/07  11:45p                941592 GAC_mscorlib_v3_5_0_0_cneutral_1.dll
10/10/07  11:46p                709656 GAC_System.Data_v3_5_0_0_cneutral_1.dll
02/09/09  06:51a                527552 GAC_System_v3_5_0_0_cneutral_1.dll
10/10/07  11:45p                 60960 GAC_System.Drawing_v3_5_0_0_cneutral_1.dll
10/10/07  11:46p                 77352 GAC_System.Messaging_v3_5_0_0_cneutral_1.dll
10/10/07  11:46p                 20000 GAC_System.Net.IrDA_v3_5_0_0_cneutral_1.dll
10/10/07  11:45p                 67112 GAC_System.Web.Services_v3_5_0_0_cneutral_1.dll
10/10/07  11:46p                280112 GAC_System.Windows.Forms_v3_5_0_0_cneutral_1.dll
10/10/07  11:45p               1038360 GAC_System.Xml_v3_5_0_0_cneutral_1.dll
10/10/07  11:46p                 88088 GAC_System.Core_v3_5_0_0_cneutral_1.dll
10/10/07  11:46p                 35904 GAC_System.Data.DataSetExtensions_v3_5_0_0_cneutral_1.dll
10/10/07  11:45p                 42048 GAC_System.Runtime.Serialization_v3_5_0_0_cneutral_1.dll
10/10/07  11:45p                474152 GAC_System.ServiceModel_v3_5_0_0_cneutral_1.dll
10/10/07  11:46p                 92704 GAC_System.Xml.Linq_v3_5_0_0_cneutral_1.dll
10/10/07  11:46p                345112 GAC_System.SR_v3_5_0_0_cneutral_1.dll
10/10/07  11:47p                 63032 GAC_Microsoft.VisualBasic.SR_v8_1_0_0_cneutral_1.dll
10/13/11  11:34p                178176 SH600_ddi.dll
10/13/11  11:21p                 23040 kbdmouse.dll
06/16/11  11:56p                102400 AgilentLan488Server32.dll
06/16/11  11:56p                 44032 Agilent.Cdf.Core.Kernel.dll
06/16/11  11:57p                415744 Agilent.Cdf.Api.Unmanaged.dll
06/16/11  11:14p                169984 LxiMdnsResponder.dll
06/16/11  11:14p                 11560 LxiMdnsResponderLicense.txt
06/16/11  11:58p                 11776 Portability.dll
06/16/11  11:59p                 13312 portmap.exe
06/16/11  11:59p                147968 Sicl32.dll
06/16/11  11:59p                 81408 siclland.dll
06/16/11  11:59p                 82432 siclrpc.dll
06/17/11  12:12a                  9216 Agilent.Cdf.Core.Lxi.Web.ComServer.Interop.dll
06/16/11  11:14p                238080 OpenNETCF.dll
06/17/11  12:21a               1089536 Agilent.Cdf.Api.dll
06/17/11  12:21a                 36352 Agilent.Cdf.Api.Gui.dll
06/16/11  11:19p                  9099 PasswordFront.asp
06/16/11  11:19p                 31371 home.asp
06/16/11  11:19p                  2315 index.asp
06/16/11  11:19p                 41690 modify_config.asp
06/16/11  11:19p                  9677 navigation.asp
06/16/11  11:19p                  7905 password.asp
06/16/11  11:19p                  2268 top.asp
06/16/11  11:19p                 23463 view_config.asp
06/16/11  11:19p                   710 Default.asp
06/16/11  11:14p                 12270 LXIIdentification.xsd
06/16/11  11:19p                 38980 QualityLXI.jpg
06/16/11  11:19p                  1004 CookieUtils.js
06/16/11  11:19p                  2192 agilent.gif

<*holy crap... sorry... I should have just attached it*>
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benemorius on July 22, 2013, 03:21:25 am
Code: [Select]
<*holy crap... sorry... I should have just attached it*>

06/16/11  11:19p                   892 down-over.gif
06/16/11  11:19p                   892 down.gif
06/16/11  11:19p                    94 line-heading.gif
06/16/11  11:19p                  3417 lxi.jpg
06/16/11  11:19p                   893 up-over.gif
06/16/11  11:19p                   893 up.gif
06/16/11  11:19p                  1627 web-device.gif
06/16/11  11:19p                  1535 web-enable.gif
06/16/11  11:19p                    48 bluebar.gif
06/16/11  11:19p                  1095 config-down.gif
06/16/11  11:19p                  1068 config-over.gif
06/16/11  11:19p                  1064 config.gif
06/16/11  11:19p                   525 data-down.gif
06/16/11  11:19p                   519 data-over.gif
06/16/11  11:19p                   514 data.gif
06/16/11  11:19p                   650 help-down.gif
06/16/11  11:19p                   679 help-over.gif
06/16/11  11:19p                   666 help.gif
06/16/11  11:19p                   584 image-down.gif
06/16/11  11:19p                   583 image-over.gif
06/16/11  11:19p                   570 image.gif
06/16/11  11:19p                   920 remote-down.gif
06/16/11  11:19p                   907 remote-over.gif
06/16/11  11:19p                   895 remote.gif
06/16/11  11:19p                   620 welcome-down.gif
06/16/11  11:19p                   623 welcome-over.gif
06/16/11  11:19p                   614 welcome.gif
06/17/11  12:21a                  6144 AgilentLxiWebService.exe
06/16/11  11:55p                 70144 AgilentLxiWebComServer.exe
06/16/11  11:57p                 32256 Agilent.Cdf.Core.Lxi.Web.ComServer.ProxyStub.dll
06/16/11  11:57p                 58880 Agilent.Cdf.Core.Lxi.Web.ComServer.dll
06/17/11  12:21a                  6144 AgilentLxiWebStartup.exe
10/13/11  11:16p                    41 ConfigureNetwork.lnk
10/13/11  11:16p                    99 usbUpdateApp.bat
10/13/11  11:16p                    88 usbUpdateFpga.bat
10/13/11  11:36p                   177 infiniiVision.txt

    Found 365 file(s). Total size 26626785 bytes.

    Directory of \Windows\StartUp

09/07/06  10:00a                    69 desktop.ini

    Found 1 file(s). Total size 69 bytes.

    Directory of \Windows\Fonts

09/07/06  10:00a                    69 desktop.ini

    Found 1 file(s). Total size 69 bytes.

    Directory of \Windows\Favorites

09/07/06  10:00a                    69 desktop.ini

    Found 1 file(s). Total size 69 bytes.

    Directory of \Windows\Recent

09/07/06  10:00a                    69 desktop.ini

    Found 1 file(s). Total size 69 bytes.

    Directory of \Windows\Programs

09/07/06  10:00a                    69 desktop.ini
10/30/11  03:35a                    19 Command Prompt.lnk
10/30/11  03:35a                    24 Windows Explorer.lnk

    Found 3 file(s). Total size 112 bytes.

    Directory of \Windows\Desktop

09/07/06  10:00a                   144 desktop.ini

    Found 1 file(s). Total size 144 bytes.

    Directory of \Windows\www

10/30/11  03:35a                    58 current-httpd.log
10/30/11  03:35a    <DIR>              wwwpub

    Found 2 file(s). Total size 58 bytes.

    Directory of \Windows\www\wwwpub

10/30/11  03:35a                     0 ApplicationLog.txt
10/30/11  03:35a    <DIR>              navbar
10/30/11  03:35a    <DIR>              Lxi
10/30/11  03:35a    <DIR>              image
10/30/11  03:35a                  1004 CookieUtils.js
10/30/11  03:35a                 23463 view_config.asp
10/30/11  03:35a                  2268 top.asp
10/30/11  03:35a                  7905 password.asp
10/30/11  03:35a                  9677 navigation.asp
10/30/11  03:35a                 41690 modify_config.asp
10/30/11  03:35a                  2315 index.asp
10/30/11  03:35a                 31371 home.asp
10/30/11  03:35a                  9099 PasswordFront.asp
10/30/11  03:35a                   961 default.htm

    Found 14 file(s). Total size 129753 bytes.

    Directory of \Windows\www\wwwpub\navbar

10/30/11  03:35a                   614 welcome.gif
10/30/11  03:35a                   623 welcome-over.gif
10/30/11  03:35a                   620 welcome-down.gif
10/30/11  03:35a                   895 remote.gif
10/30/11  03:35a                   907 remote-over.gif
10/30/11  03:35a                   920 remote-down.gif
10/30/11  03:35a                   570 image.gif
10/30/11  03:35a                   583 image-over.gif
10/30/11  03:35a                   584 image-down.gif
10/30/11  03:35a                   666 help.gif
10/30/11  03:35a                   679 help-over.gif
10/30/11  03:35a                   650 help-down.gif
10/30/11  03:35a                   514 data.gif
10/30/11  03:35a                   519 data-over.gif
10/30/11  03:35a                   525 data-down.gif
10/30/11  03:35a                  1064 config.gif
10/30/11  03:35a                  1068 config-over.gif
10/30/11  03:35a                  1095 config-down.gif
10/30/11  03:35a                    48 bluebar.gif

    Found 19 file(s). Total size 13144 bytes.

    Directory of \Windows\www\wwwpub\Lxi

10/30/11  03:35a    <DIR>              Identification

    Found 1 file(s). Total size 0 bytes.

    Directory of \Windows\www\wwwpub\Lxi\Identification

10/30/11  03:35a                 12270 LXIIdentification.xsd
10/30/11  03:35a                   710 Default.asp

    Found 2 file(s). Total size 12980 bytes.

    Directory of \Windows\www\wwwpub\image

10/30/11  03:35a                  1535 web-enable.gif
10/30/11  03:35a                  1627 web-device.gif
10/30/11  03:35a                   893 up.gif
10/30/11  03:35a                   893 up-over.gif
10/30/11  03:35a                  3417 lxi.jpg
10/30/11  03:35a                    94 line-heading.gif
10/30/11  03:35a                   892 down.gif
10/30/11  03:35a                   892 down-over.gif
10/30/11  03:35a                  2192 agilent.gif
10/30/11  03:35a                 38980 QualityLXI.jpg

    Found 10 file(s). Total size 51415 bytes.

    Total Files Listed:
        1094 File(s) 102902884 bytes.
        81 Dir(s) 27090944 bytes free
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on July 22, 2013, 04:35:53 am
The registry seems off-limits since windows seems to refuse to copy any file that's open and apparently there's no way around that. :-//
Usually in WindowsCE systems the registry is part of the nk.bin image and can't be changed. It is loaded at boot time from flash in memory, like all the other programs in the \windows directory.
Quote
Here's the output of `dir /s /a \` (firmware 2.00)
Maybe not a good idea to post it all in this forum. You can still edit it: pastebin.com and then a link.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on July 22, 2013, 08:41:44 am
Yes, the registry is in default.fdf inside nk.bin, but there is no much interesting. "SecureStorage" component looks more promising, needs to be figured out
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sbampato12 on August 05, 2013, 04:34:55 pm
Benemorius, did you tryied change de splash screen?
did you get any results with yours tests?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: sumino2000 on August 11, 2013, 01:18:52 pm
I only wish FrankBuss would elaborate on how to utilize that UART...

The serial port location:

http://i.imgur.com/yYMV75t.jpg (http://i.imgur.com/yYMV75t.jpg)

All you need are some jumper wires, if you don't want to drill a hole. Fits nicely through the USB connector hole 8)

http://i.imgur.com/9gnsuQh.jpg (http://i.imgur.com/9gnsuQh.jpg)

You can then stop the u-boot with space (can be difficult, you have to be fast, use something like HTerm which has a useful "repeat" function to send a sequence automatically until you stop it, or just hold down space while you boot it). Then you can boot the image from network like this:

Code: [Select]
set serverip 192.168.11.108
dhcp 0x4000000 nk.bin;bootm 0xf8050000

Where 192.168.11.108 is your own server, where TFTP is running and providing nk.bin. You should see something like this:

Code: [Select]
BOOTP broadcast 1
DHCP client bound to address 192.168.11.106
Using smsc device
TFTP from server 192.168.11.108; our IP address is 192.168.11.106
Filename 'nk.bin'.
Load address: 0x4000000
Loading: **#################################################################
#################################################################
...

You get the nk.bin from the nk.bin.comp from the firmware update cab-file with the bincompress.exe tool, which is included in the evaluation version of the WindowsCE development environment. Use http://www.t-hack.com/wiki/index.php/NK.BIN_toolset (http://www.t-hack.com/wiki/index.php/NK.BIN_toolset) to take a look at the content of nk.bin and to modify it.


Hi, here is info if someone want to make a NAND dump with JTAG debugger:

To Enable JTAG, you need this SPEAr600 TEST[2:0] pin configuration:
TEST_0=1, TEST_1=1, TEST_2=0

With debugger I did 128MB dump from NAND:

0000:0000-005F:FFFF  empty, just 0xFF
0060:0000-00C0:9F61  NK.BIN.COMP, size 12623714 bytes (FW 02.20)

02C2:0000- ????      Other data/files


Now we have NAND dump and need to:
1) hack MD5/RSA file consistency check to enable another files to modify
2) hack RSACryptoServiceProvider::VerifyData() or function which use it (AGILEN~1.003)
With Uboot write modificaton into NAND. Then just install licenses with any signature :-)

Now I'm not able to find MD5/RSA file consistency check. Please help.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on August 11, 2013, 06:48:22 pm
There is no file consistency check afaik. There is no need to use jtag also, just use the infiniivisionstartupoverride.txt method desribed in previous posts and you'll be able to run a patched scope app from usb flash drive whithout opening the case. There is more that enough info posted in this thread already, just nobody wants to post that final "here is .zip, unpack it to usb flash and use"  ;)
Funny situation - dissecting Rigol and Hantek in public is ok, but Agilent's name invokes some kind of shame (or fear?) )))
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on August 11, 2013, 07:36:54 pm
I guess the difference might be that the Hantek and Rigol hacks are just for bandwidth upgrade, all the other features are already included, so it is nice to have it, but most of the time not that important.

Agilent wants even for the voltmeter license EUR 61. And just the RS232/UART decoding license costs EUR 642. You want I2C/SPI, too? Another EUR 642. The sum of all available licenses might be more than EUR 10,000. And there might be people who considers to buy one or more licenses, like I did with the network license. So could be a big loss for Agilent, if there would be a public hack. Which makes it more dangerous to publish such a hack and which might even have negative consequences for Agilent: less money for Agilent means that they have less money for developing more good scopes.

So in my opinion, hack it for fun if you are a hobbyist and if you wouldn't buy one of the expensive licenses anyway, but don't publish the hack.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on August 12, 2013, 03:52:59 pm
There is no file consistency check afaik. There is no need to use jtag also, just use the infiniivisionstartupoverride.txt method desribed in previous posts and you'll be able to run a patched scope app from usb flash drive whithout opening the case. There is more that enough info posted in this thread already, just nobody wants to post that final "here is .zip, unpack it to usb flash and use"  ;)
Funny situation - dissecting Rigol and Hantek in public is ok, but Agilent's name invokes some kind of shame (or fear?) )))

Few reasons:
1. There is security risk when we publish it.
2. Agilent and their engineers are really helpful when I need real assistence.
3. On this forum were hack offered for $$$, so it is under supervision for sure.
4. This thread is in the top when you Google "Agilent DSOX hack".
5. Hack will double or triple the price of hardware.




Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on August 12, 2013, 06:59:39 pm
There is no file consistency check afaik. There is no need to use jtag also, just use the infiniivisionstartupoverride.txt method desribed in previous posts and you'll be able to run a patched scope app from usb flash drive whithout opening the case. There is more that enough info posted in this thread already, just nobody wants to post that final "here is .zip, unpack it to usb flash and use"  ;)
Funny situation - dissecting Rigol and Hantek in public is ok, but Agilent's name invokes some kind of shame (or fear?) )))

Few reasons:
1. There is security risk when we publish it.
2. Agilent and their engineers are really helpful when I need real assistence.
3. On this forum were hack offered for $$$, so it is under supervision for sure.
4. This thread is in the top when you Google "Agilent DSOX hack".
5. Hack will double or triple the price of hardware.
lol you think making a hack public will double or triple the hardware price?! Are you serious? So I guess all the other scopes/phones/tablets/games/consoles/computers/EVERYTHING ELECTRONIC have all doubled and tripled in price right? Since they have ALL been hacked since there was something to hack! Man, guess Ill be paying $599 for my $299 iPhone next time I upgrade since they jailbroke it.

And to you other "statements"

1) Nope, no security risk here, my scope is just as safe and secure as it was. Are you thinking that if the hack got out to the public that some malicious person might write a "virus" for my scope? Well who's to say I trust that the individuals on this site trying to sell me a hack arent going to do the same thing?! Or that they messed up somewhere and they made a mistake that hasnt been found and it might brick my scope?! This is why its better to let everyone look at your work if youre going to do this sort of thing.

2) Yes, they still are and always will be. They are paid to be so. They want to keep selling products. 99.9999% of the owners of electronic devices never hack or mod them anyway.

3) Most feel its insulting to reverse engineer some other work and then try and charge for it. I would never pay to jailbreak my iPhone or mod my Wii for example.

4) So?

5) You have to be kidding me... Already responded to this in the beginning of this post.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on August 12, 2013, 11:18:14 pm
There is no file consistency check afaik. There is no need to use jtag also, just use the infiniivisionstartupoverride.txt method desribed in previous posts and you'll be able to run a patched scope app from usb flash drive whithout opening the case. There is more that enough info posted in this thread already, just nobody wants to post that final "here is .zip, unpack it to usb flash and use"  ;)
Funny situation - dissecting Rigol and Hantek in public is ok, but Agilent's name invokes some kind of shame (or fear?) )))

Few reasons:
1. There is security risk when we publish it.
2. Agilent and their engineers are really helpful when I need real assistence.
3. On this forum were hack offered for $$$, so it is under supervision for sure.
4. This thread is in the top when you Google "Agilent DSOX hack".
5. Hack will double or triple the price of hardware.
lol you think making a hack public will double or triple the hardware price?! Are you serious? So I guess all the other scopes/phones/tablets/games/consoles/computers/EVERYTHING ELECTRONIC have all doubled and tripled in price right? Since they have ALL been hacked since there was something to hack! Man, guess Ill be paying $599 for my $299 iPhone next time I upgrade since they jailbroke it.

And to you other "statements"

1) Nope, no security risk here, my scope is just as safe and secure as it was. Are you thinking that if the hack got out to the public that some malicious person might write a "virus" for my scope? Well who's to say I trust that the individuals on this site trying to sell me a hack arent going to do the same thing?! Or that they messed up somewhere and they made a mistake that hasnt been found and it might brick my scope?! This is why its better to let everyone look at your work if youre going to do this sort of thing.

2) Yes, they still are and always will be. They are paid to be so. They want to keep selling products. 99.9999% of the owners of electronic devices never hack or mod them anyway.

3) Most feel its insulting to reverse engineer some other work and then try and charge for it. I would never pay to jailbreak my iPhone or mod my Wii for example.

4) So?

5) You have to be kidding me... Already responded to this in the beginning of this post.

My opinion, my rulezz... You can try to hack it by yourself and publish it ;-) I will never do that, for the reason above. Every year I spent more than 25k USD for various test equipment. When I really need for business I will buy it.
I posted in this thread lot of tricks which will be quite useful, thats all.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: KTP on August 13, 2013, 02:05:14 am
Bragging about a hack and then refusing to give out information does make you look like a bit of a douche...

But then so does spelling rules with a z...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on August 13, 2013, 03:49:17 am
Read whole thread....
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benemorius on August 13, 2013, 04:01:13 am
Benemorius, did you tryied change de splash screen?
did you get any results with yours tests?

Yes, changing the splash screen worked.

I did not attempt to overwrite any .exe or .dll files but I see no reason to doubt that it will work too. Running the firmware from USB is slower (longer boot time and occasional menu lag) and you have to remember not to pull the flash drive or else it crashes, but otherwise it works about like normal. I'm happy enough with that that I'd rather not overwrite any other files until I have NAND access, despite all indications being that there's nothing to worry about really.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on August 13, 2013, 04:24:17 am
Yes, changing the splash screen worked.

Nice, maybe you can provide a zip file with the USB flash drive content and attach it here? It will be small with a simple monochrome image as an example. Then that crazy aussie bloke and others can just replace the splash screen with their favorite image, if they want to.

Quote
I did not attempt to overwrite any .exe or .dll files but I see no reason to doubt that it will work too. Running the firmware from USB is slower (longer boot time and occasional menu lag) and you have to remember not to pull the flash drive or else it crashes, but otherwise it works about like normal. I'm happy enough with that that I'd rather not overwrite any other files until I have NAND access, despite all indications being that there's nothing to worry about really.

There is more than one way to skin a cat, but it is possible with just booting patched files from USB, and all necessary files to patch (one or two, depending on how you hack it) are writable. But needs some work with IDA (https://www.hex-rays.com/products/ida/index.shtml) or other disassemblers. Fortunately the DLLs are not encrypted. With more secure systems like used in iOS, it would be more complicated because of the additional decrypt step.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on August 13, 2013, 04:46:22 am
Yes, changing the splash screen worked.

I did not attempt to overwrite any .exe or .dll files but I see no reason to doubt that it will work too. Running the firmware from USB is slower (longer boot time and occasional menu lag) and you have to remember not to pull the flash drive or else it crashes, but otherwise it works about like normal. I'm happy enough with that that I'd rather not overwrite any other files until I have NAND access, despite all indications being that there's nothing to worry about really.

The boot time is annoying,  I need to restore backup of my USB two times, because the files on flash became corrupted.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benemorius on August 13, 2013, 04:52:08 am
There is more that enough info posted in this thread already, just nobody wants to post that final "here is .zip, unpack it to usb flash and use"  ;)
Funny situation - dissecting Rigol and Hantek in public is ok, but Agilent's name invokes some kind of shame (or fear?) )))

Not shame I think, but fear of a couple of things.

Fear of what the response from Agilent might be if the .zip file makes it to Hackaday or wherever things go to get really popular these days. It would be sad enough if Rigol responded to the popularity by patching the recent hacks, but an order of magnitude more sad at least if Agilent did the same. For the Rigol options are at least affordable if you really want them. With Agilent some of the stuff is off limits to a large number of us. As in can't have ever. Like at all. The hacks are the only way for some of us to ever have these things and nobody wants to make them go away for anyone.

There is also some fear of Agilent's attitude toward us individually. It is conceivable that I may actually contact Agilent if I ever have a problem with my scope some day since they're one of those remaining companies with whom that is actually worth doing. Given that possibility, it would be good for me if I haven't pissed them off in such a way that their desire to provide assistance is diminished. This is much less true with Rigol. I wouldn't expect much service there whether I'd pissed them off or not.

Someone will eventually post the damn .zip file. Part of the reason it's taking longer is simply that there are fewer Agilent owners out there than Rigol owners. The Agilent owner who just doesn't give a flying fuck simply hasn't come along yet.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: benemorius on August 13, 2013, 04:57:40 am
The boot time is annoying,  I need to restore backup of my USB two times, because the files on flash became corrupted.

That's interesting. I've used my scope a lot and haven't encountered any problems with corruption. It doesn't seem like any of the files there are regularly written anyway. I wonder if a different flash drive would change anything?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on August 13, 2013, 02:50:36 pm
The boot time is annoying,  I need to restore backup of my USB two times, because the files on flash became corrupted.

That's interesting. I've used my scope a lot and haven't encountered any problems with corruption. It doesn't seem like any of the files there are regularly written anyway. I wonder if a different flash drive would change anything?

I'm using micro SD Reader and card, not regular USB flash. It can be also source of problems.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on August 15, 2013, 07:32:41 am
I only wish FrankBuss would elaborate on how to utilize that UART...

The serial port location:

http://i.imgur.com/yYMV75t.jpg (http://i.imgur.com/yYMV75t.jpg)

All you need are some jumper wires, if you don't want to drill a hole. Fits nicely through the USB connector hole 8)

http://i.imgur.com/9gnsuQh.jpg (http://i.imgur.com/9gnsuQh.jpg)

You can then stop the u-boot with space (can be difficult, you have to be fast, use something like HTerm which has a useful "repeat" function to send a sequence automatically until you stop it, or just hold down space while you boot it). Then you can boot the image from network like this:

Code: [Select]
set serverip 192.168.11.108
dhcp 0x4000000 nk.bin;bootm 0xf8050000

Where 192.168.11.108 is your own server, where TFTP is running and providing nk.bin. You should see something like this:

Code: [Select]
BOOTP broadcast 1
DHCP client bound to address 192.168.11.106
Using smsc device
TFTP from server 192.168.11.108; our IP address is 192.168.11.106
Filename 'nk.bin'.
Load address: 0x4000000
Loading: **#################################################################
#################################################################
...

You get the nk.bin from the nk.bin.comp from the firmware update cab-file with the bincompress.exe tool, which is included in the evaluation version of the WindowsCE development environment. Use http://www.t-hack.com/wiki/index.php/NK.BIN_toolset (http://www.t-hack.com/wiki/index.php/NK.BIN_toolset) to take a look at the content of nk.bin and to modify it.


Hi, here is info if someone want to make a NAND dump with JTAG debugger:

To Enable JTAG, you need this SPEAr600 TEST[2:0] pin configuration:
TEST_0=1, TEST_1=1, TEST_2=0

With debugger I did 128MB dump from NAND:

0000:0000-005F:FFFF  empty, just 0xFF
0060:0000-00C0:9F61  NK.BIN.COMP, size 12623714 bytes (FW 02.20)

02C2:0000- ????      Other data/files


Now we have NAND dump and need to:
1) hack MD5/RSA file consistency check to enable another files to modify
2) hack RSACryptoServiceProvider::VerifyData() or function which use it (AGILEN~1.003)
With Uboot write modificaton into NAND. Then just install licenses with any signature :-)

Now I'm not able to find MD5/RSA file consistency check. Please help.

Hey Sumino2000,

I found on Agilent site this data sheet containing "memory map", maybe this will help: Link (http://www.google.hr/url?q=http://cp.literature.agilent.com/litweb/pdf/5990-8184EN.pdf&sa=U&ei=GIMMUsWlAYij4gTVu4CYCw&ved=0CBsQFjAA&usg=AFQjCNHoKv1WulM3oR3eRkw5xMyoKsPPzA)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on August 15, 2013, 08:14:39 am
Hi guys!

Recently i bought a 2000 series scope with Lan/Vga option, so i started poking around and this is what i managed to find out.

If you have LAN/VGA option you can boot from USB stick and using VNC get access to windows ce desktop,
windows have frame buffer in RAM for user interface, user interface you see on a scope's LCD is generated by MegaZoom,
and original agilent vnc is transmitting megazoom's frame buffer to computer...

This is how you can do it:

1. Make some batch file in "startup" folder on usb stick containing this code:

taskkill /im infiniivisionLauncher.exe
taskkill /im AgilentLxiWebService.exe

This prevents starting infiniivision application and vnc.

2. Download "mobileVNC", you can find a demo version (you'll need version for ARM). You can search "MobileVNC_Demo.zip" i used that one.

Copy executable somewhere on usb and put shortcut to executable in startup folder.

This is how you do it:
write path to executable, in my case its:

48#\usb\Secure\infiniiVision\ARM\MobileVNC.exe

and save it as ".lnk" file, copy that file to startup folder.


If you don't know ip address you can boot scope normaly and see in options-->IO-->LAN assigned ip address.
Enter this address in vnc viewer and conntect to scope, that's it!

You'll notice that it's imposible to copy any .exe files from windows folder.
There are some hidden folders, for example folder containing license and calibration data, you need to check "view hidden files" in options
and then you can "backup" them on USB drive.


If you ever looked at firmware update you probably noticed in recepie.xml:

   <!-- Try to update DSO2000 FPGA -->
   <installStep>
      <file checksum="c4e300bc784756148a13e95f83cf44da">fpga2000a.bin</file>
      <command>\windows\loadP500Flash -u fpga --target economy %TEMP%\fpga2000a.bin</command>
   </installStep>
   <!-- Try to update DSO3000 FPGA -->
   <installStep>
      <file checksum="12173c04dc2dee18976902c36fc42809">fpga3000a.bin</file>
      <command>\windows\loadP500Flash -u fpga --target performance %TEMP%\fpga3000a.bin</command>
   </installStep>


but when i called "loadP500Flash -help" in command prompt it responded with:

USAGE:

   \Windows\loadP500Flash.exe  [-t <economy|performance|coyote>] [-a
                               <hexidecimal integer>] -u <tloSplash|fpga
                               |ceImage1|ceImage2|ceImage3|custom> [--]
                               [--version] [-h] <filename>


Where:

   -t <economy|performance|coyote>,  --target <economy|performance|coyote>
     FPGA target

   -a <hexidecimal integer>,  --address <hexidecimal integer>
     NAND Flash address for the custom update type.

   -u <tloSplash|fpga|ceImage1|ceImage2|ceImage3|custom>,  --update
      <tloSplash|fpga|ceImage1|ceImage2|ceImage3|custom>
     (required)  Update Type

   --,  --ignore_rest
     Ignores the rest of the labeled arguments following this flag.

   --version
     Displays version information and exits.

   -h,  --help
     Displays usage information and exits.

   <filename>
     (required)  Filename to write to NAND Flash


   updateP500Flash


So what is this "coyote" option? Some model (or series) better than 3000???

What do you think???
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on August 16, 2013, 08:45:55 pm
Coyote is 4000. InfiniiVision is common sw for 2k, 3k, 4k.

Why do you need VNC if there is a built in telnet?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on August 30, 2013, 09:54:58 am
Some "oil into the fire":
telnet login/pass:
infiniivision
skywalker1977
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: punkerdood on September 24, 2013, 05:16:20 am
Apparently djvinc doesnt exist on the interwebs anymore.  I'd be happy to pay $140 for a fix. 

Oh well.  I guess I'll start digging into my 3034. Bummer, I've got better things to do with my time.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on September 24, 2013, 03:10:12 pm
You don't really need to pay, all the required info is in this thread. You can just boot using a USB flash drive to unlock everything.
Someone needs to throw together a thorough walk through for those that arent as savvy in this area.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Lazarus4_ on October 07, 2013, 08:57:27 pm
I don´t really understand what to do in order to "hack" the DSO.
I tried it with the USB method, but I think I haven´t done it the right way.

Maybe someone can help me via private message or so :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on October 07, 2013, 09:28:13 pm
Yea me too please. What exactly has been figured out and what can we get out of it? Of course without having to buy it from someone else I mean.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: romantao on November 02, 2013, 02:10:46 am
I want to buy one of those Agilent oscilloscopes and, as a young academic i'm interested in some particular addons.
I'm not particularly in favor of those who profit with these hacks so i understand all the secrecy about this talk.
However, the way this topic is evolving is putting myself up to the challenge of finding the way to enable some licenses :)

As it seems possible to run the firmware from a USB pen without having to sign any cab and safely make some changes in the files, i ask a naive question that contribute with something (or not) to this topic:

Is it possible to edit one specific binary file in such way that the public key used to verify the license files is changed to the old one so we can use the known private key to sign the licenses?

Since i dont have access to any scope of this range, i have no way to check this idea.... just my two thoughts...

Regards

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on November 03, 2013, 11:24:37 am
How to hack the firmware
1. Unpack the firmware *.cab by 7zip
2. Unpack infiniiVisionSetup.cab ( e.g. with WinCE CAB Manager 3.0)
    Find \Secure\infiniiVision\infiniiVisionCore.dll
3. Change at location 0x277e50 in infiniiVisionCore.dll
    byte sequence 04 00 a0 e1 to byte sequence 00 00 a0 e3
4. Enable startup Overide by creating USB flash with following structure in root of USB drive (copy structure from Secure folder from point 2)
    Edit in Startup folder file infiniivision.lnk to contains following sequence "62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"
    Replace in infiniiVision folder  infiniiVisionCore.dll with patched infiniiVisionCore.dll file
5. Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
6. Plug the USB drive to scope and turn it ON
7. There will be red  message in letf top corner "Unfinalized Software"  and "System Concerns detected: OS version is not correct. Please reload system firmware"

Applications needed:
 WinCE CAB Manager http://www.ocpsoftware.com/products.php (http://www.ocpsoftware.com/products.php)
 7Zip http://www.7-zip.org/ (http://www.7-zip.org/)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on November 04, 2013, 05:19:39 pm
How to hack the firmware
1. Unpack the firmware *.cab by 7zip
2. Unpack infiniiVisionSetup.cab ( e.g. with WinCE CAB Manager 3.0)
    Find \Secure\infiniiVision\infiniiVisionCore.dll
3. Change at location 0x277e50 in infiniiVisionCore.dll
    byte sequence 04 00 a0 e1 to byte sequence 00 00 a0 e3
4. Enable startup Overide by creating USB flash with following structure in root of USB drive (copy structure from Secure folder from point 2)
    Edit in Startup folder file infiniivision.lnk to contains following sequence "62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"
    Replace in infiniiVision folder  infiniiVisionCore.dll with patched infiniiVisionCore.dll file
5. Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
6. Plug the USB drive to scope and turn it ON
7. There will be red  message in letf top corner "Unfinalized Software"  and "System Concerns detected: OS version is not correct. Please reload system firmware"

Applications needed:
 WinCE CAB Manager http://www.ocpsoftware.com/products.php (http://www.ocpsoftware.com/products.php)
 7Zip http://www.7-zip.org/ (http://www.7-zip.org/)
Nice. So what can you do with it from this point?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jrgandara on November 04, 2013, 05:37:33 pm
After all my Sunday afternoon trying these method I finally succeed! Although there was some pit falls. Everything is working, including the MSO. But in this case I think we will not find any connector to insert in the scope to replicate the original, which must have some embedded hardware too. Any ideas?

Anyone have succeeded hacking the bandwidth from 70 to 100 or even 200 MHz?

Thanks a lot Plesa!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on November 04, 2013, 06:09:41 pm
Anyone have succeeded hacking the bandwidth from 70 to 100 or even 200 MHz?
The "-l All" in plesa's hack should enable all licenses. But if you buy a 200 MHz license, you get some new 300 MHz probes. Maybe the scope tests the probe types.

BTW: the 16 channel digital input doesn't need any electronics, it is just ground and the input signals, and you can plug-in an old 40 pin IDE cable.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: grego on November 04, 2013, 06:33:49 pm
How to hack the firmware
1. Unpack the firmware *.cab by 7zip
2. Unpack infiniiVisionSetup.cab ( e.g. with WinCE CAB Manager 3.0)
    Find \Secure\infiniiVision\infiniiVisionCore.dll
3. Change at location 0x277e50 in infiniiVisionCore.dll
    byte sequence 04 00 a0 e1 to byte sequence 00 00 a0 e3
4. Enable startup Overide by creating USB flash with following structure in root of USB drive (copy structure from Secure folder from point 2)
    Edit in Startup folder file infiniivision.lnk to contains following sequence "62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"
    Replace in infiniiVision folder  infiniiVisionCore.dll with patched infiniiVisionCore.dll file
5. Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
6. Plug the USB drive to scope and turn it ON
7. There will be red  message in letf top corner "Unfinalized Software"  and "System Concerns detected: OS version is not correct. Please reload system firmware"

Applications needed:
 WinCE CAB Manager http://www.ocpsoftware.com/products.php (http://www.ocpsoftware.com/products.php)
 7Zip http://www.7-zip.org/ (http://www.7-zip.org/)

I'm assuming to back this out you just install the latest official firmware and call it a day?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: olsenn on November 04, 2013, 06:38:47 pm
How would you guys compare the DSOX2000 to the Rigol DS2000, both with all options (freely) activsted? I know that the Agilent scope maintains its waveform update rate much better than Rigol does; however, 1Mpt memory seems kind-of craptastic (how important is this)? Also the Agilent costs about 50% more.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on November 04, 2013, 06:45:11 pm
I'm assuming to back this out you just install the latest official firmware and call it a day?
This is based on the method plesa described in reply #142 in this thread and boots from the USB flash drive. If you unplug the USB flash drive, it boots the old firmware from the internal scope flash. You can add some copy commands in the startup script on the flash drive to install it permanently.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on November 04, 2013, 11:21:22 pm
Anyone have succeeded hacking the bandwidth from 70 to 100 or even 200 MHz?
The "-l All" in plesa's hack should enable all licenses. But if you buy a 200 MHz license, you get some new 300 MHz probes. Maybe the scope tests the probe types.

BTW: the 16 channel digital input doesn't need any electronics, it is just ground and the input signals, and you can plug-in an old 40 pin IDE cable.

Fo the badwidth upgrade you will need to replace the mainboard, it is not software upgrade only. The 350/500 MHz version shares same probes.  The digital input pinout - upper row signal and the bottom one is ground.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Rufus on November 05, 2013, 12:08:55 am
Fo the badwidth upgrade you will need to replace the mainboard, it is not software upgrade only.

The scope bandwidth is a software upgrade with hardware required at 350MHz and 1GHz. The probes change at some frequencies as well.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on November 05, 2013, 06:27:09 am
Looks like there are different bandwidth upgrades. I know this one, from 100 MHz to 200 MHz (http://www.newark.com/agilent-technologies/dsox3bw24/license-b-w-upg-100-mhz-to-200/dp/31T9060). But right, for the bandwidth upgrade to 350 MHz (http://www.datatec.de/cgi-bin/shop/lshop.cgi?action=showdetail&artnum=dsox3bw32), it is not just software and the scope has to be sent to a service center. I guess they really change the mainboard and not set just some jumper, because of the high price :)

The datasheet for the 350 MHz update (http://cp.literature.agilent.com/litweb/pdf/5990-7759EN.pdf) says, that the old 200 MHz update is obsolete, maybe new scopes are shipped with this license now without the need to buy it. And the 350 MHz hardware update allows an additional software license update to 500 MHz.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: fmaimon on November 05, 2013, 03:07:46 pm

The "-l All" in plesa's hack should enable all licenses...


If this command enable all licenses, what does the changes in infiniiVisionCore.dll do?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jrgandara on November 05, 2013, 06:44:36 pm
Anyone have succeeded hacking the bandwidth from 70 to 100 or even 200 MHz?
The "-l All" in plesa's hack should enable all licenses. But if you buy a 200 MHz license, you get some new 300 MHz probes. Maybe the scope tests the probe types.

BTW: the 16 channel digital input doesn't need any electronics, it is just ground and the input signals, and you can plug-in an old 40 pin IDE cable.

Yes, it is all enabled in the Scope About, but the bandwidth still is showing 70MHz. I know the 200MHz need new probes, but those which came with the 70MHz is 150MHz and should work at least up to 100MHz if enabled.

Good to know about the IDE connector! I can´t find the pin out anywhere. Do you have this info to share?

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on November 05, 2013, 06:54:27 pm
Looks like there are different bandwidth upgrades. I know this one, from 100 MHz to 200 MHz (http://www.newark.com/agilent-technologies/dsox3bw24/license-b-w-upg-100-mhz-to-200/dp/31T9060). But right, for the bandwidth upgrade to 350 MHz (http://www.datatec.de/cgi-bin/shop/lshop.cgi?action=showdetail&artnum=dsox3bw32), it is not just software and the scope has to be sent to a service center. I guess they really change the mainboard and not set just some jumper, because of the high price :)

The datasheet for the 350 MHz update (http://cp.literature.agilent.com/litweb/pdf/5990-7759EN.pdf) says, that the old 200 MHz update is obsolete, maybe new scopes are shipped with this license now without the need to buy it. And the 350 MHz hardware update allows an additional software license update to 500 MHz.

Thats really interesting, I did not see such a document. I just remember it from Agilent sales presentation. It needs to be investigated ;-)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: grego on November 05, 2013, 07:00:04 pm
Looks like there are different bandwidth upgrades. I know this one, from 100 MHz to 200 MHz (http://www.newark.com/agilent-technologies/dsox3bw24/license-b-w-upg-100-mhz-to-200/dp/31T9060). But right, for the bandwidth upgrade to 350 MHz (http://www.datatec.de/cgi-bin/shop/lshop.cgi?action=showdetail&artnum=dsox3bw32), it is not just software and the scope has to be sent to a service center. I guess they really change the mainboard and not set just some jumper, because of the high price :)

The datasheet for the 350 MHz update (http://cp.literature.agilent.com/litweb/pdf/5990-7759EN.pdf) says, that the old 200 MHz update is obsolete, maybe new scopes are shipped with this license now without the need to buy it. And the 350 MHz hardware update allows an additional software license update to 500 MHz.

Where do you see it's obsolete?  The document you linked to certainly doesn't.

Since the front-end has to change jumping to a 350Mhz scope requires it to be sent back in for a main board change (and new probes).  All the other upgrades are software-only (and new probes).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on November 05, 2013, 08:00:25 pm
The datasheet for the 350 MHz update (http://cp.literature.agilent.com/litweb/pdf/5990-7759EN.pdf) says, that the old 200 MHz update is obsolete, maybe new scopes are shipped with this license now without the need to buy it. And the 350 MHz hardware update allows an additional software license update to 500 MHz.
Where do you see it's obsolete?  The document you linked to certainly doesn't.
There is some big red text in the PDF on the first page: "Obsolete as of July 25".

Good to know about the IDE connector! I can´t find the pin out anywhere. Do you have this info to share?
See reply #196 from plesa.

The "-l All" in plesa's hack should enable all licenses...

If this command enable all licenses, what does the changes in infiniiVisionCore.dll do?
You can try it: it doesn't accept the command line parameters without the patch.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: grego on November 05, 2013, 08:43:00 pm
The datasheet for the 350 MHz update (http://cp.literature.agilent.com/litweb/pdf/5990-7759EN.pdf) says, that the old 200 MHz update is obsolete, maybe new scopes are shipped with this license now without the need to buy it. And the 350 MHz hardware update allows an additional software license update to 500 MHz.
Where do you see it's obsolete?  The document you linked to certainly doesn't.
There is some big red text in the PDF on the first page: "Obsolete as of July 25".

Hah - my bad - I was looking for text.  However, I think they are saying the PROCESS is obsolete, not the upgrades.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jrgandara on November 06, 2013, 12:05:04 am
If your don´t like those warning messages, just replace then in infiniiVisionCore.dll with any message you like using HexEdit.   8)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jrgandara on November 12, 2013, 09:27:09 am
Anyone get the bandwidth upgrade with this hack? Mine enabled all the features but the bandwidth. And yes, the "-l All" in Plesa's hack is there there.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: rkupka on November 12, 2013, 09:30:51 am
Anyone get the bandwidth upgrade with this hack? Mine enabled all the features but the bandwidth. And yes, the "-l All" in Plesa's hack is there there.

Yes. upped from 100 MHz to 200 MHz on DSO-X2014
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jrgandara on November 12, 2013, 09:35:04 am
Mine is X-2002 and still stuck in 70MHz  :(
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sbampato12 on November 12, 2013, 06:21:47 pm
I tried it in a dsox-2002a, everything worked, except by the bandwidth whic remains 70MHz.
I didnt try a signal with more than 70MHz, but the scope info, show bw: 70.

This work with the dsox3000 too? the changes are the same?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Rigby on November 12, 2013, 07:47:38 pm
Anyone get the bandwidth upgrade with this hack? Mine enabled all the features but the bandwidth. And yes, the "-l All" in Plesa's hack is there there.

Yes. upped from 100 MHz to 200 MHz on DSO-X2014

Dammit.  Every time I'm pretty sure I'll be getting a Rigol, I come in this thread and read something compelling enough to make me reconsider.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: DavidDLC on November 12, 2013, 08:01:20 pm
Anyone get the bandwidth upgrade with this hack? Mine enabled all the features but the bandwidth. And yes, the "-l All" in Plesa's hack is there there.

Yes. upped from 100 MHz to 200 MHz on DSO-X2014

Dammit.  Every time I'm pretty sure I'll be getting a Rigol, I come in this thread and read something compelling enough to make me reconsider.

It's a beautiful scope, I started with a Rigol, then switched to Agilent and I don't have plans to go back to Rigol for a long period of time, unless there is a very huge reason.

David.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Rigby on November 12, 2013, 08:16:50 pm
Dammit.  Every time I'm pretty sure I'll be getting a Rigol, I come in this thread and read something compelling enough to make me reconsider.

It's a beautiful scope, I started with a Rigol, then switched to Agilent and I don't have plans to go back to Rigol for a long period of time, unless there is a very huge reason.

David.

It's probably ultimately going to swing in favor of Rigol again, once I price check a 4-channel Agilent vs. a 4-channel Rigol.  I want the Agilent more, but I can't afford $1900 for a DSOX2004A.

Unless Agilent somehow decide to gift me a scope, it will likely be the Rigol DS1104Z-S for me.  {insert the rare new scope sadface here}
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on November 12, 2013, 10:30:25 pm
Or you can get in on one of their Premium Used units on eBay which are like new and have the new extended warranty on them. I got my MSOX2024 for $1875. I bought the few upgrades I wanted and the VGA/LAN module, but yea getting them from this thread via the hack would be awesome too.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Carrington on November 13, 2013, 04:33:11 pm
Rigol are doing 4 channel 2000 series scopes now, which should be much cheaper than the 4000 series. Even with the eBay used shop it is hard to justify an Agilent with smaller memory and higher cost, even if the interface is a bit more fluid. Even so, they are just such nice scopes...
DS2000 series with 4 Channel?  :o
How do you know that?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dfnr2 on November 14, 2013, 12:37:19 am
I just now scanned this thread with interest, as I just picked up an MS0X3104A on Ebay.   I actually wanted the probes that came with it, and haven't decided if I will keep the scope (I don't plan to.  I plan to play with it for a while, then re-sell it.) 

In the meanwhile, I'd like to explore the LAN/VGA functionality without springing for the module.  So I followed the discussion here with interest.  Did anyone ultimately make a PCB for the LAN/VGA functionality?  If so, I'd like to avoid duplicating the effort.

Thanks for any info.

Dave
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tsmith35 on November 14, 2013, 07:01:02 am
Rigol are doing 4 channel 2000 series scopes now, which should be much cheaper than the 4000 series. Even with the eBay used shop it is hard to justify an Agilent with smaller memory and higher cost, even if the interface is a bit more fluid. Even so, they are just such nice scopes...
I've been wondering why Rigol hasn't had a 4 channel 2000 series scope...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on November 14, 2013, 11:21:30 am
Yesterday I did some investigations to locate the picture for that are used for the screensaver.
The Megazoom logo starts at 0x739E30  and has 22876 Bytes and it's a 266x86 pixel array with 1 byte/pixel
The picture uses the same 8 bit color palette as a saved 8bit color Bitmap.

At the adress 73F78C are some information's of the picture 0A 01 = 0x10a = 266  and 00 56 = 0x56 = 86.

So its possible to create a nice customized Screensvaer

Regards
Kai
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on November 14, 2013, 04:41:53 pm
^^^^^^ Very cool. Thanks for sharing that!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sbampato12 on November 15, 2013, 03:20:59 pm
What means the -l SCPIPS parameter?
I can imagine what the -l ALL do, but not the scpips.
Can someone tell me what it do?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on November 15, 2013, 08:08:57 pm
It might be SCPI programming standard, not shure yet.

-l ALL enables all "trial" licences but without time limit, that's why there are "*" following each license.

@kilobyte

You can find icon of a starship enterprise at 0x00794018, it's 4032 bytes long, and 478x122 pixels.
It look's like there are more easter eggs hidden, not only "lost" (162342),  etch-a-scope and credits.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on November 15, 2013, 09:01:06 pm
HA! Snap a shot of the Enterprise and post it! I wanna see that one!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: willemite on November 15, 2013, 09:28:37 pm
HA! Snap a shot of the Enterprise and post it! I wanna see that one!
I second that one!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sbampato12 on November 15, 2013, 09:58:08 pm
Thanks wersi.

I didnt know the SCPI programming standard.


The changes in the dll file, is the same to the 3000X series?

Interesting to think in new easter egg...!!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on November 15, 2013, 10:09:21 pm
The option SCPIPS could also be the remote logging option to debug the SCPI commands.

And for all Trekkies
see the attachment  :)

Yes i also think this could be a easter egg.
It a littlebit hard to find out in which case this picture / function will be started.

Maybe i can find more about this in the disassembly.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on November 16, 2013, 12:11:29 am
That's possible too, i'm not shure but there is RML license which is probably "Remote Logging".

2000 and 3000 series uses same firmware, i have 2000 series 'scope.

On 2000 series you can upgrade bandwidth up to 200MHz, also i found two extra options which can be enabled with -l switch.  ;)

If you dont like "reload firmware" message, you can find it with hex editor and change it, if You need new line write: 0x1B 0x0A....
If you wanna insert for example agilent copyright message write "<0x1B>M608" or if you wanna insert some graphical resource write for example "<0x1B>P1;"
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sbampato12 on November 16, 2013, 12:40:55 am
I can't realize why my (2002A) don't go to 200MHz.
Why some users tell they go to 200MHz with the firmware changes, and some (include me) don't.

Another 2 extra instructions?
Expected to exist in this scopes? or something different?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on November 16, 2013, 01:12:05 am
The option SCPIPS could also be the remote logging option to debug the SCPI commands.

And for all Trekkies
see the attachment  :)

Yes i also think this could be a easter egg.
It a littlebit hard to find out in which case this picture / function will be started.

Maybe i can find more about this in the disassembly.
Ha ha ha! Awesome! Thanks for posting that!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on November 16, 2013, 11:56:23 pm
When you pass switch SCPIPS to launcher scope returns *** Installing License: Infiniium Mode.
What is infiniium mode?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Carrington on November 18, 2013, 02:38:30 pm
Hi all!

I have a question and, I know that isn't the subject matter of this topic (I apologies), but I hope that someone can help with this, thanks.

Q: The DSOX2000/3000 series gives their maximum waveforms per seconds with auto memory only, or with maximum memory too?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on November 18, 2013, 06:36:55 pm
Muahahaha! :-DD
Agilent DSOX2000/3000 Easteregg Spaceship Screensaver (https://www.youtube.com/watch?v=A4zTj5a7cGU#ws)
Here is it the Enterprise Screensaver.

I did take a look in the dsox4000 dll and there are a lot more debug information and resources.
I opened the 4000 infiniivision with a resource hacker and I was able to extract bitmaps and Winform dialogs.
After disassembling the dll I searched for the text TREK and found the reference to this in a subfunction with other references to ...Screensaver...
So i tried it on my scope and bingo.

Regards
Kai
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on November 18, 2013, 06:45:50 pm
AH HA HA HA!!! Thats AWESOME!!!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on November 18, 2013, 11:06:32 pm
Good work!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hypernova on November 20, 2013, 01:11:40 am
Just tried the USB hack for everything including bandwidth, note to people still struggling: Remember to format the drive to FAT16. Fiddled for half an hour scratching my head before I realized that.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: DavidDLC on November 20, 2013, 04:42:54 am
I did the hack with a very old and low capacity USB drive and it works fine.

Today I tried with a low cost PNY 8 GB thumbdrive and the system does not recognize the PNY.

Is there a limitation on the USB thumbdrive size ?

Has anybody tried with a 8 GB thumdrive ?

David.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Rigby on November 20, 2013, 01:17:24 pm
I did the hack with a very old and low capacity USB drive and it works fine.

Today I tried with a low cost PNY 8 GB thumbdrive and the system does not recognize the PNY.

Is there a limitation on the USB thumbdrive size ?

Has anybody tried with a 8 GB thumdrive ?

David.

See the above post on formatting FAT16.  Vanilla FAT doesn't support partition sizes over 2GB.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: DavidDLC on November 21, 2013, 05:57:07 am
But... the low capacity USB thumdrive is a FAT32 and it works.  :scared:

David.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hypernova on November 21, 2013, 06:13:14 am
I did the hack with a very old and low capacity USB drive and it works fine.

Today I tried with a low cost PNY 8 GB thumbdrive and the system does not recognize the PNY.

Is there a limitation on the USB thumbdrive size ?

Has anybody tried with a 8 GB thumdrive ?

David.

See the above post on formatting FAT16.  Vanilla FAT doesn't support partition sizes over 2GB.
I am using a 4GB stick, FAT16 does support partition size above 2GB if you format it with 64KB cluster size.
But... the low capacity USB thumdrive is a FAT32 and it works.  :scared:

David.
All I know is that it didn't work until I reformatted to FAT16.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pinkman on November 24, 2013, 08:01:46 pm
Hi all, 1st post.

I have a newer DSO-X3034A, manufactured 28th week of 2013.

I have tried with the 2.35 Firmware (unpack, modify infiniivisionCore.dll hex data, modify startup .lnk, create startup override .txt file) and my scope simply hangs at the splash screen.  I have tried on many flash drives, new and old, and formatted FAT16 default cluster size and FAT16 with 16kb cluster size.

Has anyone verified this as working for newer 3000X or is this maybe only working on the older models?

Any suggestions for this poor university student are welcome... I have saved a lot of money and used my educational discount to get this scope, but I can not afford any more purchases for a long time :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ixfd64 on November 24, 2013, 08:05:35 pm
To boldly go... where no hack has gone before!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pinkman on November 24, 2013, 10:14:44 pm
I am still learning but if that is what I must do, then I will give it my best.

I am first trying to understand if this is not working because I have a newer scope, or because I have somehow done something incorrectly.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on November 24, 2013, 11:04:06 pm
Hi pinkman,

my usb stick is formatted with FAT32 and works without a problem.
It needs a little bit more time to start the application and the splash screen is not shown on my scope.
The folder structure on the flash drive should be

\
+-infiniiVision
  +-fpga
  +-upgrade
  +-web
  +-css
  +-help
  +-image
  +-include
  +-web-socket-js
  +-lib
  +-Lxi
     +-Identification
  +-navbar
+-Startup


So its possible that you do something wrong.
My first test also didn't work because I mistyped something.

Maybe i can try my USB stick on a newer DSOX2000 series scope at work.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pinkman on November 25, 2013, 12:16:03 am
kilobyte,

Thanks for the reply.  My understanding is that I should extract the contents of infiniivisionSetup.cab, then take contents of the "Secure" folder and copy *only* Secure folder contents to Flash root drive.  I have done this, but my folder structure looks a little bit different than what you have listed.

Are there any files, other than contents of "Secure" folder(including modified infiniivisionCore.dll)  + startupoverride text file that should be on the flash disk?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on November 25, 2013, 12:47:52 am
kilobyte,

Thanks for the reply.  My understanding is that I should extract the contents of infiniivisionSetup.cab, then take contents of the "Secure" folder and copy *only* Secure folder contents to Flash root drive.  I have done this, but my folder structure looks a little bit different than what you have listed.

Are there any files, other than contents of "Secure" folder(including modified infiniivisionCore.dll)  + startupoverride text file that should be on the flash disk?

Did you copy whole structure from extracted  \3000XSeries.02.35.2013061800.cab\infiniiVisionSetup.cab ? The whole content of \Secure\ folder must be copied to USB flash.
Also check presence of the Startup folder with modified   infiniivision.lnk which contains sequence "62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on November 25, 2013, 12:48:34 am
Muahahaha! :-DD
Agilent DSOX2000/3000 Easteregg Spaceship Screensaver (https://www.youtube.com/watch?v=A4zTj5a7cGU#ws)
Here is it the Enterprise Screensaver.

I did take a look in the dsox4000 dll and there are a lot more debug information and resources.
I opened the 4000 infiniivision with a resource hacker and I was able to extract bitmaps and Winform dialogs.
After disassembling the dll I searched for the text TREK and found the reference to this in a subfunction with other references to ...Screensaver...
So i tried it on my scope and bingo.

Regards
Kai

NICE!!!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pinkman on November 25, 2013, 01:07:54 am
kilobyte,

Thanks for the reply.  My understanding is that I should extract the contents of infiniivisionSetup.cab, then take contents of the "Secure" folder and copy *only* Secure folder contents to Flash root drive.  I have done this, but my folder structure looks a little bit different than what you have listed.

Are there any files, other than contents of "Secure" folder(including modified infiniivisionCore.dll)  + startupoverride text file that should be on the flash disk?

Did you copy whole structure from extracted  \3000XSeries.02.35.2013061800.cab\infiniiVisionSetup.cab ? The whole content of \Secure\ folder must be copied to USB flash.
Also check presence of the Startup folder with modified   infiniivision.lnk which contains sequence "62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"

I did copy the entire contents of the \Secure folder.  There were files in the "root" directory of the .CAB file (such as FPGA2000.bin, FPGA3000.bin, etc) which I did not copy - So the entire contents of the \Secure folder are duplicated on the root directory of my flash disk.

Then, I modified the infiniivisionCore.dll file as you described, I modified the \Startup\infiniivision.lnk file as you described, and created a file in in the root directory of my flash disk called "infiniivisionStartupOverride.txt" and put the text "True" inside that file.

It appears that I am following the correct procedure... I have tested quite a few different flash disks, old and new - I will see if I can get some different ones and test, but maybe I am unlucky and the newer scopes will require more work.

My next step will be to gain access to the console via the serial port.  I assume that doing this will allow me to see startup error messages as a result of my flash disk?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jrgandara on November 25, 2013, 08:54:31 am
This Startrek easteregg screen saver worked fine in my 2002! I love it!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on November 25, 2013, 12:18:54 pm
Go further! Somebody take a WinCE toolchain and make an S/N changer, change the last digit to use leaked key.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on November 25, 2013, 09:39:53 pm
I test my usb stick on a dsox2024a at work today.
The DSO is only some month old (July 2013).

It's a pity but it didn't load the firmware from usb stick.
The LED on the flash drive has flashed at startup but after that there was no reaction compared to my DSOX.
Maybe they have changed something in the bootloader or something else.

I think i will buy the LAN Module(as a Christmas gift  ;D), maybe with this its possible to do more research on the scope.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on November 25, 2013, 09:49:16 pm
Huh, now Im more glad I bought a Premium Used from Agilent. Hopefully mine will be an older one and this hack will work on it. Still havent had a change to play with it though as I havent needed anything more than the features Ive already purchased.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: DavidDLC on November 26, 2013, 12:36:16 am
But... the low capacity USB thumdrive is a FAT32 and it works.  :scared:

David.

I made my scope work with the 8GB USB drive.

I had to create a primary partition of 7.65 GB (it won't work with 7.7 or higher), and format it to FAT32.

 :-BROKE

David.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pinkman on November 26, 2013, 03:19:49 am
I test my usb stick on a dsox2024a at work today.
The DSO is only some month old (July 2013).

It's a pity but it didn't load the firmware from usb stick.
The LED on the flash drive has flashed at startup but after that there was no reaction compared to my DSOX.
Maybe they have changed something in the bootloader or something else.

I think i will buy the LAN Module(as a Christmas gift  ;D), maybe with this its possible to do more research on the scope.

As I suspected... Agilent probably planned this all along... Release a hackable 1st version of a scope, knowing that newer models will not be hackabe and there will still be a few hackable versions always floating around on the market to generate buzz about hacking... Sales skyrocket with hopeful buyers...  Kill product line after 5 years of better than average sales and provide little or no legacy support.  Lol.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on November 26, 2013, 05:58:48 am
Yea I doubt sales are going to sky rocket on $2000+ oscilloscopes just because there is a hack out there that most will never even hear about.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: vl400 on November 26, 2013, 06:03:36 am
Tried on two July build 3000x scopes and the USB boot method works. Everything except bandwidth upgrade (100MHz still 100MHz and 350MHz still 350MHz) being available.

One is v2.35 and the other v2.30 firmware.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Rufus on November 26, 2013, 06:54:51 am
Tried on two July build 3000x scopes and the USB boot method works. Everything except bandwidth upgrade (100MHz still 100MHz and 350MHz still 350MHz) being available.

One is v2.35 and the other v2.30 firmware.

I think the USB port is a bit flaky. There were problems with scopes endlessly cycling the LEDs on boot when a USB stick is inserted. Until a couple of firmware updates ago mine would never show the splash screen if a USB stick was inserted. Comments here about needing FAT16 or FAT32 and not more than 7.9GB etc might just be down to the scope liking some sticks more than others.

The scope isn't going to spend a lot of time checking or waiting for a USB stick during boot.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: willemite on November 26, 2013, 02:52:31 pm
Sounds just like trying to boot other operating systems from USB flash drives. It is always hit or miss for me, some just are not accepted on any given computer at boot time, even though they might work fine once the full O/S is loaded
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pinkman on November 26, 2013, 03:30:09 pm
Tried on two July build 3000x scopes and the USB boot method works. Everything except bandwidth upgrade (100MHz still 100MHz and 350MHz still 350MHz) being available.

One is v2.35 and the other v2.30 firmware.

I think the USB port is a bit flaky. There were problems with scopes endlessly cycling the LEDs on boot when a USB stick is inserted. Until a couple of firmware updates ago mine would never show the splash screen if a USB stick was inserted. Comments here about needing FAT16 or FAT32 and not more than 7.9GB etc might just be down to the scope liking some sticks more than others.

The scope isn't going to spend a lot of time checking or waiting for a USB stick during boot.

That is exactly what mine does.  It boots to the splash screen, and then the LED's cycle... Forever.  Maybe I need to try a few more flash drives.  Have already been through a dozen of them!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on November 26, 2013, 07:23:57 pm
I've noticed that scope hangs if there is missig full path to launcher in .lnk file (in startup folder).

For example if you forgot to add "\usb" to launcher path in the .lnk file on USB stick or if you replaced .lnk file in flash memory with one from usb stick; containing "\usb" path, scope will hang. (I did this by mistake)

If you have used "-All" switch, You probably lost 30 trial option.
In case You don't like a little star you can add separate license switches (-l AUTO, -l MSO,.....).
There are two hidden options -l VID and -l CABLE. You can find them by pressing analyse button ;)
Enjoy!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on November 26, 2013, 07:28:05 pm
I test my usb stick on a dsox2024a at work today.
The DSO is only some month old (July 2013).

It's a pity but it didn't load the firmware from usb stick.
The LED on the flash drive has flashed at startup but after that there was no reaction compared to my DSOX.
Maybe they have changed something in the bootloader or something else.

I think i will buy the LAN Module(as a Christmas gift  ;D), maybe with this its possible to do more research on the scope.

Try to format usb stick, copy override.txt and than other system files.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on November 26, 2013, 07:32:20 pm
Tried on two July build 3000x scopes and the USB boot method works. Everything except bandwidth upgrade (100MHz still 100MHz and 350MHz still 350MHz) being available.

One is v2.35 and the other v2.30 firmware.
You can upgrade 100MHz version only to 200MHz, and 350MHz can go up to 500MHz. (it should..)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: vl400 on November 26, 2013, 07:50:09 pm
You can upgrade 100MHz version only to 200MHz, and 350MHz can go up to 500MHz. (it should..)

Yeah I have, but it is using a different method. Was just pointing out that the USB boot method does not appear to enable the bandwidth upgrade  :--
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Rigby on November 26, 2013, 07:58:20 pm
I DO NOT INTEND FOR THIS TO BE TAKEN NEGATIVELY!

I find it... interesting how so many people SEEM TO BE genuinely upset that they are unable to get more scope than they paid for.

I'm not attacking, I'm not criticizing, nothing like it; it is just very interesting to me that people genuinely believe that they should be able to upgrade their scope for free.  Reading that sentence after I typed it out, you may (incorrectly) infer that I am against this point of view; you are wrong.

I guess my interest here comes from the dichotomy between a market that is quickly moving towards software upgrades like this one, and that the market is full of people who believe that once they've purchased something, they own it.

I know in the EU that the "you bought it, you own it" rule applies, but here in the US, that isn't the case.  It should be, but it isn't.

I am just wondering where the split started.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on November 26, 2013, 08:12:17 pm
Dear Rigby,

I guess these guys (me included) can't help You with that problem, since most of us are in to electronic design, hardware and software, and have very little knowledge about sociology and psychology matters.   O0
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on November 26, 2013, 09:14:59 pm
I've noticed that scope hangs if there is missig full path to launcher in .lnk file (in startup folder).

For example if you forgot to add "\usb" to launcher path in the .lnk file on USB stick or if you replaced .lnk file in flash memory with one from usb stick; containing "\usb" path, scope will hang. (I did this by mistake)

If you have used "-All" switch, You probably lost 30 trial option.
In case You don't like a little star you can add separate license switches (-l AUTO, -l MSO,.....).
There are two hidden options -l VID and -l CABLE. You can find them by pressing analyse button ;)
Enjoy!


I did not fnd anything which is related to -l CABLE.
I can confirm - adding -l BW50 upgraded the 350MHz version to 500MHz, tested with Vincent pulse generator (see attachment).

Fo someone who is going to buy a new scope can be interested current PROMO
https://www.home.agilent.com/agilent/editorial.jspx?cc=US&lc=eng&ckey=2384797&nid=-33573.0.08&id=2384797 (https://www.home.agilent.com/agilent/editorial.jspx?cc=US&lc=eng&ckey=2384797&nid=-33573.0.08&id=2384797)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on November 26, 2013, 09:51:42 pm
It's working on 2000 series, You can find it when you press Analyse button. When you add that switch launcher returns: *** Installing License: Cable Calibration.
-l VID adds HD video trigger and -l CABLE adds that cable calibration option which i'm not shure what's it for, didn't try that option yet.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on November 26, 2013, 09:58:32 pm
Has anyone tested going back to stock after modding the firmware? Any issues there? What about with re-enabling previously purchased upgrades?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on November 26, 2013, 10:00:50 pm
You'll have all options you had before (because they are enabled by license files), except 30 days trial, if you used "-l ALL" Switch.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on November 26, 2013, 10:02:58 pm
It's working on 2000 series, You can find it when you press Analyse button. When you add that switch launcher returns: *** Installing License: Cable Calibration.
-l VID adds HD video trigger and -l CABLE adds that cable calibration option which i'm not shure what's it for, didn't try that option yet.
You are right, it is also working on 3k series as well.
Feature is called "Ratio and phase Reference".

Has anyone tested going back to stock after modding the firmware? Any issues there? What about with re-enabling previously purchased upgrades?
The original licenses purchased with scope still remains on scope itself.
The "Hack" is just running unlocked firmware from USB drive.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on November 26, 2013, 10:06:56 pm
Plesa, can You please look at 0x007D51C8 in core file, You might find more switches that might work on 3000 series which don't work on 2000 series.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: DavidDLC on November 26, 2013, 10:16:07 pm
But... the low capacity USB thumdrive is a FAT32 and it works.  :scared:

David.

I made my scope work with the 8GB USB drive.

I had to create a primary partition of 7.65 GB (it won't work with 7.7 or higher), and format it to FAT32.

 :-BROKE

David.

Well 7.65GB partition was not working all the time, I just randomly set a partition of 7GB and now it boots every single time.

David.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on November 26, 2013, 10:17:57 pm
I'm using Corsairs 32GB flash voyager with FAT32, and it works fine.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on November 26, 2013, 10:20:42 pm
Plesa, can You please look at 0x007D51C8 in core file, You might find more switches that might work on 3000 series which don't work on 2000 series.

You have a good point.
We have new licence Tomography ( TOM )
So current infiniivision.lnk contains:
254#\usb\infiniiVision\infiniivisionLauncher.exe -l MSO -l MEMUP -l MEMMAX -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l EDK -l WAVEGEN -l AERO -l VID -l ADVMATH -l DVM -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l All
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on November 26, 2013, 10:22:58 pm
This is my command line:
62#\usb\secure\infiniiVision\infiniivisionLauncher.exe -l MSO -l memMax -l MEMUP -l EMBD -l AUTO -l COMP -l SGM -l MASK -l EDK -l RML -l ASV -l SGMC -l BW20 -l DIS -l SCPIPS -l VID -l CABLE

This enables all on 2000 series
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on November 26, 2013, 10:31:41 pm
Plesa, have You by any chance figured out what infiniium mode means ???
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on November 26, 2013, 10:32:04 pm
But... the low capacity USB thumdrive is a FAT32 and it works.  :scared:

David.

I made my scope work with the 8GB USB drive.

I had to create a primary partition of 7.65 GB (it won't work with 7.7 or higher), and format it to FAT32.

 :-BROKE

David.

Well 7.65GB partition was not working all the time, I just randomly set a partition of 7GB and now it boots every single time.

David.

I'm using 8GB and 32 GB flash, both formatted to FAT32 without any issue.
I had only problem during using the USB/MicroSD adaptor ( it was related to microSD connector)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: DavidDLC on November 26, 2013, 10:37:10 pm
Mmmmnnn it maybe the fricking brand is a cheapo PNY.

I have bought this one because two reasons:

1.- I like the size of the memory ( small size ), I want it to be permanently installed on the back of the unit and it is short, there are shorter ones, but more pricy.

2.- The price

Well so far with 7 GB has been working fine, if it starts to fail, I will get a quality one.

David.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on November 26, 2013, 10:38:48 pm
Plesa, have You by any chance figured out what infiniium mode means ???

I suppose that it is related to some compatibility with Infinium family scope and their SCPI commands, I guess.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on November 26, 2013, 10:39:36 pm
DavidDLC, if you can borrow LAN module, you can copy modified infiniivisioncore.dll and infiniivision.lnk to internal flash, this way 'scope will boot much faster...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on November 26, 2013, 10:46:56 pm
Plesa, have You by any chance figured out what infiniium mode means ???

I suppose that it is related to some compatibility with Infinium family scope and their SCPI commands, I guess.

You are probably right.

This is launcher return text:

\> \secure\infiniiVision\infiniivisionLauncher.exe -l MSO -l memMax -l MEMUP -l
EMBD -l AUTO -l COMP -l SGM -l MASK -l EDK -l RML -l ASV -l SGMC -l BW20 -l DIS
-l SCPIPS -l VID -l CABLE --forcemaxmem
Our command line is -l MSO -l memMax -l MEMUP -l EMBD -l AUTO -l COMP -l SGM -l
MASK -l EDK -l RML -l ASV -l SGMC -l BW20 -l DIS -l SCPIPS -l VID -l CABLE --for
cemaxmem
*** Installing License: MSO
*** Installing License: Acq Memory Max
*** Installing License: Acq Memory Max
*** Installing License: Embedded serial decode and trigger
*** Installing License: Automotive serial decode and trigger
*** Installing License: UART/RS232 serial decode and trigger
*** Installing License: Segmented Memory
*** Installing License: Mask limit testing
*** Installing License: 200MHz Bandwidth
*** Installing License: Education kit license
*** Installing License: Distributor license
*** Installing License: Enhanced Video Triggering
*** Installing License: ASV
*** Installing License: Cable Calibration
*** Installing License: Infiniium Mode
*** Installing License: Remote Log
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sbampato12 on November 27, 2013, 12:18:39 am
Any chance the aero command run on 2000X?
Maybe the software is there, just locked too.

Why different numbers in the lnk file? (Plesa has 254 and Wersi 62)
what does this command?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on November 27, 2013, 08:39:54 am
Intresting question, i looked it up on a MSDN this is what i found:

[number of ASCII characters after pound sign allocated to
command-line arguments]#[command line] [optional parameters]

Looks like i should write at least 187...

It works anyway...  :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: sprocket on November 27, 2013, 10:11:48 am
I find it... interesting how so many people SEEM TO BE genuinely upset that they are unable to get more scope than they paid for.

If they bought the scope expecting to do the free upgrade, i.e. that was part of the deliberation when deciding which one to get, I can understand that. For example I am now seriously considering getting an Agilent for my personal use because you can get the free upgrade, otherwise it just isn't worth it.

Upset might be a bit of a strong word. Disappointed would be more accurate.

Quote
I know in the EU that the "you bought it, you own it" rule applies, but here in the US, that isn't the case.  It should be, but it isn't. Might not be as bad as in the states, but it's bad enough.

Damn straight. The EU isn't ruled by corporations.

Emmh not really. Financial, chemical, automotive, agricultural and defense corporations carries a lot of weight in the EU. But that's an entirely different debate.   
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on November 27, 2013, 01:13:20 pm
Any chance the aero command run on 2000X?
Maybe the software is there, just locked too.

Why different numbers in the lnk file? (Plesa has 254 and Wersi 62)
what does this command?
Unfortunatly AERO does not work on 2000 series, i belive decoding is done by FPGA in cooperation with MEGAZOOM IV (Codename: "Baldwin" i belive), so it's not available in 2000 series.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on November 27, 2013, 02:07:14 pm
To people with fresh scopes worrying about new bootloaders: the startup override hack has nothing with new/old bootloaders, it was found in update files themselves. So if a yesterday's manufactured scope has the same sw version - the hack is also there. So check your USB sticks/folder structure and try again.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on November 27, 2013, 04:44:20 pm
Bootloader is the same for all 'scopes, it's a u-boot. It's located in separate 512kB memory, You can find all detalis about memory mapping on agilent web site...
Document is called: "5990-8184EN.pdf"
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on November 27, 2013, 04:46:40 pm
Does anyone have NAND flash image?
There is 2,5MB section with serial and model number.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on November 27, 2013, 06:30:02 pm
Any chance the aero command run on 2000X?
Maybe the software is there, just locked too.

Why different numbers in the lnk file? (Plesa has 254 and Wersi 62)
what does this command?

Is there any usage of AERO at home lab?
Check the infiniivisioncore.dll file for support on 2k family. I do not see it.

The number is the ammount of characters in .lnk file

I checked all functions of scope and did not find anything related to Tomography option (TOM), so it can be related to some upcoming software package like Agilent Spectrum Visualiser (ASV), I guess.

There two additional options FRC (FlexRay Complance) and TEL (Telecom Mask Test) , both not working.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pmcouto on November 27, 2013, 11:55:33 pm
Hi,

These seem to be the license options recognized by X3000 “infiniivisionLauncher.exe” v2.35:

Fully documented and sold by Agilent
ADVMATH   Advance Math
AERO   1553 & 429 serial decodes
AUDIO   Audio serial decode and trigger
AUTO   Automotive serial decode and trigger
COMP   UART/RS232 serial decode and trigger
EMBD   Embedded serial decode and trigger
Flex           Ray serial decode
Mask   limit testing
MEMUP    Acq Memory Max
PWR          Power application
SGM          Segmented Memory
VID          Enhanced Video Triggering
WAVEGEN   WaveGen license
EDK          Education kit license
BW10   100MHz Bandwidth (BW upgrade for 70 MHz models)   
BW20   200MHz Bandwidth (BW upgrade for 70 and 100 MHz models)   
BW50   500MHz Bandwidth (BW upgrade for 350 MHz models)

Undocumented and/or Not implemented
TOM           Tomotherapy
SGMC   Circular Segmented Memory
SCPIPS   Infiniium Mode
FLEXC   Flex Ray Plus
DIS           Distributor license
FRC           Flex Ray Compliance
TEL           Telecom Mask Test

Unknown (Used for Development/Test?)
RML           ? (Remote Logging?)
CABLE       ? (Calibration?)
ASV           ? (Agilent Spectrum Visualiser?)
ALT            FPGA Altera
FPG            FPGA Probe

(License management?)
memMax   ? (Same as MEMUP?)
memNo   Acq Memory Dflt
rmAll           Remove All Licenses
All            Licenses

Options MSO and DVM, although available in the software, are missing from this list…

Investigation still in progress  >:D
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on November 28, 2013, 03:49:30 pm
FLEXC         Flex Ray Plus ( I did not see any difference with FLEX)
DIS           Distributor license (contains following memMAX,EMBD,AUTO,FLEX,PWR,COMP,SGM,MASK,AUDIO,EDK,WAVEGEN,AERO,VID,ADVMATH,DVM,ASV,RML )
RML           Remote Logging ( create log on USB drive of remote commands - useful for automation)
ASV           Agilent Spectrum Visualiser ( about 2 years on market, useful for spectrum measurements)
TOM           Tomotherapy (As I mentioned probable for some SW like ASV) ????
memMax        Maximal Memory ( increased number of segments 500->1000)
SGMC          Circular Segmented Memory (require memMAX or MEMUP)  - quite usefull, endless loop of segments, require SGM
FRC           Flex Ray Compliance (FLEX,FLEXC required but without any obvious function - probably require MASK??)
TEL           Telecom Mask Test    (unable to boot)
CABLE         Measure delay and delta on phase
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sbampato12 on November 29, 2013, 12:44:01 pm
Any chance the aero command run on 2000X?
Maybe the software is there, just locked too.

Why different numbers in the lnk file? (Plesa has 254 and Wersi 62)
what does this command?

Is there any usage of AERO at home lab?
Check the infiniivisioncore.dll file for support on 2k family. I do not see it.

The number is the ammount of characters in .lnk file

I checked all functions of scope and did not find anything related to Tomography option (TOM), so it can be related to some upcoming software package like Agilent Spectrum Visualiser (ASV), I guess.

There two additional options FRC (FlexRay Complance) and TEL (Telecom Mask Test) , both not working.

No, I've never used aero at home, to be honest, neither on work. The question was purely for to know if the decode option was related to hardware or only software.
I think the diferences between wavegen on 2000 and 3000 might be in hardware (that is able or not to generate arbitrary waveforms), but I tought the decode was only in software...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mwilson on November 30, 2013, 08:59:24 pm
if you can borrow LAN module, you can copy modified infiniivisioncore.dll and infiniivision.lnk to internal flash

How does this work? I don't have the LAN module so can't try it out, but this option might convince me to get one. Does the scope have an FTP server or do you telnet in and copy the files around from a command line?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on December 01, 2013, 01:13:38 am
And what is the problem copying files WITHOUT lan module? Why not just build a modified update .cab?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: troth on December 01, 2013, 01:16:46 am
Just tried the hack on a DSOX3034A that I got last week. I think the build week is 43 of 2013 (late October-ish, there is a 1343 under the QR code on the serial #, MAC addr sticker on the back of the unit). The firmware version that came with it is 02.36.2013091301.

Unfortunately, I'm not having any luck getting it to boot from the USB stick with the hacked Core DLL file. I also tried to get it to boot without modifying any of the files except for the override .txt file, again with no luck.

The scope appears to read information from the USB drive (can see the led flashing). Next, all I get is it cycling through lighting up the channel buttons, intensity and wave gen, run stop and single and then ref, math, digital and serial. It goes through about 8 cycles and then reboots itself. No matter what I have tried, I have seen no change in behavior when trying to boot from the usb flash drive.

To verify that the scope can handle the formatting of the drive, I booted the scope without the usb flash drive plugged in. After the scope was up and operating normally, I plugged in the usb drive and was able to browse the directories via the Save/Recall button.

Not really asking for any one to figure this out, just trying to document another data point for a relatively new scope.

I'd be interested to know if anyone else with a newer scope that came with firmware > 2.35 is having any success with the hack.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: B0B45 on December 01, 2013, 04:30:05 am
Hi,

the trick is to use fast USB-Sticks. I use an usb3 32GB (read 30MB/s) Stick without any problems. Yesterday I've tested a Micro USB2 Stick with only 15MB/s. That one only starts the first time, then I have to unplug the Scope to make it work again.

Maybe some of you can make a speed test with your working sticks and post the result to prove me wrong or right.

BTW, a big thanks to the guys who posted the little trick. :-+

regards B0B
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on December 01, 2013, 05:10:43 pm
Just tried the hack on a DSOX3034A that I got last week. I think the build week is 43 of 2013 (late October-ish, there is a 1343 under the QR code on the serial #, MAC addr sticker on the back of the unit). The firmware version that came with it is 02.36.2013091301.

Unfortunately, I'm not having any luck getting it to boot from the USB stick with the hacked Core DLL file. I also tried to get it to boot without modifying any of the files except for the override .txt file, again with no luck.

The scope appears to read information from the USB drive (can see the led flashing). Next, all I get is it cycling through lighting up the channel buttons, intensity and wave gen, run stop and single and then ref, math, digital and serial. It goes through about 8 cycles and then reboots itself. No matter what I have tried, I have seen no change in behavior when trying to boot from the usb flash drive.

To verify that the scope can handle the formatting of the drive, I booted the scope without the usb flash drive plugged in. After the scope was up and operating normally, I plugged in the usb drive and was able to browse the directories via the Save/Recall button.

Not really asking for any one to figure this out, just trying to document another data point for a relatively new scope.

I'd be interested to know if anyone else with a newer scope that came with firmware > 2.35 is having any success with the hack.

Thanks for info. Could you try to downgrade the firmware to the latest version available on website 2.35 and try it again?
Your reported firmware seems to be not released for field.

As BOB reported, I tried some really slow USB sticks (<5MB/s) and it is not working, strange.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: troth on December 05, 2013, 12:38:59 am
Quote
Thanks for info. Could you try to downgrade the firmware to the latest version available on website 2.35 and try it again?
Your reported firmware seems to be not released for field.

As BOB reported, I tried some really slow USB sticks (<5MB/s) and it is not working, strange.

I'd like to try downgrading, but I'm a tad skittish about doing so without having a way to get the scope back to the firmware that came from the factory. I have not been able to find a cab file for the 2.36 firmware the scope shipped with.

I've tried a faster USB drive (> 20MB/s) with no change in results.

What are the symptoms of failure that people are seeing with slow drives (i.e. what does the scope do when it fails to boot from USB drive)? I don't recall seeing anyone state that explicitly in any of the messages I've read on this thread (quite possible I missed it if it is there).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on December 05, 2013, 06:43:12 pm
Huh, mine is still running 2.35. What did they do in version 2.36 I wonder.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: MarkL on December 06, 2013, 04:10:56 pm
Huh, mine is still running 2.35. What did they do in version 2.36 I wonder.

Perhaps in 2.36 they've addressed the license hack?  I think there's little doubt Agilent reads this forum.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on December 06, 2013, 04:46:56 pm
Huh, mine is still running 2.35. What did they do in version 2.36 I wonder.

Perhaps in 2.36 they've addressed the license hack?  I think there's little doubt Agilent reads this forum.
I doubt that. Arent there already confirmed people in this thread with brand new scopes running 2.36 with a successful hack?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: con-f-use on December 06, 2013, 05:37:50 pm
I doubt that. Arent there already confirmed people in this thread with brand new scopes running 2.36 with a successful hack?
There are.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on December 06, 2013, 07:21:13 pm
I doubt that. Arent there already confirmed people in this thread with brand new scopes running 2.36 with a successful hack?
There are.
Thought so. Thanks for confirming.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: troth on December 06, 2013, 07:39:40 pm
I doubt that. Arent there already confirmed people in this thread with brand new scopes running 2.36 with a successful hack?
There are.

I just read back through the thread and didn't see any evidence that someone has gotten the hack to work with a scope having 2.36 from the factory.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jstarr on December 06, 2013, 08:49:02 pm
whats a good software to use for modifying the infiniiVisionCore.dll ?

tnx
j
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jstarr on December 06, 2013, 10:16:53 pm
I found "OpenFreely" as the hexeditor to modify infiniiVisionCore.dll.  Does the date/time of the edited file have to be identical to the original?  Right now the edited file has today's date.

tnx
j



How to hack the firmware
1. Unpack the firmware *.cab by 7zip
2. Unpack infiniiVisionSetup.cab ( e.g. with WinCE CAB Manager 3.0)
    Find \Secure\infiniiVision\infiniiVisionCore.dll
3. Change at location 0x277e50 in infiniiVisionCore.dll
    byte sequence 04 00 a0 e1 to byte sequence 00 00 a0 e3
4. Enable startup Overide by creating USB flash with following structure in root of USB drive (copy structure from Secure folder from point 2)
    Edit in Startup folder file infiniivision.lnk to contains following sequence "62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"
    Replace in infiniiVision folder  infiniiVisionCore.dll with patched infiniiVisionCore.dll file
5. Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
6. Plug the USB drive to scope and turn it ON
7. There will be red  message in letf top corner "Unfinalized Software"  and "System Concerns detected: OS version is not correct. Please reload system firmware"

Applications needed:
 WinCE CAB Manager http://www.ocpsoftware.com/products.php (http://www.ocpsoftware.com/products.php)
 7Zip http://www.7-zip.org/ (http://www.7-zip.org/)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on December 07, 2013, 06:25:26 pm
I found "OpenFreely" as the hexeditor to modify infiniiVisionCore.dll.  Does the date/time of the edited file have to be identical to the original?  Right now the edited file has today's date.

tnx
j

I'm using PsPad, but there are lot of other hex editors available.
The data and time is not important.

I doubt that. Arent there already confirmed people in this thread with brand new scopes running 2.36 with a successful hack?
There are.

Could you try to downgrade the firmware to 2.35 and try the hack?
Or do you have the LAN module?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: GregerG on December 07, 2013, 08:56:26 pm
Just confirming it works on my 2.35 2012A as well, had some boot issues until I noticed the startup link was wrong and I also partitioned my (11MB/s 32GB FAT32) stick to 4gig at the same time so I can't say for sure if it would have worked with larger than 7.7gig but it works now so I'm a HAPPY camper :D

I also didn't activate all features as I wasn't sure all worked on 2000-series.... didn't want to push my luck :)
Running fine with 62#\usb\infiniiVision\infiniivisionLauncher.exe -l MSO -l memMax -l MEMUP -l EMBD -l AUTO -l COMP -l SGM -l MASK -l EDK -l BW20 -l VID -l ADVMATH -l DVM
https://www.dropbox.com/s/nlypogw0866xnwi/20131207_212432.jpg (https://www.dropbox.com/s/nlypogw0866xnwi/20131207_212432.jpg)

Noticing now I forgot WAVEGEN but that license was purchased earlier and it's still activated so it clearly reads previously installed licenses.

THANK YOU for sharing this, have been waiting ages *HUGS* (and hopefully this isn't just an activation of the trial license so it stops in a month :D)
(also I was using the backside usb port, and noticed bootup time was a bit slower - cycled the panel LED's 4 times instead of normal 2 times)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tivoi on December 08, 2013, 10:48:24 am
I was try hack,
usb flash can't work with nomal format

i was try format usb flash with hirrent boot USB, it is work

this is flash format process
http://www.hiren.info/pages/bootcd-on-usb-disk (http://www.hiren.info/pages/bootcd-on-usb-disk)

thanks and best regards
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: GregerG on December 08, 2013, 03:28:50 pm
Yes - regular FAT32 format under windows works great...
Just bought a new, faster, 8gig micro usb-stick (sandisc cruzer fit) and it works just fine, no problems what so ever...

Correction to previous post - it cycles the front panel LED's 6 times, so don't be too hasty and turn it off, give it a few seconds :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: willemite on December 09, 2013, 04:47:26 am
silly me.
after many fails thinking it was the USB formating, or the USB drive, finally remember some post way back that suggested using the same firmware--- I was trying 2.35 on stick, with 2.12 (I think) on the scope. Once I realized that, worked on the next try following upgrade.
I looked high and low for some way to unpack the cab file (with proper file names and directories)-- the referenced program refused to install on all my computers here. Finally I just used 7zip, hunted through the folder structure and noticed the xml file that gave the renaming and directory structure. Used excel to concatenate a few "copy" and "mkdir" into a DOS batchfile that made quick work of putting everything where needed.
dsox2004 now shows 200 mhz
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: GregerG on December 11, 2013, 02:28:15 am
I noticed that the enhanced video (VID) trigger work on the 2000 series,
even though it's not sold by agilent, all the way up to 1080p/i...
Perhaps a coming feature?

Also - my scope is flashed with stock firmware 2.35, and booting the usb stick with 2.35 as well,
and I still get a popup the firmwares don't match, however after you click it away it won't re-appear and the calibration and hardware self tests pass just fine.
Maybe because the md5 crc or timestamp isn't matching anymore? Will look into it tomorrow...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: wersi on December 11, 2013, 08:34:03 am
I've changed crc (Microsoft PE file spec.) but it still complains about FW....
Looks like its a verisign signature missmatch problem.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mwilson on December 12, 2013, 07:42:04 pm
I just got the LAN module for my DSO-X 3014A. I've seen references to loading the modified startup files on my USB key to the internal storage with the LAN module, but when I try FTPing or telneting to the scope I don't know the username or password.

Could someone please point me in the right direction for connecting or replacing the right startup files?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on December 12, 2013, 08:11:56 pm
Oh, I guess I missed that part of this hack. The USB drive with the custom firmware resides on the USB drive so it has the be left connected to the scope all the time doesnt it?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on December 12, 2013, 11:34:04 pm
I don't know the username or password.

Check page 12
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on December 12, 2013, 11:45:42 pm
Oh, I guess I missed that part of this hack. The USB drive with the custom firmware resides on the USB drive so it has the be left connected to the scope all the time doesnt it?
Yes. If the USB is removed the unit will reboot itself in few seconds.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mwilson on December 13, 2013, 12:41:26 am
I don't know the username or password.

Check page 12

Thank you! I was searching for "password" in the thread, not "pass". Happy to report I've been able to modify the built-in files and don't have to boot from USB key anymore.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on December 13, 2013, 01:28:07 am
I don't know the username or password.

Check page 12

Thank you! I was searching for "password" in the thread, not "pass". Happy to report I've been able to modify the built-in files and don't have to boot from USB key anymore.
I have the VGA/LAN module for my MSOX2024, any chance you could write out your steps to doing this? Not having to have the USB drive taking up the port would be very nice.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on December 13, 2013, 03:39:42 am
I don't know the username or password.

Check page 12

Thank you! I was searching for "password" in the thread, not "pass". Happy to report I've been able to modify the built-in files and don't have to boot from USB key anymore.
I have the VGA/LAN module for my MSOX2024, any chance you could write out your steps to doing this? Not having to have the USB drive taking up the port would be very nice.

Telnet to the scope, run "ProcessMgr.exe kill infiniivisionLauncher.exe" and execute "\Secure\infiniiVision\infiniivisionLauncher.exe" with parameters you would like to enable.
From my perspective the USB drive is the easiest way and there is no reason to have the hack inside scope ( except you are going to pretend it is genuine :-).
Also you cannot brick the scope this way.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on December 13, 2013, 05:50:07 am
I don't know the username or password.

Check page 12
Are you referring to this post?

Some "oil into the fire":
telnet login/pass:
infiniivision
skywalker1977
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: craftycoder on December 13, 2013, 09:19:27 pm
Can this be done over USB? What is the process to do it?
Telnet to the scope
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mwilson on December 14, 2013, 03:17:00 am
I have the VGA/LAN module for my MSOX2024, any chance you could write out your steps to doing this? Not having to have the USB drive taking up the port would be very nice.

Certainly. The way I did it once knowing the telnet username and password (thanks abyrvalg!) was to copy modified files from a USB stick to the internal storage.

I'm assuming you can render your scope unbootable by messing with the internal filesystem. If you have a working boot USB stick you could theoretically boot from it and fix it, but hopefully it doesn't come to that. Obviously proceed at your own risk.

First make a working bootable USB stick to make sure the options you want work and you've modified the DLL correctly as described earlier in this thread.

Once you're sure that's working, move the USB stick back to your PC. I made a directory in the root of my USB stick to store the files I'm going to copy to internal flash for convenience. Let's call it "temp". Copy in the modified infiniiVisionCore.dll. Also make a new modified copy of infiniivision.lnk from the startup folder.

Unlike booting from the USB stick, your new modified infiniivision.lnk needs to refer to the internal storage version of infiniivisionLauncher.exe (so change the "\usb" back to "\Secure" in the infiniivision.lnk that you modified to make your bootable USB stick). I'm using the following on a DSO-X 3014, for example. If you've already made your bootable USB stick you are probably familiar with the options you can use here and can tailor to your liking:

Code: [Select]
196#\Secure\infiniiVision\infiniivisionLauncher.exe -l MSO -l DVM -l ADVMATH -l AERO -l AUDIO -l AUTO -l COMP -l EMBD -l Flex -l Mask -l MEMUP -l PWR -l SGM -l VID -l WAVEGEN -l EDK -l memMax -l BW20
Now you have the files you need in the temp directory of the USB stick.

Boot your scope from the USB stick (if you are running from internal storage you can't replace the DLL since it's in use. There are ways around that like killing the process, but by booting from the USB stick you're also proving to yourself that if you mess something up you still have a fallback plan to boot the thing). Once booted, telnet to the scope and use the username and password provided by abyrvalg (it seems like I always have to try logging in twice. Not sure if I'm that consistently typo-prone or if there's something funny going on).

Now you're at the command prompt. If you do a 'dir' you'll see the \usb directory, which is your USB stick, and the other internal flash directories like 'secure'. Note that even though you're booting from USB, the root of the USB stick is mounted at \usb (so you'd see \usb\infiniivision, \usb\startup, etc.) and the internal flash directories are at the root level.

Copy the modified DLL to replace the internal one. If you used the same temp directory name I did, a command like this should work:

Code: [Select]
copy \usb\temp\infiniiVisionCore.dll \Secure\infiniiVision
Then copy the startup shortcut to the startup directory. The file is read-only, so I removed the read-only flag on the destination file first. Not sure if that's necessary or not:

Code: [Select]
attrib -r \Secure\startup\infiniivision.lnk
copy \usb\temp\infiniivision.lnk \Secure\startup

That should do it. Power off the scope, pull out the USB stick, and turn it on again. Hope it boots (and even better, hope it boots with your additional license options enabled).

Like I said... you can break your scope so that it won't boot from internal memory if this goes wrong. Be careful! I don't know if there's a firmware recovery procedure on these scopes (luckily it's a topic I haven't had to research yet).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on December 14, 2013, 11:53:51 am
I can add to mwilson's excellent description that there is almost nothing to fear. The startup override functionality doesn't depend neither on infiniiVisionCore.dll nor on .lnk, so it will be possible to boot form USB even if these files are totally corrupt/deleted. And more - there is U-Boot functionality (explored by FrankBuss earlier in this thread) that works at early boot stages and doesn't depend on any files at all.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on December 14, 2013, 12:35:26 pm
mwilson, can you please try this:
edit USB .lnk to
Code: [Select]
33#\windows\cmd.exe \usb\autorun.cmdat USB root create autorun.cmd with
Code: [Select]
copy \usb\temp\infiniiVisionCore.dll \Secure\infiniiVision
attrib -r \Secure\startup\infiniivision.lnk
copy \usb\temp\infiniivision.lnk \Secure\startup
\Secure\infiniiVision\infiniivisionLauncher.exe
(no need to say that files in \temp and all startup override stuff must be present too of course)
The last command (normal scope app startup) is there to prevent boot looping.

This can help people w/o LAN/telnet installing the hack - just boot from such prepared USB stick once.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mwilson on December 14, 2013, 09:41:42 pm
mwilson, can you please try this:
edit USB .lnk to
Code: [Select]
33#\windows\cmd.exe \usb\autorun.cmdat USB root create autorun.cmd with
[...]
This can help people w/o LAN/telnet installing the hack - just boot from such prepared USB stick once.

Yep. Played around with this and it doesn't look like cmd.exe can take a file as an argument. However, you can execute .cmd files directly. So this method works if you make your startup .lnk something like:

Code: [Select]
18#\usb\temp\foo.cmd
So indeed folks can install modified files internally just by booting a properly prepared USB stick once. No need for the LAN module. (And presumably if something gets messed up, you can boot from the working USB stick and re-install the firmware as normal to get the internal filesystem back to factory condition.)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on December 15, 2013, 12:53:16 am
So is it better to try and do a "permanent" hack via the USB port instead of doing it via the network port?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mwilson on December 15, 2013, 01:57:05 am
So is it better to try and do a "permanent" hack via the USB port instead of doing it via the network port?

The end result is the same, so it doesn't really matter. The USB method we just discussed is executing the same commands you'd execute from the telnet session.

If you have the LAN module, I'd probably recommend the telnet approach because then you can actually see if the commands worked and adapt as necessary... but really, if you just put the right commands in the cmd file it'll work so it's probably a wash.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on December 15, 2013, 03:09:08 am
But as far as risk goes, you could potentially brick your scope using either method if it were going to happen correct?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mwilson on December 15, 2013, 03:21:04 am
But as far as risk goes, you could potentially brick your scope using either method if it were going to happen correct?

Yes, but to abyrvalg's point, as long as you have a bootable USB stick, anything you can do through telnet/commands you'd be able to undo. If you don't know what you broke, I'm guessing you can boot from your USB stick and just install the original firmware the normal way and it will restore the internal storage.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tsmith35 on December 15, 2013, 05:18:22 am
mwilson, can you please try this:
edit USB .lnk to
Code: [Select]
33#\windows\cmd.exe \usb\autorun.cmdat USB root create autorun.cmd with
Should that be "34#\windows\cmd.exe \usb\autorun.cmd"?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on December 15, 2013, 07:27:48 am
mwilson, can you please try this:
edit USB .lnk to
Code: [Select]
33#\windows\cmd.exe \usb\autorun.cmdat USB root create autorun.cmd with
Should that be "34#\windows\cmd.exe \usb\autorun.cmd"?

No, if you use the cmd exe and not directly call the cmd/bat file, the scope will restart.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on December 15, 2013, 12:30:28 pm
Code: [Select]
16#\usb\autorun.cmd
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tsmith35 on December 16, 2013, 01:38:55 am
mwilson, can you please try this:
edit USB .lnk to
Code: [Select]
33#\windows\cmd.exe \usb\autorun.cmdat USB root create autorun.cmd with
Should that be "34#\windows\cmd.exe \usb\autorun.cmd"?
Replying to my own post... ::) I didn't notice the space between the "exe" and the "\usb". Do spaces count for the command line length?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mwilson on December 16, 2013, 05:10:06 am
mwilson, can you please try this:
edit USB .lnk to
Code: [Select]
33#\windows\cmd.exe \usb\autorun.cmdat USB root create autorun.cmd with
Should that be "34#\windows\cmd.exe \usb\autorun.cmd"?
Replying to my own post... ::) I didn't notice the space between the "exe" and the "\usb". Do spaces count for the command line length?

The space does count. The # doesn't count, though; it's the delimiter between the character count and the command. So 33 is correct in the above example. Although I'm not convinced the system actually uses the number, but I haven't played around with it much to know for sure.

WinCE shortcut file definition is here: http://msdn.microsoft.com/en-us/library/ms861519.aspx (http://msdn.microsoft.com/en-us/library/ms861519.aspx)

(But note that as previously discussed the WinCE cmd.exe doesn't take a file argument like this, so the question of whether the number is correct for this particular example is rather academic...)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: baljemmett on December 16, 2013, 04:34:34 pm
(But note that as previously discussed the WinCE cmd.exe doesn't take a file argument like this, so the question of whether the number is correct for this particular example is rather academic...)

Does adding a /C switch help?  "CMD /C <command>" is the usual way (since DOS days, with COMMAND.COM) to get the command processor to accept a command as a parameter, and the CE docs suggest it's supported...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tsmith35 on December 16, 2013, 10:24:56 pm
(But note that as previously discussed the WinCE cmd.exe doesn't take a file argument like this, so the question of whether the number is correct for this particular example is rather academic...)

Does adding a /C switch help?  "CMD /C <command>" is the usual way (since DOS days, with COMMAND.COM) to get the command processor to accept a command as a parameter, and the CE docs suggest it's supported...

http://msdn.microsoft.com/en-us/library/aa453925.aspx (http://msdn.microsoft.com/en-us/library/aa453925.aspx)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on December 20, 2013, 10:39:00 pm
All structure is created automatically by CAB Manager ( just press right mouse button on files and select Extract).
The structure which is in extracted folder subfolder Secure needs to be copied to USB flash.
Attribused does not matter.
LAN module is not necessary, but can be useful if you are gong to investigate further options.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: heynow on December 23, 2013, 05:59:46 pm
A few previous posts said you need a fast usb stick to get this hack to work.  I found the same issue and booting off slow sticks ends in a black screen and hang.  During the boot and right before the hang I saw there were several infiniivisionLauncher.exe processes running.  I only see one during a normal boot.
I came up with this way.  The changes in the other posts are still needed.  On the usb drive, in Startup\infiniivision.lnk:
Code: [Select]
17#\usb\autorun.cmdIn \usb\autorun.cmd:
Code: [Select]
dir /s \
\windows\processMgr.exe kill infiniivisionLauncher.exe
dir /s \
\windows\processMgr.exe kill infiniivisionLauncher.exe
dir /s \
\windows\processMgr.exe kill infiniivisionLauncher.exe
dir /s \
\windows\processMgr.exe kill infiniivisionLauncher.exe
dir /s \
\windows\processMgr.exe kill infiniivisionLauncher.exe
dir /s \
\windows\processMgr.exe kill infiniivisionLauncher.exe
dir /s \
\usb\infiniiVision\infiniiVisionLauncher.exe -l DIS -l SGMC -l CABLE
The "kills" get rid of any other infiniivisionLauncher.exe that may have started up.  It could be the booting is taking too long and the scope decided to start the built in infiniivisionLauncher.exe as a back up.  But I don't really know.
The "dir /s \" slow things down.  I can't find a sleep or delay command, but then again I know absolutely nothing about windows.  A delay is needed.
Other "-l" options can be used if you want.
The worst possible slowest 64MB USB stick I could find now works.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: taemun on January 06, 2014, 02:47:29 pm
Any news/comments about the 2.36 FW shipping on newer scopes (as per https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg340097/#msg340097 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg340097/#msg340097))?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on January 06, 2014, 03:04:40 pm
Any news/comments about the 2.36 FW shipping on newer scopes (as per https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg340097/#msg340097 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg340097/#msg340097))?

No, but the user who reported this firmware has only three post and seems to be no longer online. He did not tried the downgrade to 2.35.
According to number it is minor change.
Scope itself is quite robust if you are going to downgrade FW version, e.g you can downgrade from 2.35 only to the 2.30 and not to previous versions.
This firmware is not available on Agilent website which is weird.
Is there anyone else with firmware 2.36 or scope manufactured in Q3/2013 and later? Does not matter if 2000 or 3000 series.
Title: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: plesa on January 08, 2014, 09:27:00 pm
There were several request for hack DSOX2k and MSOX2k. The hack of this scope is also possible, the description of hack is same which were published for DSO3k and MSOX3k.
Whole hack is tested with firmware 2.35 and is fully working.
The whole hack is on USB drive and there is no modification of fles inside scope, so there is no risk of bricking the scope.
When the USB flash is removed the scope use the purchased licenses and not the hacked firmware from USB flash.
After hacked files loading there is message informn about firmware issue. Ths does not affect the performance, only prevent some jerks to sell hacked scope as a fully licensed one.
In forum reported firmware 2.36 by one user has been not tested due to the poor availability of scope with this FW verson.

For hack we higly reccomends to use really fast USB flah drive.
There is also way how to pernamently load hacked firmware into the scope (batch file on USB drive will rewrite the files in internal scope flash with the hacked one)




Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georgd on January 08, 2014, 09:49:08 pm
The warning message about firmware issue remains on screen all the time, or only seen after boot?

Georg

P.S. I waiting for my DSOX3032.
Title: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: plesa on January 08, 2014, 09:53:16 pm
The warning message about firmware issue remains on screen all the time, or only seen after boot?

Georg

P.S. I waiting for my DSOX3032.

Only after boot up, you need to press button to accept it. And the self test did not passed. But we did not encountered any issue with hacked software.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: troth on January 08, 2014, 10:45:12 pm
Any news/comments about the 2.36 FW shipping on newer scopes (as per https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg340097/#msg340097 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg340097/#msg340097))?

No, but the user who reported this firmware has only three post and seems to be no longer online. He did not tried the downgrade to 2.35.


I'm still following this thread, but haven't had anything to contribute to the discussion, so have been lurking.

I'm reluctant to downgrade the FW without a path back to the factory FW or a newer FW. I've been watching the agilent website for newer firmware (since 2.35 was released in june, I was hoping there'd be some update soon-ish).

A few weeks ago I wrote a python script that takes the 2.35 cab and explodes it and explodes the cab file within then uses the setup.xml file to populate the Secure directory with the right names and structure. Then the script modifies and creates all the files needed for the hack. Would not be hard to extend it to automate the population of a USB flash drive.

The script is currently in a private git repo on bitbucket.org. I haven't made it public since I have no way of verifying it's correctness and thus didn't want to inflict it on anyone. I can easily make it public if anyone is interested. It currently only works on Linux, put I don't think it would be difficult to port to Windows. I wrote it to avoid having to use the non-free cab program on windows since I'm much more of a Linux geek.
Title: Re: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: GregerG on January 09, 2014, 01:59:58 am
Only after boot up, you need to press button to accept it. And the self test did not passed. But we did not encountered any issue with hacked software.


It should pass all self tests and calibrations... at least they do pass fine for me...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: travisc on January 09, 2014, 02:00:43 am
My new DSO-X-3034A arrived today.  It had firmware 2.35 installed.  It's now 500MHz and fully optioned up thanks to this thread.

Thank you everyone that worked on this!!!

A few notes that might be helpful to others...

I had to add BW50 to the startup shortcut to upgrade from 350MHz to 500MHz.  I thought the -l All would cover that but apparently not.  So my infiniivision.lnk file is now ...
Code: [Select]
62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS -l BW50
The file structure of my startup drive is slightly different than a post I was comparing to in this thread.  It was missing a few indents which threw me for a bit.  The correct structure is ...

Code: [Select]
\
+-infiniiVision
  +-fpga
  +-upgrade
  +-web
     +-css
     +-help
     +-image
     +-include
     +-web-socket-js
     +-lib
     +-Lxi
        +-Identification
     +-navbar
+-Startup
infiniivisionStartupOverride.txt

I had to use a 4GB flash drive, an 8GB I tried at first didn't work.

When using WinCE CAB Manager I also had to turn on "Simulate Folder Names" when extracting the files to get the correct structure.

Thanks again!


Title: Re: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: plesa on January 09, 2014, 02:19:50 am
This .lnk remove the * symbol in the about screen. There is more options but some of them are not working.
255#\usb\infiniiVision\infiniivisionLauncher.exe -l MSO -l MEMUP -l memMAX -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l EDK -l WAVEGEN -l AERO -l VID -l ADVMATH -l DVM -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: taemun on January 09, 2014, 02:20:51 am
I'm still following this thread, but haven't had anything to contribute to the discussion, so have been lurking.

I'm reluctant to downgrade the FW without a path back to the factory FW or a newer FW. I've been watching the agilent website for newer firmware (since 2.35 was released in june, I was hoping there'd be some update soon-ish).

Do you have the Ethernet option? Can you poke around in Telnet?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: troth on January 10, 2014, 01:20:30 pm
Do you have the Ethernet option? Can you poke around in Telnet?

Unfortunately, I do not have the Ethernet module and it's not in the budget to buy any upgrades until later in the year.
Title: Re: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: RF-Engineer on January 10, 2014, 03:37:35 pm
This .lnk remove the * symbol in the about screen. There is more options but some of them are not working.
255#\usb\infiniiVision\infiniivisionLauncher.exe -l MSO -l MEMUP -l memMAX -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l EDK -l WAVEGEN -l AERO -l VID -l ADVMATH -l DVM -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC

I've seen references to 255#, 256#, 62#.  What do these prefix numbers mean?
Title: Re: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: RF-Engineer on January 10, 2014, 03:48:51 pm
Only after boot up, you need to press button to accept it. And the self test did not passed. But we did not encountered any issue with hacked software.


It should pass all self tests and calibrations... at least they do pass fine for me...

Interesting.  After boot-up, you don't see a red-colored firmware error message?  How did you do that?
Title: Re: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: plesa on January 10, 2014, 05:38:23 pm
Do you have the Ethernet option? Can you poke around in Telnet?

Unfortunately, I do not have the Ethernet module and it's not in the budget to buy any upgrades until later in the year.

Please do not use hacked scope for business, it is for home/ non commercial use only!!
Title: Re: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: plesa on January 10, 2014, 05:41:22 pm
This .lnk remove the * symbol in the about screen. There is more options but some of them are not working.
255#\usb\infiniiVision\infiniivisionLauncher.exe -l MSO -l MEMUP -l memMAX -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l EDK -l WAVEGEN -l AERO -l VID -l ADVMATH -l DVM -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC

I've seen references to 255#, 256#, 62#.  What do these prefix numbers mean?

Read the whole thread. Briefly it is ammount of characters in link.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ZeroAviation on January 10, 2014, 05:47:40 pm
Hi guys,

So I have read the whole thread. I want to make sure I understand something correctly though.

You can use the shortcut's without modifying the dll? Is that correct?

Thanks all for your work on this.

-Matt
Title: Re: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: plesa on January 10, 2014, 05:51:14 pm
Hi guys,

So I have read the whole thread. I want to make sure I understand something correctly though.

You can use the shortcut's without modifying the dll? Is that correct?

Thanks all for your work on this.

-Matt

No, you need to modify InfiniivisionCore.dll, this will unlok the options which needs to be selected in the link file.
Title: Re: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: RF-Engineer on January 10, 2014, 06:37:54 pm
This .lnk remove the * symbol in the about screen. There is more options but some of them are not working.
255#\usb\infiniiVision\infiniivisionLauncher.exe -l MSO -l MEMUP -l memMAX -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l EDK -l WAVEGEN -l AERO -l VID -l ADVMATH -l DVM -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC

I've seen references to 255#, 256#, 62#.  What do these prefix numbers mean?

Read the whole thread. Briefly it is ammount of characters in link.

I see that now in your message #282.  However "wersi" used #62 with many switches after, totalling much more than 62 characters.  I've been making changes without changing that parameters and the functions still seem to work.  Perhaps the firmware error message goes away with the correct character count?

To deal with the firmware error message, I used the hex editor that now shows "all options intialized and enabled..."  Same when the scope finishes booting.  This sure does look like a factory issue that way!



 
Title: Re: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: plesa on January 11, 2014, 09:43:28 am
There were several request for the digital probe schematic.The original probe cannot be dissassembled without damage.
So I just found schematic in the Agilent documents
http://cp.literature.agilent.com/litweb/pdf/5968-4632E.pdf (http://cp.literature.agilent.com/litweb/pdf/5968-4632E.pdf)
I saw lot of the probes on ebay and grabbers as well, pretty cheap.
The type is N6459 (8 channels) and N6450 (16 channels)
Title: Re: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: RF-Engineer on January 11, 2014, 01:12:04 pm
There were several request for the digital probe schematic.The original probe cannot be dissassembled without damage.
So I just found schematic in the Agilent documents
http://cp.literature.agilent.com/litweb/pdf/5968-4632E.pdf (http://cp.literature.agilent.com/litweb/pdf/5968-4632E.pdf)
I saw lot of the probes on ebay and grabbers as well, pretty cheap.
The type is N6459 (8 channels) and N6450 (16 channels)

I see many used Agilent "E" series logic probes available.  Anyone know if these are pin-for-pin compatible with the Agilent "N" series for the DSOX/MSOX?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: nowlan on January 11, 2014, 01:24:02 pm
Did anyone look inside the lan/vga adapter?
Not just simple resistors?
Title: Re: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: RF-Engineer on January 11, 2014, 01:36:37 pm
This .lnk remove the * symbol in the about screen. There is more options but some of them are not working.
255#\usb\infiniiVision\infiniivisionLauncher.exe -l MSO -l MEMUP -l memMAX -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l EDK -l WAVEGEN -l AERO -l VID -l ADVMATH -l DVM -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC

I noticed that when the three relevant files are uploaded direct to the DSOX from the USB stick, the "*" in front of each option in in "About Oscilloscope" is removed as well when using prior characters strings as described in earlier posts.     

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sbampato12 on January 11, 2014, 01:39:41 pm
I've dissembled a logic probe, but I didn't take a good camera yet.
ASAP, I will put the photos from it.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on January 11, 2014, 02:01:11 pm
I also found this documentation some times ago.

the Probes with grabbers are not so expensive on ebay.
In the company where i work we have an old E9340A with that 16 channel probes and i mean that i have measured something between the grabbers and the input pins for the flat cable.
But this was some month ago and i can't remember me for the exact value, i think i have measured round about 90kohms.

But now something other:
while i was analysing the dll for the DSOX4000 series i found a different word CAKE in the source.
Is there someone with a DSOX4000 that can try this word in the Screensaver Usertext?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Isamun on January 11, 2014, 02:37:47 pm
Did anyone look inside the lan/vga adapter?
Not just simple resistors?

Dave did a teardown:
EEVblog #145 - Agilent LAN/VGA Module Teardown (https://www.youtube.com/watch?v=hy1TYKetIpM#ws)

LAN goes straight to a MagJack. The VGA part has a bit more to it (screen buffer, driver and fpga for timing)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: RF-Engineer on January 11, 2014, 08:25:15 pm
Until a few days ago, Newark showed the N6450-60001 16 ch. logic cable assembly for around ~ USD $600.  I no longer see the cable assembly anywhere on-line without purchasing the full DSOX3MSO upgrade kit.  Impeccable timing, isn't it?   Can anyone else spot its availability?   
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: grego on January 12, 2014, 05:12:10 pm
I've been trying to get this to work for a while now - I've tried 3 different USB sticks (1G, 2G and 32G), I've got everything extracted:

infiniiVision/
Startup/
infiniivisionStartupOverride.txt

At the root of my stick.  The Override.txt file just contains "True" on a single line.  The .dll has been modified.  The .lnk file has been altered per instructions.

With the stick in I can see it being accessed when the scope is starting up, after a second or two from reading from it though it moves immediately into it's normal boot cycle and then comes up clean on the internally installed firmware.  Any suggestions?

I'm messing with this just to see how it all works - I actually have licenses installed for the things I really use but this is more intellectual curiousity now and it's frustrating when things don't work. ;-)

Thanks.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: taemun on January 12, 2014, 05:34:00 pm
With the stick in I can see it being accessed when the scope is starting up, after a second or two from reading from it though it moves immediately into it's normal boot cycle and then comes up clean on the internally installed firmware.  Any suggestions?

Which FW are you on?
Title: Re: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: plesa on January 12, 2014, 06:19:45 pm
In attachment is the USB folder structure including the .lnk files for fully enabled licenses and also for automatic copy to flash. Which will not require the presence of USB flash plugged.
You just need to unpack the InfiniiVisionSetup.CAB with the WinCE CAB MAnager ( just press right mouse button on files and select Extract and choose Simulate Folder Names)
Copy the files intoprepared folder structure inside Infiniivision folder.
And choose and rename if necessary the file in the Startup folder ( by default is set the full licence set for 3k series).
The scope should contains firmware 2.35.
Turn scope with this USB flash on.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: grego on January 12, 2014, 06:20:56 pm
With the stick in I can see it being accessed when the scope is starting up, after a second or two from reading from it though it moves immediately into it's normal boot cycle and then comes up clean on the internally installed firmware.  Any suggestions?

Which FW are you on?

2.35.2013061800
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Carrington on January 12, 2014, 08:05:41 pm
Hi

I know that the DSOX200*A can be upgrade to DSOX201*A [DSOX2BW1*], and the DSOX201*A can be upgrade to DSOX202*A [DSOX2BW2*].
Now, I know that a DSOX2002A with the hack can become in a DSOX2022A, but its real BW is only 160MHz (-3dB).
Is this also the real BW for a DSOX202*A? The datasheet says 200MHz (-3dB warranted).
Please, can someone with a DSOX201*A or a DSOX202*A measure its bandwidth (without probe, straight to BNC, using a 50 Ohm Feed Through)?

Thanks.

Note: Also, I remember read in the forum that all have the same input stage.
         The input stage is based on the LMH6518?
Title: Re: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: travisc on January 12, 2014, 09:51:08 pm
Until a few days ago, Newark showed the N6450-60001 16 ch. logic cable assembly for around ~ USD $600.  I no longer see the cable assembly anywhere on-line without purchasing the full DSOX3MSO upgrade kit.  Impeccable timing, isn't it?   Can anyone else spot its availability?   

I was looking for the logic cable assembly as well.  I ended up buying the one below off ebay the other day for my DSOX3k.  It shipped within 12 hours.  I'll have it in my hands tomorrow and can report back.

http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160 (http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: taemun on January 13, 2014, 01:43:38 am
Now, I know that a DSOX2002A with the hack can become in a DSOX2022A, but its real BW is only 160MHz (-3dB).

How did you test this? As Agilent are willing to sell a software license key to make a DSOX2002A into a DSOX2022A, I would presume that all of them are capable of the full warranted BW (200MHz -3dB point). It isn't like they are binning the front-end and putting the slow ones in the DSOX2002A models.
Title: Re: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: plesa on January 13, 2014, 07:40:12 am
Until a few days ago, Newark showed the N6450-60001 16 ch. logic cable assembly for around ~ USD $600.  I no longer see the cable assembly anywhere on-line without purchasing the full DSOX3MSO upgrade kit.  Impeccable timing, isn't it?   Can anyone else spot its availability?   

I was looking for the logic cable assembly as well.  I ended up buying the one below off ebay the other day for my DSOX3k.  It shipped within 12 hours.  I'll have it in my hands tomorrow and can report back.

http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160 (http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160)
Thnaks this type seems to have the same pinout and hopefully will be compatible.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on January 13, 2014, 07:44:21 am
Hi

I know that the DSOX200*A can be upgrade to DSOX201*A [DSOX2BW1*], and the DSOX201*A can be upgrade to DSOX202*A [DSOX2BW2*].
Now, I know that a DSOX2002A with the hack can become in a DSOX2022A, but its real BW is only 160MHz (-3dB).
Is this also the real BW for a DSOX202*A? The datasheet says 200MHz (-3dB warranted).
Please, can someone with a DSOX201*A or a DSOX202*A measure its bandwidth (without probe, straight to BNC, using a 50 Ohm Feed Through)?

Thanks.

Note: Also, I remember read in the forum that all have the same input stage.
         The input stage is based on the LMH6518?

I tested the badwidth and upgrade on 3k series and it was accordng to spec. I used the "FreeElectron" Jim Williams pulse generator. See one of my post in this thread.
How did you measure and calculate BW?
Did you use the Agilent offer for free bandwith upgrade?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: GregerG on January 13, 2014, 12:16:48 pm
Just a quick check with a sweepgenerator my 2012A with BW20 drops off at  ~250MHz.
Make sure you're using good probes if you're not using straight coax, the supplied ones for me was only 150MHz...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Carrington on January 13, 2014, 02:19:36 pm
I tested the badwidth and upgrade on 3k series and it was accordng to spec. I used the "FreeElectron" Jim Williams pulse generator. See one of my post in this thread.
How did you measure and calculate BW?
Did you use the Agilent offer for free bandwith upgrade?

Since Agilent specifies that DSOX2000A response is Gaussian (0.35), yes the "FreeElectron" Jim Williams pulse generator is OK.

But I prefer the traditional method (sweep up to -3dB), because from what I've learned, the set can be a combination between flat and/or Gaussian.

Yes, I know that offer, farnell and rs-online, apply it directly.

Thanks.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Carrington on January 13, 2014, 02:20:54 pm
Just a quick check with a sweepgenerator my 2012A with BW20 drops off at  ~250MHz.
Make sure you're using good probes if you're not using straight coax, the supplied ones for me was only 150MHz...
Exactly, that's what I wanted to know.
Thanks.  ;)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Carrington on January 13, 2014, 02:32:36 pm
By the way, after ~4 days, Agilent continues without giving me an answer.
Anyone know if the trigger is digital for the 2000X series?

Thanks.
Title: Re: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: RF-Engineer on January 13, 2014, 06:51:40 pm
Until a few days ago, Newark showed the N6450-60001 16 ch. logic cable assembly for around ~ USD $600.  I no longer see the cable assembly anywhere on-line without purchasing the full DSOX3MSO upgrade kit.  Impeccable timing, isn't it?   Can anyone else spot its availability?   

I was looking for the logic cable assembly as well.  I ended up buying the one below off ebay the other day for my DSOX3k.  It shipped within 12 hours.  I'll have it in my hands tomorrow and can report back.

http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160 (http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160)

Travisc, please provide us with an update as to whether or not your logic cable is working.  Thank you!
Title: Re: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: Someone on January 13, 2014, 09:34:04 pm
Until a few days ago, Newark showed the N6450-60001 16 ch. logic cable assembly for around ~ USD $600.  I no longer see the cable assembly anywhere on-line without purchasing the full DSOX3MSO upgrade kit.  Impeccable timing, isn't it?   Can anyone else spot its availability?   

I was looking for the logic cable assembly as well.  I ended up buying the one below off ebay the other day for my DSOX3k.  It shipped within 12 hours.  I'll have it in my hands tomorrow and can report back.

http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160 (http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160)
Or catch them through the forum at a good discount: https://www.eevblog.com/forum/buysellwanted/fs-hpagilent-logic-pods/msg189290/#msg189290 (https://www.eevblog.com/forum/buysellwanted/fs-hpagilent-logic-pods/msg189290/#msg189290)

Tested on a MSOX and work perfectly.
Title: Re: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: plesa on January 13, 2014, 09:59:50 pm
Until a few days ago, Newark showed the N6450-60001 16 ch. logic cable assembly for around ~ USD $600.  I no longer see the cable assembly anywhere on-line without purchasing the full DSOX3MSO upgrade kit.  Impeccable timing, isn't it?   Can anyone else spot its availability?   

I was looking for the logic cable assembly as well.  I ended up buying the one below off ebay the other day for my DSOX3k.  It shipped within 12 hours.  I'll have it in my hands tomorrow and can report back.

http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160 (http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160)
Or catch them through the forum at a good discount: https://www.eevblog.com/forum/buysellwanted/fs-hpagilent-logic-pods/msg189290/#msg189290 (https://www.eevblog.com/forum/buysellwanted/fs-hpagilent-logic-pods/msg189290/#msg189290)

Tested on a MSOX and work perfectly.
Is it includng grabbers and the grounding extension?
Title: Re: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: travisc on January 13, 2014, 10:15:46 pm
Until a few days ago, Newark showed the N6450-60001 16 ch. logic cable assembly for around ~ USD $600.  I no longer see the cable assembly anywhere on-line without purchasing the full DSOX3MSO upgrade kit.  Impeccable timing, isn't it?   Can anyone else spot its availability?   

I was looking for the logic cable assembly as well.  I ended up buying the one below off ebay the other day for my DSOX3k.  It shipped within 12 hours.  I'll have it in my hands tomorrow and can report back.

http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160 (http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160)

Travisc, please provide us with an update as to whether or not your logic cable is working.  Thank you!

Just an update to the logic cable assembly I purchased off eBay.  I received it today.  I tested all 16 lines with my DSOX3 series scope and they worked fine.  The quality of the cables, wires, and probes are excellent.  The probes and connectors all have little Agilent logos on them.  The parts were well packed, and the bags they came in had Agilent part and lot numbers on them.  It's the real deal.  I'm very happy with them.
Title: Re: Agilent DSOX2k, MSOX2k. DSOX3k, MSOX3k hack
Post by: RF-Engineer on January 13, 2014, 10:58:13 pm
Until a few days ago, Newark showed the N6450-60001 16 ch. logic cable assembly for around ~ USD $600.  I no longer see the cable assembly anywhere on-line without purchasing the full DSOX3MSO upgrade kit.  Impeccable timing, isn't it?   Can anyone else spot its availability?   

I was looking for the logic cable assembly as well.  I ended up buying the one below off ebay the other day for my DSOX3k.  It shipped within 12 hours.  I'll have it in my hands tomorrow and can report back.

http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160 (http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160)

Travisc, please provide us with an update as to whether or not your logic cable is working.  Thank you!

Just an update to the logic cable assembly I purchased off eBay.  I received it today.  I tested all 16 lines with my DSOX3 series scope and they worked fine.  The quality of the cables, wires, and probes are excellent.  The probes and connectors all have little Agilent logos on them.  The parts were well packed, and the bags they came in had Agilent part and lot numbers on them.  It's the real deal.  I'm very happy with them.

Great.  I just ordered the same set.  Thanks for getting back to us!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on January 13, 2014, 11:31:12 pm
So i ordered now the second last one.
The Original part costs around 900Euros.
http://www.home.agilent.com/myagilent/faces/partDetail.jspx?partNumber=N6450-60001 (http://www.home.agilent.com/myagilent/faces/partDetail.jspx?partNumber=N6450-60001)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on January 14, 2014, 04:49:47 am
There isnt by chance any way to enable 16 digital lines for the X-2000 series instead of the 8 is there?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: taemun on January 14, 2014, 04:57:55 am
There isnt by chance any way to enable 16 digital lines for the X-2000 series instead of the 8 is there?

From Dave's teardown, no. The buffer chips etc aren't loaded.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Jurkin on January 14, 2014, 12:08:50 pm
Inside  N6459-61601 (logic analyzer probe cable)

(http://www.imageup.ru/img70/1625605/n6459_1.jpg)
(http://www.imageup.ru/img70/1625606/n6459_2.jpg)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on January 14, 2014, 07:06:46 pm
Thank you for this photo.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on January 15, 2014, 08:14:18 am
Has anyone ordered a new DSOX-3034A from Newark or TEquipment.net in the US?  I wonder if it is likely to have firmware 2.35 or 2.36 on it....

@travisc: you got your DSOX-3034A just last week; was that from a US distributor?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: travisc on January 15, 2014, 12:59:43 pm
Has anyone ordered a new DSOX-3034A from Newark or TEquipment.net in the US?  I wonder if it is likely to have firmware 2.35 or 2.36 on it....

@travisc: you got your DSOX-3034A just last week; was that from a US distributor?

I bought mine at Newark in the US.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bazillus on January 17, 2014, 05:12:49 pm
I just tested, original Firmware 2.36 did not work for USB boot, just resulted in cyclic blinking of the buttons with no software being started.

Then, I "updated" to the latest firmware available from the Agilent homepage (2.35) - as suggested by the scope itself.

Now, USB boot works perfectly fine.

Stick is a SanDisk Extreme USB 3.0 16GB.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on January 24, 2014, 09:39:34 pm
Yay!!!

Just got a customer return DSO-X3000 returned back from Agilent calibration date 2 Jan 2014, they upgraded it to firmware 2.36.

Downgraded to 2.35 from the Agilent website, edited the DLL and created a USB drive and now it's all options enabled!!

Got the 'WARNING: Unfinalised software' message but otherwise perfect!!

Very happy bunny indeed  :)

Anybody now want a Rigol 2072 all options enabled brand new in box never used??!!

Helpful link...
https://dl.dropboxusercontent.com/u/2063383/DSOX3000%20hack.zip
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on January 25, 2014, 12:37:15 am
I had to try about a dozen USB sticks till I finally got one that worked reliably.

Didn't work:
Kingmax 32GB USB3 (50% of the time it was ok)
SanDisk Cruser Edge 8GB
SanDisk Cruser Edge 16GB
pqi 16GB USB3
Verbatim 16GB
PNY 8GB

Worked:
Kingston 4GB microSD with adaptor
DaneElec 2GB SD with cheapo USB card reader
Integral 8GB (Argos £7 cheapest they sold) http://www.argos.co.uk/static/Product/partNumber/9093410.htm (http://www.argos.co.uk/static/Product/partNumber/9093410.htm)

In my experience cheaper slower smaller is better...?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Carrington on January 25, 2014, 02:36:39 pm
Why the trigger jitter is not specified in the datasheet for the DSO-X series?
I can't find its value.  :-//
Thanks.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on January 25, 2014, 03:22:40 pm
I just tested, original Firmware 2.36 did not work for USB boot, just resulted in cyclic blinking of the buttons with no software being started.

Then, I "updated" to the latest firmware available from the Agilent homepage (2.35) - as suggested by the scope itself.

Now, USB boot works perfectly fine.

Stick is a SanDisk Extreme USB 3.0 16GB.

Thanks for testing!! There were several user who affraid to downgrade scope to 2.35. Was there any warnining message?
Prior downgrade I reccomneds to reset scope to factory default, this help during my downgrading experiment with firmwares prior 2.35.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on January 25, 2014, 03:51:43 pm
USB boot loops on 2.36 because of file versions mix I guess. It's no a true boot actually, the OS (and all files in OS directories) from internal flash is used, just the scope app is started from USB, so a mix of 2.36 internal and 2.35 external files occurs.

Somebody with that dreaded 2.36 should pull it out via telnet or USB stick batch copy script for study.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bazillus on January 25, 2014, 08:05:28 pm
Thanks for testing!! There were several user who affraid to downgrade scope to 2.35. Was there any warnining message?
Prior downgrade I reccomneds to reset scope to factory default, this help during my downgrading experiment with firmwares prior 2.35.

Neither problems nor warning messages at all. I expected a message like "you try to downgrade your scope" or "the latest firmware is already installed on your scope" but none of them appeared. I copied the cab file onto a USB stick, followed the original software "upgrade" procedure on the scope, then it copied files for 2-3 minutes, rebooted and the 2.35 version OS started without any hazzle. Also calibration is still fine. I think, it resets to factory default during the "upgrade" process, but I can't confirm.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on January 25, 2014, 10:13:17 pm
Digging around in the software I found an interesting thing...

Dealer ex-demo scopes with all options enabled have a time limit of 9 months on those options.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on January 25, 2014, 10:17:13 pm
The expiration date is built in the key, it is not related to the comandline parameter
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on January 27, 2014, 11:05:16 pm
It should be LAN module for 181 USD
http://www.home.agilent.com/myagilent/faces/partDetail.jspx?partNumber=75019-68705&imageStatus=NO&_afrLoop=1455775011571000&_afrWindowMode=0&_afrWindowId=null#%40%3F_afrWindowId%3Dnull%26_afrLoop%3D1455775011571000%26imageStatus%3DNO%26partNumber%3D75019-68705%26_afrWindowMode%3D0%26_adf.ctrl-state%3D39lnsndix_58 (http://www.home.agilent.com/myagilent/faces/partDetail.jspx?partNumber=75019-68705&imageStatus=NO&_afrLoop=1455775011571000&_afrWindowMode=0&_afrWindowId=null#%40%3F_afrWindowId%3Dnull%26_afrLoop%3D1455775011571000%26imageStatus%3DNO%26partNumber%3D75019-68705%26_afrWindowMode%3D0%26_adf.ctrl-state%3D39lnsndix_58)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on January 28, 2014, 05:21:29 am
It should be LAN module for 181 USD
http://www.home.agilent.com/myagilent/faces/partDetail.jspx?partNumber=75019-68705&imageStatus=NO&_afrLoop=1455775011571000&_afrWindowMode=0&_afrWindowId=null#%40%3F_afrWindowId%3Dnull%26_afrLoop%3D1455775011571000%26imageStatus%3DNO%26partNumber%3D75019-68705%26_afrWindowMode%3D0%26_adf.ctrl-state%3D39lnsndix_58 (http://www.home.agilent.com/myagilent/faces/partDetail.jspx?partNumber=75019-68705&imageStatus=NO&_afrLoop=1455775011571000&_afrWindowMode=0&_afrWindowId=null#%40%3F_afrWindowId%3Dnull%26_afrLoop%3D1455775011571000%26imageStatus%3DNO%26partNumber%3D75019-68705%26_afrWindowMode%3D0%26_adf.ctrl-state%3D39lnsndix_58)
Wait, so Im confused. That LAN module you linked to says that it was replaced by the DSOXLAN-FG, if I already have the DSOXLAN module in my MSOX2024A does that mean that there is a new/updated LAN/VGA module. The link for the DSOXLAN-FG module says: "This part is not available for direct sale but an instrument repair is orderable through our service center. Please contact Agilent to inquire about returning your instrument for repair."
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hypernova on January 28, 2014, 11:33:22 am
I wonder what's changed, FG can't stand for Function Gen so what could it be?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on January 28, 2014, 08:01:51 pm
I just contacted Agilent on the DSOXLAN-FG module and apparently those links that were posted were not supposed to be exposed to the general public. He explained that the DSOXLAN-FG is a part reference for the entire assembly that is sold to us as the DSOXLAN. He said there is nothing different about its merely an internal part number.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on January 28, 2014, 10:26:12 pm
I just contacted Agilent on the DSOXLAN-FG module and apparently those links that were posted were not supposed to be exposed to the general public. He explained that the DSOXLAN-FG is a part reference for the entire assembly that is sold to us as the DSOXLAN. He said there is nothing different about its merely an internal part number.

Thanks for check, I just post it when I found it on website.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on January 30, 2014, 10:08:05 pm
My DSOXLAN modul that I have ordered from Datatec a couple of weeks ago was marked with DSOXLAN FG.
 
@abyrvalg
Yes I'm also interested for a 2.36 Firmware packet to look inside the core dll

Also i have prepared a raw image with the Keysight Logo to replace the megazoom screensaver logo but until now i didn't had the time to change the data in the dll :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Matrixx on February 01, 2014, 12:20:43 am
Had version 2.36.
downgraded to 2.35 and now it works :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on February 01, 2014, 07:20:20 am
Hi folks, I'm going to take advantage of the Agilent promo --- I have ordered a DSOX3k + LAN module.  The items are back-ordered 4 wks, so it'll be a bit of a wait...but I expect it to be loaded with v2.36 firmware.  Following what I've read here, I will telnet in, copy the files to a local USB, and share them here.  Hopefully we find a way to make v2.36 work from USB boot with configured options! Thanks people for all the ideas shared so far!  :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on February 03, 2014, 05:36:21 pm
Hi folks, I'm going to take advantage of the Agilent promo --- I have ordered a DSOX3k + LAN module.  The items are back-ordered 4 wks, so it'll be a bit of a wait...but I expect it to be loaded with v2.36 firmware.  Following what I've read here, I will telnet in, copy the files to a local USB, and share them here.  Hopefully we find a way to make v2.36 work from USB boot with configured options! Thanks people for all the ideas shared so far!  :)
Why not just downgrade?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on February 03, 2014, 08:06:53 pm
Why not just downgrade?

Well, since we know that works already it is easy last resort.  I think it will be fun to try 2.36; several people are curious to see the core dll, so I can help with that effort.  And, eventually 2.36 might be on Agilents website for download.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: grego on February 03, 2014, 10:26:13 pm
Why not just downgrade?

Well, since we know that works already it is easy last resort.  I think it will be fun to try 2.36; several people are curious to see the core dll, so I can help with that effort.  And, eventually 2.36 might be on Agilents website for download.

I'm still trying to get the modified 2.35 version working on my scope. :(
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: grego on February 12, 2014, 04:04:28 pm
Finally got it to work using a podunk 4G USB stick I got from Digikey for attending some training from ST Micro.  Go figure.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: eurofox on February 12, 2014, 04:13:41 pm
Hi,

I just wonder if I miss something?

Base on the Quote from: plesa on November 03, 2013, 10:24:37 PM

Instead of moving the startup on the USB key just live on the local disk

How to hack the firmware
1. Unpack the firmware *.cab by 7zip
2. Unpack infiniiVisionSetup.cab ( e.g. with WinCE CAB Manager 3.0)
    Find \Secure\infiniiVision\infiniiVisionCore.dll
2a. copy infiniiVisionCore.dll to infiniiVisionCore.old
3. Change at location 0x277e50 in infiniiVisionCore.dll
    byte sequence 04 00 a0 e1 to byte sequence 00 00 a0 e3

To reverse the change infiniiVisionCore.old to infiniiVisionCore.dll
Restart ...

eurofox

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on February 16, 2014, 12:34:59 am
Well only time will tell I suppose. We'll just have to hide and watch what they do.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on February 16, 2014, 08:23:31 pm
Hi,

I just wonder if I miss something?
Base on the Quote from: plesa on November 03, 2013, 10:24:37 PM

Instead of moving the startup on the USB key just live on the local disk
<snip>
To reverse the change infiniiVisionCore.old to infiniiVisionCore.dll
Restart ...

eurofox

I believe that would work, and you could also overwrite the infiniivision.lnk file with the original.  But, I haven't tried any of this yet...still waiting for gear to arrive.

In any case, you would want to make sure you have a failsafe USB boot key in the event something was corrupted on the local disk, and especially if you don't have the LAN module, as you might be unable to boot the scope and/or be "locked out" of it in some way and unable to resolve the problem.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on February 26, 2014, 09:03:05 pm
Muahahaha! :-DD
Agilent DSOX2000/3000 Easteregg Spaceship Screensaver (https://www.youtube.com/watch?v=A4zTj5a7cGU#ws)
Here is it the Enterprise Screensaver.

I did take a look in the dsox4000 dll and there are a lot more debug information and resources.
I opened the 4000 infiniivision with a resource hacker and I was able to extract bitmaps and Winform dialogs.
After disassembling the dll I searched for the text TREK and found the reference to this in a subfunction with other references to ...Screensaver...
So i tried it on my scope and bingo.

Regards
Kai

Today i was at the embedded world fair here in Nürnberg/Germany and i could try the Screensaver Easteregg with the text TREK which will work as seen in my video.
After I started the Preview it will show some credits.

It was a little bit sad that i didn't have a possibility to make a video of this.

It would be nice if someone which have a DSOX4000 available take a video of this easteregg.


 
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on February 27, 2014, 06:58:35 pm
Hi folks, I'm going to take advantage of the Agilent promo --- I have ordered a DSOX3k + LAN module.  The items are back-ordered 4 wks, so it'll be a bit of a wait...but I expect it to be loaded with v2.36 firmware.  Following what I've read here, I will telnet in, copy the files to a local USB, and share them here.  Hopefully we find a way to make v2.36 work from USB boot with configured options! Thanks people for all the ideas shared so far!  :)

It's coming next Wednesday (March 5th)! :)

Edit: It has arrived! Niccceeeee! As expected, it has firmware v2.36 on it.  The DSOXLAN module has shipped separately, so I need to wait few more days...  Will update again when I have everything!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on March 18, 2014, 02:08:43 am
I just contacted Agilent on the DSOXLAN-FG module and apparently those links that were posted were not supposed to be exposed to the general public. He explained that the DSOXLAN-FG is a part reference for the entire assembly that is sold to us as the DSOXLAN. He said there is nothing different about its merely an internal part number.

My DSOXLAN modul that I have ordered from Datatec a couple of weeks ago was marked with DSOXLAN FG.

I can add that the DSOXLAN module that I bought (from ZoroTools) was labeled "DSOXLAN-FG"; it came in a legit Agilent box, sealed and well packaged.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on March 18, 2014, 02:47:35 am
My Agilent DSO-X 3034A arrived earlier in the month and it took until today to get a DSOXLAN module for it.  The scope is running v2.36 firmware as has been the case for recent folks. It's been a pleasure to use so far, and I'm looking forward to unlock a little extra potential.

For the purpose of exploring v2.36, here is some details (for the complete file listing, see attached FileList.txt):

    Directory of \Secure\infiniiVision

01/01/86  12:04a    <DIR>                    web
01/01/86  12:04a    <DIR>                    fpga
10/10/07  06:45p                       46624 System.Drawing.dll
10/10/07  06:45p                      214552 mscorlib.dll
05/05/13  09:21a                       82432 Agilent.Cdf.Api.Licensing.dll
05/05/13  09:21a                      160256 Agilent.Cdf.Api.Lxi.dll
05/05/13  09:21a                       85504 Agilent.Cdf.Api.Security.dll
05/05/13  09:21a                       28160 Agilent.Cdf.Api.SystemManagement.dll
05/05/13  09:21a                      163840 Agilent.Cdf.Api.dll
05/05/13  09:21a                        9216 Agilent.Cdf.Core.Lxi.Web.ComServer.Interop.dll
08/24/12  03:16p                      238080 OpenNETCF.dll
05/16/13  08:43p                       13312 WebPageData.dll
08/24/12  03:16p                      398336 SetupConverter.exe
01/01/86  12:04a                     1152032 splashImage.bin
08/24/12  03:17p                      251392 dnssd_CE.dll
08/24/12  03:17p                      355840 libcups2.dll
08/24/12  03:17p                       83968 libcups2backend.dll
09/13/13  11:10a                      215040 vncServer.exe
08/24/12  03:20p                       21504 websockify.exe
09/13/13  11:17a                    17312416 infiniiVisionCore.dll
09/13/13  11:10a                       12104 infiniiVisionLauncher.exe
09/13/13  11:10a                      180736 infiniiVisionWebCom.dll


The infiniiVisionCore.dll is the same size (in bytes) as the previous v2.35 release, however the two files are different

The bytes previously mentioned to patch at location 0x277e50 are not there.  My best guess (just by comparing, and noting the same sequence of bytes) is that they are now at 0x277e30.

I patched the bytes at 0x277e30, and setup the USB boot key as per the instructions here.  I tried 3 different USB keys: SanDisk Cruzer 2GB, Kingston DataTraveler 4GB, Transcend 32GB.  All were USB 2.0 drives, and formatted FAT32.  None of these drives worked.  During boot, groups of LEDs on front of the scope would flash in sequence and after a short while the scope would restart and try again.  Removing the USB drive, the scope would boot as normal.

I am not sure if I patched the infiniiVisionCore.dll correctly as it is different to v2.35.  I have uploaded the .dll here. (http://wikisend.com/download/130184/infinii236.zip)  I hope a more knowledgeable person could look at it and provide some comments.  If more files are needed, just let me know. @plesa @abyrvalg hoping you guys might be able to take a look.


Reading back through the thread, people have had success with:
"a podunk 4G USB stick I got from Digikey"
SanDisk Extreme USB 3.0 16GB
Kingston 4GB microSD with adaptor
DaneElec 2GB SD with cheapo USB card reader
Integral 8GB

Hoping I will not have to downgrade --- I will keep trying with other USB drives...

Sparky
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on March 18, 2014, 08:08:21 am
Sparky, let's partition the problem a bit: try booting from USB w/o any patches first (original dll, no added params in .lnk) - the scope should start normally (but slower) using files on USB.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on March 18, 2014, 08:31:56 am
My Agilent DSO-X 3034A arrived earlier in the month and it took until today to get a DSOXLAN module for it.  The scope is running v2.36 firmware as has been the case for recent folks. It's been a pleasure to use so far, and I'm looking forward to unlock a little extra potential.

For the purpose of exploring v2.36, here is some details (for the complete file listing, see attached FileList.txt):

    Directory of \Secure\infiniiVision

01/01/86  12:04a    <DIR>                    web
01/01/86  12:04a    <DIR>                    fpga
10/10/07  06:45p                       46624 System.Drawing.dll
10/10/07  06:45p                      214552 mscorlib.dll
05/05/13  09:21a                       82432 Agilent.Cdf.Api.Licensing.dll
05/05/13  09:21a                      160256 Agilent.Cdf.Api.Lxi.dll
05/05/13  09:21a                       85504 Agilent.Cdf.Api.Security.dll
05/05/13  09:21a                       28160 Agilent.Cdf.Api.SystemManagement.dll
05/05/13  09:21a                      163840 Agilent.Cdf.Api.dll
05/05/13  09:21a                        9216 Agilent.Cdf.Core.Lxi.Web.ComServer.Interop.dll
08/24/12  03:16p                      238080 OpenNETCF.dll
05/16/13  08:43p                       13312 WebPageData.dll
08/24/12  03:16p                      398336 SetupConverter.exe
01/01/86  12:04a                     1152032 splashImage.bin
08/24/12  03:17p                      251392 dnssd_CE.dll
08/24/12  03:17p                      355840 libcups2.dll
08/24/12  03:17p                       83968 libcups2backend.dll
09/13/13  11:10a                      215040 vncServer.exe
08/24/12  03:20p                       21504 websockify.exe
09/13/13  11:17a                    17312416 infiniiVisionCore.dll
09/13/13  11:10a                       12104 infiniiVisionLauncher.exe
09/13/13  11:10a                      180736 infiniiVisionWebCom.dll


The infiniiVisionCore.dll is the same size (in bytes) as the previous v2.35 release, however the two files are different

The bytes previously mentioned to patch at location 0x277e50 are not there.  My best guess (just by comparing, and noting the same sequence of bytes) is that they are now at 0x277e30.

I patched the bytes at 0x277e30, and setup the USB boot key as per the instructions here.  I tried 3 different USB keys: SanDisk Cruzer 2GB, Kingston DataTraveler 4GB, Transcend 32GB.  All were USB 2.0 drives, and formatted FAT32.  None of these drives worked.  During boot, groups of LEDs on front of the scope would flash in sequence and after a short while the scope would restart and try again.  Removing the USB drive, the scope would boot as normal.

I am not sure if I patched the infiniiVisionCore.dll correctly as it is different to v2.35.  I have uploaded the .dll here. (http://wikisend.com/download/130184/infinii236.zip)  I hope a more knowledgeable person could look at it and provide some comments.  If more files are needed, just let me know. @plesa @abyrvalg hoping you guys might be able to take a look.


Reading back through the thread, people have had success with:
"a podunk 4G USB stick I got from Digikey"
SanDisk Extreme USB 3.0 16GB
Kingston 4GB microSD with adaptor
DaneElec 2GB SD with cheapo USB card reader
Integral 8GB

Hoping I will not have to downgrade --- I will keep trying with other USB drives...

Sparky

Read the whole thread. 2.36 is not possible to patch the same way. To hack the scope you need to downgrade the firmware to 2.35 as few members does.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on March 18, 2014, 11:26:55 am
plesa, do you know where is the problem exactly? USB startup override itself doesn't work anymore? Or some problems with patching?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on March 18, 2014, 11:32:36 am
Thanks Sparky for sharing the new dll version.

I copied the dll to my usb stick and i was able to start it but the dll hack at the right position is not working.
Also i didn't see any changes i the near of the Unfinalized Software output.
I will spend some more time today in the evening.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on March 18, 2014, 12:38:49 pm
plesa, do you know where is the problem exactly? USB startup override itself doesn't work anymore? Or some problems with patching?

Currently I do not have the 2.36 but we have discussion and there is blocked USB booting capability. Thats why it can be really dangerous to try to patch it.
If someone has the dll extracted you can send it to me for investigation.

Also bellow is additional change in 2.35 which will enable enable multiple force trigerring by pressing the Force trigger (not need to press the single button).

find position 1F24B4 and change it from

013C A0E3 2700 83E3 0110 A0E3
04E0 9DE4 D160 01EA

to
08E0 8FE2 F041 2DE9 0CD0 4DE2
FEA2 FEEB F4FF FFEA

Try it only from usb, not from scope flash to prevent bricking your scope.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ot1 on March 18, 2014, 02:23:31 pm
I didn't read all 28 of the pages on this thread but it seems that no one mentioned the fact that agilent has a promo on the X series that is buy one option and all other options are free. You can also jump one bandwidth up from your current purchased bandwidth. Looks like the promo ends march 31, perhaps longer too with new s scopes.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on March 18, 2014, 02:56:19 pm
I didn't read all 28 of the pages on this thread but it seems that no one mentioned the fact that agilent has a promo on the X series that is buy one option and all other options are free. You can also jump one bandwidth up from your current purchased bandwidth. Looks like the promo ends march 31, perhaps longer too with new s scopes.

It is mentioned in different Agilent thread, it has fixed price.
http://www.home.agilent.com/agilent/editorial.jspx?cc=US&lc=eng&ckey=2430287&nid=-33573.970736.00&id=2430287 (http://www.home.agilent.com/agilent/editorial.jspx?cc=US&lc=eng&ckey=2430287&nid=-33573.970736.00&id=2430287)

For someone running Agilent WinXP instruments there is also running promo for the Win7 upgrade for spectrum analyzers.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on March 18, 2014, 03:48:11 pm
Sparky, let's partition the problem a bit: try booting from USB w/o any patches first (original dll, no added params in .lnk) - the scope should start normally (but slower) using files on USB.

This is a good suggestion!  I will give this a try, as I need to find a USB drive that can actually boot.

Thanks,
Sparky
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on March 18, 2014, 04:07:34 pm
Read the whole thread. 2.36 is not possible to patch the same way. To hack the scope you need to downgrade the firmware to 2.35 as few members does.

@plesa: I have indeed read the whole thread, but found no discussion about patching 2.36.  I'm aware many people could not USB boot on 2.36 and simply downgraded to 2.35 as a "work around".  As far as I read here, those with 2.36 were trying to boot from a patched 2.35 DLL and system files, but with 2.36 installed on their system.  I thought that may have been causing it not to work.

I thought we could investigate the 2.36 DLL, and a few people requested to see the 2.36 DLL, so I posted it.  I thought it would be interesting to determine how the 2.36 system was different and a new way to patch it.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on March 18, 2014, 04:16:11 pm
Thanks Sparky for sharing the new dll version.

I copied the dll to my usb stick and i was able to start it but the dll hack at the right position is not working.
Also i didn't see any changes i the near of the Unfinalized Software output.
I will spend some more time today in the evening.

Thanks for testing, kilobyte.  Did you try and boot with the un-patched DLL first?  And it booted okay?

I assume you then tried booting with the patch at the new location of 0x277e30 ?  Seems there are more checks in this firmware...

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on March 18, 2014, 04:20:55 pm
plesa, do you know where is the problem exactly? USB startup override itself doesn't work anymore? Or some problems with patching?
Currently I do not have the 2.36 but we have discussion and there is blocked USB booting capability. Thats why it can be really dangerous to try to patch it.
If someone has the dll extracted you can send it to me for investigation.

@plesa: I posted the 2.36 DLL in my large post above, but here is direct link (http://wikisend.com/download/130184/infinii236.zip).

I presume this "discussion" about 2.36 having blocked USB booting happened outside this thread...I did not read anything about that.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on March 18, 2014, 05:58:25 pm
I didn't read all 28 of the pages on this thread but it seems that no one mentioned the fact that agilent has a promo on the X series that is buy one option and all other options are free. You can also jump one bandwidth up from your current purchased bandwidth. Looks like the promo ends march 31, perhaps longer too with new s scopes.
Yea its been mentioned a couple times in multiple threads, the only issue is many of us have already spent close to or more than the amount Agilent now gives all the options for. Unless there is going to be some plan for crediting those that have already bought hundreds in upgrades this upgrade "deal" just feels like spit in your face.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Rigby on March 18, 2014, 07:26:38 pm
I didn't read all 28 of the pages on this thread but it seems that no one mentioned the fact that agilent has a promo on the X series that is buy one option and all other options are free. You can also jump one bandwidth up from your current purchased bandwidth. Looks like the promo ends march 31, perhaps longer too with new s scopes.
Yea its been mentioned a couple times in multiple threads, the only issue is many of us have already spent close to or more than the amount Agilent now gives all the options for. Unless there is going to be some plan for crediting those that have already bought hundreds in upgrades this upgrade "deal" just feels like spit in your face.

I get what you're saying, but not fully.  The stuff you paid for still does what you paid for it to do, and it was enough of a deal that you willingly paid for those options.

I also get that you feel you're being treated unfairly because of the dramatic cost difference between what you paid per option vs. what someone will pay per option until this deal ends.  Technology always gets cheaper, though maybe you didn't expect it to get SO cheap so quickly, I guess.

Either they are about to announce a new scope or line of scopes, or they're doing the rare "Can I More Money Overall If I Lower The Price And Sell More" test.  This is what Steam Sales prove time & time again; that more net revenue is gained by selling at a lower price.  Maybe Agilent is giving that a go. 

I'd put my money on new hardware coming soon, though.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on March 18, 2014, 08:00:13 pm
I didn't read all 28 of the pages on this thread but it seems that no one mentioned the fact that agilent has a promo on the X series that is buy one option and all other options are free. You can also jump one bandwidth up from your current purchased bandwidth. Looks like the promo ends march 31, perhaps longer too with new s scopes.
Yea its been mentioned a couple times in multiple threads, the only issue is many of us have already spent close to or more than the amount Agilent now gives all the options for. Unless there is going to be some plan for crediting those that have already bought hundreds in upgrades this upgrade "deal" just feels like spit in your face.

I get what you're saying, but not fully.  The stuff you paid for still does what you paid for it to do, and it was enough of a deal that you willingly paid for those options.

I also get that you feel you're being treated unfairly because of the dramatic cost difference between what you paid per option vs. what someone will pay per option until this deal ends.  Technology always gets cheaper, though maybe you didn't expect it to get SO cheap so quickly, I guess.

Either they are about to announce a new scope or line of scopes, or they're doing the rare "Can I More Money Overall If I Lower The Price And Sell More" test.  This is what Steam Sales prove time & time again; that more net revenue is gained by selling at a lower price.  Maybe Agilent is giving that a go. 

I'd put my money on new hardware coming soon, though.
FWIW I still havent modded my MSOX2024. I havent needed any of the upgrades I hadnt already purchased. But seeing as how I have had my scope for less than a year and in two weeks for what I paid for 3 upgrades I could have gotten them ALL?! That stings a bit and angers many.

As far as new hardware goes, maybe. Doesnt help me at all though as now the resale value of these scope will be hurt badly as any upgrades wont be worth nearly as much seeing as how the entire suite can be bought for $500 or the thing can be modded for free. It would be interesting to see if they did come out with new scopes as arent 2000X and 3000X series only 3 years old? Seems fast to refresh two lines of oscilloscopes. But mayeb thats where all the competition has driven things.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: zucca on March 18, 2014, 08:47:43 pm
WOW, all the opitions for 800$ on the 3000 X-Series?

Starting April 1, 2014 ehh... April Fools' Day? I hope it is not a joke.
Probably I will spent my money for that. I want to support Agilent when it makes such a good offer to their customer, I hope other companies will follow that good example.

BTW those options are a evil business, man I know it is about money but jeeeeee I personally hate the idea to put on the market something not at the fully potential.... just decide an honest price with everything there and let it go...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Kryan9 on March 18, 2014, 09:21:21 pm
I didn't read all 28 of the pages on this thread but it seems that no one mentioned the fact that agilent has a promo on the X series that is buy one option and all other options are free. You can also jump one bandwidth up from your current purchased bandwidth. Looks like the promo ends march 31, perhaps longer too with new s scopes.
Yea its been mentioned a couple times in multiple threads, the only issue is many of us have already spent close to or more than the amount Agilent now gives all the options for. Unless there is going to be some plan for crediting those that have already bought hundreds in upgrades this upgrade "deal" just feels like spit in your face.

I get what you're saying, but not fully.  The stuff you paid for still does what you paid for it to do, and it was enough of a deal that you willingly paid for those options.

I also get that you feel you're being treated unfairly because of the dramatic cost difference between what you paid per option vs. what someone will pay per option until this deal ends.  Technology always gets cheaper, though maybe you didn't expect it to get SO cheap so quickly, I guess.

Either they are about to announce a new scope or line of scopes, or they're doing the rare "Can I More Money Overall If I Lower The Price And Sell More" test.  This is what Steam Sales prove time & time again; that more net revenue is gained by selling at a lower price.  Maybe Agilent is giving that a go. 

I'd put my money on new hardware coming soon, though.
FWIW I still havent modded my MSOX2024. I havent needed any of the upgrades I hadnt already purchased. But seeing as how I have had my scope for less than a year and in two weeks for what I paid for 3 upgrades I could have gotten them ALL?! That stings a bit and angers many.

As far as new hardware goes, maybe. Doesnt help me at all though as now the resale value of these scope will be hurt badly as any upgrades wont be worth nearly as much seeing as how the entire suite can be bought for $500 or the thing can be modded for free. It would be interesting to see if they did come out with new scopes as arent 2000X and 3000X series only 3 years old? Seems fast to refresh two lines of oscilloscopes. But mayeb thats where all the competition has driven things.

I think they're just trying to pre-empt and kill off any sales of Tektronix's new competitor, the MDO3000. With the options so cheap now, you can get a fully unlocked Agilent for half the price of the comparable Tek, even if the Tek can now have comparable performance.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on March 18, 2014, 10:34:42 pm
Sparky, let's partition the problem a bit: try booting from USB w/o any patches first (original dll, no added params in .lnk) - the scope should start normally (but slower) using files on USB.

@abyrvalg: I tried booting from 5 different USB drives.  In each case, I used original dll, .lnk and other files from the scope.  The only addition to the USB drive not from the scope is the infiniivisionStartupOverride.txt file, in the root directory.

With or without the USB drive plugged in, the scope boots in ~42sec.  It takes ~31 sec for the "Agilent Technologies" logo to appear, and then another 11-12sec until the main screen appears.  Note: I have the DSOXLAN module installed.  Without the DSOXLAN module it boots to the main screen in about 35sec.

How long (in seconds) does it take the scope to boot on 2.35 when USB drive is plugged in?  In my case, with or without USB drive the time is the same, which makes me think it is not booting from USB drive at all!  When I had "patched" DLL on USB drive, it would not boot at all.

In my case, either none of the USB drives I have are bootable, or there is something else in 2.36 that prevents boot (maybe something in the dll, or elsewhere controlling start-up).  Perhaps this is what plesa was referring to by "blocked USB booting capability".  Perhaps startupOverride txt file does not work like previous?

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on March 19, 2014, 01:00:16 am
Sparky, looks like your test is incorrect: if you are using 100% original .lnk then it points to internal folder (\Secure\infiniiVision), so you are starting the same process just a bit differently. You need to try .lnk with modified folder path, but no feature options (they'll cause troubles with unpatched dll):
Code: [Select]
44#\usb\infiniiVision\infiniivisionLauncher.exe
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on March 19, 2014, 01:09:14 am
Sparky, looks like your test is incorrect: if you are using 100% original .lnk then it points to internal folder (\Secure\infiniiVision), so you are starting the same process just a bit differently. You need to try .lnk with modified folder path, but no feature options (they'll cause troubles with unpatched dll):
Code: [Select]
44#\usb\infiniiVision\infiniivisionLauncher.exe

Oh, of course!  My bad!  I will repeat and report back.

Update:
This time, my USB drives give different results when trying to boot. 

 - Two newest drives (Transcend 32GB "Ultra Speed" and Kingston 4GB "DataTraveler")
   Scope attempts to boot for 62 and 72 sec, respectively, and then the system reboots and tries again.  It appears the scope is really trying to read and boot from these drives, but a new protection method prevents it from doing so.  Note, this is attempting USB boot with unpatched DLL, so there is something other than DLL blocking USB boot in this v2.36 firmware.

 - Two oldest drives (SanDisk 2GB "Cruzer" and no-name 2GB)
   These don't seem to do anything; the system boots in ~45 seconds.  As far as I can tell, the scope couldn't read from these disks during boot and so it started normally.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on March 19, 2014, 05:52:39 pm
I did a further test to check if the infiniivisionStartupOverride file contents had any effect.  Using my Transcend drive which appears to be the "best bet" as far as boot capability goes, I changed the "True" to "False" in the override text file.  I expected the scope to boot as normal in about 45sec.  Surprisingly, it didn't!  The system continued to try and boot for ~70sec, and then restarted.

Has anyone tested setting "False" in the text file, and did it lead to normal internal boot?  I assume this is what should happen, but would be nice to confirm.

Seems like need to investigate what might be blocking USB boot capability...

Update: Upon further testing, the contents of override file is unimportant; only its existence is checked.  Upon deleting the file, the scope boots as normal, which was the expected behavior.  The presence of the override text file is preventing boot from USB.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on March 21, 2014, 01:05:11 am
re: USB boot override

With help from another member here, so far it is thought that file "\Windows\ProcessStartupFolder.exe" is possibly responsible for blocking USB boot capability.

In v2.35 ProcessStartupFolder.exe is 12744 bytes; in v2.36 it is a bit bigger.

Unfortunately I can't copy this file off the system; 'copy' and trying to dump the file with 'type' both result in errors.  I also tried 'processMgr.exe kill' before copying and that didn't work.  This may be why Agilent haven't posted the 2.36 update online --- it would be immediate way to obtain ProcessStartupFolder.exe and inspect it.

If anyone has further suggestions for copying this file off the scope let me know and I can try.

If there is no way forward I will likely downgrade to the v2.35 firmware this weekend.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on March 21, 2014, 01:30:07 am
Did you try to kill the InfinivisionLaucher as well?
Can you post the processes running on the 2.36?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on March 21, 2014, 04:01:19 am
Did you try to kill the InfinivisionLaucher as well?
Can you post the processes running on the 2.36?

Thanks for the suggestion.  I just tried: killed both ProcessStartupOverride and InfiniiVisionLauncher but still got error on copy:
"Cannot copy \Windows\ProcessStartupFolder.exe to \usb"
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on March 21, 2014, 09:12:07 am
Sparky, try attrib -s -h \Windows\ProcessStartupFolder.exe, then copy, maybe some attribute prevents copiing. If attrib fails, try without -s also.

If none will work, try pulling out \Windows\cmd.exe for study - maybe there is some restriction right in the shell itself.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: eurofox on March 21, 2014, 12:03:24 pm
Hi,

I got finally my scope and enable the trial, this ways I have all options enabled. ;

In 10 days I will have the permanent options enabled, I suppose everybody know about this promotion from Agilent. :)

eurofox
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: con-f-use on March 21, 2014, 02:41:43 pm
In 10 days I will have the permanent options enabled, I suppose everybody know about this promotion from Agilent. :)
Just the general stuff. What was it they charge for all the options? I remember something like €500?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: eurofox on March 21, 2014, 02:44:08 pm
In 10 days I will have the permanent options enabled, I suppose everybody know about this promotion from Agilent. :)
Just the general stuff. What was it they charge for all the options? I remember something like €500?


I think $500 for the 2000 and $800 for the 3000 range.

eurofox
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Frost on March 21, 2014, 06:18:37 pm
DSOX2APPBNDL -> 9 for 1 _-_ 401 Euro + VAT instead of 2735 Euro + VAT

DSOX3APPBNDL -> 15 for 1 _-_ 641 Euro + VAT instead of 9900 Euro + VAT

DSOX4APPBNDL -> 16 for 1 _-_ 1202 Euro + VAT instead of 14779 Euro + VAT
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: elektrinis on March 22, 2014, 08:37:08 am
Guys, thank you very much. I got my 2004A running with all features and 200MHz. Nice!
I had some troubles with cheap uSD card reader - scope did not mount any card even when booted up. But old 256MB USB drive did the job just fine!

BTW, it was already mentioned here, but I remind for those who are considering hacking their scope: you will get a warning text during boot, also in "About" page. Also you will get a prompt after boot up. Fortunately these texts are easy to change or even remove. In my case, I left the warning there, just changed the text with owner's information, in case the scope gets stolen (but it is possible to remove this text, just fill in with spaces or NULL characters). As for prompt after boot up, I did not dig deep in to removing it, just changed the text to something neutral, as you would have to press Back button anyway to get rid of language selection after normal boot (any way to switch off this annoying thing?).
Check pictures below:

https://dl.dropboxusercontent.com/u/68288580/agilent/IMG_20140322_130405_543.jpg
https://dl.dropboxusercontent.com/u/68288580/agilent/IMG_20140322_130427_395.jpg
https://dl.dropboxusercontent.com/u/68288580/agilent/IMG_20140322_130249_858.jpg

However, I have failed with one thing... I wanted to check how downloaded demo license works... So I downloaded a Segmented Memory Application and installed it on the scope (from internal boot). As expected, feature started working even without the hack (with indicated trial end date).
The problem is that SGM is no longer working from hacked boot, even though license is still valid.
What can I do to get this functionality back? Is it possible to disable license check? It is really one of those features that I should not have messed with...

Now... How do we:
1. disable license checking.
2. copy modded files in to internal memory? No LAN card here. Still, it looks like it is possible via USB-only.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on March 22, 2014, 07:08:15 pm
Sparky, try attrib -s -h \Windows\ProcessStartupFolder.exe, then copy, maybe some attribute prevents copiing. If attrib fails, try without -s also.

If none will work, try pulling out \Windows\cmd.exe for study - maybe there is some restriction right in the shell itself.

I noticed only the "readonly" (R) attribute was set for ProcessStartupFolder.exe, and I tried to remove it, but resulted in an error (cannot set attribute...).

I tried also on \Windows\cmd.exe but same scenario --- cannot be copied...

Thanks everyone, and especially abyrvalg for the help to investigate the v2.36 firmware.  It seems there is some interesting things going on with ProcessStartupFolder.exe, but unfortunately no way to inspect it.

Looks like I will begin the v2.35 downgrade soon...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on March 22, 2014, 07:12:51 pm
What did 2.36 bring for updates anyway? Is there even any reason to try and keep it?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: romantao on March 22, 2014, 07:51:00 pm
soory for jack up the main topic, but in previous posts some users were discussing the possibility of building a pcb with the ethernet connection. Has anyone ended up designing the module?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on March 22, 2014, 08:55:54 pm
Sparky, you have the 2.36 app extracted already, so you can try booting it from USB after downgrade just for curiosity. Please report the results if any.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on March 22, 2014, 09:15:03 pm
What did 2.36 bring for updates anyway? Is there even any reason to try and keep it?

As 2.36 hasn't been publicly released we don't know for sure, but it's possible it does not contain any enhancements or bug fixes; its purpose may be exclusively for blocking USB boot.  (And because it hasn't been released, we can't get to ProcessStartupFolder.exe from a cab file.)

For reference, 2.35 brought the following:

Enhancements
For both the 2000X and 3000X families:
• Default cursors placement will no longer overlay cursors on the same value.
For the 3000X family:
• N2820A high sensitivity 2 channel current probe support has been expanded to allow for a greater range of user defined resistance.
• LIN error triggering has been added.
• WaveGen modulation frequency now has more granularity for user adjustment.

Defects Addressed
For the 2000X and 3000X family:
• Mask “Save on Error” capability now works for SINGLE acquisitions
• Scope will behave better in higher activity LAN networks
• A number of bitmaps behaviors have been improved for some tablets
For the 3000X family:
• LIN 2.0 decoding now better handles the Checksum field.
• An Arb file import error has been addressed; it no longer skips some time column data.
• For IC2 decoder search: previously, read packets were sometimes erroneously found during write searches.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on March 22, 2014, 09:17:24 pm
Sparky, you have the 2.36 app extracted already, so you can try booting it from USB after downgrade just for curiosity. Please report the results if any.

I have done the downgrade to 2.35 --- it booted first attempt from USB drive loaded with 2.35 files.  All options and 500MHz BW activated as expected.

I will try the 2.36 app on USB drive and report what happens.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on March 22, 2014, 09:56:04 pm
I'm now running 2.35 from internal.  I copied the 2.36 files to USB and it booted fine from USB drive.  Same result as noted by kilobyte here (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg408031/#msg408031).

I have not tried booting the patched dll, but as mentioned by kilobyte it is not working.  I wonder if kilobyte made any further discoveries?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georgd on March 23, 2014, 07:53:23 pm
Telnet connection to port 5024 on DSOX3032 doesn't woork.
LAN adapter is self made, other services: ping, WEB and telnet responds normally.
This behavior is common for software running from internal flash and from USB flash.

Georg
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: euzer on March 24, 2014, 09:36:34 am
From what I can gather the soon to be released chargeable DSOX3APPBNDL offers all possible (published) licensable upgrades except for bandwidth and MSO functionality.

Two questions on running the hacked 2.35 firmware from USB.
Is any calibration maintained when running the hacked>?
Is it still possible to save screen images to the USB memory stick?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georgd on March 24, 2014, 11:49:28 am

Is any calibration maintained when running the hacked>?
Is it still possible to save screen images to the USB memory stick?

Yes calibration is maintained, and
you can save/recall data to/from USB stick.

Georg
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georgd on March 24, 2014, 05:07:08 pm
Just finished my LAN module.
Here's some pictures, I see some imperfections.
Module is working with some restrictions described in my previous post, only LEDs no lit.

Georg
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: trevwhite on March 24, 2014, 05:49:16 pm
Lan module looks great! It would be really good to make one. Do you have cad files available?

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: M. András on March 24, 2014, 09:21:28 pm
im wondering what are these units are calibrated for, its full hardware capability or for marketed bandwith?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on March 24, 2014, 09:28:38 pm
im wondering what are these units are calibrated for, its full hardware capability or for marketed bandwith?

Must be full capability, because the higher bandwidths can be unlocked with the purchased bandwidth option, and it doesn't require the unit to be sent for (re)calibration.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on March 24, 2014, 11:28:51 pm
CAD files please... Thank you in advance.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 47MHz on March 28, 2014, 05:58:38 pm
Great job you guys!

In my DSOX there is one problem with this hack - I have all the licenses excluding band. It's still 100MHz instead of 200MHz. My oscilloscope was originally 100MHz. Maybe thats the problem?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mwilson on March 28, 2014, 06:16:27 pm
I have all the licenses excluding band. It's still 100MHz instead of 200MHz. My oscilloscope was originally 100MHz. Maybe thats the problem?

What command are you using in the startup .lnk file? You need to add "-l BW20" to the command line, the "-l All" license doesn't cover bandwidth.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 47MHz on March 29, 2014, 10:06:06 am
This is how my file look like:

62#\usb\secure\infiniiVision\infiniivisionLauncher.exe -l MSO -l memMax -l MEMUP -l EMBD -l AUTO -l COMP -l SGM -l MASK -l EDK -l RML -l ASV -l SGMC -l BW20 -l DIS -l SCPIPS -l VID -l CABLE

Still no 200MHz band.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tsmith35 on March 29, 2014, 09:30:40 pm
This is how my file look like:

62#\usb\secure\infiniiVision\infiniivisionLauncher.exe -l MSO -l memMax -l MEMUP -l EMBD -l AUTO -l COMP -l SGM -l MASK -l EDK -l RML -l ASV -l SGMC -l BW20 -l DIS -l SCPIPS -l VID -l CABLE

Still no 200MHz band.

You have 186 characters to the right of the "#", so I think the file should read:

186#\usb\secure\infiniiVision\infiniivisionLauncher.exe -l MSO -l memMax -l MEMUP -l EMBD -l AUTO -l COMP -l SGM -l MASK -l EDK -l RML -l ASV -l SGMC -l BW20 -l DIS -l SCPIPS -l VID -l CABLE
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: zucca on April 04, 2014, 01:37:53 pm
I just got in my email the upgrade code for all the options from Newark, when I go home after work I will upgrade my puppy X3000. It was $760 and not $800 as advertised on the Agilent website.
Thanks Agilent for giving me this opportunity.

Here again the link for the upgrade promotion:

http://www.home.agilent.com/agilent/editorial.jspx?cc=US&lc=eng&ckey=2430287&nid=-33573.970736.00&id=2430287 (http://www.home.agilent.com/agilent/editorial.jspx?cc=US&lc=eng&ckey=2430287&nid=-33573.970736.00&id=2430287)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: eurofox on April 04, 2014, 04:16:23 pm
I just got in my email the upgrade code for all the options from Newark, when I go home after work I will upgrade my puppy X3000. It was $760 and not $800 as advertised on the Agilent website.
Thanks Agilent for giving me this opportunity.

Here again the link for the upgrade promotion:

http://www.home.agilent.com/agilent/editorial.jspx?cc=US&lc=eng&ckey=2430287&nid=-33573.970736.00&id=2430287 (http://www.home.agilent.com/agilent/editorial.jspx?cc=US&lc=eng&ckey=2430287&nid=-33573.970736.00&id=2430287)


Got my upgrade on April 1st, not an April joke  :-DD :-DD :-DD
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georgd on April 04, 2014, 07:22:45 pm
Here are Gerber, drill and DXF files for LAN module builders.
I wish to see prettier modules than my!

Georg
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: trevwhite on April 04, 2014, 07:47:26 pm
Hey, Georg. Brilliant, very generous of you.

Thank you

Trev
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: zucca on April 04, 2014, 08:31:07 pm
Very cool Georg!

BTW it´s a shame Agilent didn´t design a digital output for a display (HDMI or a DisplayPort) there.
Since I am not expert on those interfaces do you think it is impossible or just tons of brain, spare time and FPGA jazz would do the trick?

I simply can´t stand to have a poor analog video output in such a beautiful 2014 model DSO. On top of that I know the internal display signals are already digital, so what a shame to convert them in analog ones... It is like to take cold beers, warm them up in a oven and finally serve them...

Maybe if someone else is interested it would be nice to put on the Georg board not only the LAN interface but also:

- the raw video digital signals coming from the mainboard, for possible future development
- JTAG?
- I2C?
- UART? (see also https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg260721/?topicseen#msg260721 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg260721/?topicseen#msg260721))

Let´s do an EEVBlog Hack board!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on April 04, 2014, 08:49:00 pm
Huh, I wonder when a chinese manufacturer will come up with these boards...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on April 05, 2014, 03:15:58 pm
If you want to see the gerber files, use http://www.gerber-viewer.com (http://www.gerber-viewer.com)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on April 08, 2014, 03:04:07 am
Quote
Huh, I wonder when a chinese manufacturer will come up with these boards...
Quote
Finally found one (a DSOXLAN) on eBay for a good price. Now I just hope the one they send me is in good condition. There are still 3 left if anyone else is looking.
http://www.ebay.com/itm/291108310383 (http://www.ebay.com/itm/291108310383)

I recently purchased a couple of 'real' DSOXLAN from a Chinese seller for less than half retail including free shipping. Seller had 8 of them that I had reported on in the 'Buy/Sell/Wanted' area, but all are gone now. I just got them in today and happily all has tested well with both of them. The $200 US is not too bad of a price for a 'factory' module, and you get the VGA as a bonus, something that would be very difficult to hack. Hopefully the seller will find a few more modules to sell.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: euzer on April 08, 2014, 07:56:26 am
Yay!!!

Just got a customer return DSO-X3000 returned back from Agilent calibration date 2 Jan 2014, they upgraded it to firmware 2.36.

Downgraded to 2.35 from the Agilent website, edited the DLL and created a USB drive and now it's all options enabled!!

Got the 'WARNING: Unfinalised software' message but otherwise perfect!!

Very happy bunny indeed  :)

Anybody now want a Rigol 2072 all options enabled brand new in box never used??!!

Helpful link...
https://dl.dropboxusercontent.com/u/2063383/DSOX3000%20hack.zip
Shows "All options enabled" at power up.
Shows the following features enabled :
MSO, memMax, EMBD, AUTO, FLEX, PWR, COMP, SGM, MASK, AUDIO, DIS, EDK, WAVEGEN, AERO, VID, ADVMATH, DVM, ASV, CABLE, SCPIPS, RML, SGMC, TOM.
No bandwidth increase features shown.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hypernova on April 08, 2014, 08:12:50 am
Quote
Huh, I wonder when a chinese manufacturer will come up with these boards...
Quote
Finally found one (a DSOXLAN) on eBay for a good price. Now I just hope the one they send me is in good condition. There are still 3 left if anyone else is looking.
http://www.ebay.com/itm/291108310383 (http://www.ebay.com/itm/291108310383)

I recently purchased a couple of 'real' DSOXLAN from a Chinese seller for less than half retail including free shipping. Seller had 8 of them that I had reported on in the 'Buy/Sell/Wanted' area, but all are gone now. I just got them in today and happily all has tested well with both of them. The $200 US is not too bad of a price for a 'factory' module, and you get the VGA as a bonus, something that would be very difficult to hack. Hopefully the seller will find a few more modules to sell.


I was the one that bought the last of his stock, was a bit surprising how banged up the module is on the sides. Guess these things were passed around a lot in the lab they came from.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: eurofox on April 08, 2014, 08:18:36 am
The last release of the firmware is 2.36 but on the Agilent website only the 2.35 is available.

Where can I get the 2.36?

eurofox
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: euzer on April 08, 2014, 09:30:12 am
This is interesting http://cp.literature.agilent.com/litweb/pdf/DSOX3104A-01.pdf (http://cp.literature.agilent.com/litweb/pdf/DSOX3104A-01.pdf)

Service Note
December 5, 2012
DSOX3014A – Oscilloscope, Mixed Signal, 4 Channel, 100MHz
Serial Numbers: ALL
Corrupted firmware code renders the oscilloscope inoperable.

Situation:
At regular intervals, the scope compares the checksum of the firmware code running in RAM with the checksum in Flash. This allows the detection of inadvertent or unauthorized changes to the files. If the two checksums ever differ, an error message is displayed and the scope becomes inoperable. The error message will read:
The InfiniiVision software has been corrupted. Please contact Agilent Support for help.

Solution/Action:
Go to Agilent.com, reload all files associated with oscilloscope model affected and without opening the file, download it to the scope.

There's also a recommended hardware mod if the scope hisses http://cp.literature.agilent.com/litweb/pdf/DSOX3014A-03.pdf (http://cp.literature.agilent.com/litweb/pdf/DSOX3014A-03.pdf)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on April 08, 2014, 12:55:19 pm
I was the one that bought the last of his stock, was a bit surprising how banged up the module is on the sides. Guess these things were passed around a lot in the lab they came from.

Yea, one of mine was a little rough, but the other was in very good condition. Both worked equally well and look about the same when plugged into the scope (outside condition is very good). I'm all for saving more than a couple hundred bucks on something you can't even see once plugged in anyway... Very happy with the purchase.

Still, I can't believe how UGLY they make the back of an otherwise nice looking scope look. What an awkward design approach to attach a module??? I understand the desire to lock the unit in place, but give me a break... They should have just skipped the locking loop and clips that protrude out of the back of the case and opted for a couple of torx screws to lock down the module flat to the rear surface. Anyone with a torx driver and enough time and wherewithal to remove the module is going to figure out how the get the whole scope anyway. It's even easier and faster to steal by just clipping the stupid loop with a pair of diagonal cutters, probably already sitting on the bench or nearby, and quickly unclip the module. What a DUMB and UGLY engineering idea, and a silly attempt to lock those modules down.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Neganur on April 13, 2014, 01:39:28 am
FPG and ALT options grant additional selections for the rear trigger output

utility -> options -> rear panel -> rear panel menu

EDIT: Maybe it's caused by something else anyway. I felt that the scope was not running stable (it would reboot) especially when browsing the serial decode menu so I dropped FPG, ALT and TOM. They're undocumented and at least FPG is not recognised by the N5406A / N5434A FPGA dynamic probe software for the other infiniivision scopes. The Trigger output choices are still available.

CABLE is nice though. The help menu worked, so here's the description:
(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=89344;image)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on April 17, 2014, 09:38:45 pm
Has anyone bought the DSOX3APPBNDL ($800) to unlock all the options (except BW and MSO feature)?

If so, I wonder if the boot override infiniivisionLauncher options for BW and MSO still work correctly after installing DSOX3APPBNDL? 

If anyone has done this, can you please test and post about it?

I'm contemplating buying the application bundle, but I don't want to loose BW and MSO ... and I can't afford everything at once!!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Neganur on April 18, 2014, 01:05:26 am
I bought the bundle. But unfortunately I do have the 1 GHz MSO version, so I can't try what you want to know without deleting the perpetual license file for the MSO.

I did notice that you can still install the undocumented options though so I imagine that the bandwidth and mixed signal options still work. You won't need all the other command line parameters anymore.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hypernova on April 18, 2014, 03:24:21 am
I just tried out the LAN functions today and noticed some weird errors with the hacked USB method. If I boot from the hacked drive I get hit with errors like these on web page access:
Quote
Parse error in script

Microsoft VBScript runtime error: '800a01ad'

Description: ActiveX component can't create object: 'infiniiVisionWebCom.ScopeInfo'

In file: scopeInfo.asp
On line: 4

Other network functions are fine like telnet, VNC, java and HTML5 based (http://xxx/rfp.html (http://xxx/rfp.html)) remote panels. So it looks like only dynamically generated pages are bad.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Neganur on April 18, 2014, 04:33:48 am
check if the file on your usb stick is read only (and remove that flag)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hypernova on April 18, 2014, 05:01:20 am
Didn't work, went into infiniiVision\web and checked them too, they aren't set to read only.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on April 18, 2014, 05:19:00 am
I bought the bundle. But unfortunately I do have the 1 GHz MSO version, so I can't try what you want to know without deleting the perpetual license file for the MSO.

I did notice that you can still install the undocumented options though so I imagine that the bandwidth and mixed signal options still work. You won't need all the other command line parameters anymore.

Thanks for your response Neganur!  :)  I agree with you --- if the undocumented options still work after the bundle license, then it is reasonable to assume the BW and MSO options will be okay, too.

You are most "unfortunate" to have the 1GHz MSO version, eh?  :P
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on April 26, 2014, 02:11:25 am
Anyone looking for a reasonable price DSOXLAN ($200 US) can check this site out. http://www.168electronics.com/agilent-dsoxlan-2000-30000-infiniivision-x-lanvga-module-p-66.html (http://www.168electronics.com/agilent-dsoxlan-2000-30000-infiniivision-x-lanvga-module-p-66.html) (no relationship with the seller)

I purchased two already from his eBay store and they both work perfectly. They are both a little bit tattered, like they were stored in a bin together and moved about a bit, but fully functional. I have not purchased any from his web store, but notice he accepts PayPal, so the buyer protection should be there.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on April 26, 2014, 10:41:33 am
Anyone looking for a reasonable price DSOXLAN ($200 US) can check this site out. http://www.168electronics.com/agilent-dsoxlan-2000-30000-infiniivision-x-lanvga-module-p-66.html (http://www.168electronics.com/agilent-dsoxlan-2000-30000-infiniivision-x-lanvga-module-p-66.html) (no relationship with the seller)

I purchased two already from his eBay store and they both work perfectly. They are both a little bit tattered, like they were stored in a bin together and moved about a bit, but fully functional. I have not purchased any from his web store, but notice he accepts PayPal, so the buyer protection should be there.
I just got an email back from the seller stating that his web store inventory was incorrect, that he does not have them available any longer.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: charliex on April 30, 2014, 04:01:59 am
picked up a new dso-x 2002 from frys for $1000 today, updated firmware to 2.35, applied usb with a transcend 4GB usb formatted as FAT16, worked fine.

neato
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on April 30, 2014, 06:10:40 pm
picked up a new dso-x 2002 from frys for $1000 today, updated firmware to 2.35, applied usb with a transcend 4GB usb formatted as FAT16, worked fine.

So you effectively now have a NEW FULLY LOADED MSOX2022A for $1000... yes, very neato
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Methodical on May 01, 2014, 04:32:21 pm
Does anyone have a rigol 2072a and dso 2000 series scope, and have info on which they prefer?  Seems to me the agilent would be preferred, even at a cost premium.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on May 01, 2014, 05:11:57 pm
They are just different. For general reliability go for Agilent. I chose so.
https://www.eevblog.com/forum/reviews/my-new-toy-)-agilent-dsox2002a-sex-on-a-stick!/msg216361/#msg216361 (https://www.eevblog.com/forum/reviews/my-new-toy-)-agilent-dsox2002a-sex-on-a-stick!/msg216361/#msg216361)

But that Rigol DS2000 has huge 56Mpoints memory, dedicated segmented memory (record) controls, it can have two channel arbitrary generator...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: free_electron on May 08, 2014, 06:44:03 pm
Muahahaha! :-DD
Agilent DSOX2000/3000 Easteregg Spaceship Screensaver (https://www.youtube.com/watch?v=A4zTj5a7cGU#ws)
Here is it the Enterprise Screensaver.

I did take a look in the dsox4000 dll and there are a lot more debug information and resources.
I opened the 4000 infiniivision with a resource hacker and I was able to extract bitmaps and Winform dialogs.
After disassembling the dll I searched for the text TREK and found the reference to this in a subfunction with other references to ...Screensaver...
So i tried it on my scope and bingo.

Regards
Kai

Today i was at the embedded world fair here in Nürnberg/Germany and i could try the Screensaver Easteregg with the text TREK which will work as seen in my video.
After I started the Preview it will show some credits.

It was a little bit sad that i didn't have a possibility to make a video of this.

It would be nice if someone which have a DSOX4000 available take a video of this easteregg.

yep. it works. just tried it
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on May 08, 2014, 10:50:46 pm
Agilent DSOX3000 and Tektronix DPO3000 are just different. I would choose Agilent because it must be easy and fast to use, but that Tektronix has some useful extra features. I like its two big multipurpose knobs.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on May 08, 2014, 10:56:39 pm
Here is Agilent guys' point of view.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tsmith35 on May 09, 2014, 01:10:56 am
I rarely look at parallel busses or that many digital signals at once.

I guess I misread that... ;)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Smalldog on May 14, 2014, 06:39:13 am
picked up a new dso-x 2002 from frys for $1000 today, updated firmware to 2.35, applied usb with a transcend 4GB usb formatted as FAT16, worked fine.

neato

I saw an open box (not sure if it's a return or not) Agilent DSOX2002A at the Fry's in Phoenix.  I think they wanted $1049 for it.  I looked at the shipping date on the box, and (if memory serves me right) it was shipped to Fry's in October of 2012, so it's been on the shelf for at least 18 months.  It's not listed on the website as available in the store, but I saw it there.  Thinking about seeing if they will discount it to $999 since it's been there so long, and if it's a return, who knows if it has problems because I am pretty sure that Fry's is not competent at testing this kind of equipment other than powering it on and saying "it's works fine".

Out of curiosity, which Fry's did you manage to scoop your scope up at?

Smalldog
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dunkemhigh on May 15, 2014, 03:55:40 pm
I am considering making a LAN board from my DSOX2x. Getting the PCB from itead would leave me with 4-9 spares, so I wondered if anyone else is interested in this? The way it would work, I think, is that I would make a board complete with magjack (since trying to find the same one as someone else designed around can be problematic) and sell it on at cost. Modifying the blank panel cover would be your problem, although I might be amenable do that as well.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on May 15, 2014, 06:43:27 pm
I am considering making a LAN board from my DSOX2x.

Where are you located?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dunkemhigh on May 15, 2014, 07:03:46 pm
Quote
Where are you located?

I am in the UK.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sbampato12 on May 15, 2014, 08:04:38 pm
How much do you think it could cost at the end? possible with the shipment (to brazil). If I could afford it I'm interested (I've just bought too much gears, so I'm little in trouble about money next 2 months... :) ).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dunkemhigh on May 15, 2014, 08:10:05 pm
At a rough guess, the PCB would be about £3-4, the magjack about £8,  (nearly double those for $US) plus shipping.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: fmaimon on May 15, 2014, 09:08:37 pm
Quote from: Sbampato12 on Today at 05:04:38 PM (https://www.eevblog.com/forum/index.php?topic=15764.msg444991#msg444991)
How much do you think it could cost at the end? possible with the shipment (to brazil). If I could afford it I'm interested (I've just bought too much gears, so I'm little in trouble about money next 2 months... :) ).

Try quoting in Agilent's website. You may find it's not that worth the trouble to import it. Yes, it is more expensive than buying in the US, but the difference is less than the shipping and import taxes that you will have to pay...

Brainfart... Somehow I though you were talking about a new oscilloscope...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: trevwhite on May 15, 2014, 09:16:10 pm
Hi. I am interested in a board.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: trevwhite on May 15, 2014, 09:20:13 pm
I thought I saw the magjack at coolcomponents.co.uk? I ordered one but never got the board sorted or tested the magjack itself. This magjack was from the board posted earlier in this forum. It was cheap as well.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dunkemhigh on May 15, 2014, 09:48:01 pm
Quote
This magjack was from the board posted earlier in this forum

Yes, I couldn't find that one and the pins looked non-standard. But I've since discovered that the part number on the pdf is incorrect (I think) with a 2 where a 1 should be. So now I've found it and it costs about £4.50 plus VAT.

That makes things a lot easier and I am about to send the gerbers for that board to itead (thanks very much georgd for doing those). But first, could someone with a pukka one confirm that it is 1.6mm PCB, or are we talking thinner stuff?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: trevwhite on May 15, 2014, 09:56:05 pm
Okay great. I am definitely up for a board thanks.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on May 16, 2014, 03:42:40 am
At a rough guess, the PCB would be about £3-4, the magjack about £8,  (nearly double those for $US) plus shipping.
Please put me on your list...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georgd on May 16, 2014, 07:09:20 am
Quote
But first, could someone with a pukka one confirm that it is 1.6mm PCB, or are we talking thinner stuff?

Yes, the PCB must 1.6 mm thick.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dunkemhigh on May 16, 2014, 09:39:08 am
Quote
Yes, the PCB must 1.6 mm thick

Cheers :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dunkemhigh on May 16, 2014, 10:47:38 am
It's a bit late to worry about this now because itead have the gerbers, but there seems to be a problem with the LEDs on this board:

Quote
Module is working with some restrictions described in my previous post, only LEDs no lit

It seems to me the problem is that the magjack has bi-colour LEDs (i.e. two in reverse parallel) but the layout assumes single ended LEDs (common return). I checked the magjack on the hi-res photo someone posted (thanks!) and that also has bi-colours, so I think the pinout on this board is incorrect for the LED connections.

Not sure how this can be resolved without access to a real unit. Maybe someone with one could trace the connections for us?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: trevwhite on May 16, 2014, 11:24:32 am
Well as long as the network connection works I do no really care about the leds.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dunkemhigh on May 16, 2014, 11:29:05 am
Particularly since they're round the back and usually not visible :). But it is the principle of the thing and would be nice to get it right.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georgd on May 16, 2014, 05:21:25 pm

Quote
Module is working with some restrictions described in my previous post, only LEDs no lit

I must correct statement in my previous post, LED are working.
Green for link and Yellow to activity indicator.
Reason for not working is mistake in pin position.
Please study attached images.

Georg


 
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dunkemhigh on May 16, 2014, 05:38:54 pm
Can you expand on that pin mistake, please? I haven't worked out what it is and what it should be.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: fmaimon on May 16, 2014, 06:10:56 pm
If there is any spare board, I would like one, with the magjack, if possible. These kind of things are hard to come by in Brazil.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: WVL_KsZeN on May 16, 2014, 06:31:54 pm
I'd be interested aswell (I'm in .nl).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: cyr on May 16, 2014, 08:42:19 pm
Finally got my back-ordered DSOX3034A, downgraded to 2.35 and "upgraded" successfully. An 8GB sandisk cruzer blade USB stick worked fine as boot medium. I did notice this issue though:

I just tried out the LAN functions today and noticed some weird errors with the hacked USB method. If I boot from the hacked drive I get hit with errors like these on web page access:
Quote
Parse error in script

Microsoft VBScript runtime error: '800a01ad'

Description: ActiveX component can't create object: 'infiniiVisionWebCom.ScopeInfo'

In file: scopeInfo.asp
On line: 4

Other network functions are fine like telnet, VNC, java and HTML5 based (http://xxx/rfp.html (http://xxx/rfp.html)) remote panels. So it looks like only dynamically generated pages are bad.

Anyone know a fix for this? Putting the hack in internal flash perhaps?

EDIT in case anyone is looking for info, putting the hacked files into internal flash does fix the issue with the web interface. /EDIT
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dunkemhigh on May 16, 2014, 09:13:21 pm
If there is any spare board, I would like one, with the magjack, if possible. These kind of things are hard to come by in Brazil.

I'm sure something can be arranged :)

Thanks for the expressions of interest, everyone. It will take a while for the boards to come through, but once I have them and have figured out the actual costs I will ask for confirmed requirements from those interested.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: trevwhite on May 16, 2014, 09:15:45 pm
Many thanks for getting this sorted. Just let me know when and how you want payment.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: starblue on May 17, 2014, 02:57:05 pm
Does anybody know what a "(d)" following the license names means?

I got my scope back from repairs and most licenses were marked like that, see attached screenshot.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georgd on May 17, 2014, 03:35:52 pm
Activated distributor licence with time limit?
But why not display (d) after MSO, did you purchased MSO licence?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on May 17, 2014, 04:22:25 pm
What was repaired on your scope? Was there a power supply malfunction?
For the (d) mark I recommend you to contact your Agilent authorized distributor.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on May 17, 2014, 05:31:40 pm
I notice a license beginning on the second line that reads DIS(2015-1-27). Could that be a DIStributor License that ends on January 27, 2015?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: starblue on May 17, 2014, 06:39:36 pm
> But why not display (d) after MSO, did you purchased MSO licence?

I added the MSO license today after getting it back.
Also, most of the other d's disappeared after I added the DSOX3APPBNDL license (i.e. for those options that were included in the license). I had done that before the repair, but apparently I needed to load the license file again.

> What was repaired on your scope?

It wouldn't boot most of the time (screen stayed dark, LEDs cycled), so I got it repaired on warranty.
Seems to be OK now, and I got a nice cal certificate for the state after repairs.

> I notice a license beginning on the second line that reads DIS(2015-1-27). Could that be a DIStributor License that ends on January 27, 2015?

I suppose so.

I had the trial licenses activated, which expired during the repair.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on May 17, 2014, 06:47:23 pm
It wouldn't boot most of the time (screen stayed dark, LEDs cycled), so I got it repaired on warranty.
So they did not tell you the exact reason? How old was that scope?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: starblue on May 17, 2014, 06:49:49 pm
> So they did not tell you the exact reason?

No, they didn't.

> How old was that scope?

Brand new.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on May 17, 2014, 06:52:28 pm
It must have been a production failure. It happens. It would be worse, if the fault appeared three years and one month after purchase.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on May 17, 2014, 07:31:50 pm
Just received my msox2024a via agilent's ebay certiprime store. Fantastic scope and of course even more fantastic with the license stuff from this thread (thanks much to the major contributors!).

Now, I'm look at the dsoxlan diy projects and I am going to run some protoboards soon, so figure I may as well roll my own lan adapter board.

My #1 question though is the center tap voltage requirement on the phy side. Looking at pictures/video of the real dsoxlan board I can see what appears to be a 11 ohm resistor (marked 110 on the video) and capacitor joined together to the 2 joined center taps of the amp magjack. This would imply the other end of the cap (likely a 0.01uf) is going to ground and the other end of the 11 ohm resistor is going to VCC (3.3V or ??).

The georgd board appears to have the center taps of his magjack going through a 1uf cap and then to GND on the edge connector?

So, if someone has a real dsoxlan board, what is the other end of the 11 ohm resistor connected to? GND (seems unlikely) or one of the edge pins or one of the regulators on the board?

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: blueindiana on May 19, 2014, 02:31:37 pm
hey
this is chenyi from china   
My English is very poor,so  I used Google to translate Chinese into English? I hope it does not affect your understanding.
I met a  serious problem:
I am trying to update my oscilloscope's firmware(DSOX2012A) tonight,and i ignored the warning following behind:
//CAUTION: When upgrading your oscilloscope, download the .cab file, and load the complete file into the oscilloscope. Please do not “unpack” or “unzip” the .cab upgrade file; you could potentially only load a portion of the required files in the package. This could result in your oscilloscope becoming non-operational, requiring it to be sent to an Agilent service center to be repaired.//
i unziped the file,then the oscilloscope sure enough becoming non-operational. so i was wondering if there's anyone konws how to fix it.   thank you for your Reply
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on May 19, 2014, 04:50:11 pm
Well, what exactly happens when you turn on your scope?
Did you try this?
1) Save the *.cab file on the USB flash disc.
2) Insert the USB flash disc into scope's USB port.
3) Turn on the scope.
4) The scope might boot up from the USB flash disc.
Please note that I do not know if this works. You are doing everything at your own risk!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on May 19, 2014, 06:05:54 pm
Just received my msox2024a via agilent's ebay certiprime store. Fantastic scope and of course even more fantastic with the license stuff from this thread (thanks much to the major contributors!).

Now, I'm look at the dsoxlan diy projects and I am going to run some protoboards soon, so figure I may as well roll my own lan adapter board.

My #1 question though is the center tap voltage requirement on the phy side. Looking at pictures/video of the real dsoxlan board I can see what appears to be a 11 ohm resistor (marked 110 on the video) and capacitor joined together to the 2 joined center taps of the amp magjack. This would imply the other end of the cap (likely a 0.01uf) is going to ground and the other end of the 11 ohm resistor is going to VCC (3.3V or ??).

The georgd board appears to have the center taps of his magjack going through a 1uf cap and then to GND on the edge connector?

So, if someone has a real dsoxlan board, what is the other end of the 11 ohm resistor connected to? GND (seems unlikely) or one of the edge pins or one of the regulators on the board?

cheers,
george.

Anybody??

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jlmoon on May 20, 2014, 02:47:18 pm
Sort of surprising considering how many very intelligent people buy and use this kind of tool.
I just assumed most of the people/companies who could readily afford that type of tool don't really need to be hacking options.

Yes, the vast majority have no need nor desire to hack their scope, nor would most even think to look for one. Agilent know that and rely on that. If a hack did eventually happen, I doubt they would bat much of an eyelid.



Sigh!  Nothing like an "Electronic Rubik's Cube"!  The sheer challenge of UN-doing the Done-up!..  :-DD
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: HooRide on May 21, 2014, 10:20:30 pm
Does anybody know what a "(d)" following the license names means?

I got my scope back from repairs and most licenses were marked like that, see attached screenshot.

Unless numbers work in a completely different way in Germany; you have a higher firmware version than what is available on their site for us to upgrade to.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: blueindiana on May 22, 2014, 01:14:38 pm
Well, what exactly happens when you turn on your scope?
Did you try this?
1) Save the *.cab file on the USB flash disc.
2) Insert the USB flash disc into scope's USB port.
3) Turn on the scope.
4) The scope might boot up from the USB flash disc.
Please note that I do not know if this works. You are doing everything at your own risk!

thanks for your relay,i've tried the method you told me?i failed .   i posted the scope out to reload the  firmware.Thanks again for your courtesy.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: starblue on May 22, 2014, 06:53:29 pm
Unless numbers work in a completely different way in Germany; you have a higher firmware version than what is available on their site for us to upgrade to.

Yes, new scopes come with 2.36 which is not (yet?) available for download.
That has been discussed on this thread already.

Jürgen
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dunkemhigh on June 06, 2014, 08:24:28 pm
Quote
It will take a while for the boards to come through, but once I have them and have figured out the actual costs...

The boards have turned up, and I've built one to verify that it works. It does :)

The pix show the bare board (no silkscreen or solder mask - it is really bare, not just figuratively) and the built one. The built one has a PTH cap because I didn't have a SMT one big enough. Built boards will go out with the right thing.

I can ship these for the following prices (which basically cover my costs). Note that the built units attract VAT since I have to buy the magjacks on a company account.
Item Cost
Bare PCB to UK address £2.50
Built PCB to UK address £9.60
Bare PCB to US address £4
Built PCB to US address £13.50

All prices use untracked shipping, and the US ones will take about 10 days. However, there is a possibility I've screwed up so I will ask for the actual cost once I've sent the items. If you're not in the US or UK I will quote you separately.

I have 9 of these PCBs to go, and my preference is to ship bare PCBs. If you want a built one it will take a little while to ship - I need to order the parts and build them first, and I am a bit busy at the moment, so they won't go out overnight.

PM me with your address and whether you want built or raw, and I'll take it from there.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: zucca on June 07, 2014, 05:35:31 pm
Anybody??

Zucca!

Here just to start:

(http://s2.postimg.org/49xg7cv21/IMG_1375.jpg)
(http://s2.postimg.org/puxxh82ex/IMG_1376.jpg)

if we call

(http://s2.postimg.org/5l0m231a1/IMG_1375_crop.jpg)

and

(http://s2.postimg.org/3uhl0ljqx/IMG_1377.jpg)

Here is when I get continuity:

A with 0,3,4,7,10,14,16,17
B with 1,2

Good luck!

PS: My multimeter shows 10R , not 11...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on June 07, 2014, 05:46:57 pm
Zucca, thanks!

I received boards back from the pcb house a few days ago, a panel that includes a lan board. I've trimmed it to fit/push into the edge connector, nice snug fit and all the pads line up perfectly. I need to order a magjack - next digikey order - this week.

Edit: Ok, just plugged the board into my dsox and measured power on Pin 1/2 per your annotated pictures and there is 3.3V on those 2 pins. So, that means the terminator power feed in the magjack have a cap to ground (likely 0.01uF) and a series resistor fed from 3.3V which makes perfect sense.

Now I know how to wire the magjack termination. The PCB layout I did has a variety of options including its own terminator regulator (just in case) since I sent it out to fab before anyone (thanks again Zucca) responded to my request.

I've got to figure out the LED polarity on the magjack still. If you have time or get a chance, could you ohm out the LED connections (on the magjack) all the way to the edge connector? TIA.

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: zucca on June 07, 2014, 06:34:38 pm
For the LED, If this

https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg445541/#msg445541 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg445541/#msg445541)

was not helpful, surely I will. Datasheet?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on June 07, 2014, 06:59:52 pm
For the LED, If this

https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg445541/#msg445541 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg445541/#msg445541)

was not helpful, surely I will. Datasheet?

I've seen that post (I've read all this thread a few times). What wasn't clear was WHICH end of the LED (anode or cathode) was wired to the edge connector. The pictures don't show the internal traces (of course) so I can't tell the anode/cathode connection.

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: zucca on June 07, 2014, 08:42:37 pm
Unbeliveable...

Like at work, also in my spare time I have to cover the holes left by someone else. "Do it right or not do it", that´s should be the first teaching to our children.
I´m not irritated at all, just surprised  :o.

Here the Datasheet:

http://www.trpconnector.com/pdfs/6605758.pdf (http://www.trpconnector.com/pdfs/6605758.pdf)

Now it looks like the 5-6605758-2 has already the 250R for the LED inside.

Here we go (see datasheet for the Dx pins):

D1 and D3 to pin 1/2 (3.3V, see posts above).
D2 and D4 see below:

(http://s22.postimg.org/hi43ax4oh/IMG_1376_crop.jpg)

Moreover IMO there are some filtering caps between D1,D3 and ground.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on June 07, 2014, 10:53:55 pm
Thanks Zucca, that clears things up nicely. I'll put it into a schematic in the next few days and post it up. At least it will then be clear and in one place how the magjack is wired.

Yes, the -2 has the 250 ohm resistors inside. My PCB had work either way, since digikey appears to stock some flavours of the 5-6605758 but not all of them.

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on June 14, 2014, 01:21:43 am
So, I have my LAN board working nicely thanks to Zucca's clarifications of some of the signals. I'll post up a schematic in the next day or three, but here's some pics.

First pic is my lan board (most of the resistor options etc are to cover any cathode/anode polarity issues with the LEDs - before Zucca provided the additional details, and if a regulator would be needed for the termination network in the magjack). This is a picture prior to cutting out a slot in the edge connector and trimming the excess board material. This PCB was on a 'panel', so it was cut from a large rectangular panel of various other test boards etc.

After trimming it was a perfect fit into the edge connector in my dsox scope.

(http://www.taskled.com/leds/aglanpcb.jpg)

I carefully measured the length of the board so that it would fit snugly into the pocket with the plan to cut a hole for the magjack to stick out. By choosing the length 'just right' the original plastic clip/panel snaps nicely into place and supports the magjack end of the board and prevents it moving in any direction. Worked out nearly factory :)

(http://www.taskled.com/leds/aglan.jpg)

LEDs work, board works and I can access it via the webpage for full control. I used telnet to update the 2 required files that open up the licenses inside the scope. This halves the boot time (compared to the USB drive) but more importantly allows the webpage access to work. As someone else in this thread found, if you boot from a USB drive the webpage stuff doesn't work and reports an error.

Of course (as per the other DIY lan boards), the scope doesn't recognise it, so it doesn't appear in the utility->I/O menu, but all the configuration stuff can be done via the webpage server. In my case I put it at a static IP (starts off working since it gets an IP from a DHCP service on the network.

cheers,
george.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on June 14, 2014, 05:22:05 am
< snip >
...This halves the boot time (compared to the USB drive) but more importantly allows the webpage access to work. As someone else in this thread found, if you boot from a USB drive the webpage stuff doesn't work and reports an error.
cheers,
george.

Thank you georges80 for mentioning this information about the webpage!  I encountered the webpage errors two days ago and the situation was just as described earlier in this thread, and it was inconvenient because I could not grab screenshots quickly to the PC.  It's good to know that editing the files on the local system will let the web browser access work as needed.  I have to do this update soon!

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: trevwhite on June 14, 2014, 07:18:41 am
Hi all

I built a board up kindly provided by dunkemhigh. It seems to get an IP address, I can ping it but when I try to load the webpage it just reboots instantly. Is this a known issue when booting from a usb stick?

Thanks

Trev
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on June 14, 2014, 02:16:03 pm
When running from a USB drive and I try to access the webpage interface I do NOT get a reboot. What I get is an error message from the browser (firefox, IE etc, doesn't matter, same error message).

The solution (maybe there are others) is to transfer the license patches INTO the scope, i.e. the two files (as per mwilson's posts) get written to the scope and then boot from the scope. Does you lan card work ok (accesses the webpage correctly) if you boot from the scope (remove the USB drive)?

Another test to make sure your lan card is working is to telnet to the scope (login/password have been posted earlier in this thread -> infiniivision/skywalker1977 if I remember correctly). Telnet works just fine even if you have booted from a USB drive.

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on June 14, 2014, 10:03:16 pm
So, I made my own LAN card and of course it isn't recognised/displayed in the I/O settings like all the other DIY lan cards. I remember seeing a comment by Plesa about pin 78 appearing maybe like a 'detect' pin. Looking at the pictures Zucca posted, there's a 0 ohm resistor and from his measurements it make pin 78 ground potential.

Plesa mentioned he had issues when he connected pin 78/80 (he used kapton on other pins of his vga/lan card). Anyhow, I figured I'd try to connect pin 78 to pin 80 on my DIY lan board. I get no errors (that he reported), BUT I now have the dsox2000 recognising that there is a LAN card plugged in. Menu now has all the Lan Configuration menu stuff active. The IP address (static in my case) is being populated correctly as per my router setup as soon as I plugged in the lan cable.

I'll post up more details in a bit - just got this working and now need to play with it a little :)

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: zucca on June 14, 2014, 10:31:10 pm
Well done bro! I knew there was potential in you... I'm glad I was a part of this project. The next step would be setting up a HDMI interface there... but it is not as important as a LAN! Well... Who cares now about a external monitor interface...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on June 14, 2014, 11:04:18 pm
Zucca, thanks for the pics and your connection info, definitely was what I needed to get my lan board running.

Here's the 'patch' to make the dsox recognise the lan card:

(http://www.taskled.com/leds/lan_rec.jpg)

and this is proof :)

(http://www.taskled.com/leds/lan_recs.jpg)

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georgd on June 15, 2014, 04:33:22 am
I am so happy that LAN adapter is fully functional!
Even most wanted feature for me: SCPI over port 5024.
Here is screenshoots taken by VNC.

Many thanks for all contributors in this project.

Georg
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dunkemhigh on June 15, 2014, 06:50:25 am
Quote
Here's the 'patch' to make the dsox recognise the lan card:

Blinding work, that man  :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dunkemhigh on June 15, 2014, 03:20:34 pm
The mod georges80 made to the existing rear panel plug is what I had in mind, but when it came to putting knife to plastic I had a change of heart - it is rather final if one should screw up.

So, instead, I milled a but of PCB to the right size and affixed that to the LAN PCB with a couple of right-angle brackets. If I'd though to do this before sending off the gerbers I would have included the holes in the PCB, but they came out not too badly free-hand.

I used PCB pillars as extensions to have something to grip to pull the card out. They also make it easier to align the card when fitting it, but it now occurs to me that a flat blade could be inserted into the top and bottom cutout (where the clips on the real thing latch), so ejecting it isn't the problem I thought it might be. So at some point I'll remove the pillars and have the screw heads sitting flush.

So, not as pretty as either of the other DIY mods, but it's a bit easier and not fatal if you get it wrong.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: zucca on June 15, 2014, 04:28:17 pm
I ordered a 3D Printer... can´t wait to start to play with and fix all those above described problems about enclosures. I´m quite surprised nobody is already came up with a sketchup .stl file.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dunkemhigh on June 15, 2014, 10:06:06 pm
Quote
surprised nobody is already came up with a sketchup .stl file

Don't know about anyone else, but I haven't because I have no experience of designing enclosures for 3D printing. I want to get this done reasonably quickly and then move on to using the scope, rather than spend the next 6 months learning how not to spend as much as the scope cost on making a plastic box to fit in it. But feel free to show us how it's done, optionally offering to sell us said boxes  :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: HighVoltage on June 16, 2014, 09:05:59 pm
I am in need of some help for booting from a USB Stick on my DSO-X 2002A, that I just bought used.
It came with  Firmware 2.35 is installed.
Options:
- EDK, Wavegen is permanently activated
- LAN/VGA Module is installed.

After reading this thread, I followed the instructions.
First the scope did not want to boot from a USB stick, but after formatting the stick with FAT16 it is booting ok.
After the bootup I am getting the message "All Options enabled"
But when I look in the "About Oscilloscope" window, the options are not installed
Instead I see: BW20, VID, CABLE, SCPIPS

The first picture below is normal bootup
the following three pictures are from the USB bootup.

Can someone explain to me, what I might have done wrong.
In addition to the bootup from the USB stick, do I need to do anything else?
Thanks for any advise



Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: WVL_KsZeN on June 19, 2014, 08:12:55 pm
Another dunkemhigh LAN board soldered up and installed :-) It gets recognized by the scope (georges80 hack by shortening the two pins), but during boot it does give an error 'System concers detected -LAN/VGA option module fault'. I guess this is because there's no VGA things happening on the board. Do yours also show the error after booting?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on June 19, 2014, 08:58:19 pm
No LAN/VGA errors/warning when I boot my scope up. The only 'warning' is the license hack. I have installed the license hack into my scope - rather than booting from a USB flash drive (not sure if that makes any difference). Try booting yours without the USB flash drive (if that's how you are booting)... just as a test.

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: WVL_KsZeN on June 19, 2014, 09:05:00 pm
My scope is not hacked :-) No usb drives here.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on June 19, 2014, 09:16:35 pm
Hmm - well, I get no lan/vga errors/concerns/warnings. Maybe check that the card is inserted well and there's no shorts or issues with the edge connector/card mating.

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dunkemhigh on June 19, 2014, 09:25:31 pm
I just applied the pin 78/80 mod to my PCB, and additionally copied the dll to internal flash so I don't need the USB stick. On boot I still get the message "Booting from USB" although it boots without a USB stick! No LAN/VGA error message, and dropping into the I/O menus I can see and set the LAN parameters fine.

I feel a bit guilty that mine works but two I sent to other people don't. Maybe another recipient could pop up and say if theirs works...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: WVL_KsZeN on June 19, 2014, 09:26:41 pm
weird.. double checked my soldering and measured all the values. All values OK and no shorts. Reseated the board, but still the 'concern' remains.. hmmm..

Pulling out the multimeter, I do measure some strange values at the magjack.. when looking at the card from the bottom, with the magjack to the left, I measure the following on the row of 6 pins :

highest pin (closest to capacitor, let's call it pin 1) to pin 2 = 0.4 ohms.
pin 1 to pin 3 also 0.4 ohms!
pin 1 to pin 4 also 0.4 ohms!
pin 1 to pin 5 also 0.4 ohms,
pin 1 to pin 6 0.1 ohms.

but i didnt make any shorts on the bottom side while soldering.. maybe the casing of the magjack is shorting the traces together on the upper side of the board? There's no solder mask here.. No.. between pins and magjack = OL.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dunkemhigh on June 19, 2014, 10:45:21 pm
I measure:

1 - 2 = 6R
1 - 3 = 5R8
2 - 3 = 6R7

1,2,3 - 4,5,6 = 0R

6 - 5 = 6R
6 - 4 = 5R8
5 - 4 = 6R7

This is a standalone magjack (same order as the one you have). Yours is shorting somehow - if there is nothing external doing it it has to be a bum magjack. If you can confirm that I'll send you this spare.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: WVL_KsZeN on June 20, 2014, 09:01:51 am
Will desolder The magjack andere check it next monday!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on June 20, 2014, 04:10:23 pm
No LAN/VGA errors/warning when I boot my scope up. The only 'warning' is the license hack. I have installed the license hack into my scope - rather than booting from a USB flash drive (not sure if that makes any difference). Try booting yours without the USB flash drive (if that's how you are booting)... just as a test.

cheers,
george.
I thought when you installed the hack directly to the scope it didnt give the warning and booted as normal?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: trevwhite on June 20, 2014, 04:14:32 pm
I get the same values when I measure my board. Magjack code is : RJMG163218101NR

weird.. double checked my soldering and measured all the values. All values OK and no shorts. Reseated the board, but still the 'concern' remains.. hmmm..

Pulling out the multimeter, I do measure some strange values at the magjack.. when looking at the card from the bottom, with the magjack to the left, I measure the following on the row of 6 pins :

highest pin (closest to capacitor, let's call it pin 1) to pin 2 = 0.4 ohms.
pin 1 to pin 3 also 0.4 ohms!
pin 1 to pin 4 also 0.4 ohms!
pin 1 to pin 5 also 0.4 ohms,
pin 1 to pin 6 0.1 ohms.

but i didnt make any shorts on the bottom side while soldering.. maybe the casing of the magjack is shorting the traces together on the upper side of the board? There's no solder mask here.. No.. between pins and magjack = OL.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dunkemhigh on June 20, 2014, 04:50:38 pm
pins 1 and 6 are shorted on the PCB, so the 0R1 is expected there. 1 and 6 are also the center tap of the two channel magnetics, so you will see some connection between all pins when it's mounted on the PCB. But 0R4 is rather low.

The datasheet for the magjack is here:

http://www.farnell.com/datasheets/71713.pdf (http://www.farnell.com/datasheets/71713.pdf)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on June 20, 2014, 06:06:30 pm
No LAN/VGA errors/warning when I boot my scope up. The only 'warning' is the license hack. I have installed the license hack into my scope - rather than booting from a USB flash drive (not sure if that makes any difference). Try booting yours without the USB flash drive (if that's how you are booting)... just as a test.

cheers,
george.
I thought when you installed the hack directly to the scope it didnt give the warning and booted as normal?

No, the hack will give a warning error regardless of USB boot or internal flash boot. Basically the scope likely must checksum/crc or somehow sign the files to determine if something has been 'altered/damaged/changed'.

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on June 20, 2014, 06:11:37 pm
pins 1 and 6 are shorted on the PCB, so the 0R1 is expected there. 1 and 6 are also the center tap of the two channel magnetics, so you will see some connection between all pins when it's mounted on the PCB. But 0R4 is rather low.

The datasheet for the magjack is here:

http://www.farnell.com/datasheets/71713.pdf (http://www.farnell.com/datasheets/71713.pdf)

The magjack magnetics on the phy side are just transformers and I'd expect very low DC resistance. I tested a 1gig magnetics that I have on one of my boards and they basically read near zero ohms (the lead resistance of my fluke 87III has more resistance).

Also, I've noticed on the original DIY design that the center tap of the transformer (on the phy side) is going to a capacitor and then ground.

From measurements by Zucca the agilent unit has 3.3V tied to the center tap pins (via a 10 ohm resistor and a cap, likely 0.1uf, to ground). i.e. the center tap is powered to 3.3V. This is common with the magnetics (some use 0V) - all depends on the actual phy in use. In this case 3.3V to the center taps is the 'correct' voltage. Not sure if that has any bearing in this case since your unit works from your reports.

cheers,
george

Edit: Fix stupid typo - grrr...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sbampato12 on June 24, 2014, 08:16:43 pm
I've received the pcb from dunkemhigh (thank a lot!), but I haven't got the MagJack yet.
But I already did the jumper on 78-80 pins, and connected it to scope, and got a LAN options avaliable.  :-+ :-+

Only waiting the magjack...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on June 30, 2014, 01:35:26 am
Another dunkemhigh LAN board soldered up and installed... but during boot it does give an error 'System concers detected -LAN/VGA option module fault'.

I also received two of the dunkemhigh boards and I am getting the same error on boot 'System concerns detected - LAN/VGA option module fault'. I installed the recommended magjack, pair of 220R and single 1uf components on both boards, but I get the same error on each. Anyone figure this out yet? Any suggestions?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on June 30, 2014, 02:17:49 am
As per my post #563 I don't believe the cap to ground on the center tap of the magnetics is correct. The original LAN/VGA board has 3.3V going through a 10 ohm resistor to the center taps. Also a cap to ground on the center tap side (just a bit of filtering). The key though is that the center tap is at 3.3V potential.

I'd give that a try and see if it helps. Presumably the scope is doing some checks via the Phy during boot up and sensing something isn't quite right. Given NOTHING is wired to any other pins the detected problem seems more than likely just a LAN issue.

My board (I layed out my own 'version') reports no lan/vga erros and works perfectly. I used the same magjack as the agilent lan/vga board and used the 10 ohm/0.1uf cap to get 3.3V to the two center taps.

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on June 30, 2014, 04:03:26 am
Thanks George. I had read your posts, but was under the impression that others had the dunkemhigh board working fine with just the two 220R and a 1uf. It seems that way from other reports about the board anyway.

I'm not sure how to assure that the jack has 3.3 volts to the center tap without actually measuring voltages on the jack while the board is installed and running. And I'm worried about leaving it installed and running in my expensive scope given the error, and then probing around on top of that with power to the scope and board. I'm hoping someone else who has this board can give a more definitive answer about the correct component values, and if another component should be added or not. Alternatively, if someone knows what voltages should be applied to what edge connector pins on the card, I could then check the center taps with the card uninstalled and powered by my bench power supply.

I appreciate your help and comments, but I'm a bit apprehensive, especially remembering that Dave burnt his scope up once on a bad LAN card and had to return it to Agilent to be repaired.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on June 30, 2014, 04:13:14 am
The 3.3V comes from the edge connect. Go back a few pages in this thread and you'll find the pinout that Zucca posted and voltages he measured.

I soldered a few flying leads to various points on my board and plugged it in to measured and verify the 3.3V pin on the edge connector and it was correct as per Zucca's post.

Seems like quite a few folk have had similar problems to yours - so that's why I'm wondering if the incorrect center tap voltage is the issue.

I'm pretty sure (could be wrong...) that the dunkemhigh board has the center tap pins tied together and ONLY to a cap that is grounded on the other end - i.e. there is no DC bias being injected into the center tap.

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dunkemhigh on June 30, 2014, 07:36:46 am
I wonder if the board works for me due to the cap I used, which is visible in the photo here: previous EEVblog post (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg457798/#msg457798). Doesn't seem likely, but maybe I should try and break it...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: WVL_KsZeN on June 30, 2014, 08:49:35 am
Weird, I haven't got it work yet, wonder why dunkemhigh's board is working. Maybe I should send mine to dunkemhigh to compare in his scope?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dunkemhigh on June 30, 2014, 09:29:27 am
Quote
Maybe I should send mine to dunkemhigh to compare in his scope?

If you wanted to do that, I'd be happy to try it.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: WVL_KsZeN on June 30, 2014, 09:38:47 am
OK, I'll send it to you :-)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on June 30, 2014, 10:54:30 am
OK, I'll send it to you :-)

Great, I guess I will wait to see what dunkemhigh finds out first.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on June 30, 2014, 11:03:35 am
The 3.3V comes from the edge connect. Go back a few pages in this thread and you'll find the pinout that Zucca posted and voltages he measured...

I'm pretty sure (could be wrong...) that the dunkemhigh board has the center tap pins tied together and ONLY to a cap that is grounded on the other end - i.e. there is no DC bias being injected into the center tap.

Thanks, I see those posts and will try and check it out when I get a chance.

It seems several of us are having the same issue with the board. Hopefully WVL_KsZeN can get his board back to dunkemhigh quickly and the problem found.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: JimHorn on July 04, 2014, 01:46:48 am
So far, I've found how to set up version 2.35 on a USB drive - but not 2.37 which is the only version Agilent provides anymore. I'd like to try the mods described earlier on my 02.35.201... version DSO 3014A but they don't work with the 2.37 image (I'm sure the infiniiVisionCore.dll locations to change have moved, among other things).

Does anyone have ideas on how to either modify the 2.37 image to enable options -or- where I might find a copy of the 2.35 version?

Many thanks to all -
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on July 04, 2014, 06:16:18 pm
Oh wow, so theres a 2.37 now? When did that come out? Last I had heard of was 2.36. And I have to say, you guys that have been working on the LAN card have been doing an awesome job, but seriously, all that work has made me very glad I just bought the VGA/LAN card when I did and jumped on it when I was able to get a good deal! Keep it up though as Im sure it will help lots of people out there!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: zucca on July 05, 2014, 07:57:20 pm
Here the 2.37

http://www.home.agilent.com/agilent/software.jspx?ckey=2014548&lc=eng&cc=US&nid=-33573.970736&id=2014548 (http://www.home.agilent.com/agilent/software.jspx?ckey=2014548&lc=eng&cc=US&nid=-33573.970736&id=2014548)

Released on the 21st May 2014
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on July 05, 2014, 08:20:43 pm
If someone needs the old 2.35 please send me a pm.
I have uploaded the cab file on my webspace.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on July 06, 2014, 11:02:40 pm
Oh wow, so theres a 2.37 now? When did that come out? Last I had heard of was 2.36....

Some info for all: firmware v2.36 was never available for download from Agilent; it only ever came pre-installed on new units or refurbs.  The previously downloadable version was v2.35.

I've attached the release notes for v2.37 --- there are a few enhancements, especially for power application measurements.

Previous attempts by members in the forum, myself included, were unsuccessful to get v2.36 working with the USB boot for patching options; other than USB boot not working, it appeared changes in "ProcessStartupFolder.exe" were involved, but this file could not be read from flash.  Anyone want to look at v2.37.  I will post back some findings after I look at the new firmware.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on July 11, 2014, 06:31:21 am
For those interested, I have uploaded (http://wikisend.com/download/321628/infiniiVision.rar) the "infiniiVisionCore.dll" from firmware releases 2.35, 2.36 and 2.37.  The file is ~50kB larger in 2.37 than the previous two versions (which are the same size, but different).

Since 2.36 did not allow USB boot it would be surprising if 2.37 allowed it again...  I have not tested installing 2.37 and seeing if a downgrade to 2.35 is possible...

From previous investigation, it seems \Windows\ProcessStartupFolder.exe in 2.36 may have been modified to prevent booting from USB drive.  I made a lot of attempts to copy ProcessStartupFolder.exe from internal flash when I had 2.36 installed, but it was not possible.

Is there any way to obtain this file from the 2.37 CAB?  I could not find it in infiniiVisionSetup.cab, so perhaps it is in another file (NK.BIN.COMP?)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: zucca on July 13, 2014, 08:23:32 pm
After getting a request from someone here what I did:

1) Upgrade from 2.35 to 2.37: OK!
2) Test SCPI on port 5024 with FW 2.37 (require LAN Module): OK!

Code: [Select]
Welcome to Agilent MSOX3054A InfiniiVision - MY5113XXXX
>>*idn?
AGILENT TECHNOLOGIES,MSO-X 3054A,MY5113XXXX,02.37.2014052001

3) downgrade from 2.37 to 2.35: FAILED!

See screenshot below, forgive me for the focus

(http://s18.postimg.org/ihfa8xhq1/Downgrade_failed.jpg)

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dunkemhigh on July 14, 2014, 12:58:46 am
Quote
3) downgrade from 2.37 to 2.35: FAILED!

Erk! That's a bit of a one-way trip. We should all be grateful you've tested that, at the expense of not being able to muck about with your kit now :(
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: eurofox on July 14, 2014, 11:04:01 am
Quote
3) downgrade from 2.37 to 2.35: FAILED!

Erk! That's a bit of a one-way trip. We should all be grateful you've tested that, at the expense of not being able to muck about with your kit now :(

Smart done from Agilent  :-DD :-DD :-DD
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on July 14, 2014, 01:18:48 pm
Once original Agilent Option Licenses are installed in a scope, there is no need to reinstall them each time the firmware is updated. The new firmware keeps all your existing licenses intact. With this being the case, I’m curious… Has anyone loaded the hacked 2.35 firmware internally to their scope (not just booted from USB), then updated to the 2.37 firmware. If so, were any or all the upgraded options kept, as they would be in a scope with original Agilent licenses?

If so, this would be a good scenario for anyone with 2.35 or lower, as the options could be loaded and then the scope updated as future firmware and features are released. It would not be good for newer scopes already loaded with firmware later than 2.35.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: zucca on July 14, 2014, 01:29:31 pm
were any or all the upgraded options kept, as they would be in a scope with original Agilent licenses?

In my case I paid $$$ for the options and I did not hack the scope. Of course I was not worried at all to test the upgrade to 2.37, since I was sure the options were still there no matter what.

Good Luck for all your hacked scopes, in my experience it is just a matter of time so be patience, don´t give up with the reverse engineering and don´t lose hope.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mwilson on July 14, 2014, 10:29:19 pm
I’m curious… Has anyone loaded the hacked 2.35 firmware internally to their scope (not just booted from USB), then updated to the 2.37 firmware. If so, were any or all the upgraded options kept, as they would be in a scope with original Agilent licenses?

Because the hack isn't really "installing" licenses, it's modifying the actual oscilloscope software to make it think certain licenses are enabled, the firmware upgrade will replace that oscilloscope software with a non-modified version, so the scope will no longer think the licenses are enabled. (For example, I did install the modified 2.35 to the internal memory but whenever I wanted to undo it to try a different method or experiment I simply re-installed the 2.35 firmware from Agilent and all the hacked license features were gone.)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on July 14, 2014, 10:40:41 pm
Because the hack isn't really "installing" licenses, it's modifying the actual oscilloscope software to make it think certain licenses are enabled, the firmware upgrade will replace that oscilloscope software with a non-modified version, so the scope will no longer think the licenses are enabled...

OK, that make sense. I guess keeping 2.35 installed is a good idea, at least until something is able to be done with 2.37 (or later). Don't see any compelling reason to go to 2.37 anyway.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: yocheng on July 16, 2014, 01:58:13 pm
How to hack the firmware
1. Unpack the firmware *.cab by 7zip
2. Unpack infiniiVisionSetup.cab ( e.g. with WinCE CAB Manager 3.0)
    Find \Secure\infiniiVision\infiniiVisionCore.dll
3. Change at location 0x277e50 in infiniiVisionCore.dll
    byte sequence 04 00 a0 e1 to byte sequence 00 00 a0 e3
4. Enable startup Overide by creating USB flash with following structure in root of USB drive (copy structure from Secure folder from point 2)
    Edit in Startup folder file infiniivision.lnk to contains following sequence "62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"
    Replace in infiniiVision folder  infiniiVisionCore.dll with patched infiniiVisionCore.dll file
5. Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
6. Plug the USB drive to scope and turn it ON
7. There will be red  message in letf top corner "Unfinalized Software"  and "System Concerns detected: OS version is not correct. Please reload system firmware"

Applications needed:
 WinCE CAB Manager http://www.ocpsoftware.com/products.php (http://www.ocpsoftware.com/products.php)
 7Zip http://www.7-zip.org/ (http://www.7-zip.org/)

These steps can be used in the 2.37 firmware?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on July 16, 2014, 02:40:00 pm
How to hack the firmware
1. Unpack the firmware *.cab by 7zip
2. Unpack infiniiVisionSetup.cab ( e.g. with WinCE CAB Manager 3.0)
    Find \Secure\infiniiVision\infiniiVisionCore.dll
3. Change at location 0x277e50 in infiniiVisionCore.dll
    byte sequence 04 00 a0 e1 to byte sequence 00 00 a0 e3
4. Enable startup Overide by creating USB flash with following structure in root of USB drive (copy structure from Secure folder from point 2)
    Edit in Startup folder file infiniivision.lnk to contains following sequence "62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"
    Replace in infiniiVision folder  infiniiVisionCore.dll with patched infiniiVisionCore.dll file
5. Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
6. Plug the USB drive to scope and turn it ON
7. There will be red  message in letf top corner "Unfinalized Software"  and "System Concerns detected: OS version is not correct. Please reload system firmware"

Applications needed:
 WinCE CAB Manager http://www.ocpsoftware.com/products.php (http://www.ocpsoftware.com/products.php)
 7Zip http://www.7-zip.org/ (http://www.7-zip.org/)

These steps can be used in the 2.37 firmware?

No.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on July 16, 2014, 02:40:44 pm
These steps can be used in the 2.37 firmware?

No. The structure and length of the new firmware cab is different.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: yocheng on July 16, 2014, 03:36:03 pm
How to hack the firmware
1. Unpack the firmware *.cab by 7zip
2. Unpack infiniiVisionSetup.cab ( e.g. with WinCE CAB Manager 3.0)
    Find \Secure\infiniiVision\infiniiVisionCore.dll
3. Change at location 0x277e50 in infiniiVisionCore.dll
    byte sequence 04 00 a0 e1 to byte sequence 00 00 a0 e3
4. Enable startup Overide by creating USB flash with following structure in root of USB drive (copy structure from Secure folder from point 2)
    Edit in Startup folder file infiniivision.lnk to contains following sequence "62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"
    Replace in infiniiVision folder  infiniiVisionCore.dll with patched infiniiVisionCore.dll file
5. Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
6. Plug the USB drive to scope and turn it ON
7. There will be red  message in letf top corner "Unfinalized Software"  and "System Concerns detected: OS version is not correct. Please reload system firmware"

Applications needed:
 WinCE CAB Manager http://www.ocpsoftware.com/products.php (http://www.ocpsoftware.com/products.php)
 7Zip http://www.7-zip.org/ (http://www.7-zip.org/)

These steps can be used in the 2.37 firmware?

No.

My firmware is 2.37 I can drop to 2.35?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: yocheng on July 16, 2014, 03:37:53 pm
These steps can be used in the 2.37 firmware?

No. The structure and length of the new firmware cab is different.

My firmware is 2.37 I can drop to 2.35 firmware?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on July 16, 2014, 03:48:18 pm
My firmware is 2.37 I can drop to 2.35 firmware?

You should go back and read the last couple of pages...

After getting a request from someone here what I did:
1) Upgrade from 2.35 to 2.37: OK!
2) Test SCPI on port 5024 with FW 2.37 (require LAN Module): OK!
3) downgrade from 2.37 to 2.35: FAILED!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on July 16, 2014, 07:54:46 pm
A quick analysis of 2.37 shows that Startup Override functionality is disabled in ProcessStartupFolder.exe: it still looks for infiniivisionStartupOverride.txt file, but instead of executing lnk/exe files it runs "ipconfig.exe /all > ipconfig.txt" (what is it? a "tampered" mark?), then "rebootInfiniiVision.exe", which surprisingly results in reboot  >:D 2.36 has the same problem I guess.
We should focus on downgrade I think.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on July 16, 2014, 10:58:15 pm
So i did some tests with the "Unfinalized Software" Hack on the 2.37 Firmware.

On my Scope is currently the version 2.35 with the most options enabled by DSOAPP Bundle except the MSO Function.

I extracted the cab file of the 2.37 with this tool MSCEInf - CAB Analyzer (No Setup needed and free)
And searched for the same code location and it has moved to 0x27A9A0, changed the 4 byte to 00 00 A0 E3 and put the whole Infiniivision folder to the usb stick.
The Scope boots the 2.37 and the additional features are enabled. (see Screenshots)

A quick analysis of 2.37 shows that Startup Override functionality is disabled in ProcessStartupFolder.exe: it still looks for infiniivisionStartupOverride.txt file, but instead of executing lnk/exe files it runs "ipconfig.exe /all > ipconfig.txt" (what is it? a "tampered" mark?), then "rebootInfiniiVision.exe", which surprisingly results in reboot  >:D 2.36 has the same problem I guess.
We should focus on downgrade I think.
:wtf: Nice find!
Maybe it's posible the change the exe with an older one that supports usb booting
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: yocheng on July 16, 2014, 11:44:25 pm
My firmware is 2.37 I can drop to 2.35 firmware?

You should go back and read the last couple of pages...

After getting a request from someone here what I did:
1) Upgrade from 2.35 to 2.37: OK!
2) Test SCPI on port 5024 with FW 2.37 (require LAN Module): OK!
3) downgrade from 2.37 to 2.35: FAILED!

Thank you for your reply, post too long, not scrutiny. Sorry.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: yocheng on July 16, 2014, 11:53:03 pm
So i did some tests with the "Unfinalized Software" Hack on the 2.37 Firmware.

On my Scope is currently the version 2.35 with the most options enabled by DSOAPP Bundle except the MSO Function.

I extracted the cab file of the 2.37 with this tool MSCEInf - CAB Analyzer (No Setup needed and free)
And searched for the same code location and it has moved to 0x27A9A0, changed the 4 byte to 00 00 A0 E3 and put the whole Infiniivision folder to the usb stick.
The Scope boots the 2.37 and the additional features are enabled. (see Screenshots)

A quick analysis of 2.37 shows that Startup Override functionality is disabled in ProcessStartupFolder.exe: it still looks for infiniivisionStartupOverride.txt file, but instead of executing lnk/exe files it runs "ipconfig.exe /all > ipconfig.txt" (what is it? a "tampered" mark?), then "rebootInfiniiVision.exe", which surprisingly results in reboot  >:D 2.36 has the same problem I guess.
We should focus on downgrade I think.
:wtf: Nice find!
Maybe it's posible the change the exe with an older one that supports usb booting

You cracked the 2.37 firmware?
1.I use 4G USB format it FAT16
2.Change at location 0x27A9A0 in infiniiVisionCore.dll byte sequence 04 00 a0 e1 to byte sequence 00 00 a0 e3
3 Edit in Startup folder file infiniivision.lnk to contains following sequence "62#usbinfiniiVisioninfiniivisionLauncher.exe -l All -l SCPIPS"
4.Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
5.5.Plug the USB drive to scope and turn it ON

But I can not hack it , The LED lamp has been circulating blinking, screen also continue to restart.
who can send me the USB file zip. my E-mail: yocheng@163.com      Thank you very much!
               
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on July 17, 2014, 12:11:33 am
Thank you for your reply, post too long, not scrutiny. Sorry.

You never know what you might be missing by not reading...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on July 17, 2014, 12:14:11 am
So i did some tests with the "Unfinalized Software" Hack on the 2.37 Firmware.
...
The Scope boots the 2.37 and the additional features are enabled. (see Screenshots)

Nice work!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on July 17, 2014, 06:29:14 am
A quick analysis of 2.37 shows that Startup Override functionality is disabled in ProcessStartupFolder.exe: it still looks for infiniivisionStartupOverride.txt file, but instead of executing lnk/exe files it runs "ipconfig.exe /all > ipconfig.txt" (what is it? a "tampered" mark?), then "rebootInfiniiVision.exe", which surprisingly results in reboot  >:D 2.36 has the same problem I guess.
We should focus on downgrade I think.

@abyrvalg: How did you located the file ProcessStartupFolder.exe in the 2.37 download?  I looked but could not find it in any .cab file, so I assume it is compressed with other /Windows/* files, perhaps in a .BIN file but I don't know.  If you could provide some idea, I would appreciate it so I can understand how it all fits together.

ProcessStartupFolder.exe is one file I could not copy from the scope when I was on 2.36 firmware.  We suspected that it was fundamental to changing the USB boot process, and now thanks to your efforts we have good idea what is happening!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on July 17, 2014, 09:09:57 am
Tools to extract the firmware/kernel.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: daemon82 on July 17, 2014, 12:51:37 pm
Hello guys!

I seemed to have a FW problem with the oscilloscope and had to upgrade the firmware unfortunately before I found this forum...
Now I have 2.37 fw revision.
I tried to downgrade  by tricking the process into thinking the 2.35 files are 2.37 indeed by changing strings in INFINI~1.028
I have recalculated the MD5 for the infiniVIsionSetup.cab too to set it in the recipe.xml
I unpacked the .cab files with 7zip and packed them back with CABPACK.
It did not work, I get error message about the file loading unsuccessful.
I am not sure though if it was a wrong packing method I used, or something else.

Did anybody approach the downgrade process from this angle?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on July 17, 2014, 05:40:59 pm
Looks like the problem is here:
2.35 infiniiVisionCore.dll: infiniiVisionInstallService.exe --minimumVersion 2.20.00.00
2.37 infiniiVisionCore.dll: infiniiVisionInstallService.exe --minimumVersion 2.36.00.00
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on July 17, 2014, 06:32:39 pm
Hello guys!

I seemed to have a FW problem with the oscilloscope and had to upgrade the firmware unfortunately before I found this forum...
Now I have 2.37 fw revision.
I tried to downgrade  by tricking the process into thinking the 2.35 files are 2.37 indeed by changing strings in INFINI~1.028
I have recalculated the MD5 for the infiniVIsionSetup.cab too to set it in the recipe.xml
I unpacked the .cab files with 7zip and packed them back with CABPACK.
It did not work, I get error message about the file loading unsuccessful.
I am not sure though if it was a wrong packing method I used, or something else.

Did anybody approach the downgrade process from this angle?

You can buy the DSOX3APPBNDL and it will unlock almost the same like any hack....
http://www.home.agilent.com/en/pd-2401593-pn-DSOX3APPBNDL/application-bundle-for-infiniivision-3000-x-series-oscilloscopes (http://www.home.agilent.com/en/pd-2401593-pn-DSOX3APPBNDL/application-bundle-for-infiniivision-3000-x-series-oscilloscopes)
Included options
DSOX3ADVMATH Advanced math measurement application
DSOX3AERO A/D trigger and decode (MIL-STD 1553/ARINC 429)
DSOX3AUDIO Audio serial trigger and analysis (I²S)
DSOX3AUTO Automotive trigger and analysis (CAN/LIN)
DSOX3COMP Computer trigger and analysis (RS232/UART)
DSOX3EMBD Embedded trigger and analysis (I²C/SPI)
DSOX3FLEX FlexRay trigger and analysis
DSOX3MASK Mask limit testing
DSOX3MEMUP Memory upgrade to 4 Mpts
DSOX3PWR Power measurements
DSOX3SGM Segmented memory acquisition
DSOX3VID Video trigger and analysis
DSOX3WAVEGEN Integrated 20 MHz function/arbitrary waveform generator
DSOXDVM Integrated digital voltmeter
DSOXEDK Educator’s training kit
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on July 17, 2014, 06:40:01 pm
Update: not 100% sure, but it looks like this version is checked against the FileVersion field of VS_VERSION_INFO resource of infiniivisionLauncher.exe inside the cab. This exe looks similar for 2.35 and 2.37, just the version string, timestamps and digital signature differs. Anyone to try putting a 2.37 launcher into 2.35 cab and updating? Somebody from Agilent?  >:D
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on July 17, 2014, 09:57:11 pm
So I did the update to 2.37 and tried how to downgrad to V2.35.
The first step was a modified cab based on V2.35 and Infiniivision.cab from 2.37 to change the Windows folder with the ProcessStartupFolder.exe
The 2.37 Firmware has loaded the Firmware Update successfully but it takes a couple of minutes before the scope reboots.
This is the simples way to restore the \windows folder to an older version because ist write protected.

The next Step was to rename the 2.37 to 2.35 in the infiniiVisionLauncher and infiniiVisionCore and replaced these files directly over telnet from usb to the \sercure folder.
after a reboot i tried to load a V2.35 Firmware but this didn't works maybe the timestamp was also checked. :(

After I replaced the newest files in the \secure\infiniivision folder direcly with the 2.35 Files I was able to load the old v2.35 setup.

So its posible to go back to the V2.35 with the help of telnet access.

Because i did this with try&error i don't have more details at the moment. For the moment I'm happy that my scope is run with V2.35 again an working Usb Startup. :phew:

btw It's easy the change the Splash Screen \windows\compileImageForSplashScreen.exe \usb\SplashImage.png \Secure\InfiniiVision\splashImage.bin
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on July 18, 2014, 05:47:01 am
kilobyte, good news!

If someone with telnet access wants to experiment with cab versioning, there seems to be a quick way to test is it accepted w/o installing it: run infiniiVisionInstallService.exe --validateOnly --minimumVersion 2.36.00.00 \usb\your_cab_file
I don't have a scope to try, use infiniiVisionInstallService.exe --help to get more info on that
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on July 20, 2014, 05:54:59 am
So i did some tests with the "Unfinalized Software" Hack on the 2.37 Firmware.

On my Scope is currently the version 2.35 with the most options enabled by DSOAPP Bundle except the MSO Function.

I extracted the cab file of the 2.37 with this tool MSCEInf - CAB Analyzer (No Setup needed and free)
And searched for the same code location and it has moved to 0x27A9A0, changed the 4 byte to 00 00 A0 E3 and put the whole Infiniivision folder to the usb stick.
The Scope boots the 2.37 and the additional features are enabled...

Thanks kilobyte! I'm in the same boat as you --- have 2.35 and most options enabled by DSOAPP bundle, except BW and MSO.  I was able to reproduce your finding by modifying 2.37 as you instruct, and the MSO and BW options activated.  Thanks for the updated memory location to edit.

Tools to extract the firmware/kernel.

Thank you abyrvalg! I appreciate the nice instructions :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mischo22 on July 22, 2014, 07:56:53 pm
I tested the Version 2.37 installed on my usb-stick.

Warning: It change the Telnet Password!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on July 22, 2014, 09:00:21 pm
It is weird with 2.37 installed on scope telnet password remain unchanged.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on July 22, 2014, 09:15:17 pm
Telnet password is set at every startup by /windows/createUserAccounts.exe program, which lives inside nk.bin.comp - no way to change it.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on July 22, 2014, 10:55:03 pm
I don't have any problems with Telnet login.

But here the first login fail and the second login is working with putty.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dunkemhigh on July 23, 2014, 12:49:02 am
Weird, I haven't got it work yet, wonder why dunkemhigh's board is working. Maybe I should send mine to dunkemhigh to compare in his scope?

The board is here and in my scope. It works exactly the same as my board does - that is, there is no discernable problem. I don't get any warning on boot, and I can do the full remote control stuff without error.

This kind of suggests that mys scope is somehow different from everyone elses. I guess I could flog it with a $200 markup like that chap flogging E4's :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: zucca on July 23, 2014, 01:37:03 am
I don't have any problems with Telnet login.

But here the first login fail and the second login is working with putty.

I used kitty but same thing: first no, second yes no problem. I remember I powered the scope down disconnect the AC main and redo the test, it started no problem immediately. As far I remember in my case the problem was just the first telnet after the upgrade to 2.37. It could be I'm wrong...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: WVL_KsZeN on July 23, 2014, 08:06:43 am
Weird, I haven't got it work yet, wonder why dunkemhigh's board is working. Maybe I should send mine to dunkemhigh to compare in his scope?

The board is here and in my scope. It works exactly the same as my board does - that is, there is no discernable problem. I don't get any warning on boot, and I can do the full remote control stuff without error.

This kind of suggests that mys scope is somehow different from everyone elses. I guess I could flog it with a $200 markup like that chap flogging E4's :)
Well, that explains why I couldnt find any error.. still, not being the only one with the error there must be something we're overlooking?  :-//

When I'm home, I'll write down the serial of my scope, maybe by comparing we can figure out if it's a hardware thing? Too bad I dont know anybody with an original module to try and see if that works or not..
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mischo22 on July 23, 2014, 08:21:19 pm
I have the solution for the brocken web Interface when the firmware is startet from usb-stick:

Copy the file "/infiniivision/upgrade/infiniiVisionWebCom.dll" from the USB-stick to "/infiniivision" on the stick.
The Webinterface works fine now.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dunkemhigh on July 23, 2014, 11:12:56 pm
Quote
The Webinterface works fine now.

Smart work, that man  :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on July 24, 2014, 02:22:51 am
... I ... wonder why dunkemhigh's board is working. Maybe I should send mine to dunkemhigh to compare...

The board is here and in my scope. It works exactly the same as my board does - that is, there is no discernable problem. I don't get any warning on boot, and I can do the full remote control stuff without error.

This kind of suggests that my scope is somehow different from everyone else...

Well, that explains why I couldnt find any error.. still, not being the only one with the error there must be something we're overlooking?  :-//

When I'm home, I'll write down the serial of my scope, maybe by comparing we can figure out if it's a hardware thing? Too bad I dont know anybody with an original module to try and see if that works or not..

I too have been unsuccessful in getting either of my dunkemhigh boards to work.
Before going after serial numbers, perhaps it is a difference between the different scopes models themselves (2000A vs 3000A, or even 100MHz vs 500MHz). There should be no difference between DSOX and MOSX, as both models are the same, only the MSOX has been software enabled on the later.

What models are successful users of dunkemhigh LAN boards using them in?
And what models are unsuccessful users of dunkemhigh LAN boards using them in?
I'm using an MSOX3054A, and I have no issues when using an actual Agilent DSOXLAN module.

I believe dunkemhigh has a 2000A. Is anyone with a 3000A successful in using a dunkemhigh LAN card?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dunkemhigh on July 24, 2014, 09:43:32 am
Quote
I believe dunkemhigh has a 2000X

Yes, it is a DSO-X 2004A. Maybe that A is significant.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on July 24, 2014, 12:49:39 pm
Quote
I believe dunkemhigh has a 2000X

Yes, it is a DSO-X 2004A. Maybe that A is significant.

I think they are all "A" models... My model number has now been appended with the "A".
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on July 24, 2014, 02:47:11 pm
Mine is an msox2024a and my home made lan board works perfectly.

I've mentioned this before...

The dunkemhigh board has one issue that doesn't follow the original design. The original agilent lan board has the magjack center taps connected together and to 3.3V via a 10ohm resistor (and bypass cap). The dunkemhigh magjack (from what I can see and correct me if I'm wrong) has the center tap of each isolation transformer connected together then via a capacitor to ground, no 3.3V connection.

Maybe the 3000 series is more fussy and the phy detects a problem.

It would be worth tying the center taps to a 10 ohm resistor to the 3.3V on the edge connector to see if that fixes anything.

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dunkemhigh on July 24, 2014, 03:02:20 pm
Quote
I've mentioned this before...

Indeed, and it would be cool if someone could try that. Obviously, it's not much use me doing it... :)

I am not about to complain, but if that is the problem I can't see why mine doesn't suffer, at least some times. It would be conceivable that my board/jack has something different (a short of open, maybe), but I've tried a different board that fails for someone else yet works perfectly for me.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on July 24, 2014, 04:37:50 pm
Dunkemhigh - yes, that's why I mentioned maybe that the 3000 series is more fussy...

At this point yours is a 2000 series and works fine and mine is also a 2000 series and works fine. I DID early on disconnect the 3.3V to the center taps and on my 2000 series it still worked fine... I did put it back to 3.3V to be 'correct'.

Does anyone with a 3000 series have a working diy lan board?

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Antonsio on July 26, 2014, 07:31:14 pm
Hi
I am new in the forum. I designed a LAN board for my DSOX2004 using the gerber files posted in this theme. The LAN connector is different and i made some changes on the board. My problem is the same like with most of the people here - center tap of the isolation transformers. I tried everything, but i can't find where exactly is the 3.3V pin on the edge connector. I saw the pictures here with description of the pins but it didn't work for me. Anyway the PCB is working, but during boot procedure a get a message - "System concerned .... LAN Failure"  or something like that.
If somebody knows which pin exactly is 3.3V i will appreciate it :)
(Sorry for the bad english)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georgd on July 26, 2014, 07:56:39 pm
On my scope from first day, if USB stick unplugged, I also see error message, but LAN module work and recognized by scope! "System concern detected..." hide the LAN error message.

Did you tried to communicate with scope over LAN?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on July 26, 2014, 08:15:23 pm
Hi
I am new in the forum. I designed a LAN board for my DSOX2004 using the gerber files posted in this theme. The LAN connector is different and i made some changes on the board. My problem is the same like with most of the people here - center tap of the isolation transformers. I tried everything, but i can't find where exactly is the 3.3V pin on the edge connector. I saw the pictures here with description of the pins but it didn't work for me. Anyway the PCB is working, but during boot procedure a get a message - "System concerned .... LAN Failure"  or something like that.
If somebody knows which pin exactly is 3.3V i will appreciate it :)
(Sorry for the bad english)

Look at Zucca's post ->

https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg458172/#msg458172 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg458172/#msg458172)

"B" in the drawing is the signal that needs to go to 3.3V. All the info is in that post.

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Antonsio on July 27, 2014, 07:39:57 am
First of all - thanks for the answers. The communication with the scope is OK. I tried few things from my browser and it works fine. Only the starting process of the scope is  slower than normaly (maybe with 20-30sec). This i think is because of the tests that the system makes during boot for the LAN card. If LAN card is not responding properly the test is made few more times. Again - its not a big problem, but the boot of the scope is relatively slow and now is even slower.
When i try to connect the center taps together and connect them to 1,2 pin (shown on ZUCCA's pictures) i get the same error. I will try few more things and if i clear the error the PCB files will be changed and i will update my version of the project (altium files). By the way the connector that i use is:
http://www.tme.eu/bg/details/rj45-trafo-lt/syediniteli-rj/amphenol/lmj2018814100dl2t1b/ (http://www.tme.eu/bg/details/rj45-trafo-lt/syediniteli-rj/amphenol/lmj2018814100dl2t1b/)

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Gandalf_Sr on July 27, 2014, 04:05:24 pm
I'm looking out for a DSOX2xx4 or DSO3xx4 that I could buy and 'upgrade'.  Seems a new one may have 2.37 which may prevent me from doing the USB boot feature - not sure?

I've read the whole thread, but there are a few of basic things I'm not clear on.

1. What are folks using to telnet into the scope?  I know it can be done if there's a LAN card fitted but what if there's no LAN card?  Is it done using the connection to the serial port header on the PCB or can you connect via the USB using an USB-Serial cable?

2. What are the port settings for the serial connection - BAUD rate etc?

3. If you get to the point that you can boot from USB, it seems that the USB stick needs to stay in the scope.  Is there a second USB port or does that mean you can't save stuff to the USB drive?

Thanks,
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on July 27, 2014, 04:47:20 pm
First of all - thanks for the answers. The communication with the scope is OK. I tried few things from my browser and it works fine. Only the starting process of the scope is  slower than normaly (maybe with 20-30sec). This i think is because of the tests that the system makes during boot for the LAN card. If LAN card is not responding properly the test is made few more times. Again - its not a big problem, but the boot of the scope is relatively slow and now is even slower.
When i try to connect the center taps together and connect them to 1,2 pin (shown on ZUCCA's pictures) i get the same error. I will try few more things and if i clear the error the PCB files will be changed and i will update my version of the project (altium files). By the way the connector that i use is:
http://www.tme.eu/bg/details/rj45-trafo-lt/syediniteli-rj/amphenol/lmj2018814100dl2t1b/ (http://www.tme.eu/bg/details/rj45-trafo-lt/syediniteli-rj/amphenol/lmj2018814100dl2t1b/)

Do your magjack LEDs work? Seems you have the pinout in your schematic back to front (anode/cathode flipped). e.g. you have pin 12 as the cathode, but the datasheet has pin 12 as the anode (same mistake in your schemetic for the 2nd LED).

The anode end of both LEDs (connect together) and feed from the 3.3V on the card edge.

I use the same magjack style (AMP part number) and it works perfectly without any errors. Boot up time is 37 seconds to where it says Agilent etc and 45 seconds to being fully booted and displaying a trace etc (msox2024a). I did copy the patched firmware to the internal memory to speed boot time versus a USB stick.

The center taps should connect together and connect to a capacitor (1uF seems fine) and resistor (10 ohms). The other end of the capacitor goes to ground. The other end of the resistor goes to 3.3V on the card edge.

I'll have to draw up a schematic of my lan vga diy card since it does work perfectly without any errors (at least on my msox2024a).

cheers,
george.


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Antonsio on July 27, 2014, 06:38:20 pm
Yes, you are right - the leds are not connected properly. Maybe PCB design for 1 hour is not good idea :D
I will make some cuts on the board when i have spare time and i will try to clear thigs up. Thanks for the answer.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: WVL_KsZeN on July 28, 2014, 07:02:41 pm
Just for the record, my scope is an (unhacked) mso-x 2024a, so it's not a case of the 3000 being more fussy.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on July 28, 2014, 07:45:46 pm
Just for the record, my scope is an (unhacked) mso-x 2024a, so it's not a case of the 3000 being more fussy.

Thanks. That kind of kills the 2000A vs 3000A theory...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on July 28, 2014, 08:22:33 pm
Just an idea: maybe it depends on sw version?
There is an FPGA in VGA part of original board, so it can be configured and then checked (or not checked, depending on sw inside the scope).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on July 28, 2014, 09:14:52 pm
Just an idea: maybe it depends on sw version?
There is an FPGA in VGA part of original board, so it can be configured and then checked (or not checked, depending on sw inside the scope).

Good thinking, it may well be a VGA related fault and not necessarily the LAN. After all, the reported error is "LAN VGA option module fault". Perhaps on some scope versions the logic says; if there exists a LAN module, the VGA must exist also, let's check...

I never proceeded further with my card after receiving the error, as I'm very afraid of damaging my expensive scope. But after Antonsio reported he receives the same error and then has good communication with his board, it got me thinking that perhaps the communication with my dunkemhigh board may work just fine also. Your comments only further support the reason why the error may appear and the LAN still work. I will have to test and report back...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on July 28, 2014, 09:41:36 pm
So, folk that have lan/vga problems with the diy board, what is your firmware version on your scope and what model do you have?

Mine works perfect with no error lan/vga error messages (with my diy lan card):

MSOX2024A and firmware version 2.35.2013061800 as reported on the 'about scope' screen. Also with licenses 'enabled' and loaded into the scope (versus usb flash drive).

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dunkemhigh on July 28, 2014, 10:39:15 pm
DSO-X 2004A, firmware 02.35.2013061800

Also licenses enabled and loaded into the scope, but I still get the message about booting from USB, and the 'About' screen even says (in red) "Booting from USB device".

It's possible I screwed up somewhere  :-//
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on July 28, 2014, 11:53:04 pm
MSOX 3054A, firmware 02.35.2013061800
Error with dunkemhigh board, but fine with Agilent DSOXLAN.
No need for other mods, as I already have MSO, max BW for my model, and the DSOX3APPBNDL.

I really don't think that the difference is in the loadable firmware, but could it be hidden in the fixed code of some other piece of hardware in a later (or earlier) revision scope? My scope was new in Nov 2011.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Antonsio on July 29, 2014, 08:14:40 am
I also think that this error may not be related to LAN only. I've tried everything to clear up the error, but nothing work. Anyway - the LAN connection is ok (which is the main point). Instead of this error i've seen something else, which i think is important. When i push in the edge connector the LAN PCB without any component and any pin from 1 to 80 connected together i get strange boot image - one of the colors maybe is missing. We tried everything with my colleague ( he have a DSOX 3024A , not hacked ) and on his scope we get same boot display with "color distortion". Finaly we thought maybe this is related to empty pins for the VGA connection. We cleared them and now everything is ok. The module is installed "tightly" without box and when i need LAN i just remove the original cover (shown in the attached photos) :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dunkemhigh on July 29, 2014, 09:07:56 am

3. If you get to the point that you can boot from USB, it seems that the USB stick needs to stay in the scope.  Is there a second USB port or does that mean you can't save stuff to the USB drive?

Can't give you a definitive answer on your first two questions, sorry, but there are three USB ports: a host (A) and  device (B) at the rear, and host (A) at the front.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: euzer on July 29, 2014, 09:37:18 am
3. If you get to the point that you can boot from USB, it seems that the USB stick needs to stay in the scope.  Is there a second USB port or does that mean you can't save stuff to the USB drive?

Thanks,


Is any calibration maintained when running the hacked>?
Is it still possible to save screen images to the USB memory stick?

Yes calibration is maintained, and
you can save/recall data to/from USB stick.

Georg
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Gandalf_Sr on July 29, 2014, 04:26:38 pm
Thanks for the confirmation on multiple USB ports.  I was really trying to understand what I needed to do to get the dll file onto the USB drive, I think am I missing something here.

Is it possible to set up a batch file on the USB drive that issues the command to copy the file onto the drive?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: cassiopeia on August 11, 2014, 07:53:34 pm
Dear All,

this is my first post on eevblog forum.
I use firmware 2.35 on a dsox2002a. The trick works only if NO trial license is enable ! With trial license, either it does not work, or only some license are activated, although the scope reports "all license activated" at startup.

Hope this can help.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dundee on August 29, 2014, 06:22:43 pm
kilobyte's way is working for me!
Thank you :)

I'm using an intenso aluline 8gb stick. Formated as Fat32

Is it possible to upgrade the bandwith on my model (3012)?

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georgd on August 31, 2014, 05:15:28 am
Follow this link, as I see your problem is exactly same:

https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg414813/#msg414813 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg414813/#msg414813)

Goeorg
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dundee on August 31, 2014, 11:03:44 pm
Thanks georgd!

It's working!

By the way:
I've  got a few requests about sending a ready hacked zip package. Do it by your own!  :-/O
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: alanambrose on September 27, 2014, 04:42:23 pm
Hi George,

Possible to post your working schematic? - I'm just laying out this board and it would seem a good idea not to reinvent the ... schematic :)

Thanks, Alan
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on September 27, 2014, 05:30:41 pm
This is the final schematic of my working lan card. I'm using an Digikey 1419-1021-ND for the magjack.

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: yocheng on September 28, 2014, 04:34:04 am
 :-+Thanks to kilobyte for help, and now my oscilloscope has cracked.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: alanambrose on September 28, 2014, 01:22:31 pm
Thanks George, I'll post up my layout when it's back and verified. I'll try the Amphenol part first and then revert to the TRP part if there are problems.

Alan
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pstemari on October 10, 2014, 05:59:24 pm
Yeesh.  I think Agilent/Keysight *wants* people to just hack these scopes.

Tried buying the "ultimate" software bundle, which is cheap enough that for me, at least, hacking the scope isn't really worth the bother.

You would think that you could just put a scope S/N and credit card number into their website and get back a license key. Noooooooo.

If you go the Keysight website to get the bundle, you have to pick a distributor to get a quote from.  Then you get to call the distributor, and they will ship "stock" from their warehouse.  Once you get whatever they ship in the mail, then presumably you use that to go to their website, put in a S/N,, and get back a license key.

 :phew:
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on October 10, 2014, 06:38:30 pm
If you go the Keysight website to get the bundle, you have to pick a distributor to get a quote from.  Then you get to call the distributor, and they will ship "stock" from their warehouse.  Once you get whatever they ship in the mail, then presumably you use that to go to their website, put in a S/N,, and get back a license key.

All you need from the certificate that the distributor sends you is your "Agilent order Number" and "Agilent Certificate Number" and most distributors can give you that over the phone or email it to you after payment is made. Make sure that you ask first. I have done this for several machines with no problems. From time to order to time of feature installation was just minutes. Compare that with a company that sells modules you have to install...

If you have a favorite Agilent Distributor already, then you can even skip right to order placement and have all your licenses installed almost as fast as I could type this reply.

Agilent requires you to go through a distributor, because they do not bypass the people that make them sales. Also, you can sometimes get a discount with a distributor that you would not get through a direct purchase. At the same time, Agilent does allow direct purchase of small parts that would be a hassle for you and the distributor to go through channels if you had to.

Thank you Agilent for making the process as easy as possible...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: HighVoltage on October 10, 2014, 11:02:36 pm
How interesting, I just noticed that Keysight extended their bundle offer for the option pack until 12-6-2014.

And yes, if you ask your distributor for an additional discount, you probably get it.
At least in Germany they offered it.


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on October 10, 2014, 11:19:12 pm
How interesting, I just noticed that Keysight extended their bundle offer for the option pack until 12-6-2014.

And yes, if you ask your distributor for an additional discount, you probably get it.
At least in Germany they offered it.

Forget asking Newark (Element14). At least here in the US... they said it was already discounted and that they do not offer the bundle at a lower price... hahaha, I got it elsewhere at a good discount.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: zucca on October 10, 2014, 11:39:05 pm
Shh.... I bought it at Newark....
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: pstemari on October 18, 2014, 06:20:47 am
All you need from the certificate that the distributor sends you is your "Agilent order Number" and "Agilent Certificate Number" and most distributors can give you that over the phone or email it to you after payment is made. Make sure that you ask first.

No such luck here.  Still no email and no physical certificate. Emailed Techni-Tool with a WTF?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on October 23, 2014, 05:33:40 pm
Ok I've got a DSO-X 3032A on my desk, it's running 2.37 so I'm trying kilobytes method. I'm using the same USB sticks that I've used on previous 2000 and 3000 series scopes so I know they work ok, but I'm having problems. It just keeps rebooting when I power it up with USB stick is in place (with the folder structure on it obviously).

Contents of the USB stick are here:
https://dl.dropboxusercontent.com/u/2063383/3000%20usb%20stick.zip

Free ESD safe bench mat to the first person to help me get this damn thing booting with the options enabled.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on October 23, 2014, 07:55:04 pm
Do you have a LAN Module available?

Because you need to Replace first some Files to downgrade the Firmware.

Without these Steps it is not possible to change the ProcessStartupFolder.exe in the Windows directory

BR
Kai
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Neganur on October 23, 2014, 08:38:50 pm
don't remember if it matters, but the path in your .lnk file is not in double quotes, i.e. 64#"\usb....Launcher.exe" (remember to increase the character count)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on October 24, 2014, 08:26:08 am
Do you have a LAN Module available?

Because you need to Replace first some Files to downgrade the Firmware.

Without these Steps it is not possible to change the ProcessStartupFolder.exe in the Windows directory

BR
Kai

Ahhh.. reading back over the previous few pages again (and again, and again) it looks like the scope must be 2.35 in flash to be able to boot 2.37 from the USB stick.

I mistakenly thought your mod allowed me to boot a modified 2.37 from USB when the scope had 2.37 in flash.

I guess I need to get a LAN module and do some more reading then...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on October 26, 2014, 01:06:54 pm
Do you have a LAN Module available?

Because you need to Replace first some Files to downgrade the Firmware.

Without these Steps it is not possible to change the ProcessStartupFolder.exe in the Windows directory

BR
Kai

Ahhh.. reading back over the previous few pages again (and again, and again) it looks like the scope must be 2.35 in flash to be able to boot 2.37 from the USB stick.

I mistakenly thought your mod allowed me to boot a modified 2.37 from USB when the scope had 2.37 in flash.

I guess I need to get a LAN module and do some more reading then...

Right. I've got DSOXLAN module plugged in and have managed to get telnet access. Read through the previous few pages and it looks like there's a significant chance of me bricking this thing if I'm not careful.

If my understanding is correct I need to create a hybrid upgrade CAB based on parts of the 2.35 and 2.35 CABs, specfically replacing the naughty ProcessStartupFolder.exe to enable subsequent downgrade to 2.35.

However, it's not going anywhere so far....

I tried the instructions and tools in TOOLS.ZIP posted by abyrvalg some time ago, trying to find ProcessStartupFolder.exe. The "dosetup.py" Python program fails and produces no output apart from 3 traceback error messages, and the "bincompress.exe" program just moans about "Not an 0x000fff file" or something similar. Not a good start.

Any suggestions or pointers?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: HighVoltage on October 26, 2014, 02:27:21 pm
At one time in the past I gave up on my MSOX3104A. I was really afraid that something would go wrong and Agilent would not honor any warranty on this expensive scope. So I bought the option pack in the discounted bundle and it works really well. Sometimes it is not worth the time or effort, as long as the full option pack is so cheap. Unless - of course - we use it to learn and we are willing to take the risk.

On my MSO7104B the "fix" was so much easier and thanks to this forum, it works well with all options enabled.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on October 26, 2014, 06:04:23 pm
Quote from: kilobyte

So I did the update to 2.37 and tried how to downgrad to V2.35.
The first step was a modified cab based on V2.35 and Infiniivision.cab from 2.37 to change the Windows folder with the ProcessStartupFolder.exe
The 2.37 Firmware has loaded the Firmware Update successfully but it takes a couple of minutes before the scope reboots.
This is the simples way to restore the \windows folder to an older version because ist write protected.

The next Step was to rename the 2.37 to 2.35 in the infiniiVisionLauncher and infiniiVisionCore and replaced these files directly over telnet from usb to the \sercure folder.
after a reboot i tried to load a V2.35 Firmware but this didn't works maybe the timestamp was also checked. :(

After I replaced the newest files in the \secure\infiniivision folder direcly with the 2.35 Files I was able to load the old v2.35 setup.

So its posible to go back to the V2.35 with the help of telnet access.


Been for a walk on the beach and I've come back this this with a clear head...

I've done the following:
1) Taken the 2.35 CAB file and extracted the infiniiVisionSetup.cab file
2) Upacked the 2.37 CAB file and replaced its infiniiVisionSetup.cab file with the one I extracted above
3) Used a program called CABPACK to create a new hybrid CAB file from the unpacked 2.37 with its new 2.35 component

The intention is to put this on a USB stick and then do a firmware upgrade, hopefully this is the same thing kilobyte did in the first part of the process he describes above.

I'm a little reluctant to try this, mainly because my new hybrid CAB file is 19 meg in size and the original 2.35 and 2.37 CAB files were 22 meg!!

Might have to have a bottle of vodka to hand before I push the button on this...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on October 26, 2014, 06:59:26 pm
Select MSZIP in the compression type of CABPACK then the file should have near the same size.

The step with a hybrid CAB is not nessesary.
When i did the downgrad on my scope i have tried out different things.
This step is only needed if you need the latest firmware on the scope with USB Boot (issues with different dll versions are posible??)

TO downgrade it must be enough to replace these two file with files from 2.35
infiniiVisionLauncher.exe
infiniiVisionCore.dll

after a reboot it should be possible to load the 3000XSeries.02.35.2013061800.cab

I have to test this on my scope again but this should be the easiest way and should work.

And while downgrade there should be no infiniivisionStartupOverride.txt on the usb drive  :phew:
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on October 26, 2014, 07:51:05 pm
Wooo well done Mr Kilobyte!!

From the Agilent 2.35 upgrade CAB I extracted the files you said:
infiniiVisionLauncher.exe
infiniiVisionCore.dll

Put them on a USB stick, booted the 2.37 scope and got telnet access (infiniivision, skywalker1977)

Killed the running version (a step you didn't mention, probably because it was obvious to you!):
processmgr kill infiniiVisionLauncher.exe

Change to application directory
cd \secure\infiniivision

Copy those two old files:
copy \usb\infiniiVisionLauncher.exe
copy \usb\infiniiVisionCore.dll

Reboot and get firmware concerns message, scope still thinks it has 2.37, no problem.

Put Agilent 2.35 upgrade CAB onto USB stick and up(down)grade as normal. Lots of waiting, scope then reboots with 2.35 up and running.

Then reboot with USB stick with modified 2.37 files to get all options including MSO and full bandwidth.


Many, many thanks sir. I owe you something nice from under my desk!!

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Rigby on October 27, 2014, 01:02:25 pm
Many, many thanks sir. I owe you something nice from under my desk!!

That took a weird turn...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: jmole on October 29, 2014, 01:51:23 am
How interesting, I just noticed that Keysight extended their bundle offer for the option pack until 12-6-2014.

And yes, if you ask your distributor for an additional discount, you probably get it.
At least in Germany they offered it.

sigh.. did this earlier today; really needed the wavegen. TestEquity gave me the package for $450ish. Not too bad since I got the scope on ebay, certified refurbished from Agilent for around $2k two years ago.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: 2lostkiwis on November 05, 2014, 11:58:59 pm
Wooo well done Mr Kilobyte!!

...

Reboot and get firmware concerns message, scope still thinks it has 2.37, no problem.
Put Agilent 2.35 upgrade CAB onto USB stick and up(down)grade as normal. Lots of waiting, scope then reboots with 2.35 up and running.
Then reboot with USB stick with modified 2.37 files to get all options including MSO and full bandwidth.
Many, many thanks sir. I owe you something nice from under my desk!!

This process worked for me too, my scope that was shipped with 2.37 is now running 2.35. Now I just have to get to work and build the USB stick. Not sure why I am doing this as I bought the app bundle, still I can go from 350MHz to 500MHz. I think it just must be the curiosity...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on November 20, 2014, 01:45:24 pm
I am really close of purchasing a new DSOX2004A (without any options) in the next couple of days.
However I am not sure about the following. Can please somebody confirm:
Thanks!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: daemon82 on November 21, 2014, 07:35:47 am
So you are saying that the bundle stayed intact after downgrading?
We also purchased a bundle. I was thinking about downgrading too, just for the logic analyzer. Although we would use it very seldom it would be nice to have the option to it.
If your bundle remained intact I will make the downgrade too.

This process worked for me too, my scope that was shipped with 2.37 is now running 2.35. Now I just have to get to work and build the USB stick. Not sure why I am doing this as I bought the app bundle, still I can go from 350MHz to 500MHz. I think it just must be the curiosity...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on November 21, 2014, 09:52:43 am
I am really close of purchasing a new DSOX2004A (without any options) in the next couple of days.
However I am not sure about the following. Can please somebody confirm:
  • Is it still hackable? By reading this thread I think so -  I just need to add a LAN board. Am I correct?
  • The DSOX2004A (default is 70 Mhz) can be 'enhanced' to 200 Mhz?
  • Any idea where to get the logic probes then (item # N6459-60001, I did not find a price for it). Are there any other (maybe older) logic probes from Agilent usable?
Thanks!

Yes I hacked a 2.37 scope using just a LAN card and telnet. Logic pods are easily bought on ebay for $200 or so. If anybody wants to borrow the LAN card for a day you can, just pay shipping both ways.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on November 21, 2014, 02:24:47 pm
Thanks Toploser!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on November 25, 2014, 12:29:52 pm
I am hoping I can get a good Black Friday deal on an Agilent Keysight DSOX2000/3000.
But the shipping costs can eat up all the savings. As intl. shipping costs are not only calculated by weight but also volume of the box, can somebody please measure the size of the original Agilent/Keysight box (should be identical on 2000/3000 series) and post it here? Thanks!!

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georgd on November 25, 2014, 03:27:41 pm
Outer dimension of DSOX3000 box is 24 x 34 48 cm.

Georg
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on November 25, 2014, 05:49:19 pm
Grrrr :--  Zoro raised the price by exactly 5% this morning ...

Oh, and thank you for the measurements George.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: DavidDLC on December 04, 2014, 05:29:49 pm
Yes I hacked a 2.37 scope using just a LAN card and telnet. Logic pods are easily bought on ebay for $200 or so. If anybody wants to borrow the LAN card for a day you can, just pay shipping both ways.

Is there somebody in USA that can offer to borrow a LAN card as TopLoser ? Of course I will pay the shipping both ways.

If yes, I will order an oscilloscope.

Guys, please help here !

David
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: tivoi on December 12, 2014, 09:53:41 am
any body try with dsox2000 ver 2.38?
thanks
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: michanisani on December 13, 2014, 11:28:58 am
Hi
Where I get full instructions for DSOX2000 Lan update?
thanks
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: zucca on December 15, 2014, 05:14:38 pm
any body try with dsox2000 ver 2.38?
thanks

Thanks for the head´s up about the new FW. I will install the 2.38 FW soon (BTW I have not a hacked scope).

Here the link for the new FW

http://www.keysight.com/main/software.jspx?id=2014548&nid=-11143.0.00&lc=eng&cc=US (http://www.keysight.com/main/software.jspx?id=2014548&nid=-11143.0.00&lc=eng&cc=US)

Here what´s new:

New Features for 2000A and 3000A

Software is now Keysight Technologies branded.

Trigger Rate SCPI query has been added - TRIGger:FREQuency? <gate time in sec>

New bit rate measurement has been added.

New Features for 3000A

N2804A/N2805A 100MHz/300MHz differentia
l probe support has been added.

N7020A Power Rail probe support has been added.

Bug Fixes

AER/TER behavior is improved.

*STB behavior is improved


See attachments for details.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on December 15, 2014, 08:47:45 pm
The new Splash screen looks a bit boring.
I found the old Agilent Splash screen looks nicer but its simple to change this.

The new Bit-rate measurement is a nice new feature.

I can Start the Modified V2.38  (another Address must be used) from USB with V2.35 on the Scope.

Ok i tested it here the Telnet Downgrade Method back to 2.35 is still working.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on December 16, 2014, 01:16:31 am
I can Start the Modified V2.38  (another Address must be used) from USB with V2.35 on the Scope.

kilobyte: Thanks for the testing and reporting here on v2.38!

Could you mention the updated addresses at which the bytes need to be changes?

Thanks!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on December 16, 2014, 07:54:09 pm
I have change the Data At 0x27AF78 to 00 00 A0 E3
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on December 17, 2014, 08:15:25 pm
I modified the keysight logo to a more known brand  >:D

A real HP/Agilent/Keysight product now  ;)

I wrote a little tool to extract the Bitmap data and the location from the dll, not finished yet but it works with 4byte aligned Bitmap data.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on December 17, 2014, 10:31:56 pm
Wow, I love it.  :-+ :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: HighVoltage on December 18, 2014, 08:33:04 am
I modified the keysight logo to a more known brand  >:D
This is very impressive!
It would be great to have this on my scope.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: fons on December 23, 2014, 06:19:53 pm
Hi!

Does anybody know where can I find the 2.35 firmware? The keystone website only lets you download the latest one (2.38)

Thanks!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: zucca on December 23, 2014, 06:26:42 pm
I wrote a little tool to extract the Bitmap data and the location from the dll, not finished yet but it works with 4byte aligned Bitmap data.

master of disaster... congrats...

(http://www.chiark.greenend.org.uk/scopes/images/teklogo.jpg) on 1st April?

also this one would be good...

(http://cdn.ninjamarketing.it/wp-content/uploads/2014/04/oshw-logo-400-px.png)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on December 30, 2014, 12:00:20 pm
Is there somewhere a comparision of the DSOX3000A board differences between the 100/200 and the 350/500 Mhz version available (e.g. high res pictures of the front end of both versions)? I could not find any.

It is always said that Agilent/Keysight will swap boards if you want to upgrade from 100/200 to 350/500 Mhz. I am wondering if there is really a significant difference or if they just inject some software instead of swapping boards.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dianzimi on January 06, 2015, 06:33:32 am
Wooo well done Mr Kilobyte!!

From the Agilent 2.35 upgrade CAB I extracted the files you said:
infiniiVisionLauncher.exe
infiniiVisionCore.dll

Put them on a USB stick, booted the 2.37 scope and got telnet access (infiniivision, skywalker1977)

Killed the running version (a step you didn't mention, probably because it was obvious to you!):
processmgr kill infiniiVisionLauncher.exe

Change to application directory
cd \secure\infiniivision

Copy those two old files:
copy \usb\infiniiVisionLauncher.exe
copy \usb\infiniiVisionCore.dll

Reboot and get firmware concerns message, scope still thinks it has 2.37, no problem.

Put Agilent 2.35 upgrade CAB onto USB stick and up(down)grade as normal. Lots of waiting, scope then reboots with 2.35 up and running.

Then reboot with USB stick with modified 2.37 files to get all options including MSO and full bandwidth.


Can you send me the 2.15 cab file ?my email address is dian.zi.mi@163.com
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EEVblog on January 06, 2015, 07:16:57 am
It is always said that Agilent/Keysight will swap boards if you want to upgrade from 100/200 to 350/500 Mhz. I am wondering if there is really a significant difference or if they just inject some software instead of swapping boards.

Yes, they have to actually swap boards, the 300/500MHz was a different front end. Although wait a few days and that could be changing...  ;)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Rigby on January 06, 2015, 03:57:42 pm
wait a few days and that could be changing...  ;)

Oh I hate it when you do this.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on January 07, 2015, 07:56:03 am
I'm curious too.
Maybe it has something to do with the two scopes that i can see on the dropcam livestream?
The looks very very similar.  :)

I'll let it be a surprise.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on January 07, 2015, 07:52:17 pm
I'm curious too.
Maybe it has something to do with the two scopes that i can see on the dropcam livestream?
The looks very very similar.  :)

I'll let it be a surprise.

Mmmmh; Dave says "the 300/500MHz was a different front end." I am wondering what that means, especially to my already existing 200 Mhz version...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on January 08, 2015, 09:58:54 am
wait a few days and that could be changing...  ;)

Oh I hate it when you do this.

Maybe to do with the new 3000T series...

http://uk.farnell.com/keysight-technologies/dsox3012t/oscilloscope-2-ch-100mhz-5gsps/dp/2449632 (http://uk.farnell.com/keysight-technologies/dsox3012t/oscilloscope-2-ch-100mhz-5gsps/dp/2449632)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: EEVblog on January 08, 2015, 10:01:38 am
Mmmmh; Dave says "the 300/500MHz was a different front end." I am wondering what that means, especially to my already existing 200 Mhz version...

I was given wrong information on that unfortunately.
The new 3000T still has different front end hardware between the 100/200 and 350/500 versions.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: WVL_KsZeN on January 08, 2015, 10:59:35 am
Bingo!

https://translate.google.com/translate?sl=auto&tl=en&js=y&prev=_t&hl=en&ie=UTF-8&u=http%3A%2F%2Fwww.hw.cz%2Fprodukty%2Fosciloskopy-keysight-dsox3000t-graficky-trigger-pro-kazdeho-inzenyra.html&edit-text= (https://translate.google.com/translate?sl=auto&tl=en&js=y&prev=_t&hl=en&ie=UTF-8&u=http%3A%2F%2Fwww.hw.cz%2Fprodukty%2Fosciloskopy-keysight-dsox3000t-graficky-trigger-pro-kazdeho-inzenyra.html&edit-text=)

-comes with a touchscreen
-4Mpts memory
-greatly extended match functions
-correlated signal analysis (time and frequency domain)

and the datasheet aswell : Datasheet (https://mega.co.nz/#!M8MEVCjS!m44W76kvGf3Iz0ddv_JUb49vVNBkCTkJL7TuTmp2dmk)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Neganur on January 08, 2015, 09:30:28 pm
woah, a proper full bandwidth 1mV front end. What took them so long :P
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: WVL_KsZeN on January 08, 2015, 09:35:47 pm
woah, a proper full bandwidth 1mV front end. What took them so long :P
No, it's still magnified : "2. Specifications are valid after a 30-minute warm-up period and ± 10 °C from firmware calibration temperature. 1 mV/div and 2 mV/div are a magnification of 4 mV/div setting. For vertical accuracy calculations, use full scale of 32 mV for 1 mV div and 2 mV/div sensitivity setting."
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Neganur on January 08, 2015, 10:03:11 pm
hmm you're right - further down in the characteristics it states the all familiar sentence that you quote. But I don't know what to make of this table then (page 7):
(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=128593;image)
vertical setting steps of 1, 2, 5 mV and the noise stays basically the same in those three settings. Is the noise not amplified?
I guess they had to come up with something to compare it to the Tek scope? Poor move Agilent : /
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: WVL_KsZeN on January 08, 2015, 10:21:01 pm
It's just a digital amplification (only scaling on the display), so of course the noise in Vpp stays the same.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Neganur on January 09, 2015, 01:09:56 am
Yeah I guess I still hoped it had real amplification. Magnified pixels again, boo!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: fons on January 12, 2015, 10:19:54 am
Hi!

Does anybody know where can I find the 2.35 firmware? The keystone website only lets you download the latest one (2.38)

Thanks!

Thanks to those who sent me the firmware in PM. I had version 2.36 in the scope, after downgrading to 2.35 I can use the usb hack without problems. Thanks!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Isamun on January 18, 2015, 04:32:58 pm
Last year I was lucky enough to pick up a demo version of a 3034a. All the options where there when I got the unit and are listed with an astrix (*). I haven't updated the firmware yet, due to the fear of loosing my beloved/free options. Anyone know if an update will remove them?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on January 18, 2015, 04:59:52 pm
Last year I was lucky enough to pick up a demo version of a 3034a. All the options where there when I got the unit and are listed with an astrix (*). I haven't updated the firmware yet, due to the fear of loosing my beloved/free options. Anyone know if an update will remove them?

The astrix (*) means that the options are either in DEMO MODE or the scope is a STORE DEMO, and thus in demo mode. There has been posts indicating that the store demo units have a runtime of 120 days, but I cannot say for sure. In either case, updating the firmware should not remove the demo, but again, I cannot say for sure...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ToBeFrank on January 18, 2015, 05:48:15 pm
The astrix (*) means that the options are either in DEMO MODE or the scope is a STORE DEMO, and thus in demo mode. There has been posts indicating that the store demo units have a runtime of 120 days, but I cannot say for sure. In either case, updating the firmware should not remove the demo, but again, I cannot say for sure...

Not necessarily. It could be in distributor mode. If the first item in the list is "All", it's a good bet. My scope has been this way for well over a year. The really cool part is if they put new features in future firmware that require licenses, a distributor scope will automatically turn them on when you upgrade the firmware.

(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=130718)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Isamun on January 18, 2015, 06:58:16 pm
Thank you both.

Last year I was lucky enough to pick up a demo version of a 3034a. All the options where there when I got the unit and are listed with an astrix (*). I haven't updated the firmware yet, due to the fear of loosing my beloved/free options. Anyone know if an update will remove them?

The astrix (*) means that the options are either in DEMO MODE or the scope is a STORE DEMO, and thus in demo mode. There has been posts indicating that the store demo units have a runtime of 120 days, but I cannot say for sure. In either case, updating the firmware should not remove the demo, but again, I cannot say for sure...

Is there a way I can check the runtime? I would presume this would have been reset at their factory when it was "refurbished".

The astrix (*) means that the options are either in DEMO MODE or the scope is a STORE DEMO, and thus in demo mode. There has been posts indicating that the store demo units have a runtime of 120 days, but I cannot say for sure. In either case, updating the firmware should not remove the demo, but again, I cannot say for sure...

Not necessarily. It could be in distributor mode. If the first item in the list is "All", it's a good bet. My scope has been this way for well over a year. The really cool part is if they put new features in future firmware that require licenses, a distributor scope will automatically turn them on when you upgrade the firmware.

(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=130718)

I also have the "All" (no astrix).

(http://i.imgur.com/At0JUB7.png) (http://i.imgur.com/At0JUB7.png)

If I read you correctly, you have performed an update and still kept the options. In your opinion, the case would be the same for me?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ToBeFrank on January 18, 2015, 09:22:07 pm
If I read you correctly, you have performed an update and still kept the options. In your opinion, the case would be the same for me?

You should be fine. Whether they are time limited or not, I don't know. It may be the case that you got lucky and they forgot to clear the licenses out of your scope before sending it to you.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on January 19, 2015, 12:58:25 am
If I read you correctly, you have performed an update and still kept the options. In your opinion, the case would be the same for me?
You got a nice catch then with ALL functions enabled. Upgrading firmware should not disable any legitimate features, demo, distributor, or purchased. I see from the screenshot that your firmware is quite old. You'll have a great incentive to upgrade to the latest firmware, with many new capabilities, improved measurements, and bug fixes... Great Score!

One other nice thing to know about your scope, is that it has the 500MHz front end.  :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Isamun on January 20, 2015, 06:32:30 pm
Im happy to report the update went as expected.
Thank you for the confidence boost.

(http://i.imgur.com/DqepazH.png) (http://i.imgur.com/DqepazH.png)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iRad on January 20, 2015, 06:56:53 pm
Im happy to report the update went as expected.
Thank you for the confidence boost.

(http://i.imgur.com/DqepazH.png) (http://i.imgur.com/DqepazH.png)
Excellent!  :-+
Now you can check out your new and free ARB you didn't have yesterday...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: oedipe78 on January 21, 2015, 10:02:48 am
Hello everyone,

Explanations are mixed between different versions. I'm afraid to get a stupidity.   :-BROKE

Someone could explain step by step how to change the latest version (2.38)?
And how to load the modified version?

Does anyone want to change the firmware new scope DSOX/MSOX 3000T ?

Thank you in advance.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on January 21, 2015, 11:47:47 am
For the data that have to be modified see here
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg569677/#msg569677 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg569677/#msg569677)

And for Firmware Downgrade see TopLosers summary here
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg537981/#msg537981 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg537981/#msg537981)

Does anyone want to change the firmware new scope DSOX/MSOX 3000T ?
Maybe if you like to buy me one of these...  ;D

I already have a dsox3024a at home so i didn't buy a new one in the next time.

I hope they release a firmware package to have a look into.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: oedipe78 on January 21, 2015, 01:40:02 pm
I still have many questions.  :scared:

For the data that have to be modified see here
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg569677/#msg569677 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg569677/#msg569677)

is the infiniiVisionCore.dll (v2.35) file needs to be changed ?

you change address : 0x0x27AF78 , data : 0x00 00 A0 E3 ?

From the Agilent 2.35 upgrade CAB I extracted the files you said:
infiniiVisionLauncher.exe
infiniiVisionCore.dll

Where you find the version 2.35? (it is not available on the official website)

this is the original file?


Put them on a USB stick, booted the 2.37 scope and got telnet access (infiniivision, skywalker1977)

Killed the running version (a step you didn't mention, probably because it was obvious to you!):
processmgr kill infiniiVisionLauncher.exe

Change to application directory
cd \secure\infiniivision

Copy those two old files:
copy \usb\infiniiVisionLauncher.exe
copy \usb\infiniiVisionCore.dll

Reboot and get firmware concerns message, scope still thinks it has 2.37, no problem.
I understood.

Put Agilent 2.35 upgrade CAB onto USB stick and up(down)grade as normal. Lots of waiting, scope then reboots with 2.35 up and running.

Then reboot with USB stick with modified 2.37 files to get all options including MSO and full bandwidth.

you downgrade to version 2.35. This is Original firmware 2.35?

After I upgrade to Version 2.38. This is not the original firmware 2.38, what do I need to change?


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on January 21, 2015, 01:52:12 pm
I still have many questions.  :scared:

Where you find the version 2.35? (it is not available on the official website)

3000 series 2.35 CAB here:
https://dl.dropboxusercontent.com/u/2063383/3000XSeries.02.35.2013061800.cab

Use this CAB file as a source of the two files that will replace the ones on your scope. Then use it to downgrade your scope to 2.35

No need to edit or modify the contents of any of the files yet. That will come later when you have downgraded to 2.35.





Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: cassiopeia on February 04, 2015, 01:54:48 pm
Dear all,

I confirmed that it is possible to launch the 2.38 version from USB stick, with 2.35 firmware inside. Anyway, I have a question about changing the splash screen : I found the new one more, humm... serious.
I have of course read the whole thread, but it did not work. I have no LAN adapter, so I try to do this with the USB key.
What I did :
put
Code: [Select]
21#\usb\img.cmd in the Startup\infiniiVision.lnk file of the usb key.
create an img.cmd file, at the root of the USB key, with :
Code: [Select]
\Windows\compileImageForSplashScreen.exe \usb\img.png \Secure\infiniiVision\splashImage.binBut nothing append... Any clue ? Thanks !
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on February 04, 2015, 10:28:27 pm
Hi,

I did a test on my scope and it should work.

My Steps:

1. create a bat file in usb root dir (create_splashscreen.bat)
2. I've insert the following text \windows\compileImageForSplashScreen.exe \usb\splashImage.png \Secure\InfiniiVision\splashImage.bin
3. rename the existing infiniivision.lnk (like infiniivision2.lnk)
4. create a new infiniivision.lnk with 28#\usb\create_splashscreen.bat

Plug the flashdrive into the scope and power up.

Now It takes some time.
Interesting effect is that the hacked Infiniivision Software will be loaded too.
After a reboot with an unplugged usb stick it should show up the new spalshscreen (It's a stupid idea to use a scope screenshot as a splashscreen  ;D)

If you want to try it with my files you can download it here http://kaibareis.de/dsox/Splashscreen_change.zip (http://kaibareis.de/dsox/Splashscreen_change.zip)

Best Regards
Kai
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: cassiopeia on February 05, 2015, 06:40:18 pm
Thank you !

Your script works, mine does not... the only differences are some case in path name (Windows vs windows and infiniivision vs Infiniivision). I'll dig into that...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on February 05, 2015, 08:59:44 pm
Try changing .cmd extensions to .bat
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on February 05, 2015, 11:43:00 pm
Please, is anyone able to provide me with the 2.35 files for DSOX2000 series?
Thanks!!!!

Solved - 2000 firmware seems to be identical to the 3000 Firmware, thus Toplosers link above is fine.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: yocheng on February 23, 2015, 03:04:30 am
I modified the keysight logo to a more known brand  >:D

A real HP/Agilent/Keysight product now  ;)

I wrote a little tool to extract the Bitmap data and the location from the dll, not finished yet but it works with 4byte aligned Bitmap data.

I upgraded to firmware 2.38, but the Keysight brand too ugly, want to switch back to Agilent, such as the picture red circle place. I would like to ask how to operate?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: srhelio on February 23, 2015, 11:46:05 am
I still have many questions.  :scared:

Where you find the version 2.35? (it is not available on the official website)

3000 series 2.35 CAB here:
https://dl.dropboxusercontent.com/u/2063383/3000XSeries.02.35.2013061800.cab

Use this CAB file as a source of the two files that will replace the ones on your scope. Then use it to downgrade your scope to 2.35

No need to edit or modify the contents of any of the files yet. That will come later when you have downgraded to 2.35.


Hello everyone, I have readed all the post and I have some questions:

 I have got a MSOX-2014A with old firmware 2.20.2012110802. I found  only the above firmware but I don't know if 3000xSeries is the same that 2000xSeries.

First i will update the scope to 2.35 firmware and then i will continue all the process that you wrote, right?

Thanks for your work !!!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on February 23, 2015, 01:09:00 pm
First i will update the scope to 2.35 firmware and then i will continue all the process that you wrote, right?
YES
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on February 24, 2015, 08:13:57 am
Does anyone want to change the firmware new scope DSOX/MSOX 3000T ?

The 3000T looks to be not hackable.
The nk.bin.comp is encrypted (Verisign DIGITAL ID) and it looks like the infiniivisioncore.dll is integrated in the nk.bin.comp file.

I modified the keysight logo to a more known brand  >:D

A real HP/Agilent/Keysight product now  ;)

I wrote a little tool to extract the Bitmap data and the location from the dll, not finished yet but it works with 4byte aligned Bitmap data.

I upgraded to firmware 2.38, but the Keysight brand too ugly, want to switch back to Agilent, such as the picture red circle place. I would like to ask how to operate?

It's a bit complicated but i will create a short guide and some necessary file how to change the logo.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Neganur on February 24, 2015, 08:46:10 am
kilobyte, how difficult would you think it would be to add USB mouse support to the 2000A/3000A ? Is it a matter of adding a driver to the embedded 6CE?
Even though the GUI probably has no click-able items, I'd love to be able to use the mouse-wheel. Unfortunately, only very few keys on the keyboard have any function outside of the text entry mode (ESC, arrow keys)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: srhelio on February 24, 2015, 12:25:48 pm
Hello.

Can someone confirm the  firmware 3000XSeries.02.35.2013061800.cab is compatibility for my MSOX 2014A?

If NO, where can I download?

KILOBYTE, I readed that you has got it  in your website but  I don't find it.

Thanks.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: yocheng on February 24, 2015, 02:48:53 pm
Does anyone want to change the firmware new scope DSOX/MSOX 3000T ?

The 3000T looks to be not hackable.
The nk.bin.comp is encrypted (Verisign DIGITAL ID) and it looks like the infiniivisioncore.dll is integrated in the nk.bin.comp file.

I modified the keysight logo to a more known brand  >:D

A real HP/Agilent/Keysight product now  ;)

I wrote a little tool to extract the Bitmap data and the location from the dll, not finished yet but it works with 4byte aligned Bitmap data.

I upgraded to firmware 2.38, but the Keysight brand too ugly, want to switch back to Agilent, such as the picture red circle place. I would like to ask how to operate?

It's a bit complicated but i will create a short guide and some necessary file how to change the logo.


Look forward to your tutorial :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: oedipe78 on February 27, 2015, 11:36:04 am
The 3000T looks to be not hackable.
The nk.bin.comp is encrypted (Verisign DIGITAL ID) and it looks like the infiniivisioncore.dll is integrated in the nk.bin.comp file.

Hi,
I bought a DSOX3014T and I'm ready to make tests for crack.
I checked too, the files are encrypted  (Verisign DIGITAL ID).
Can you modify the file may be for 30 days license?  :-/O
what do you think?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Pinkus on February 27, 2015, 01:52:21 pm
If the 30 day period would mean 30x24 = 720 scope working hours, this would be fine for many peoples.

I did not check the PCB pictures (andy maybe something similar was mentioned in the 49 pages above), but somewhere there probably will be a real time clock running. What if this clock is being stopped? Or running very sloooooooooow by changing its crystal?
Then at least the off-time of the scope would not count, which could be sufficent in many cases.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sbampato12 on February 27, 2015, 02:30:47 pm
If the 30 day period would mean 30x24 = 720 scope working hours, this would be fine for many peoples.

I did not check the PCB pictures (andy maybe something similar was mentioned in the 49 pages above), but somewhere there probably will be a real time clock running. What if this clock is being stopped? Or running very sloooooooooow by changing its crystal?
Then at least the off-time of the scope would not count, which could be sufficent in many cases.


Even if this could work, and the software are great tools, you still missing the MSO and BW upgrade...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: deadbeef on February 27, 2015, 10:44:56 pm
The 30 day trial option that comes with the scope is a kind of a "hack" from Agilent's side to give you the options without generating the licences and compromising the private keys used for signing the licenses. At least it was so in fw 2.38...
The scope uses some variables in its "secure storage" (which seems to be encrypted part of the flash).

When starting it checks if the demo was never used before. Then when you start it it remembers when the demo should expire, how many days you have left and current date.
When the scope starts up it checks the time difference between stored "current date" and current time and figures out how many days have passed.
It also checks if you are past the "demo expiry date"

It also remembers the "current date" if you manually set the clock. So dialing forward to 2176 or something like that ans starting the demo, dialing clock back... will not trick it.

So... 30 days trial period does not mean 720 working hours it means 30 realtime days (counted in seconds if I remember correctly)

if infinivision.dll is in the nk.bin.comp and this is encrypted/signed and verified somewhere in the boot process this means that hacking will be very difficult with high potential to brick the scope...

Oh... and the "Unfinalized software" message does not come from any signature and/or checksum failure... it is a side of patching the dll. You basically modify a function to always return false. The true value of that function is otherwise stored in the "secure storage"... :)

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on March 15, 2015, 05:31:29 pm
Soo glad to see this thread is still alive and kicking and people are still working on hacking these scopes! Thank you to everyone! Now we just need to get it all consolidated in one tutorial thread/post and itll be complete!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on March 16, 2015, 01:42:36 am
Firmware revision 2.39 has been released March 10, 2015.

The release notes do not report new features or bug fixes.  Instead only two enhancements are listed:
- Bit rate measurement units have been improved.
- Reference memory skew behavior is improved in some situations.

The update seems rather minor and obscure...I wonder if it contains undocumented changes to the protection mechanisms, or blocking firmware downgrades etc.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on March 16, 2015, 03:04:15 pm
3000T nk.bin.comp decryptor with source. No "illegal numbers" inside, they key is derived from file data.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on March 16, 2015, 06:58:18 pm
More info on kernel/encryption/etc: there are two WinCE images in the scope - main one (nk.bin.comp) and recovery (recover.nk.bin.comp). It is unknown yet when recovery gets activated (this functionality is in bootloader which is not available for study). As far as I can see, recovery asks for USB stick with .ksx/.agx (firmware) file and installs it.
nk.bin.comp is signed and encrypted - can't modify it straight way. recover.nk.bin.comp is neither signed nor encrypted - can be modified.
nk.bin.comp decryption/verification takes place at install time (by LoadP500Flash.exe flasher), signature is not written into flash, so bootloader doesn't verify anything.
Conclusion: modify LoadP500Flash.exe in recovery to bypass sig check, flash modded recovery, enter recovery mode (how?), flash modded main via modded recovery... PROFIT.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georgd on March 16, 2015, 08:13:01 pm
Uboot is released under GPL license.

In the following post tnt wrote:

[url=https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg253106/#msg253106]https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg253106/#msg253106 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg253106/#msg253106)
[/url]
Not quite true. I addressed a request to Agilent directly to get the source for the GPL software distributed with the scope (u-boot mostly) and I received the source package back. I also posted a link to it in the first topic about this scope, probably more than a year ago.


Georg
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on March 17, 2015, 09:01:00 am
Looks like telnet password is changed too. It is generated from instrument id now (still possible to get it, but I don't have a 3000T to try anyway)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: DavidDLC on March 20, 2015, 06:01:21 pm
Has anyone tried 2.39 ?

I want to buy an oscilloscope and the vendor has this version.

David.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iankellogg on March 22, 2015, 02:52:36 pm
I managed to get this hack to work with 200mhz bandwidth on my scope but has any one ever figured out how to load the hack to the internal flash?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on March 22, 2015, 04:14:04 pm
I managed to get this hack to work with 200mhz bandwidth on my scope but has any one ever figured out how to load the hack to the internal flash?

I run it in the internal flash. The procedure *IS* documented way back in this loooong thread.... You'll need to look for it just like I did. Speeds up the boot time versus from a flash drive.

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: cassiopeia on March 23, 2015, 07:44:20 pm
Dear all,

The hack works with 2.39 firmware, the new address in the dll is 0x27B0F4, and the values are always 00 00 A0 E3.
In the picture attached, the bandwidth did not work, because I had BW50, that I changed for BW20, which works fine now.

Edit : when I said "the hack", it means "booting on USB device on a scope with regular firmware 2.35 installed".
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dunkemhigh on March 23, 2015, 08:10:14 pm
Blinding work, thanks  :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iankellogg on March 24, 2015, 03:19:13 pm
I managed to get this hack to work with 200mhz bandwidth on my scope but has any one ever figured out how to load the hack to the internal flash?

I run it in the internal flash. The procedure *IS* documented way back in this loooong thread.... You'll need to look for it just like I did. Speeds up the boot time versus from a flash drive.

cheers,
george.

this forum thread is a mess to find stuff! I will try to find it. I haven't even figured out how to do the update yet. still running 2.35
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: cassiopeia on March 24, 2015, 07:38:21 pm
I'll try to summarize, but only from the point where you have a device with regular 2.35 firmware. If you have a newest version, you have to search this topic (access to scope file system with lan, and fake the firmware version to allow downgrade, then the scope will be able to boot on usb key).
What you need :
* the python script attached to this post (I am *NOT* the author of this useful script. Linux users : replace \ by /...)
* the 2.39 firmware from Agilent
Steps :
* extract Agilent .cab firmware with you favorite program
* extract infiniiVision.cab file : you have now an infiniiVision folder
* chdir to infiniivision folder, copy dosetup.py to this folder
* python  dosetup.py (linux users should chande \ by / in _setup.xml file !!!)
* then chdir to Secure/infiniiVision
* open infiniiVisionCore.dll with hex editor, and at @0x27B0F4, change 04 00 a0 e1 by 00 00 a0 e3, then save (could be a good idea to make a backup before...)
* copy all the infiniiVision and Startup directories to an USB key
* add the infiniivisionStartupOverride.txt (attached to this post) at the root dir of your usb key
* edit Startup/infiniivision.lnk file to your needs (add the options that you want - mine is attached, for 2000 serie).

I hope this is clear (and accurate) and will help.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: iankellogg on March 25, 2015, 02:27:44 am
I'll try to summarize, but only from the point where you have a device with regular 2.35 firmware. If you have a newest version, you have to search this topic (access to scope file system with lan, and fake the firmware version to allow downgrade, then the scope will be able to boot on usb key).
What you need :
* the python script attached to this post (I am *NOT* the author of this useful script. Linux users : replace \ by /...)
* the 2.39 firmware from Agilent
Steps :
* extract Agilent .cab firmware with you favorite program
* extract infiniiVision.cab file : you have now an infiniiVision folder
* chdir to infiniivision folder, copy dosetup.py to this folder
* python  dosetup.py (linux users should chande \ by / in _setup.xml file !!!)
* then chdir to Secure/infiniiVision
* open infiniiVisionCore.dll with hex editor, and at @0x27B0F4, change 04 00 a0 e1 by 00 00 a0 e3, then save (could be a good idea to make a backup before...)
* copy all the infiniiVision and Startup directories to an USB key
* add the infiniivisionStartupOverride.txt (attached to this post) at the root dir of your usb key
* edit Startup/infiniivision.lnk file to your needs (add the options that you want - mine is attached, for 2000 serie).

I hope this is clear (and accurate) and will help.

This was pretty good instructions. Only thing for me was, the script didn't work. I didn't need to use it though, it does work with the new firmware.

I haven't been able to find the post where someone installs it to internal flash. Maybe i just don't understand what to do.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on March 25, 2015, 04:23:42 am
I haven't been able to find the post where someone installs it to internal flash. Maybe i just don't understand what to do.

Read this. (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg347345/#msg347345)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: telectroboy on March 26, 2015, 10:25:27 am
Hello Guys,

I'm lost with this. I try to read and read again this topic but I'm not able to find the way to do.

 So I've got a DSO-X2002A 2.30 and I've hacked it with your help since 1 year and a half. But my USB key is crashed.
I remember that I've downloaded the firmware 2.35 from agilent website (unavailable now) extract it with WinCECAB and modify few hexadecimal word somewhere.

I don't remember a script or something like that.

If someone is able to summarize the way to do with USB key (without flash it inside the scope)
Because what tell cassopieia doesn't work for me. Python script work!
But Scope never boot!


Many Thanks
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: telectroboy on March 26, 2015, 12:12:47 pm
Does someone has a link to 2.35 version official firmware?

For DSO-X 2002A
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on March 26, 2015, 12:40:26 pm
Does someone has a link to 2.35 version official firmware?

For DSO-X 2002A

https://dl.dropboxusercontent.com/u/2063383/2000XSeries.02.35.2013061800.cab
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: telectroboy on March 26, 2015, 12:54:14 pm
OK !!! 8)

Thanks a lot.
I'm upgrading to 2.35 version and I will try again the cassiopieia summary!

I hope it was the problem.


 |O |O |O |O
It wasn't the problem.
So now I've got a 2.35 version but the USB key doesn't want to boot.


Does someone has an idea?
Thx

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: DavidDLC on March 26, 2015, 01:03:50 pm
Dear all,

The hack works with 2.39 firmware, the new address in the dll is 0x27B0F4, and the values are always 00 00 A0 E3.
In the picture attached, the bandwidth did not work, because I had BW50, that I changed for BW20, which works fine now.

Edit : when I said "the hack", it means "booting on USB device on a scope with regular firmware 2.35 installed".

Do you need to downgrade the 2.39 ? Or will it boot direct from USB with 2.35 modified ?

David.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on March 26, 2015, 01:06:10 pm
Dear all,

The hack works with 2.39 firmware, the new address in the dll is 0x27B0F4, and the values are always 00 00 A0 E3.
In the picture attached, the bandwidth did not work, because I had BW50, that I changed for BW20, which works fine now.

Edit : when I said "the hack", it means "booting on USB device on a scope with regular firmware 2.35 installed".

Do you need to downgrade the 2.39 ? Or will it boot direct from USB with 2.35 modified ?

David.

You need to downgrade the scope to 2.35. You can then boot the modified 2.39 from USB.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: telectroboy on March 26, 2015, 01:11:40 pm
Which files are at root of USB stick?

Only infiniivisionstartupoverride.txt and directories "startut" and "infiniivision" ??
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on March 26, 2015, 01:14:04 pm
Which files are at root of USB stick?

Only infiniivisionstartupoverride.txt and directories "startut" and "infiniivision" ??

Correct
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: telectroboy on March 26, 2015, 01:38:44 pm
Please could you check this?

I've made something wrong but I don't understand what.

This is an archive of the USB Stick Root.

Thanks again

https://www.wetransfer.com/downloads/51b0840e5968daab35aeac63c9dafc6020150326133429/79eaa210a732573f595c7f0971a5d47320150326133429/1fe488 (https://www.wetransfer.com/downloads/51b0840e5968daab35aeac63c9dafc6020150326133429/79eaa210a732573f595c7f0971a5d47320150326133429/1fe488)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on March 26, 2015, 01:44:00 pm
Please could you check this?

I've made something wrong but I don't understand what.

This is an archive of the USB Stick Root.

Thanks again

https://www.wetransfer.com/downloads/51b0840e5968daab35aeac63c9dafc6020150326133429/79eaa210a732573f595c7f0971a5d47320150326133429/1fe488 (https://www.wetransfer.com/downloads/51b0840e5968daab35aeac63c9dafc6020150326133429/79eaa210a732573f595c7f0971a5d47320150326133429/1fe488)

Contents seem fine. Keep trying different USB sticks. I find that only 1 out of 10 work for me, and I have tried LOTS of different ones from LOTS of different manufacturers. Don't format it NTFS, use FAT.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: telectroboy on March 26, 2015, 02:01:32 pm
SUPER!!!!

You are right.

Manufacturer of USB key is important.



THANKS A LOT to you and all people who create this and help to do.

 :-+ :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: DavidDLC on March 26, 2015, 02:07:25 pm
If somebody on this forum has an extra bare board or assembled card for the LAN module, please PM. I prefer bare board with silkscreen and soldermask.

You know sometimes when you have a PCB house making the PCBs for you they sent you more than one.

David.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on March 26, 2015, 06:47:18 pm
If somebody on this forum has an extra bare board or assembled card for the LAN module, please PM. I prefer bare board with silkscreen and soldermask.

You know sometimes when you have a PCB house making the PCBs for you they sent you more than one.

David.

pm sent...

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: aholtzma on March 28, 2015, 04:48:51 pm
This is the final schematic of my working lan card. I'm using an Digikey 1419-1021-ND for the magjack.


Did you release the layout files or gerbers for this?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on March 28, 2015, 05:37:43 pm
This is the final schematic of my working lan card. I'm using an Digikey 1419-1021-ND for the magjack.


Did you release the layout files or gerbers for this?

I thought I did... The design is in PADS, so not sure how useful that is to most. Gerbers and pads file attached. Obviously there's no guarantee etc etc...

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hugoneus on April 01, 2015, 01:55:47 am
Has anyone used the FPGA programming port on the unit? My unit's flash is completely erased (was corrupted). When I turn the unit on, nothing at all happens.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dziobu on April 01, 2015, 01:10:54 pm
So its posible to go back to the V2.35 with the help of telnet access.

Hi!
There is easier way to downgrade.

I have flashed 2.39 a long before I found this site. But now I have 2.35 with just PC and USB-key ;)

All has beed checked today on my MSO-X 2012 (originally it was standard 100MHz + MEMUP update with 2.39 firmware).
1. downgrade to 2.37 (it just works)
2. unpack 2000XSeries.02.37.2014052002.cab (ex with WinRAR)
3. extract file infiniiVisionLauncher.exe from infiniiVisionSetup.cab (2.37) (ex with WinCE CAB Manager)
4. unpack 2000XSeries.02.35.2013061800.cab (ex with WinRAR)
5. open infiniiVisionSetup.cab (from 2.35) file in WinCE CAB Manager, find infiniiVisionLauncher.exe on list and delete it
6. add infiniiVisionLauncher.exe (from 2.37 cab) to file list and set all properties like in old file (flags: uncheck all; location: \Secure\InfiniiVision; Hard-coded path checked)
7. file->save and exit WinCE CAB Manager
8. calc MD5 of edited infiniiVisionSetup.cab and update it in recipe.xml file
9. compress all files (ex with CabPack) from 2.35 firmware with edited infiniiVisionSetup.cab
10. flash new file

After this I reflashed scope once again with untouched 2.35 to update modified file but I don't know if it was necessary.
Also I don't know if there is possibility to downgrade directly from 2.39.

Now I have 2.35 in scope and 2.39 from USB (and I didn't need to use python script).

Starting scope from USB key:
NOT WORKS:
- Kingston DTSE9 (8GB)
- silicon power touch 830 (8GB)
- PQI connect 201 (16GB)
- all my no-name keys... (1GB..16GB)

WORKS:
- LEEF Spark 32GB


And I would like to thank everyone on this forum for files/instructions/descriptions.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: FrankBuss on April 01, 2015, 07:05:49 pm
Has anyone used the FPGA programming port on the unit? My unit's flash is completely erased (was corrupted). When I turn the unit on, nothing at all happens.
How did you manage to do this? What FPGA programming port do you mean? Are you sure the u-boot bootloader is corrupted, too? If not, you could enter commands with the serial port (see this post (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg260895/#msg260895) for the pins) and flash it again over network. Otherwise you really need to find and use some JTAG port.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: DavidDLC on April 02, 2015, 12:10:33 am
What a lucky me.

I bought a DSO-X-2014A to replace my DSO-X2012A, I got the cheapest price on the internet for it (first part of been lucky)

I was nervous about it having the latest firmware and have to do the hack using the lan, thanks to georges80 for the board, but.....the unit came with software 2.36 ! I was able to downgrade to 2.35 using only the cab file, and since I already had the usb hacked software for my 2012A it was so easy to convert the new one ! Wooooooraleeee.

 O0 :clap: :clap: :clap:

David.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hugoneus on April 02, 2015, 05:11:02 am
Has anyone used the FPGA programming port on the unit? My unit's flash is completely erased (was corrupted). When I turn the unit on, nothing at all happens.
How did you manage to do this? What FPGA programming port do you mean? Are you sure the u-boot bootloader is corrupted, too? If not, you could enter commands with the serial port (see this post (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg260895/#msg260895) for the pins) and flash it again over network. Otherwise you really need to find and use some JTAG port.

Unfortunately it is fully erased. It was really badly corrupted. The RS232 port no longer outputs anything. The u-boot is basically completely gone. But there is another port on the PCB which I assume is the JTAG port of the FPGA...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on April 02, 2015, 10:00:36 am
Hugoneus, check this post for CPU JTAG https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg274963/#msg274963 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg274963/#msg274963)

Another possibility is BootROM USB flash loader mode:
ST's flash utility http://www.st.com/web/en/catalog/tools/PF257557 (http://www.st.com/web/en/catalog/tools/PF257557)
This mode should be activated by pulling BOOT_SEL pin (K18, check the picture) low at power on, but no reports on this so far. The PCB picture in JTAG post looks like there is a track in inner layer going to this pin, perhaps you can look closer. If it is tied straight to VCC then bad luck, otherwise try shorting it to GND and turning the scope on with USB cable attached to PC - does something pops up?
Also SPEAr600 RM says that ROM enters USB boot if normal (flash) boot fails regardless of BOOT_SEL state. But this requires primary bootloader in flash to be corrupted "correctly" so ROM doesn't recognize it (briefly shorting some flash DATA lines at power up is common way to simulate this state).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: abyrvalg on April 02, 2015, 10:49:27 am
A quick look into xloader_image.bin shows that UBOOT image is loaded from SPI flash rather than from NAND. SOIC8 U3204 25Pxxx (hard to read) near the CPU must be it.
In worst case you can desolder it and program xloader_image.bin (at 0) and u-boot_image.bin (at 0x10000) manually - this should be enough to get u-boot up running.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: rickstar on April 03, 2015, 05:52:46 am
Hi, I am loving this thread.

Does anybody have a link to download 2.37 or can I PM them for an email please :-)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dziobu on April 03, 2015, 08:00:49 am
Does anybody have a link to download 2.37 or can I PM them for an email please :-)

https://www.dropbox.com/s/y4y3d2xmj2gmgdb/2000XSeries.02.37.2014052002.cab?dl=0 (https://www.dropbox.com/s/y4y3d2xmj2gmgdb/2000XSeries.02.37.2014052002.cab?dl=0)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: rickstar on April 03, 2015, 09:41:25 am
Does anybody have a link to download 2.37 or can I PM them for an email please :-)

https://www.dropbox.com/s/y4y3d2xmj2gmgdb/2000XSeries.02.37.2014052002.cab?dl=0 (https://www.dropbox.com/s/y4y3d2xmj2gmgdb/2000XSeries.02.37.2014052002.cab?dl=0)

Thank you very much, so are a good man  :) :clap:  :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: oedipe78 on April 09, 2015, 12:20:51 pm
Looks like telnet password is changed too. It is generated from instrument id now (still possible to get it, but I don't have a 3000T to try anyway)

Yes, the telnet password has been changed.
I have a 3000T, what to do to get the password?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mischo22 on April 09, 2015, 04:08:51 pm
It is possible to extract the programm files from an 3000T (Telnet)? can i run the 3000T-Software an an 3000 scope?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Neganur on April 09, 2015, 08:53:34 pm
probably not, IIRC there's a bigger FPGA on the T model. I wouldn't mind paying an upgrade fee for the touch though. I keep grabbing the trigger level dial instead of the entry knob >.>
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dianzimi on April 15, 2015, 08:06:43 am
firmware 2.39 is successful crack without usb device and the band is 200Mhz.you can crack all option by the  update the  firmware(it is have changed some parameter of original firmware file).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: gts1991 on April 20, 2015, 07:46:33 pm
Can you gentlemen do as unlock? DSOX2002A instructions with pictures ?  ??? Because I do not fully understand how to do it safely .  ;D
Thank you  8)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: klaus11 on April 27, 2015, 10:00:54 am
Today I requested budget for DSOX2024 used, and leave a document fragment.

.........Options                                                 
                    DSOX2MASK Mask Limit Testing                           
                    DSOX3VID  DSOX3VID Video Triggering and Analysis       
                    (this is not a std option availble for   
                    DSOX2000 series but a special version)   
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: v1t0r on April 29, 2015, 01:15:36 pm
I'm about to buy a DSOX2004A but before making a purchase I'd like to know if it's still possible to make the hack in recent firmware or is required to hack the hardware?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: klaus11 on April 29, 2015, 04:20:28 pm
I'm in the same situation, I would buy DSOX2002A.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: GlowingGhoul on May 05, 2015, 02:24:52 am
Is the 3000T series hackable? I read many posts but the answer doesn't seem clear to me.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: eman (AKA e-lectric-man) on May 18, 2015, 10:45:17 pm
I've been reading this thread since I got my new MS0-X-3052A about a week ago. I am mostly a hobbyist in my electronics interests and have no commercial use for this equipment. As such I feel fine about using the hacks discussed in this thread.

I wouldn't actually mind paying a fair price to get the scope's features enabled, but I have not found the licenses at anywhere near a reasonable price. So here I am.

The scope I got is apparently been sitting on some shelf for quite a while. It came with FW version 2.10, and it's manufacture date is 2012. It's a fine machine, and I got it for a very good price from eBay. It is completely new and in original packaging, and I'm happy with the purchase. After making my first pass at reading this thread I decided that I needed to upgrade the FW to version 2.35, as this seems to be the most preferred around here. I downloaded a copy from a link provided in https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg616147/#msg616147 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg616147/#msg616147) comment. I installed the upgrade, and it went just fine. So the scope now has FW version 2.35.

Next I proceeded to building a USB stick with the hack discussed earlier in the thread. Thanks to all the people involved in this ongoing project. This is one of the best threads on such a technical subject that I've ever seen, and I'm quite impressed with the fact that it is still active.

So my first version of the USB setup was a total mess, and of course it didn't work at all. Then I hunkered down and figured out the layout of the file system that is required, and I found that all the ones described herein have at least a few minor inaccuracies, and some are outright wrong. I started with the _setup.xml file found in the CAB FW file. I converted a copy of this file in stages into a set of commands for building the directory tree required for the USB stick, and populating it with the files appropriately renamed. The structure of the directories is most closely correctly given in the https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg364171/#msg364171 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg364171/#msg364171) post. It has just one minor inaccuracy. The web-socket-js folder should be inside the include folder. Thus:

Quote
\
+-infiniiVision
  +-fpga
  +-upgrade
  +-web
     +-css
     +-help
     +-image
     +-include
     +-web-socket-js
     +-lib
     +-Lxi
        +-Identification
     +-navbar
+-Startup
infiniivisionStartupOverride.txt

should be:

\
+-infiniiVision
  +-fpga
  +-upgrade
  +-web
     +-css
     +-help
     +-image
     +-include
          +-web-socket-js
     +-lib
     +-Lxi
        +-Identification
     +-navbar
+-Startup
infiniivisionStartupOverride.txt

I'm not actually sure how important this is, but I added this information in case it helps anybody.

Another minor problem I found was the case difference between some file names and references to them. One in particular seemed like a potential deal breaker is the one pointing to the infiniivisionLauncher.exe file in the infiniivision.lnk file in the Startup folder. Either the file was originally spelled with "vision" and the link with "Vision" or the other way around. I can't remember which at the moment. I'm aware that WinCE is most likely case insensitive like Windows, but I remember back in the ancient time when I was a Windows programmer I ran into a variety of exceptions to this rule. So I think some care should be taken here to match the cases properly. As a matter of fact some experimenting I did with testing this match led to USB stick configurations that behaved quite differently as I tried to boot the scope.

At any rate, I am now at the stage that I can produce USB sticks that will either seem to do nothing as I boot the scope, or else they hang it in a boot flashing-lights loop. I don't think I have yet successfully booted from a USB stick, partly because I haven't seen any error messages when I  boot the scope. I also have not seen the list of enabled licenses change. Finally, I can always remove the USB stick after a successful boot without the scope rebooting, which seems to indicate that the scope must have booted from the internal FW.

In the meantime I've also enabled the 30 day trial, which may be affecting me in some way I don't understand yet.

I'll keep playing with this stuff until I get it to work. I think my next step is to setup some way to allow me to telnet to the scope. Then I can play with the internal code, which I have not yet done.

This is a lot of fun. Thanks to all participants!

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on May 18, 2015, 10:55:18 pm
Try lots and lots of different USB sticks, it's hit and miss which types work. For me it's been seriously hit and miss which sticks work with any particular scope. Never found one particular make that works with all scopes.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: eman (AKA e-lectric-man) on May 18, 2015, 11:42:34 pm
I also initially thought that different sticks behaved differently. However, it seems to me that if I populate a stick in the proper order right after I format it, I get much more consistent behavior. Here's what I do now all the time:

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on May 18, 2015, 11:47:03 pm
I can send you a link to a doenload for a known good and working file structure for a 3000 series scope if you think that would take out one more variable?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: eman (AKA e-lectric-man) on May 19, 2015, 02:00:03 am
Sure! I think I've got it right, but I don't really have a way to verify this. It would help either eliminate one avenue, or fix the problem altogether.

I appreciate your offer, and I will look forward to the link.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on May 19, 2015, 02:14:27 am
Try lots and lots of different USB sticks, it's hit and miss which types work. For me it's been seriously hit and miss which sticks work with any particular scope. Never found one particular make that works with all scopes.

My success rate with USB stick was 5 working like charm and one type not. All working units were Kingston. But there were people with USB stick from same vendor, exactly same type only small difference in size (eg 32G and 32G) and the boot does not work at all.
So it is really strange behavioral.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sbampato12 on May 19, 2015, 11:50:54 am
For me, the best rates were with Sandisk ones. And Kingston but the OLD ones, relly old (the first 'generation' of DataTravelers).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on May 19, 2015, 11:55:53 am
Sure! I think I've got it right, but I don't really have a way to verify this. It would help either eliminate one avenue, or fix the problem altogether.

I appreciate your offer, and I will look forward to the link.

https://dl.dropboxusercontent.com/u/2063383/Agilent%20DSOX3000%20237%20cracked.zip
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: eman (AKA e-lectric-man) on May 19, 2015, 03:35:09 pm
Quote
Quote
Sure! I think I've got it right, but I don't really have a way to verify this. It would help either eliminate one avenue, or fix the problem altogether.

I appreciate your offer, and I will look forward to the link.
https://dl.dropboxusercontent.com/u/2063383/Agilent%20DSOX3000%20237%20cracked.zip

Thanks for the link. As it turns out, my USB setup was exactly the same as the one in the link. Not :o by this!

So my results are still the same, meaning: I may have a working hack, but I can't tell for sure because of the 30 day trial being active. On the other hand I may be playing the game of "Find the Right USB Stick", since I can in some circumstances get the loop-di-loop behavior.

Thanks a bunch anyway. You have helped me eliminate some variables here!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: eman (AKA e-lectric-man) on May 19, 2015, 03:42:39 pm
A question for the experienced among you: How can I tell whether I'm successfully loading the system from USB or from built in FW? I thought that when the system is loaded from the USB, one cannot unplug the USB drive without causing a system reboot. Is this always the case?

My startup is very clean and no different from the internal FW system startup. The only difference I can see is that under File Explorer menu I get a mounted USB as well as the usual "\Agilent Flash" folder, and the default open folder right after startup is the USB folder.

Any ideas?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on May 19, 2015, 03:57:42 pm
My startup is very clean and no different from the internal FW system startup.

Since you are booting a hacked firmware image, you should be getting a warning after boot from the scope:

"System concerns detected:"  etc etc

So, if you aren't getting the warning in the middle of the screen after booting (prior to then touching any button/knob), then you haven't booted the hacked version from the external USB flash drive.

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: eman (AKA e-lectric-man) on May 19, 2015, 04:11:16 pm
I was afraid you might say that.  :(

So I guess when I get the looping effect during startup then the system is actually trying to boot from the USB drive and failing. Since I am using verified bootable tree in my USB stick, then the only possibility left to explain the failure is the type of USB stick I'm using.

I think I'll order a bunch of different ones today!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: eman (AKA e-lectric-man) on May 19, 2015, 06:35:18 pm
 :) ;) SUCCESS!!!  ;) :)

I Have a fully functional scope booting from USB stick. I get no error messages during the boot, I just have to wait for the looping to start, and after approximately 6 or 7 loops, I get a message saying "booting from USB stick" on  the second splash screen. This message is displayed in small red letters on the top left of the screen. Once the boot completes, I get an additional message in the center of the display. this one says "All options enabled" on the first line and "Press any key to continue" on the second line. The message goes away when I press a key.

The next thing I checked was the "About Oscilloscope" screen. Here I found a surprise. I have been populating the USB stick with the software I got from TopUser a few comments back. I had assumed the stuff to be derived from FW version 2.35. But Here I see the system version being 2.37. That's way cool. I may try to build a stick based on 2.39 later...

I went through some changes to my command line specification in infiniivision.lnk file. I ended up with the following command which enables the largest number of licenses:

    86#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS -l CABLE -l TOM -l SGMC

Most of the enabled licenses have a '*' displayed next to them, but there is no expiration date indicated.

So here's what made the stuff work for me: I reformatted one of my USB sticks (on my Apple MacBook Pro) so the single partition present on the stick was modified from "MS-DOS (FAT)" which is FAT32 to "exFAT" which I believe is FAT16. I then loaded the files onto this stick in the order which I described in one of my earlier posts. That did the job. The USB stick I'm using is a very small one made by SanDisk, and it's a 8GB size.

That's way cool!

Thanks to all for the invaluable help.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: drlustig on May 22, 2015, 05:52:53 pm
:) ;) SUCCESS!!!  ;) :)

I Have a fully functional scope booting from USB stick. I get no error messages during the boot, I just have to wait for the looping to start, and after approximately 6 or 7 loops, I get a message saying "booting from USB stick" on  the second splash screen. This message is displayed in small red letters on the top left of the screen. Once the boot completes, I get an additional message in the center of the display. this one says "All options enabled" on the first line and "Press any key to continue" on the second line. The message goes away when I press a key.

The next thing I checked was the "About Oscilloscope" screen. Here I found a surprise. I have been populating the USB stick with the software I got from TopUser a few comments back. I had assumed the stuff to be derived from FW version 2.35. But Here I see the system version being 2.37. That's way cool. I may try to build a stick based on 2.39 later...

I went through some changes to my command line specification in infiniivision.lnk file. I ended up with the following command which enables the largest number of licenses:

    86#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS -l CABLE -l TOM -l SGMC

Most of the enabled licenses have a '*' displayed next to them, but there is no expiration date indicated.

So here's what made the stuff work for me: I reformatted one of my USB sticks (on my Apple MacBook Pro) so the single partition present on the stick was modified from "MS-DOS (FAT)" which is FAT32 to "exFAT" which I believe is FAT16. I then loaded the files onto this stick in the order which I described in one of my earlier posts. That did the job. The USB stick I'm using is a very small one made by SanDisk, and it's a 8GB size.

That's way cool!

Thanks to all for the invaluable help.

Confirmed. This actually works. Thank you! I formatted my 8GB Samsung USB Stick as exFat in Windows and followed your instructions. My 4GB did not seem to work for booting. Needed to upgrade from an earlier FW to 2.35 (link in a post above) to be able to boot from my USB stick. It even boots up reasonably fast, which is nice.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: WattsUp on May 29, 2015, 02:05:52 pm
I managed to successfully show the booting from USB message on my (temporary) DSO X 2000. It then booted and showed all options enabled. Is there a way to save this, so USB is not needed for every boot and the options are permanent?
Thanks.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: GlowingGhoul on May 29, 2015, 02:30:29 pm
Do these hacks work on the DSOX3000T series?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on May 29, 2015, 02:32:28 pm
Do these hacks work on the DSOX3000T series?
No
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Andlier on June 04, 2015, 09:36:55 am
So its posible to go back to the V2.35 with the help of telnet access.

Hi!
There is easier way to downgrade.

I have flashed 2.39 a long before I found this site. But now I have 2.35 with just PC and USB-key ;)

All has beed checked today on my MSO-X 2012 (originally it was standard 100MHz + MEMUP update with 2.39 firmware).
1. downgrade to 2.37 (it just works)
2. unpack 2000XSeries.02.37.2014052002.cab (ex with WinRAR)
3. extract file infiniiVisionLauncher.exe from infiniiVisionSetup.cab (2.37) (ex with WinCE CAB Manager)
4. unpack 2000XSeries.02.35.2013061800.cab (ex with WinRAR)
5. open infiniiVisionSetup.cab (from 2.35) file in WinCE CAB Manager, find infiniiVisionLauncher.exe on list and delete it
6. add infiniiVisionLauncher.exe (from 2.37 cab) to file list and set all properties like in old file (flags: uncheck all; location: \Secure\InfiniiVision; Hard-coded path checked)
7. file->save and exit WinCE CAB Manager
8. calc MD5 of edited infiniiVisionSetup.cab and update it in recipe.xml file
9. compress all files (ex with CabPack) from 2.35 firmware with edited infiniiVisionSetup.cab
10. flash new file

After this I reflashed scope once again with untouched 2.35 to update modified file but I don't know if it was necessary.
Also I don't know if there is possibility to downgrade directly from 2.39.

Now I have 2.35 in scope and 2.39 from USB (and I didn't need to use python script).

Starting scope from USB key:
NOT WORKS:
- Kingston DTSE9 (8GB)
- silicon power touch 830 (8GB)
- PQI connect 201 (16GB)
- all my no-name keys... (1GB..16GB)

WORKS:
- LEEF Spark 32GB
 

And I would like to thank everyone on this forum for files/instructions/descriptions.

I can confirm that this downgrade procedure worked on a msox-3054A from 2.37 to 2.35, used the 2000x 2.37-firmware provided somewhere in this thread, and 3000x 2.35 firmware.
Then went on with cassiopeia's guide to boot modded 2.39 firmware from a 4GB kingston usb-stick, worked first try.  :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mark on August 01, 2015, 03:30:51 pm
Sorry guys I haven't read the full thread but I wondered if this worked on the MSOX3054A?  Is the MSOX3054A a good buy (refurbished)? 

Does the hack offer all that is included in dsox3appbndl? 

Thanks, I'm still reading and trying to decide if this is as good a deal as it seems. 
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on August 01, 2015, 03:54:10 pm
Sorry guys I haven't read the full thread but I wondered if this worked on the MSOX3054A?  Is the MSOX3054A a good buy (refurbished)? 

Does the hack offer all that is included in dsox3appbndl? 

Thanks, I'm still reading and trying to decide if this is as good a deal as it seems.

Farnell are doing a very good deal on the MSOX3054 if you go to the trade counter, I think it's £2800+VAT. Even on the website they are 60% off list price or something crazy.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mark on August 01, 2015, 04:01:50 pm
Sorry guys I haven't read the full thread but I wondered if this worked on the MSOX3054A?  Is the MSOX3054A a good buy (refurbished)? 

Does the hack offer all that is included in dsox3appbndl? 

Thanks, I'm still reading and trying to decide if this is as good a deal as it seems.

Farnell are doing a very good deal on the MSOX3054 if you go to the trade counter, I think it's £2800+VAT. Even on the website they are 60% off list price or something crazy.

It's 3K + vat on the website, any way of getting 2800+ without actually travelling there in person?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on August 01, 2015, 04:08:19 pm
Sorry guys I haven't read the full thread but I wondered if this worked on the MSOX3054A?  Is the MSOX3054A a good buy (refurbished)? 

Does the hack offer all that is included in dsox3appbndl? 

Thanks, I'm still reading and trying to decide if this is as good a deal as it seems.

Farnell are doing a very good deal on the MSOX3054 if you go to the trade counter, I think it's £2800+VAT. Even on the website they are 60% off list price or something crazy.

It's 3K + vat on the website, any way of getting 2800+ without actually travelling there in person?

No, it's a promotion to increase trade counter footfall. Can't help you out because I'm not around this week and I'm not sure when the promotion ends, could be today. Call trade counter and ask, they're open till 5:30. Tell them Mr B sent you!

EDIT: Ooops it's Saturday today, thought it was Friday...
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Swonkie on August 09, 2015, 03:33:25 pm
I'm looking for the 2.35 firmware for a 2000 series scope. I only found 2.35 for a 3000 scope. Can someone please post it, because I have built myself a LAN adapter and need to downgrade my current 2.38 firmware so I can boot from USB. That would be awesome.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: stroma on August 10, 2015, 01:17:25 pm
Please, is anyone able to provide me with the 2.35 files for DSOX2000 series?
Thanks!!!!

Solved - 2000 firmware seems to be identical to the 3000 Firmware, thus Toplosers link above is fine.

Swonkie, maybe you didn't read carefully :)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Swonkie on August 16, 2015, 07:00:26 pm
Thank you - indeed I didn't see that.
The operation was successful. My thanks to everybody who contributed valuable information to this thread.

I now have two of these unpopulated boards left (ordered from a PCB pool service, so they have soldermask and are cut to the correct shape already):
https://github.com/aewallin/DSOXLAN (https://github.com/aewallin/DSOXLAN)
(Thanks aewallin, although I wish you provided all the required files, ready to order. I also had to fix the soldermask layer over the connector.)

The LAN adapter works, but the scope shows a warning message on boot. Although, if you plan to patch the firmware, you will get a firmware related warning anyway and the LAN adapter warning won't show up anymore.

If anyone is interested in getting one of the PCBs and can suggest a way for me to ship it, without having to spend a lot of money or time, pm me.
I could also send the resistors and capacitor required, if that would help, but you have to order the magjack yourself (see link above).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Campus on August 22, 2015, 09:40:15 pm
Hi,

I am one of the happy recipients of Swonkies PCB. Unfortunately it's not working as expected. I used a RJ45 jack which has no LEDs so I left out the 220Ohms resistors and only soldered the 1nF cap and the 10Ohms resistor. The card is recognized by the device and I can configure the LAN settings as required. My router also seems to somewhat detect the scope as it is shown in the list with the configured IP address.  But I cannot ping it and also the web ui does not return anything. Also telnetting into port 80 does not work.
Would be great if someone has an idea what could be wrong. Maybe I need to emulate the LEDs of the jack?

Thanks,
Campus
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on August 22, 2015, 10:02:32 pm
If LAN settings is available it looks like on scope side it is OK. Did you tried Wireshark to detect the traffic on LAN? It is too long, since I made testing of masked pins on LAN module.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Campus on August 22, 2015, 10:55:08 pm
Hmm, nmap returns no open port and the Message Analyzer shows that the scope never answers any packet. I've seen lots of SYN requests for a new http connection but no reply. Looks like the scope cannot send any packets.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on August 22, 2015, 11:00:17 pm
LEDs aren't needed to make the card work - they are just pretty flashing lights...

Are you sure the PCB is seated well into the edge connector in the scope - it's pretty fine pitch. Contacts on the PCB clean and shiny?

My DIY lan card works just fine on my msox2024a with the latest firmware, so your card should work ok if it's all soldered well and making good contact on the main board.

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Campus on August 22, 2015, 11:17:19 pm
LEDs aren't needed to make the card work - they are just pretty flashing lights...

I was also assuming that and because of that I did not solder the 220 Ohm resistors.

Are you sure the PCB is seated well into the edge connector in the scope - it's pretty fine pitch. Contacts on the PCB clean and shiny?

PCB is clean and looks nice and and seems to fit quite exact into the connector. I also tried several times pulling and adding the board again but no change in result.

My DIY lan card works just fine on my msox2024a with the latest firmware, so your card should work ok if it's all soldered well and making good contact on the main board.

Do you know which pins of the RJ45 are used for sending or receiving? Maybe I could beep them back to the contacts of the pcb.

One other thing I noticed is that https://github.com/aewallin/DSOXLAN lists a 100nF instead of the 1nF shown in the pcb layout. Is that an error or does it not matter that much?

Thanks,
Campus
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on August 23, 2015, 03:36:27 am
The resistors are only for the LEDs.

My schematic is attached.

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sbampato12 on August 23, 2015, 05:25:53 am
Check if the pcb is installed 'all the way to the end', I've had no response with one scope, that 'missed the last 1mm'.

A little more force, and it worked like a charm....
(please do not make any force that could damage the scope pcb or connector...)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Campus on August 23, 2015, 05:24:48 pm
Hi,

so far no luck here. I checked the connectors on the pcb under a microscope and can see little traces from the connecting pins so the physical layout seems to be ok. Then I replaced the 1nF cap with a 100nF cap as shown in Georges pdf. Then I added some leds and the missing resistors to complete the board. The leds light up but no change in behavior. The card is visible in the network which means arp displays the correct scope MAC address for the configured ip address. But I cannot receive any ip or ping packet back from the scope. I also tried different cables and machines in the network.
In my case both LEDs are always on and never blink or turned off. Is that normal behavior?

Thanks a lot to all of you helping me out with this issue,
Campus
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on August 23, 2015, 06:01:07 pm
Both LEDs off with cable unplugged. One LED lit when cable plugs in then the other LED flashes with various network traffic (just any traffic). My scope has a static IP. Various other devices on my network are also static IP. PC's/laptops/tablets/phones etc are all dynamic IP.

Here's the configuration of my scope in case it helps at all (below).

Anyhow, One LED should be flashing with traffic, not both solid permanently, so you have something not quite right in the hardware (imo).

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Kintekobo on August 23, 2015, 06:44:45 pm
Hi Campus. I would heartily recommend putting WireShark to work here. It would save a lot of guesswork and can usually show the problem area for further investigation.


I am keen to see if you can get this working as I would be very interested in doing the same myself. Is Georges80 the person producing the boards and if so are you planning on producing any more?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Campus on August 23, 2015, 06:56:03 pm
Hi,

I got the pcb from Swonkie who made a small batch of them. I now believe the reason why it's not working is the mag jack. According to the datasheet of the Digikey 1419-1021-ND (http://www.trpconnector.com/pdfs/6605758.pdf (http://www.trpconnector.com/pdfs/6605758.pdf)) the RJ45 pins are re-routed inside the jack, so pin 1 on the pcb is not pin 1 on the RJ45 side. My replacement jack is a simple 1-to-1 jack where each pin goes through directly (http://www.reichelt.de/Modularkabel-stecker-etc-/MEBP-8-8S/3/index.html?&ACTION=3&LA=2&ARTICLE=11372&GROUPID=848&artnr=MEBP+8-8S&SEARCH=Modularkabel%2C+-stecker+etc (http://www.reichelt.de/Modularkabel-stecker-etc-/MEBP-8-8S/3/index.html?&ACTION=3&LA=2&ARTICLE=11372&GROUPID=848&artnr=MEBP+8-8S&SEARCH=Modularkabel%2C+-stecker+etc)).
So I guess I need to find a place where I can get a jack with the same mapping.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Swonkie on August 23, 2015, 07:36:07 pm
I now believe the reason why it's not working is the mag jack.

That's what I would suggest too - compare the exact pinouts of your magjack to the suggested one.
As I said in the PM, I have used the board with a 1nF capacitor and it works very reliably.
By the way, telnet is on the default port 23, not on port 80.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Campus on August 23, 2015, 10:27:19 pm
Hi again,

I finally found a distributor in Europe who ships a pin compatible mag jack.  :-+ When it has arrived I will give it a try and report back whether it works.

@Swonkie: I know that telnet runs on port 23. When saying "telnetting into port 80" I meant redirecting telnet into port 80 because it's the easiest way to check whether a port is open. I could then manually make a HTTP request to check the web server response.

@Kintekobo: I analyzed the network traffic but never saw any reply packet coming from the scope.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Campus on August 26, 2015, 11:21:20 pm
Hi again,

today I received a compatible Mag Jack and I replaced the existing jack and also removed the no longer required LED resistors. And I couldn't believe it but it worked immediately. DHCP works and also static IP works. This is really cool. Thanks a lot to george80 and Swonkie and all the others helping me with this problem.

Has some of you any experience with the performance of the different client UIs available? Is the Java-based client more responsive than the HTML5 one? I don't have Java installed and could not test it so far.

Thanks again,
Campus
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Marchello on December 01, 2015, 01:59:43 pm
Hi folks!

Can I unlock DSOX3104A with FW 2.41?

Mark.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on December 13, 2015, 08:25:48 am
I just downloaded the v2.41 firmware from Keysight --- a lot has changed as far as "infiniiVisionSetup.cab" is concerned: 
 - The file "infiniiVisionCore.dll" no longer exists!  :-\
 - "/Secure/Startup/infiniivision.lnk" is empty (rather than contain default link to infinivisionlauncher.exe, which itself exists)
 - "/Secure/Startup" directory is missing many files present in firmware v2.39 and earlier
 - There is a new "/Secure/help" folder containing what looks like language packs

Did anyone look into changes in the boot process or allowing options in firmware v2.41?  infiniiVisionCore.dll was large file at 16.5MB ...there's no new files anywhere near that size.

I attached the release notes for v2.41.  The enhancements/fixes over v2.40 are pretty minor, but 2.40 introduces some networking improvements:
 + negative duty cycle measurement
 + Ax+B operator now allows negative A
 + DVM handles channel invert more appropriately


Does anyone have the v2.40 firmware update from Keysight?  I would like to take a look; unfortunately no longer available on Keysight website...

Any thoughts about the changes to the firmware, potential to downgrade etc.??
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on December 13, 2015, 05:08:48 pm
Hi folks!

Can I unlock DSOX3104A with FW 2.41?

Mark.

Buy IDA Pro and it can be possible. Downgrade to 2.3x seems to be better option :)
The changes between latest version 2.41 and 2.35 are minor.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: nctnico on December 13, 2015, 05:49:58 pm
A quicker way is to do a binary compare and identify if and where the to-be-patched location has been moved to.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: MarkL on December 15, 2015, 03:06:08 pm
...
I attached the release notes for v2.41.  The enhancements/fixes over v2.40 are pretty minor, but 2.40 introduces some networking improvements:
 + negative duty cycle measurement
 + Ax+B operator now allows negative A
 + DVM handles channel invert more appropriately
It might not matter much to others, but in 2.41 I'm happy they finally seem to have fixed the bug where the scope issues multiple netbios name queries back to a host connecting to the SCPI port.  If there wasn't a netbios listener on the host, the scope would hang for about 8 seconds each time.  Netbios has nothing to do with SCPI, or TCP connections for that matter.

That only took 2 1/2 years to fix.

It would be nice to have the REAL list of issues fixed and other changes in each release, and not some fluffy little list deemed harmless for public consumption.  Without an option to downgrade, I want to know ALL the changes when I risk a one-way upgrade.


EDIT: minor typo.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mark on December 15, 2015, 06:20:04 pm
Does anyone know if the options will expire if I set the clock forwards before starting the built-in trial?  I set mine to 2115, started the trial, then set the clock back to 2015. Someone mentioned it earlier in the thread but I didn't see an answer, maybe wishful thinking... :-//
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Hydrawerk on December 15, 2015, 07:03:29 pm
Setting the clock has no impact on built-in trials.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on December 15, 2015, 07:11:27 pm
Does anyone know if the options will expire if I set the clock forwards before starting the built-in trial?  I set mine to 2115, started the trial, then set the clock back to 2015. Someone mentioned it earlier in the thread but I didn't see an answer, maybe wishful thinking... :-//

This works on 6k series ( non X). But not on 3kX and 2kX series scopes.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Sparky on December 21, 2015, 12:29:43 am
A quicker way is to do a binary compare and identify if and where the to-be-patched location has been moved to.

Hi nctnico, perhaps you are replyig to me?  If so regarding patch location in v2.41, the binary file infiniiVisionCore.dll is missing from the .cab file.  Perhaps a big restructure of the firmware? I didn't find any other .dll file which could have replaced it.

Does anyone have a copy of firmware v2.40?

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Wiljan on January 17, 2016, 10:28:35 pm
Hi, just found this great thread.

I do have a DSO-X2014A with FW 2.41, no LAN module.
Are there any way to downgrade to 2.37?

Please advise, thx
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mark41 on January 23, 2016, 09:07:37 pm
Could you please help me to hack my DSO-X 2012A with firmware 02.10. I asked plesa and he said I need 2.35 firmware version to get. Is there anybody who has this firmware and successfully hacked this series and could help with this procedure?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: dziobu on January 23, 2016, 10:08:19 pm
There are untouched firmware files:
https://www.dropbox.com/s/mt6w8fj6oqer51g/2000XSeries.02.35.2013061800.cab?dl=0 (https://www.dropbox.com/s/mt6w8fj6oqer51g/2000XSeries.02.35.2013061800.cab?dl=0)
https://www.dropbox.com/s/y4y3d2xmj2gmgdb/2000XSeries.02.37.2014052002.cab?dl=0 (https://www.dropbox.com/s/y4y3d2xmj2gmgdb/2000XSeries.02.37.2014052002.cab?dl=0)
https://www.dropbox.com/s/c4u6zukxjthj76a/2000XSeries.02.39.2015022602.cab?dl=0 (https://www.dropbox.com/s/c4u6zukxjthj76a/2000XSeries.02.39.2015022602.cab?dl=0)

And read this:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/585/ (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/585/)
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/735/ (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/735/)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Wiljan on January 24, 2016, 11:11:57 am
When I'm trying to load FW 2.35, 2.37, or 2.39 instead of current fw 2.41 on DSOX2014

I do get this "Error: The file did not load correctly" after a while
I did try the 'Secure Erase'  as sugested in another thead for the same error but lower fw, it did not help.

Would it be possible to go back from 2.41 if I had a LAN card?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: trevwhite on January 24, 2016, 06:01:07 pm
Hi all

It looks like I might have to send my scope in for repair under warranty. Bit concerned that they might upgrade the firmware whilst it is there. Has anyone been able to downgrade from the latest firmware to 2.35 successfully?

Thanks

Trev
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on January 24, 2016, 06:47:24 pm
I did an update to 2.41 on my scope.
The good news: Still the same telnet login :), Star Trek Screensaver still working and a hacked infiniivision with all options can be started over telnet.
The bad news: The infiniivision exe & dll is now in the \windows folder. So it's not possible to change the files because this folder is "read only".

I tried also infiniiVisionInstallService.exe from an older version to load an older firmware version but the exe doesn't run.
I think the only way to downgrade is to try directly \windows\loadP500Flash -u ceImage1 %TEMP%\nk.bin.comp with the high risk to brick the scope.  :-BROKE

At the moment I won't risk to brick my scope because i have the license bundle on it and the only option that is missing is the MSO option which is rarely used.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mark41 on January 24, 2016, 07:15:38 pm
Still I cant get my oscilloscope boot from usb that has hacked 2.39. I get black background and agilent logo only only, it takes I while, longer then normal boot but it boots into 2.35. My structure on the usb looks like this:

Code: [Select]
L:\
????Agilent Flash
?   ????config
?   ????wfmMem
????Secure
?   ????infiniiVision
?   ?   ????fpga
?   ?   ????upgrade
?   ?   ????web
?   ?       ????css
?   ?       ????help
?   ?       ????image
?   ?       ????include
?   ?       ?   ????web-socket-js
?   ?       ????lib
?   ?       ????Lxi
?   ?       ?   ????Identification
?   ?       ????navbar
?   ????Startup
????Temp
Is it correct ?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on January 24, 2016, 07:19:19 pm
Do you have infiniivisionStartupOverride.txt file in root?
Upgrade to 2.35 firmware and try multiple USB sticks.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mark41 on January 24, 2016, 07:21:50 pm
Yes I do. It's different from the normal boot because it takes a bit longer time and the logo with mountains doesn't show up.
I managed to make it work with a help of my friend.  :-+  I wonder why nobody made and posted a link to a usb image to make it easier for people. Is it forbidden or what ?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Wiljan on January 25, 2016, 01:11:29 pm
Did build a LAN interface and it does work  :) Still on FW2.41 I can use the scope over WEB

If I go for the "Firmware Version" and browse the the filter are Keysight X-Series files(*.ksx) or Agilent X-Series files (*.agx), so here it will not work with 2.37 cab file

I can telnet on port: 5024 no password required and I can controll the scope in respec to "Oscilloscopes Programmer's Guide"  like :SINGLe or :RUN

If I telnet on port 23 I'm required to enter user/ pass and the infiniivision / skywalker1977 are incorrect

Any hint?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on January 25, 2016, 03:15:00 pm
The first login on telnet will fail every time on my scope.
The second login should work.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Wiljan on January 25, 2016, 05:39:38 pm
Thx kilobyte, you are right the login / pass needs to be typed twice  :)
So now I have access for the promt

Pocket CMD v 6.00
\> dir

    Directory of \

01/01/98  12:00p    <DIR>                    Network
01/26/16  01:27a    <DIR>                    Application Data
01/26/16  01:27a    <DIR>                    profiles
01/26/16  01:27a    <DIR>                    Documents and Settings
01/26/16  01:27a                          23 Control Panel.lnk
01/26/16  01:27a    <DIR>                    My Documents
01/26/16  01:27a    <DIR>                    Program Files
01/26/16  01:27a    <DIR>                    Temp
01/26/16  01:27a    <DIR>                    Windows

    Found 9 file(s). Total size 23 bytes.
    1 Dir(s) 15499264 bytes free


I can kill infiniivisionLauncher and start it again ...
processMgr.exe kill infiniivisionLauncher.exe
infiniiVisionLauncher -l All

When the soft restarts I still only have the few original options

I also tried FTP standard port as well and it only gives access for 2 folders called webdata and webupdate ... both empty

Any idea how to move on from here?

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Wiljan on January 25, 2016, 05:53:24 pm
Ok... got a bit futher  8)

So basic the scope do have FW2.41 installed

I hava a USB stict with the modified FW2.37

From telnet
\windows> cd \usb
\usb> cd infiniiVision
\usb\infiniiVision> processMgr.exe kill infiniivisionLauncher.exe
\usb\infiniiVision> infiniiVisionLauncher -l All
Our command line is -l All
*** Installing License: All Licenses

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: trevwhite on January 26, 2016, 10:48:09 am
Wiljan, can I just confirm that over Telnet with FW 2.41 you are able to enable all licenses? You have to telnet and do the procedure each time you power up but it does work?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Wiljan on January 26, 2016, 11:29:09 am
Wiljan, can I just confirm that over Telnet with FW 2.41 you are able to enable all licenses? You have to telnet and do the procedure each time you power up but it does work?
Yes I have FW2.41 flashed in scope and a USB stick with FW2.37 modified.
I have to Telnet into the scope and run the FW2.37 from USB each time if I want all licenses enabled.

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: trevwhite on January 26, 2016, 11:32:51 am
That is awesome!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TopLoser on January 26, 2016, 11:35:33 am
Awesome indeed, might have to bump up the price of that MSO-X-3054 I've got posted for sale now!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on January 29, 2016, 09:22:46 pm
Ok... got a bit futher  8)

So basic the scope do have FW2.41 installed

I hava a USB stict with the modified FW2.37

From telnet
\windows> cd \usb
\usb> cd infiniiVision
\usb\infiniiVision> processMgr.exe kill infiniivisionLauncher.exe
\usb\infiniiVision> infiniiVisionLauncher -l All
Our command line is -l All
*** Installing License: All Licenses

I have a 2.41 scope too, and I took your directions and wrapped it up into a VBScript to do this automatically. Note: I am NOT a VBScript programmer, in fact it's a technology that I've spent a good deal of my career avoiding, mostly but not always successfully. However, if you want to script up a nasty macro key pusher to an async telnet interface, sometimes needs must.

First, I formatted a USB stick as exFAT and copied the contents of the zip file in this post https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg535755/#msg535755 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg535755/#msg535755)

I renamed the infiniivisionStartupOverride.txt file on the root of the usb stick with .old on the extension so the scope doesn't just loop at bootup, and I can just leave the USB stick permanently plugged in.

You will need to make sure Windows has its Telnet client installed, you do this from Control Panel -> Programs -> Programs and Features -> Turn Windows features on or off, and select the Telnet client.

Copy the attached file to your computer and remove the .txt extension.

You can run the x3000a.vbs directly from the command line or make up a shortcut, but either way you need to specify on the command line the IP address or hostname of the scope, for example

Code: [Select]
x3000a.vbs a-mx3054a-12345

or

Code: [Select]
x3000a.vbs 192.168.50.123

Note that because it's a dumb key pusher, it has limitations. Firstly you might need to alter the delays for your particular PC, and secondly if you change focus to a different app or window, it'll start pumping in characters into that window rather than the telnet session, so I'd let it do its stuff until someone better than me can come up with something better. You could also significantly reduce the "WScript.Sleep 45000", but I left it like that because there is some useful feedback to the end user.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: trevwhite on January 29, 2016, 10:10:35 pm
Great work, thanks for this script.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Wiljan on January 30, 2016, 09:51:28 am
Thx Howardlong, script works here as well  :) I made a small bat file with the IP address included

I have been thinking when having 2.41 on scope and loaded 2.37 from usb stick.
If it would be save to flash the 2.37 (and if that not possible since it's already loaded than take the FW2.35) first and then 2.37 ?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on January 30, 2016, 10:27:39 am
Ok... got a bit futher  8)

So basic the scope do have FW2.41 installed

I hava a USB stict with the modified FW2.37

From telnet
\windows> cd \usb
\usb> cd infiniiVision
\usb\infiniiVision> processMgr.exe kill infiniivisionLauncher.exe
\usb\infiniiVision> infiniiVisionLauncher -l All
Our command line is -l All
*** Installing License: All Licenses

This can be easily ported to Python and RPi2 platform which can be powered from scope itself. And run on startup or by Cron.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on January 30, 2016, 01:31:03 pm
Indeed, this morning I finally found a use for one my original RPi's that's been stuck in a drawer.

It all sits in the probe compartment and runs automatically at scope boot up.

The RPi is powered from a hub that's connected to the rear USB port. This hub also has the USB stick with the 2.37 code.

I wrote an "expect" script (attached) and added it to the rc.local so it runs on boot up.

Quick setup

Install Rasbian Jessie
sudo apt-get install telnet
sudo apt-get install expect

Place the attached x3000a.txt script in your /home/pi directory, and rename it to x3000a.

To run it immediately from your /home/pi directory, run the following (setting your scope's IP address or host name as appropriate):

  expect x3000a 192.168.50.123

Next steps (running automatically at power up)

Power your RPi from one of the USB ports so it powers up and boots when the scope initially boots.

Raspberry pi configuration changes in GUI:
   set to cli only (Note that you can always go back into the gui with startx from the command line)
   wait for network

I recommend using a static IP address on the RPi and the scope so this will work without a DHCP server if you're off your LAN (a straight through CAT5 patch cable between Pi and scope works in this case). It looks like some well meaning individual chose to change how static addresses are set up in RPi, rendering hundreds of pages on the subject obsolete. It's now in /etc/dhcpcd.conf.

Add to the bottom of /etc/dhcpcd.conf file your Pi's static IP address details:

   interface eth0
   static ip_address=192.168.50.123/24
   static routers=192.168.50.1
   static domain_name_servers=192.168.50.1

To make it work automatically at boot* add the following to your /etc/rc.local file before the "exit 0", setting the IP address to your scope's, and note the "&" on the end, it is not a typo!

  /usr/bin/expect /home/pi/x3000a 192.168.50.123 &

*I strongly recommend getting it to work from the command line first with a monitor before setting it up to work "headless" at boot time in case some of the timings don't work out for you.

One caveat: remove any USB stick in the front before boot, that appears as \usb with the rear one \usb2.

Edit: added some clarifications and one correction to a typo on the static IP address config.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on January 30, 2016, 02:00:00 pm
Indeed, this morning I finally found a use for one my original RPi's that's been stuck in a drawer.

It all sits in the probe compartment and runs automatically at scope boot up.

The RPi is powered from a hub that's connected to the rear USB port. This hub also has the USB stick with the 2.37 code.

I wrote an "expect" script (attached) and added it to the rc.local so it runs on boot up.

In brief:

Install Rasbian Jessie
sudo apt-get install telnet
sudo apt-get install expect

Raspberry pi configuration in GUI (Note that you can always go back into the gui with startx from the command line)
   set to cli only
   wait for network

Place the attached x3000a.txt script in your /home/pi directory, and rename it to x3000a.

I recommend using a static IP address on the RPi and the scope so this will work without a DHCP server if you're off your LAN. It looks like some well meaning individual chose to change how static addresses are set up in RPi, rendering hundreds of pages on the subject obsolete. It's now in /etc/dhcpcd.conf

   add to the bottom of /etc/dhcpcd.conf file

   interface wlan0
   static ip_address=192.168.50.123/24
   static routers=192.168.50.1
   static domain_name_servers=192.168.50.1

To make it work at boot, add the following to your /etc/rc.local file before the "exit 0", setting the IP address to your scope's:

  /usr/bin/expect /home/pi/x3000a 192.168.50.123 &

One caveat: remove any USB stick in the front before boot, that appears as \usb with the rear one \usb2.

You are pretty fast, well done!!  :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on January 31, 2016, 03:48:31 pm
Edit: the following only applies if your scope already has 2.41 installed.

Interestingly, the telnet kill-and-launch-from-USB method  (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg850610/#msg850610)works with a USB key made with the current 2.41 3000XSeries.02.41.2015102200.cab (http://www.keysight.com/main/software.jspx?ckey=2014548&lc=eng&cc=GB&nid=-32540.1150205&id=2014548) firmware directly downloaded from Keysight extracted with the Python script too.

But, with 2.41, there is apparently no need to add any additional files to the USB root, patch a dll, or change any .lnk file.

In short, copy just the infiniiVision directory generated by the dosetup.py script to the USB root.

dosetup.py is in the agilent.zip attachment in this post (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg636470/?topicseen#msg636470).

Here are modified instructions to prepare a clean FAT32 formatted USB stick (my modifications in bold italics), and assumes that you have Python 2.7 installed in the default C:\Python27 in Windows.

* extract Agilent .cab firmware with you favorite program (I used 7zip)
* extract infiniiVisionSetup.cab file : you have now an infiniiVisionSetup folder
* chdir to infiniivisionSetup  folder, copy dosetup.py to this folder
* c:\Python27\python dosetup.py (linux users should chande \ by / in _setup.xml file !!!)
* then chdir to Secure/infiniiVision
* copy all the infiniiVision and Startup directories directory to an USB key (ie, there should be a single infiniiVision directory on the root of the USB key with a bunch of files and directories within it)

To run:


Notes:

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on January 31, 2016, 10:27:35 pm
Thx Howardlong, script works here as well  :) I made a small bat file with the IP address included

I have been thinking when having 2.41 on scope and loaded 2.37 from usb stick.
If it would be save to flash the 2.37 (and if that not possible since it's already loaded than take the FW2.35) first and then 2.37 ?

I haven't figured out how to downgrade a 2.41 scope's flash, it doesn't seem to like it from USB stick or via the web interface as far as I can see, operator error excepted of course!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on February 02, 2016, 05:43:45 pm
This has turned out to be even easier than I thought on a 2.41 scope, you don't even need a USB stick, just a telnet connection.

A VBscript "x3000aV2.vbs.txt" is attached. Remove the ".txt' from the file name. Setup a shortcut to x3000aV2.vbs with the IP address or hostname of your scope as the first parameter. You will need Windows' Telnet client installed (in Windows Features).

It turns out that the \secure folder is still there but hidden, the script runs the following from telnet:

Code: [Select]
cd \secure\infiniivision
processmgr kill infiniivisionlauncher.exe
infiniivisionlauncher -l all


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mark on February 02, 2016, 06:12:11 pm
Thanks for your hard work Howard!  I have one possibly stupid question, is this all possible without a DSOXLAN or home-made equivalent? 
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on February 02, 2016, 07:23:53 pm
Thanks for your hard work Howard!  I have one possibly stupid question, is this all possible without a DSOXLAN or home-made equivalent?

No, because you cannot connect to telnet over USB :( Homemade DSOXLAN adapter will work.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on February 02, 2016, 09:03:40 pm
Thanks for your hard work Howard!  I have one possibly stupid question, is this all possible without a DSOXLAN or home-made equivalent?

I don't know what's available on the board itself other than a serial line that I am sure will work with u-boot. Whether it offers a serial terminal in Windows CE, I don't know, but Windows isn't Linux so I wouldn't be at all surprised if that's not available. The last time I did anything seriously with Windows CE was about 1997 when it first came out! I do have two Windows CE 6.0 dev boards here gathering dust, if I get chance I'll try to blow off the cobwebs.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: chromex on February 02, 2016, 09:57:17 pm
Do these hacks work on the DSOX3000T series?
No

Did someone manage to make these hacks work on the DSOX3000T series now?  ::)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: trevwhite on February 04, 2016, 01:52:19 pm
I followed the instructions HowardLong put up using the Lan connector and the VB script. Interestingly my scope is a 3024A but when I did the -l all option it downgraded me to 100Mhz. I had to change the command to "-l BW20 l-all"

This then worked. When I reboot after the script the network card needs its configuration reset to auto as all the options are lost. Within a few seconds though all is back up again.

Regarding the DIY Lan card. After reading through this thread I picked up the bit about the DIY lan cards and found the difference between the center tap configurations. My original card had a 1uF connected to ground and was rebooting the scope. It seems the more successful versions have the 10R and 1nF circuit connected to the center tap. I modded my card to that configuration and the card does work but I get the message indicating the card is faulty upon boot. My wiring is the same has georges80 circuit but maybe its because its a 3000 series and not the 2000? Has anyone got a 3000 series scope working with a diy lan card and do not get the error message?


Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on February 04, 2016, 05:40:26 pm
I followed the instructions HowardLong put up using the Lan connector and the VB script. Interestingly my scope is a 3024A but when I did the -l all option it downgraded me to 100Mhz. I had to change the command to "-l BW20 l-all"

This then worked. When I reboot after the script the network card needs its configuration reset to auto as all the options are lost. Within a few seconds though all is back up again.


Doh! Schoolboy error, sorry. My 3054A dropped to 350MHz. "-l bw50" added after the "-l all" fixed it. Sorry for missing that.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: trevwhite on February 04, 2016, 05:44:52 pm
What you created is fantastic, thank you.

Howard, did you buy the proper LAN adapter? Does the scope forget its network setting when you execute the script?

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on February 04, 2016, 10:07:14 pm
What you created is fantastic, thank you.

I merely follow in the footsteps of giants. Almost all of the work was already done.

Quote
Howard, did you buy the proper LAN adapter? Does the scope forget its network setting when you execute the script?

I do have a proper Keysight DSOXLAN. I don't know where it's getting the LAN data from, it's showing nonsense but I can still telnet into the address I originally set up in the standard boot. It prints too, so I guess there's something else going on which is cosmetic only as far as I can see, but stand to be corrected.

I have a CE 6.0 dev environment up now, and an ARM demo board running it which it doesn't matter if I brick, I can always bring that back to life. I can create my own .exe's that run fine on the scope, in console mode at any rate. To their credit Agilent/Keysight threw out the standard Windows UI and copied pretty faithfully their awesome Ui from their previous vxWorks scopes, so I'm not even sure yet if they use the Windows GDI, the consistent API that sits between programmer and graphics device.

The problem of the IP address and the way the scope starts up in default mode I feel maybe related, perhaps it's simple and just needs to be started in a particular directory to pick up the settings, I don't know.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: trevwhite on February 05, 2016, 09:18:45 pm
Okay, I think I have gotten to the bottom of the DIY Lan cards.

From reading back through this thread ( again ) I noticed that some people who did not see the error message regarding the LAN card were running hacked software.

I find that after I did the mod to correct the centre tap of the transformers and shorted pins 78/80 my lan card works perfectly but I get the error message on first boot for firmware 2.41 ( unhacked ). But when I run Howards script, the scope reboots with all licenses and does not display the error.

So I think the error is software related and not hardware. Not sure if anyone else can prove this but I feel comfortable the LAN card is working fine on 3000x scopes
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ECEdesign on February 26, 2016, 06:18:37 pm
What would be the best firmware version to upgrade a DSOx2000 scope with current firmware version 1.21.2011072803?  The only firmware on Keysight's page is 2.41 and that firmware does not seem to be hack-able.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on February 26, 2016, 06:56:39 pm
Everything is hackable, question is only time and effort including 2.41.
The best will be 2.36 or 2.36 booted from USB stick.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on February 26, 2016, 09:37:36 pm
What would be the best firmware version to upgrade a DSOx2000 scope with current firmware version 1.21.2011072803?  The only firmware on Keysight's page is 2.41 and that firmware does not seem to be hack-able.

2.41 is easily liberated but you need a LAN card and be able to double click an icon on your desktop once the scope's booted to the second splash screen with the black background. Depending on your setup that may or may not be easily feasible: as I work in mixed signal I always have a PC permanently at the bench so it's not a big deal.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ECEdesign on February 27, 2016, 01:27:53 am
I don' have a LAN card for my scope.  I did some digging through this thread it looks like 2.35 is the best version.  I will probably start by booting from a USB drive since its a bit safer see if it works out.  I found the original 2.35 firmware in the thread I still need to find what needs to be modified to get the hack to work.

Also I saw a teardown of the agilent MSO probes, it doesn't look like there is any circuitry in them so would any header extension get MSO capability once the MSO function is unlocked?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on February 27, 2016, 01:39:11 am
I don' have a LAN card for my scope.  I did some digging through this thread it looks like 2.35 is the best version.  I will probably start by booting from a USB drive since its a bit safer see if it works out.  I found the original 2.35 firmware in the thread I still need to find what needs to be modified to get the hack to work.

Also I saw a teardown of the agilent MSO probes, it doesn't look like there is any circuitry in them so would any header extension get MSO capability once the MSO function is unlocked?

There is step by step description in this thread.
For MSO just the header will do the job, no identification of genuine probe.
Check ebay for original MSO probe.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on February 27, 2016, 02:01:12 am
There *IS* circuitry in the MSO probe - it's a 90k (nominal) resistor in series with the signal and INSIDE each of the flying lead (grey plastic ends) where the little ground pins go. So you can't just take a header and wires and call it done.

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on February 27, 2016, 06:34:17 am
There *IS* circuitry in the MSO probe - it's a 90k (nominal) resistor in series with the signal and INSIDE each of the flying lead (grey plastic ends) where the little ground pins go. So you can't just take a header and wires and call it done.

cheers,
george.

That is correct. I also suspect that the wires in the ribbon cable itself may be resistive/lossy. If all you're doing is low speed stuff it's certainly possible you could sling something together, but georges80 is correct, the probes are not just a ribbon cable.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Jay_Diddy_B on February 27, 2016, 07:11:07 am
Hi,

I haven't checked but some of the cables and probes from the old logic analyzer might work. I am think 1650, 1660 series instruments. They have a similar divider.

Regards,

Jay_Diddy_B
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on February 27, 2016, 11:34:53 am
Certainly those from the old 54622d and 54642d work.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on February 27, 2016, 05:23:32 pm
There *IS* circuitry in the MSO probe - it's a 90k (nominal) resistor in series with the signal and INSIDE each of the flying lead (grey plastic ends) where the little ground pins go. So you can't just take a header and wires and call it done.

cheers,
george.

That is correct. I also suspect that the wires in the ribbon cable itself may be resistive/lossy. If all you're doing is low speed stuff it's certainly possible you could sling something together, but georges80 is correct, the probes are not just a ribbon cable.

The weaved cable signal wires are resistive/lossy. They are nominal 190 ohm wires on mine. The ground wires in the weave ARE zero ohms.

I did some research/discovery of the cables, since I used them with an adapter I made to allow me to use them into the msox2000 analog front end for serial decoding. The 2000 series performs serial decode using the 4 channel analog inputs unlike the 3000 that uses the LA inputs.

cheers,
george.

Edit to correct that the signal wires are resistive. (The ground wires are NOT).
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georgd on February 28, 2016, 06:44:12 am

The weaved cable wires are not resistive/lossy. They are just nominal 0 ohm wires.
george.

The weaved cable are resistive and forms lossy transmission line, patendted by HP enginner:
http://www.google.com/patents/US4777326 (http://www.google.com/patents/US4777326)

My cable has 120 cm long an has 180 Ohms.

Georg
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on February 28, 2016, 10:38:22 pm
Has anyone figured out howmtomtalemthe pod thingy apart on these? I have an old wone that's missing a couple of final probe leads, I don't mind taking it apaaaaarrt (TM) and measuring it if it's easy enough, but an obvious non-destructive disassembly alluded me last time I looked.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Jay_Diddy_B on February 28, 2016, 10:55:28 pm
Hi Howard and the group,

I am not entirely sure which 'thingy-ma-bob' you are talking about. If you are talking about this part:

(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=204770;image)

These photographs will help you unlock the secrets.

(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=204772;image)

(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=204774;image)



Regards,

Jay_Diddy_B

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on February 28, 2016, 11:07:51 pm

The weaved cable wires are not resistive/lossy. They are just nominal 0 ohm wires.
george.

The weaved cable are resistive and forms lossy transmission line, patendted by HP enginner:
http://www.google.com/patents/US4777326 (http://www.google.com/patents/US4777326)

My cable has 120 cm long an has 180 Ohms.

Georg

Yes, you are correct, around 190 ohms for the data wire on the cable and zero ohms for the interleaved ground wires. Even more magic than I thought to maintain good impedance match along the cable.

...and thus an even better reason to source the correct cables for the scope if one purchased the none msox version.

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: plesa on February 28, 2016, 11:38:11 pm

The weaved cable wires are not resistive/lossy. They are just nominal 0 ohm wires.
george.

The weaved cable are resistive and forms lossy transmission line, patendted by HP enginner:
http://www.google.com/patents/US4777326 (http://www.google.com/patents/US4777326)

My cable has 120 cm long an has 180 Ohms.

Georg

Yes, you are correct, around 190 ohms for the data wire on the cable and zero ohms for the interleaved ground wires. Even more magic than I thought to maintain good impedance match along the cable.

...and thus an even better reason to source the correct cables for the scope if one purchased the none msox version.

cheers,
george.

Genuine cable N6459 has input resistance 90k.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: georges80 on February 28, 2016, 11:41:04 pm
The CABLE is around 180 ohms on the 'signal' lines, and zero ohms on the ground lines.

The test PIN/HEADS are 90K. i.e. the part that unclips from (as in Jay's picture).

We're talking two different parts....

cheers,
george.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on February 29, 2016, 03:43:37 pm
http://www-d0.fnal.gov/trigger/stt/commiss/agilent/agilentprobing.pdf (http://www-d0.fnal.gov/trigger/stt/commiss/agilent/agilentprobing.pdf)

Page 9:

The Standard Probing System

The standard probing system
consists of IC clips, probe leads,
probe housing and probe cable.
Because it is passive, the standard
probing system is smaller,
lighter, and much easier to use
than active probing systems. This
passive probing system is similar
to a probing system used on a
high frequency oscilloscope. It
consists of an isolation network
(as shown in figure 3) at the
probe tip and a shielded resistive
transmission line
.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Jay_Diddy_B on February 29, 2016, 04:14:17 pm
Hi group,

This document shows a picture of this special cable:

http://cp.literature.agilent.com/litweb/pdf/5968-8153EN.pdf (http://cp.literature.agilent.com/litweb/pdf/5968-8153EN.pdf) page 14.

Here is the picture:

(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=204925;image)

The part number: 01650-61607 suggests that has been used since the 1650 series of LAs.

Some of the connections will measure low resistance, other higher resistance. There is a mixture of low resistance and resistance wire connections.

The manual describes the Logic inputs as 1GSa/s sample rate and 50 MHz toggle rate.

Regards,

Jay_Diddy_B

Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on February 29, 2016, 09:52:37 pm
This is the cable I'm talking about with the woven cable:

https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg367778/#msg367778 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg367778/#msg367778)

There are two central rivets hidden beneath the label which is the reason I'm reticent to go medieval on it.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mykeil on March 12, 2016, 09:20:54 pm
I am trying to unlock Agilent 54831D Infiniium MSO. It is running Windows XP.
Did someone did this?

Can someone show me the way? Thanks.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on March 12, 2016, 09:38:21 pm
I am trying to unlock Agilent 54831D Infiniium MSO. It is running Windows XP.
Did someone did this?

Can someone show me the way? Thanks.

Is it Windows 95 or XP?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mykeil on March 12, 2016, 09:51:07 pm
It is Windows XP.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on March 12, 2016, 10:06:59 pm
It is Windows XP.

You might want to look at this thread https://www.eevblog.com/forum/testgear/agilent-hp-54831d-advice/ (https://www.eevblog.com/forum/testgear/agilent-hp-54831d-advice/)

User Blacknoise was very helpful.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Mykeil on March 12, 2016, 10:12:58 pm
Thank you a lot. I will contact him.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: keitheevblog on March 29, 2016, 04:37:51 am
Howardlong and friends: you guys simply kick a**.

The posts here were fantastic.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: elliotb on April 05, 2016, 08:28:07 pm
I recently scored a cheap dsox2004a in ebay and upgraded the software to 2.35. I've read through the thread (a few times) but I'm stuck unpacking the cab file... I can extract it fine but I don't have a way to do the numerous copies necessary to create the /Secure file structure. I tried installing cab manager 3.0 but the website it gone and all the installers I can find are just bloatware... I work in linux mostly but can run Windows 8.1 in a vm. Does anyone have a python script to unpack the files using _setup.xml?

Thanks,
Elliot
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: kilobyte on April 05, 2016, 09:15:36 pm
Hi Elliot,

 you can use this tool here http://www.codeppc.com/telechargements/msceinf/msceinf.htm (http://www.codeppc.com/telechargements/msceinf/msceinf.htm) to extract the cab file
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: elliotb on April 05, 2016, 09:54:58 pm
Thanks kilobyte! Didn't see this so I ended up just hacking up a python script (after spending over an hour trying to get the damn cab manager installed). Inline below in case it's useful for anyone else. Just takes a single arg which is the extracted infiniiVisionSetup.cab directory. Looks like its all working now!  :-+

 #!/usr/bin/python
 #
 # Parse xml into cab file system
 #
import sys
import os
import shutil
from xml.etree import ElementTree

 # Dir name
dir = None

 # get root
root = sys.argv[1]

if root is None:
    os.exit ("Must specify root")

with open (root + "/_setup.xml", 'rt') as f:
    tree = ElementTree.parse (f)

for node in tree.iter():

    if node.attrib.get ('type') is not None:

        # Check if we should get new base dir
        if node.attrib.get ('type')[0] == '\\':
            dir = node.attrib.get ('type')
            dir = dir.replace ("\\", "/")
            dir = dir[1:]
            print "mkdir %s" % dir
            if not os.path.exists (dir):
                os.makedirs (dir)

        # Check if we found a destination dir
        else:
            if node.attrib.get ('translation') == 'install':
                dest = dir + '/' + node.attrib.get ('type')
 #                print "Dest: %s" % dest

    # Check if we have a source
    if node.tag == 'parm' and dir is not None:
        src = root + "/" + node.attrib.get ('value')
        print "cp %s %s" % (src, dest)
        shutil.copyfile (src, dest)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on April 06, 2016, 12:55:59 am
Man its been forever since I last checked this thread! Gotta scan through it and see whats new and whats changed in the game!
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mongo on April 06, 2016, 05:30:40 am
As someone whom had to pay the price for the "NEW" official MSO cable for the DSOX2000, which I hope actually works (as you cannot access the digital lines from the serial key enabled)  I wanted to upload a picture of the latest shipping cable. Note it does come with a licensed entitlement that you have to register but I did not try it without the key.

Note that it is not braided cable, but I am unwilling to pull it apart until I make sure I can decode SPI/I2C while watching the digital channels for timing.

(http://s24.postimg.org/jxklzgar9/2000_XMSO.jpg)
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: mongo on April 06, 2016, 04:38:38 pm
Note that if you have a DSOX2000 series scope the $700 cable is not worth your time, even if the cost isn't an issue and you need a MSO for slow speed serial will be better off writing a sketch on an Arduino Uno.  The MSO functionality on this series is less capable than anything else that dares to claim to be an MSO.  Despite all of the marketing fluff you can't even have the digital channels on while decoding serial and you cannot decode serial on the digital lines. 

This means that if you wanted to check your chip select timing on a SPI bus you are SOL.  Apparently the "hardware serial decoding" is done by something with less horsepower than an AVR.  As I do lots of slow speed serial work I will be putting the cable in a box next to my bus pirate as a reminder to remind myself the the glory days of HP/Agilent are gone.  :--

And yes it is my fault I thought it was a good thing they quit reselling Rigol at this price point, and was willing to wait 45 days for them to ship me a breakout cable and a sheet of paper.  But that delay removes any ability to return the main unit to a retailer.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: elliotb on April 07, 2016, 04:15:20 pm
Thank you for sharing that mongo. Good to know... I've been looking for a used one online but based on your review I will abandon all hope for the digital lines.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Keysight DanielBogdanoff on April 07, 2016, 05:14:06 pm
Hi mongo,

I'll follow up with you on the message you sent us, I'm sorry that the MSO isn't living up to what you need.

Some history on this, when we started shipping the 2000 X-Series scopes there was no decoding at all. After a lot of customer feedback, we enabled serial decoding with the 2.30 firmware release, but the caveat was that the 2000 X-Series only have one of the MegaZoom ASICs. The digital lines and serial decoding use the same block in the ASIC, so it's a physical impossibility to enable the decoding and the digital channels simultaneously.  The 3000T and up have two ASICs, which is why we support that in those scopes. It makes us sad, too.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on April 07, 2016, 05:26:23 pm
For the avoidance of doubt, the older 3000A also supports full decode on analogue and digital channels.  :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Keysight DanielBogdanoff on April 07, 2016, 05:44:51 pm
For the avoidance of doubt, the older 3000A also supports full decode on analogue and digital channels.  :-+

Yes, correct.

It's also worth noting that if you are looking at a new scope, the MSO is free until September.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on April 07, 2016, 05:46:32 pm
LOL anyone else find it odd that a Keysight/Agilent rep comments in a thread about hacking their device to get upgrades for free? Ha ha
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Bud on April 07, 2016, 05:55:50 pm
I appreciate Daniel's presence and his valuable input. Hope he does not take your comment seriously.
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: ben_r_ on April 07, 2016, 06:04:16 pm
I appreciate Daniel's presence and his valuable input. Hope he does not take your comment seriously.
What?! Take what seriously exactly?
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: Howardlong on April 07, 2016, 06:08:45 pm
Daniel's presence here and on the forum as a whole is indeed appreciated: he has a thicker skin than me that's for sure. Sometimes, things are just better left unsaid though if you know what I mean  :-+
Title: Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
Post by: TheSteve on April 07