License hacks were fairly trivial on the earlier scopes as the keys used were accidentally exposed in a firmware update. They're apparently using new keys now, so current scopes aren't vulnerable, but the older ones still are, even with the newly released features.Really? I thought most of the options were only embedded in the newer firmware releases?
License hacks were fairly trivial on the earlier scopes as the keys used were accidentally exposed in a firmware update. They're apparently using new keys now, so current scopes aren't vulnerable, but the older ones still are, even with the newly released features.Really? I thought most of the options were only embedded in the newer firmware releases?
But why would they offer a trial matching the keys on a firmware version that doesnt have that option embedded? As far as I can tell the old firmware simply doenst have some of the options, so they might need to continue offering the trials of the options that were available in the leaked key against it for that odd customer who hasnt done a firmware update, but why would they release trials or licenses for the new options against the old keys? since you'd have to have the new firmware installed to use them.License hacks were fairly trivial on the earlier scopes as the keys used were accidentally exposed in a firmware update. They're apparently using new keys now, so current scopes aren't vulnerable, but the older ones still are, even with the newly released features.Really? I thought most of the options were only embedded in the newer firmware releases?
Sure, but putting a newer firmware on an older scope does not alter the keys.
I don't understand why the keys would be persistent in the scope - surely new firmware = (potentially) new keys.I guess if the trusted keys were part of a user-initiated update process they would be much easier to manipulate than if they're stored in some memory that is at least never written from the code, or possibly write-protected or write-once?
I don't understand why the keys would be persistent in the scope - surely new firmware = (potentially) new keys, if you want a newer option one an old scope you need to update the FW anyway.
But why would they offer a trial matching the keys on a firmware version that doesnt have that option embedded? As far as I can tell the old firmware simply doenst have some of the options, so they might need to continue offering the trials of the options that were available in the leaked key against it for that odd customer who hasnt done a firmware update, but why would they release trials or licenses for the new options against the old keys? since you'd have to have the new firmware installed to use them.
That assumes that installed licenses are stored as-is, and validated at startup, which isn't the only way to do it.I don't understand why the keys would be persistent in the scope - surely new firmware = (potentially) new keys, if you want a newer option one an old scope you need to update the FW anyway.
If they did, every single scope in the field would need new licenses issuing for every enabled feature.
Sort of surprising considering how many very intelligent people buy and use this kind of tool.
You'd need to store more than a flag, as the license may also contain an expiry date, and the storage would need to be flexible to store any number of licenses, whereas by only storing the key and the serial#, it's fixed, and quite small. By storing the license and validating, it can be as large as there is ordinary flash storage and forward compatible with any new software feature.True, but I'd guess storing an expiry date still takes less space than a license key, so probably not much difference. Just need to allocate enough fixed locations for the number of envisaged future options, as opposed to the maximum number of keys installable at one time.
Sort of surprising considering how many very intelligent people buy and use this kind of tool.
I just assumed most of the people/companies who could readily afford that type of tool don't really need to be hacking options.
Thats what I would assume as well, but the mere concept of "hacking" did not come about from those trying to save money, but for the challenge of undoing what was done and beating a system. Then they typically just give it to the rest.Sort of surprising considering how many very intelligent people buy and use this kind of tool.
I just assumed most of the people/companies who could readily afford that type of tool don't really need to be hacking options.
You cant understand the natural desire to get more for less? Everyone wants that, we just dont always get it.Sort of surprising considering how many very intelligent people buy and use this kind of tool.
I just assumed most of the people/companies who could readily afford that type of tool don't really need to be hacking options.
What marmad said.
We don't need a philosophical argument here but remember that Agilent maintains its cutting edge because its profitable. If it wasn't profitable they wouldn't be in that market. I never understood this really - it's not like Agilent has a lock on the market - if you don't like or can't afford their equipment buy something else. There's plenty of manufacturers out there.
Thats what I would assume as well, but the mere concept of "hacking" did not come about from those trying to save money, but for the challenge of undoing what was done and beating a system. Then they typically just give it to the rest.
Well I was referring to the real first hacking, back in the hardware, phreaking, etc days before there was "software", but yes I understand your point.Thats what I would assume as well, but the mere concept of "hacking" did not come about from those trying to save money, but for the challenge of undoing what was done and beating a system. Then they typically just give it to the rest.
In general that might be true - but in this context - hacking test and measurement gear (which means you might brick the equipment which you use - i.e. much different possible ramifications than mere software hacking), I think the motives would likely be closer to getting bandwidth, options, etc. that you'd like to have for your own use - but can't readily afford to pay for.
You'd need to store more than a flag, as the license may also contain an expiry date
Sort of surprising considering how many very intelligent people buy and use this kind of tool.I just assumed most of the people/companies who could readily afford that type of tool don't really need to be hacking options.
Yes, the vast majority have no need nor desire to hack their scope, nor would most even think to look for one. Agilent know that and rely on that. If a hack did eventually happen, I doubt they would bat much of an eyelid.
really ?AFAIK one thing they have done is made it not possible to set the clock back to before the release date fo the current firmware. Not sure if they have done anything else to prevent re-trials. Might also be interesting to see if you can request the same trial more than once.
can I use the 30 day trail and after 30 days "just" dial the clock back in time and the trail will be accessible again ?
really ?
can I use the 30 day trail and after 30 days "just" dial the clock back in time and the trail will be accessible again ?
Might also be interesting to see if you can request the same trial more than once.
really ?
can I use the 30 day trail and after 30 days "just" dial the clock back in time and the trail will be accessible again ?
The reinstall trick doesn't work with the internal 30day full trial since there's no install file, I lost them when I dialed the clock forward so they are gone forever for me. I suspect that if you dial forward to 2099 first before activating them and then dial back it might work.QuoteMight also be interesting to see if you can request the same trial more than once.
Tried that, no go. They keep a record of your applications on their server.
really ?
can I use the 30 day trail and after 30 days "just" dial the clock back in time and the trail will be accessible again ?
Yep, the licenses get deleted once they expire but if you dial the clock back you can install them again. So just dial the clock as far back to the build date of the FW you are on after you install and you are golden, of course the only draw back is that you can't install FW updates that comes later than the trial expiration date.
The reinstall trick doesn't work with the internal 30day full trial since there's no install file, I lost them when I dialed the clock forward so they are gone forever for me. I suspect that if you dial forward to 2099 first before activating them and then dial back it might work.QuoteMight also be interesting to see if you can request the same trial more than once.
Tried that, no go. They keep a record of your applications on their server.
really ?
can I use the 30 day trail and after 30 days "just" dial the clock back in time and the trail will be accessible again ?
Yep, the licenses get deleted once they expire but if you dial the clock back you can install them again. So just dial the clock as far back to the build date of the FW you are on after you install and you are golden, of course the only draw back is that you can't install FW updates that comes later than the trial expiration date.
The reinstall trick doesn't work with the internal 30day full trial since there's no install file, I lost them when I dialed the clock forward so they are gone forever for me. I suspect that if you dial forward to 2099 first before activating them and then dial back it might work.QuoteMight also be interesting to see if you can request the same trial more than once.
Tried that, no go. They keep a record of your applications on their server.
This worked for me only once, setting the clock back and run self cal. The second time they've expired looks like for good. I've tried a couple of different "procedures" but no joy..
really ?
can I use the 30 day trail and after 30 days "just" dial the clock back in time and the trail will be accessible again ?
The reinstall trick doesn't work with the internal 30day full trial since there's no install file, I lost them when I dialed the clock forward so they are gone forever for me. I suspect that if you dial forward to 2099 first before activating them and then dial back it might work.QuoteMight also be interesting to see if you can request the same trial more than once.
Tried that, no go. They keep a record of your applications on their server.
I have just got an new scope(demo model) with some active trials in it, i dont have the keys so is there any way to export them out for backup ?
Tooms
Which one stopped working? The built in one with all features or the downloaded one?
Which one stopped working? The built in one with all features or the downloaded one?
The built in trial that came with the scope. What's a "downloaded one"?
None that I know of, but since you got a demo unit are you sure it's not full licenses? Demo unit usually come fully activated since they aren't meant to stay in your possession for long. When I bought my 3014A the dealer gave me a demo unit before he got the stock in and that one was fully activated.
None that I know of, but since you got a demo unit are you sure it's not full licenses? Demo unit usually come fully activated since they aren't meant to stay in your possession for long. When I bought my 3014A the dealer gave me a demo unit before he got the stock in and that one was fully activated.
it has the trial for all options for around 90 days and then they will expire.
I can see in the papirs that i got that they install the demo licenser there is having a runtime of 120 days and there is about 90 days left now, but i dont have the key files and was hoping that i can export them some how.
Thanks
Tooms
None that I know of, but since you got a demo unit are you sure it's not full licenses? Demo unit usually come fully activated since they aren't meant to stay in your possession for long. When I bought my 3014A the dealer gave me a demo unit before he got the stock in and that one was fully activated.
it has the trial for all options for around 90 days and then they will expire.
I can see in the papirs that i got that they install the demo licenser there is having a runtime of 120 days and there is about 90 days left now, but i dont have the key files and was hoping that i can export them some how.
Thanks
Tooms
Well, logic dictates that there must be hidden SCPI commands that access what you need. Either way even if you can extract them you have to return the demo unit anyway, and those licenses are locked to the serial of the scope.
Unless you mean you bought an ex-demo?
None that I know of, but since you got a demo unit are you sure it's not full licenses? Demo unit usually come fully activated since they aren't meant to stay in your possession for long. When I bought my 3014A the dealer gave me a demo unit before he got the stock in and that one was fully activated.
it has the trial for all options for around 90 days and then they will expire.
I can see in the papirs that i got that they install the demo licenser there is having a runtime of 120 days and there is about 90 days left now, but i dont have the key files and was hoping that i can export them some how.
Thanks
Tooms
Well, logic dictates that there must be hidden SCPI commands that access what you need. Either way even if you can extract them you have to return the demo unit anyway, and those licenses are locked to the serial of the scope.
Unless you mean you bought an ex-demo?
yes i have bought an ex-demo msox3024a there is as good as new but cheaper
Quoteyes i have bought an ex-demo msox3024a there is as good as new but cheaperWell then become drinking buddies with the dealer, they probably have the files then.
How much did you pay? My 3014A after taxes came in at 6333K USD (190k NTD at 30/1 exchange rate), this is with the SEGMEM and MEMUP options, I also got the Front Panel Cover for free.
Well, logic dictates that there must be hidden SCPI commands that access what you need.Why? There is no legitimite reason to need to read license data out.
True, but I'd guess storing an expiry date still takes less space than a license key, so probably not much difference. Just need to allocate enough fixed locations for the number of envisaged future options, as opposed to the maximum number of keys installable at one time.
With their existing scheme, the software only needs to be able to verify a hash using the securely stored key value, and never needs to write anything, so the mechanism to do so can be left out entirely.
Until some muppet leaves the scope initialisation tool in the firmware package.
QuoteWell, logic dictates that there must be hidden SCPI commands that access what you need.Why? There is no legitimite reason to need to read license data out.
Has anyone recently installed MSO or bandwidth options with a license? Did the model number change?
Of course as you said earlier, the firmware itself could be an easier target than the licenses, for the scopes where the key information is unknown. If the only license check is in the software, it could be as simple as changing a branch or two. The only thing to work out would be what verification of the firmware code is done, and how to defeat it. But fiddling with that seems far more likely to lead to a possibly bricked scope, so it's not something I'd necessarily try unless I either had money to burn or a really pressing need for a feature I couldn't afford to buy...Someone who can afford the scope might be more likely to have EEPROM programmers and the like as well, meaning recovery from accidental bricking may not be too difficult. Unless there's some storage that can't be rewritten with external hardware somehow...
Just to make it clear:Your last sentence pretty much sums up all I went through. Happy ending though.
(...)
In the worst case, if license code was fixed, attacking the firmware should be possible (despite code signing), but I'm certainly not about to risk bricking a 7k$ piece of test gear ...
Just to make it clear:I wonder how hard it is to change the serial number.... 8)
* There is several public keys used to check the license signature, which key is used is dependent of the serial number of the scope. The secret key for the first public key, which is used for all early scope serials, has been leaked by Agilent themselves as a mistake and so it's trivial to generate your own licenses for those scope.
My warranty is fixed to the serial number. I am never gonna change it. :(If you can change it, you can change it back
I am the first one to try the firmware on my 2000x scope and it worked for me. I took the risk of bricking my scope but well I was rewarded with a fully enabled scope.
Does the hacked firmware void the warranty??More than likely, however like Jailbreaking or something, if you can get the original firmware back on there before you send it in for servicing theyll probably never know you were ever running a customer firmware.
Pretty darn cool. Ill wait till someone releases such a fix for free through. I dont like the idea of having to pay for cracks/hacks.
Nevermind, apparently Im not allowed to post the details. PM them for the pricing.Pretty darn cool. Ill wait till someone releases such a fix for free through. I dont like the idea of having to pay for cracks/hacks.
Uhm... how much djvinc charges for this firmware? It's really uncool...
Uhm... how much djvinc charges for this firmware? It's really uncool...The firmware is an initiative that requires a contribution, for many reasons I can't explain easily on this topic. Happy to tell on PM though.
Nevermind, apparently Im not allowed to post the details. PM them for the pricing.
Uhm... how much djvinc charges for this firmware? It's really uncool...The firmware is an initiative that requires a contribution, for many reasons I can't explain easily on this topic. Happy to tell on PM though.
Well, "contribution" should work like "If you like my work - please donate".
It should be all about pride and accomplishment... Making this kind of hacking for living is just low...
I'm surprised, that people on this forum are willing to pay for this - curious what Dave thinks about it 8)
Requiring payment (or not) doesn't affect the legality. Possibly the sentence though.Well, "contribution" should work like "If you like my work - please donate".
It should be all about pride and accomplishment... Making this kind of hacking for living is just low...
I'm surprised, that people on this forum are willing to pay for this - curious what Dave thinks about it 8)
I will of course not allow this forum to be used as a basis to peddle anything potentially illegal, either content or services.
Well, "contribution" should work like "If you like my work - please donate".
It should be all about pride and accomplishment... Making this kind of hacking for living is just low...
I'm surprised, that people on this forum are willing to pay for this - curious what Dave thinks about it 8)
I will of course not allow this forum to be used as a basis to peddle anything potentially illegal, either content or services.
Dave what about the Rigol Hack? Is that legal?
Dave what about the Rigol Hack? Is that legal?
How long is a piece of string?
How far do you want to open the can of worms?
IMO there is a big difference between sending a simple existing serial command down the existing provided interface, and reverse engineering and bypassing an encrypted software feature set.
Argue away...
Perhaps consider taking down your potentially illegal Rigol hack video in the process :)
"I dont know" in your own tone :) Argument is not my thing, they are all just mind chatter between individuals trying to affirm their own belief.
Perhaps consider taking down your potentially illegal Rigol hack video in the process :)
"I dont know" in your own tone :) Argument is not my thing, they are all just mind chatter between individuals trying to affirm their own belief.
Legality aside there is a moral distinction between providing a platform where discussion of hacks/cracks is not censored and providing a platform where hacks/cracks are offered for sale.
Not "not allowed" specifically. Perhaps it was a bad choice of words. I was asked not to. And no, it was not by Dave.Nevermind, apparently Im not allowed to post the details. PM them for the pricing.
Not allowed by whom?
Not "not allowed" specifically. Perhaps it was a bad choice of words. I was asked not to. And no, it was not by Dave.Nevermind, apparently Im not allowed to post the details. PM them for the pricing.
Not allowed by whom?
Certainly not. Like I said I was not asked by Dave. As far as I care, he's the only one that makes anything "official" here. Rights of ownership. I just obliged the individual that asked me to edit my post. It's pretty simple to guess who might have asked that and for what reasons. I just dont want to be any further involved in the situation.Not "not allowed" specifically. Perhaps it was a bad choice of words. I was asked not to. And no, it was not by Dave.Nevermind, apparently Im not allowed to post the details. PM them for the pricing.
Not allowed by whom?
So is it official now that "Agilent" hack is not allowed here in this forum, while other Chinese's stuff is ok ? ???
How many people use this hacked firmware?
Really Dave? Read the first page of Hantek / Tekway hack. Extensive reverse engineering was done.
Well, "contribution" should work like "If you like my work - please donate".
Making this kind of hacking for living is just low...
Does anyone have the old firmware which leaked the private keys? Obviously Agilent removed it from the web site. If someone can supply me with it I think I can create a license key generator.
I'd still like to get the first key though, if anyone has it.
ehm, i give you some stats. I do have "please donate if you like" link, i mentioned it few times here and there (as well poeple who donated did it too) and honestly i did got together less than 300USD - in almost 3yrs. Not that i'm begging now for money, but simply telling the truth about donations.
Hardware reversing costs not only time but as well some lab resources, they need to be paid. So it's not for living.
[...] But other might not have that luck, so yes i understood why "djvinc" asked for money.
I'd still like to get the first key though, if anyone has it.
The file containing it is linked two posts up.
I eventually figured out how to download it from that Russian site yesterday, but it doesn't seem to be a complete archive. I'll have another look later.
I'd still like to get the first key though, if anyone has it.
The file containing it is linked two posts up.
I eventually figured out how to download it from that Russian site yesterday, but it doesn't seem to be a complete archive. I'll have another look later.
first you need the network module...
Indeed. It begs the question - has anyone whacked in a magjack and gotten the scope to use it yet? Early on I remember there was some effort to inspect the network module to see which pin to pull up/down to tell the scope it had a LAN port hooked up but I don't see whether anyone actually did it.There is a Xilinx XC3S100 FPGA on the board. Looks like it is for the VGA output (together with an ADV7125 triple DAC and a CY7C1325 RAM on the back), because the ethernet connection is just two wires, as Dave mentioned in one of his videos and as you can see in my photo of it:
Or maybe if the scope will detect the LAN/VGA being inserted hot, one could just boot up the scope and run over the connector with a weak pullup/pulldown while watching the network menu to see if it activates. Then again, I wouldn't be surprised if rebooting is required after inserting a module.
I'd say that would be highly unlikely. I really don't think they are too bothered about people making their own LAN interface. It would also be sensible to keep the LAN and VGA functions seperate in case they wanted to do different permutations in the future.
But I wouldn't be surprised, if they implemented some kind of protection in the FPGA. It has lots of LEs to implement even a small microcontroller in it for a simple verification protocol.
- at time of publishing there was no GPL code released
I don't know if we're talking about the same network module, but the only one I know of is the LAN/VGA module which costs $400 USD so buying it is completely out of the question.I was able to talk AgilentUsed (their eBay selling account) down to $170 for one. Though that was with my MSOX2024A purchase, but maybe it could be done separately or if someone is planning on buying a 2000 X-series from them...
At one point I guess I had a brain fart and thought it was under $200, and I was half-seriously toying with the idea of trying to talk myself in to considering it. I looked up the price to get an exact figure for consideration and shat my pants so hard they probably felt the shockwave in china. I still haven't figured out how to cope with the fact that my primary high-end scope is lacking some very basic functionality that even won hung lo scopes usually have.
But I wouldn't be surprised, if they implemented some kind of protection in the FPGA. It has lots of LEs to implement even a small microcontroller in it for a simple verification protocol.
<?xml version="1.0"?>
<install>
<killProcess>infiniivisionLauncher.exe</killProcess>
<installStep>
<!-- replace /magicparameter with right one -->
<command>\Secure\infiniiVision\infiniivisionLauncher.exe /magicparameter</command>
</installStep>
</install>
So if I put together a PCB with a magjack and plug it into the scope, presumably it has a default IP?
From there, it remains to break out the RS232 lines to the CPU and add that magic command line option and everything is up for grabs?
So if I put together a PCB with a magjack and plug it into the scope, presumably it has a default IP?
From there, it remains to break out the RS232 lines to the CPU and add that magic command line option and everything is up for grabs?
Yes, you will need just the PCB and MagJack. If you need the status LEDs working you will need few passives.
Default configuration is automatic IP adress from DHCP, so you need just running DHCP on your computer.
I think before doing a PCB it would be worth checking to see if there is a pullup/pulldown used for option detect. (or at least make sure all the pads are broken out to allow experimentation)
Nice pinout of the module. If we only knew the TX+, TX÷, RX+ and RX÷ on those LAN pins we're getting there. If someone has access to a genuine module and a calliper, we could get the proper dimensions for that card-edge connector too. Looking at Dave's video it seems there is a key slot in the middle somewhere.
I just got a MSOX3024A (+ free WaveGen and DVM), but I haven't started playing with it beyond installing the latest official FW. Haven't even activated the full-feature trials.
I'm hoping that if I wait, I don't have to reset the date as often to keep them working... Or did I miss something here?
Nice pinout of the module. If we only knew the TX+, TX÷, RX+ and RX÷ on those LAN pins we're getting there. If someone has access to a genuine module and a calliper, we could get the proper dimensions for that card-edge connector too. Looking at Dave's video it seems there is a key slot in the middle somewhere.
I just got a MSOX3024A (+ free WaveGen and DVM), but I haven't started playing with it beyond installing the latest official FW. Haven't even activated the full-feature trials.
I'm hoping that if I wait, I don't have to reset the date as often to keep them working... Or did I miss something here?
I've got access to an official LAN/VGA module. Will high-res photos of the boards help at all? I can't do anything electrical to the boards, as they're not mine and I can't afford to F it up.If you can get photos as straight on as you can (or scans) alongside a ruler they should be usable for duplicating the board shape. The board photos might be enough to figure out the pinout. I'd guess it's two layers?
Going on vacation for a week and a half or so, but I should be able to get some 25MP pics when I'm back in the last week of July.
Why so complicated? Drill a hole in the scope for a magjack, mount it with some hot glue and solder some wires to it :) While you have it open: solder some more wires for the UART connector, maybe even a MAX3232 converter board, because it is 3.3V digital level UART, and then a standard d-sub 9 connector for the case.You're kidding right, you own one of these scopes? These scopes aren't budget range, they are £1061 upwards. I don't know who here is willing to drill such a beautiful and expensive machine, but I wouldn't do to mine! >:D
Hmm... In addition to the MagJack on the cheat PCB we might drop in some pin headers (for wiring to the secret UART), a MAX3232 and a DSUB9 connector instead of the VGA port. It might even fit in the original LAN module case :P
I only wish FrankBuss would elaborate on how to utilize that UART...
I only wish FrankBuss would elaborate on how to utilize that UART...
set serverip 192.168.11.108
dhcp 0x4000000 nk.bin;bootm 0xf8050000
BOOTP broadcast 1
DHCP client bound to address 192.168.11.106
Using smsc device
TFTP from server 192.168.11.108; our IP address is 192.168.11.106
Filename 'nk.bin'.
Load address: 0x4000000
Loading: **#################################################################
#################################################################
...
..or an IDC ribbon cable with IDC D connector, as found on old PCs.I only wish FrankBuss would elaborate on how to utilize that UART...
The serial port location:
http://i.imgur.com/yYMV75t.jpg (http://i.imgur.com/yYMV75t.jpg)
All you need are some jumper wires, if you don't want to drill a hole. Fits nicely through the USB connector hole 8)
set serverip 192.168.11.108 ; dhcp 0x361000 nk.nb0 ; go 0x362000
cvrtbin.exe -r -a 0x80361000 -w 32 -l 0x01248688 nk.bin
..or an IDC ribbon cable with IDC D connector, as found on old PCs.Right, would be even better, because less danger that it gets lose. You can then cut all the wires except the two you need to thread through some holes.
There is one trick which can help.
Create following structure on USB drive and the scope will run link or whole firmware from USB flash drive.
1. Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
2. Create "Startup" directory where you can store link for execution
3. (Optional) Copy the folder "infiniiVision" from infiniiVisionSetup.cab. It can be unpacked e.g with WinCE CAB Manager 3.0). It will make the boot sequence little bit longer but allow you to boot up firmware from USB without flashing it ( tested with 2.35 and 2.30)
I can confirm that scope is hackable without the LAN/VGA module or taking the scope apart. If someone will be still interested in manufacturing LAN module I can post schematic.
Please do not ask me for details related to hacking the scope, I will not share them.
Can someone with opened scope please check where the BOOT_SEL pin (K18) of SPEAr600 goes? Look here for the drawing http://www.st.com/web/en/resource/technical/document/datasheet/CD00248440.pdf (http://www.st.com/web/en/resource/technical/document/datasheet/CD00248440.pdf) pg.93
Grounding this pin at power up should activate USB download mode in cpu's bootrom - an unlimited access to the internals, regardless of fw versions etc, it's in metal
What path to use in the startup link to load from USB?
I don't know when I'll get around to it but I'm still quite interested in making a PCB for the LAN module.
FrankBuss,
Dave's teardown video shows that CPU has vias to all pins. Sure, u-boot is enough for now, even that simpler infiniivisionStartupOverride.txt way is enough, but times can change (fixes), but bootrom will still be there forever. Also there is probability that BOOT_SEL is accessible somewhere on lan/vga/gpib slot, who knows. Why not to check?
SPEAr flasher http://www.st.com/web/en/catalog/tools/PF257557 (http://www.st.com/web/en/catalog/tools/PF257557)
Thats sounds interesting. It suppose that it should be possible to acces such a pin without dissasembling the scope at least for service purpose, when the UART is not accessible.I doubt it. Usually such complex systems are programmed once, probably with JTAG on the same connector with the UART signals for u-boot and then the other programming over network, then you do all service tasks over network or USB. Developers at Agilent might have bare boards or with an open case lying on their work desks anyway, with all internal connections accessible.
The usb drive's root is seen as \usb folder in rootfs, so just add an \usb\ prefix to the path on usb drive
Folder Startup with file infiniivision.lnk which should contains "45#\usb\infiniiVision\infiniivisionLauncher.exe"
OKI, and do you have any plan for mechanical construction?
Otherwise you can break the DSOX internal connector.
Thanks. That was the first thing I tried. Is there any output on the UART about this process? Any change I make from the default \Secure path results in a failure to boot. Without any error messages, I'm left to just guessing as to why.No, the UART doesn't show much activity after booting. Maybe the DLLs are missing? I think it searches it in the same directory where the exe file is, and then in \windows, but not in \secure\infiniivision. The easiest way would be to write a cmd-file, which copies the \secure\infiniivision directory to the USB stick, if cmd files can be started with this concept too.
benemorius,Ok thanks. That must be it. I didn't know if this method interrupted the boot process late enough for that to be possible or not. The firmware I need is probably on my desktop that I haven't unpacked yet since moving so it will have to wait until I have more time to play.
try the same version as inside the scope (or update the scope). There are hardcoded paths to some data files in various places, there are dlls in windows folder (inside nk.bin.comp), so you are trying to start a mix of both versions actually
The easiest way would be to write a cmd-file, which copies the \secure\infiniivision directory to the USB stick, if cmd files can be started with this concept too.Hey, that's probably worth trying. :D
The easiest way would be to write a cmd-file, which copies the \secure\infiniivision directory to the USB stick, if cmd files can be started with this concept too.Hey, that's probably worth trying. :D
$cat copy.cmd
dir \ > \usb\root.txt
dir \Secure > \usb\secure.txt
dir \Secure\infiniiVision > \usb\infiniiVision.txt
md \zzz
copy "\Secure\infiniiVision\*" \usb\zzz 1> \usb\out.txt 2>\usb\error.txt
dir \usb\zzz >\usb\zzz.txt
$cat out.txt error.txt
Copied 10 file(s).
$ls -a zzz
. ..
$cat zzz.txt
Directory of \usb\zzz
File not found.
0 Dir(s) 357945344 bytes free
$cat root.txt
Directory of \
01/01/98 12:00p <DIR> Network
01/01/98 12:00p <DIR> Agilent Flash
01/01/98 12:00p <DIR> usb
01/01/98 12:00p <DIR> Secure
10/29/11 07:03p <DIR> Application Data
10/29/11 07:03p <DIR> profiles
10/29/11 07:03p <DIR> Documents and Settings
10/29/11 07:03p 23 Control Panel.lnk
10/29/11 07:03p <DIR> My Documents
10/29/11 07:03p <DIR> Program Files
10/29/11 07:03p <DIR> Temp
10/29/11 07:03p <DIR> Windows
Found 12 file(s). Total size 23 bytes.
1 Dir(s) 27090944 bytes free
$cat secure.txt
Directory of \Secure
11/14/11 09:38a <DIR> infiniiVision
11/14/11 09:38a <DIR> Startup
11/14/11 09:38a <DIR> cal
11/14/11 09:38a <DIR> help
11/14/11 09:38a <DIR> bin
11/15/11 09:26a <DIR> System
Found 6 file(s). Total size 0 bytes.
1 Dir(s) 17625088 bytes free
$cat infiniiVision.txt
Directory of \Secure\infiniiVision
11/14/11 09:38a <DIR> web
11/14/11 09:38a <DIR> fpga
10/10/07 07:45p 214552 mscorlib.dll
08/04/11 10:02p 1089536 Agilent.Cdf.Api.dll
03/07/11 01:57p 238080 OpenNETCF.dll
08/04/11 10:02p 9728 WebPageData.dll
03/07/11 01:57p 398336 SetupConverter.exe
08/05/11 12:38p 1152032 splashImage.bin
10/13/11 04:49p 218624 vncserver.dll
10/13/11 04:55p 14748832 infiniiVisionCore.dll
10/13/11 04:49p 11112 infiniiVisionLauncher.exe
10/13/11 04:49p 180224 infiniiVisionWebCom.dll
Found 12 file(s). Total size 18261056 bytes.
1 Dir(s) 17625088 bytes free
copy \secure\infiniivision\splashImage.bin \secure\infiniivision\splashImage.bin.org
\windows\compileImageForSplashScreen \usb\yourimage.png \secure\infiniivision\splashImage.bin
I don't think the USB drive is write protected, because you can see the logs.Doh! I didn't think that one through at all, did I? :palm:
One problem in your script: "md \zzz" should be "md \usb\zzz", but I guess you have already created the directory.Whoops. You're right. I guess it was accidentally changed in one of the many iterations between the first try and the last one which I copied here. It must have been right at first because the directory has in fact been created.
Also check that it's empty. Sometimes files are write protected in Windows, which you can change with "attrib -r filename" and which you can see with "attrib" (on a Windows machine). Maybe wait a bit longer if the USB drive needs more time to write the files. Windows should mount USB drives without caching, so usually no need to unmount it.It is indeed empty according to the filesystem. I haven't checked whether any file data was written but I believe a correct FAT implementation should create the file entry before writing any data so worst case should be a 0 byte file reported by the filesystem. I waited about 15 seconds after it should have finished but next time I'll wait longer just in case. I didn't expect a write cache to be enabled either.
Writing to the \secure directory and subdirectories is possible too. And with the USB startup trick there is no danger to brick the scope, if you have made backups of the files first, because the scope resets, if the application crashes on start, and then it would go into an infinite reset loop. But with the startup file you can restore a non-working executable again.I'll test writing next time too and see what happens. I really need to get back to work right now though. I've been distracted long enough already.
You could test writing with something non-critical, like replacing the startup image:Code: [Select]copy \secure\infiniivision\splashImage.bin \secure\infiniivision\splashImage.bin.org
\windows\compileImageForSplashScreen \usb\yourimage.png \secure\infiniivision\splashImage.bin
yourimage.png works with 800x480 pixels, 24 bit color, no transparency.
copy "\Secure\infiniiVision\*" \usb\zzz
copy "\Secure\infiniiVision\*" \usb\zzz 1>\usb\out.txt 2>\usb\error.txt
Directory of \
01/01/98 12:00p <DIR> Network
01/01/98 12:00p <DIR> Agilent Flash
01/01/98 12:00p <DIR> usb
01/01/98 12:00p <DIR> Secure
10/30/11 03:35a <DIR> Recycled
10/30/11 03:35a <DIR> Application Data
10/30/11 03:35a <DIR> profiles
10/30/11 03:35a <DIR> Documents and Settings
10/30/11 03:35a 23 Control Panel.lnk
10/30/11 03:35a <DIR> My Documents
10/30/11 03:35a <DIR> Program Files
10/30/11 03:35a <DIR> Temp
10/30/11 03:35a <DIR> Windows
Found 13 file(s). Total size 23 bytes.
Directory of \Agilent Flash
10/30/11 01:47a <DIR> tmp
10/30/11 01:47a <DIR> wfmMem
10/30/11 01:47a <DIR> setups
10/30/11 01:47a <DIR> config
10/30/11 01:47a <DIR> data
10/30/11 01:47a <DIR> masks
10/30/11 01:47a <DIR> arb
10/30/11 03:30a <DIR> webupdate
10/30/11 01:47a <DIR> LxiMdns
Found 9 file(s). Total size 0 bytes.
Directory of \Agilent Flash\setups
10/30/11 01:47a 0 setup_0.scp
10/30/11 01:47a 0 setup_1.scp
10/30/11 01:47a 0 setup_2.scp
10/30/11 01:47a 0 setup_3.scp
10/30/11 01:47a 0 setup_4.scp
10/30/11 01:47a 0 setup_5.scp
10/30/11 01:47a 0 setup_6.scp
10/30/11 01:47a 0 setup_7.scp
10/30/11 01:47a 0 setup_8.scp
10/30/11 01:47a 0 setup_9.scp
Found 10 file(s). Total size 0 bytes.
Directory of \Agilent Flash\config
10/30/11 01:47a 418 labelList.txt
10/30/11 03:30a 155537 setup.scp
Found 2 file(s). Total size 155955 bytes.
Directory of \Agilent Flash\masks
10/30/11 01:47a 0 mask_0.msk
10/30/11 01:47a 0 mask_1.msk
10/30/11 01:47a 0 mask_2.msk
10/30/11 01:47a 0 mask_3.msk
Found 4 file(s). Total size 0 bytes.
Directory of \Agilent Flash\arb
10/30/11 01:47a 0 arb_0.csv
10/30/11 01:47a 0 arb_1.csv
10/30/11 01:47a 0 arb_2.csv
10/30/11 01:47a 0 arb_3.csv
Found 4 file(s). Total size 0 bytes.
Directory of \Secure
11/14/11 09:38a <DIR> infiniiVision
11/14/11 09:38a <DIR> Startup
11/14/11 09:38a <DIR> cal
11/14/11 09:38a <DIR> help
11/14/11 09:38a <DIR> bin
11/15/11 09:26a <DIR> System
Found 6 file(s). Total size 0 bytes.
Directory of \Secure\infiniiVision
11/14/11 09:38a <DIR> web
11/14/11 09:38a <DIR> fpga
10/10/07 07:45p 214552 mscorlib.dll
08/04/11 10:02p 1089536 Agilent.Cdf.Api.dll
03/07/11 01:57p 238080 OpenNETCF.dll
08/04/11 10:02p 9728 WebPageData.dll
03/07/11 01:57p 398336 SetupConverter.exe
08/05/11 12:38p 1152032 splashImage.bin
10/13/11 04:49p 218624 vncserver.dll
10/13/11 04:55p 14748832 infiniiVisionCore.dll
10/13/11 04:49p 11112 infiniiVisionLauncher.exe
10/13/11 04:49p 180224 infiniiVisionWebCom.dll
Found 12 file(s). Total size 18261056 bytes.
Directory of \Secure\infiniiVision\web
11/14/11 09:38a <DIR> Lxi
11/14/11 09:38a <DIR> help
11/14/11 09:38a <DIR> image
11/14/11 09:38a <DIR> lib
11/14/11 09:38a <DIR> navbar
03/07/11 02:10p 222 ClickFix.js
09/30/11 03:22a 1797 CookieUtils.js
10/10/11 10:02p 349976 InfiniiVision_Quick_Reference.html
09/08/11 10:07p 19999 appletInstall.jar
04/27/11 10:02p 26521 appletScpi.jar
07/30/11 10:01p 915251 appletVnc.jar
04/27/11 10:03p 465 appletsVersion.asp
03/07/11 02:10p 1472 constant.asp
03/07/11 02:10p 4117 doModifyConfig.asp
03/07/11 02:10p 3900 doSave.asp
08/28/11 11:39p 4084 download.asp
08/18/11 10:01p 269 enumConst.asp
09/30/11 03:22a 3635 getImage.asp
03/07/11 02:10p 1413 home.html
03/07/11 02:10p 840 homeBottom.asp
03/07/11 02:10p 3539 homeMiddle.asp
03/07/11 02:10p 12275 homeTop.asp
06/27/11 10:02p 1156 index.asp
03/07/11 02:10p 2975 infoCal.asp
03/07/11 02:10p 3747 infoLicense.asp
03/07/11 02:10p 4144 infoNav.html
04/27/11 10:02p 9940 infoVersion.asp
03/07/11 02:10p 781 information.html
03/07/11 02:10p 1175 lanInfo.asp
03/07/11 02:10p 30473 modifyConfig.asp
03/07/11 02:10p 25393 navigation.asp
03/07/11 02:10p 8858 networkStatus.asp
06/16/11 10:02p 5154 pwdPrompt.asp
06/15/11 11:37a 3287 pwdVerify.asp
10/05/11 11:35p 9268 recall.asp
06/15/11 11:37a 4516 remoteApplet.asp
05/26/11 10:05p 18473 remoteFrontPanel.asp
09/12/11 10:53a 12763 remoteSCPICommands.asp
08/18/11 10:01p 26044 save.asp
06/15/11 11:37a 1206 saveFrame.asp
10/05/11 11:35p 4387 saveRecall.asp
03/07/11 02:10p 2138 scopeInfo.asp
03/07/11 02:10p 4137 style.css
04/27/11 10:03p 2347 toolbarHelp.asp
03/07/11 02:10p 2769 top.asp
04/27/11 10:03p 1067 utils.js
03/07/11 02:10p 11491 viewConfig.asp
Found 47 file(s). Total size 1547464 bytes.
Directory of \Secure\infiniiVision\web\Lxi
11/14/11 09:38a <DIR> Identification
Found 1 file(s). Total size 0 bytes.
Directory of \Secure\infiniiVision\web\Lxi\Identification
03/07/11 02:10p 710 Default.asp
03/07/11 02:10p 12270 LXIIdentification.xsd
Found 2 file(s). Total size 12980 bytes.
Directory of \Secure\infiniiVision\web\help
03/07/11 02:10p 1308 helpBrowserWebControl.asp
03/07/11 02:10p 1460 helpGetImage.asp
03/07/11 02:10p 4666 helpHome.asp
03/07/11 02:10p 6869 helpHomeAdv.asp
03/07/11 02:10p 1216 helpInfoCal.html
03/07/11 02:10p 1359 helpInfoOptions.html
03/07/11 02:10p 1713 helpInfoVersion.asp
03/07/11 02:10p 7834 helpModifyConfig.asp
03/07/11 02:10p 2740 helpNav.asp
03/07/11 02:10p 1337 helpRecall.asp
03/07/11 02:10p 5275 helpRemoteFrontPanel.asp
03/07/11 02:10p 1299 helpRemoteSCPICommands.asp
03/07/11 02:10p 1242 helpSave.asp
03/07/11 02:10p 1290 helpSaveRecall.asp
03/07/11 02:10p 1213 helpStyle.css
03/07/11 02:10p 102 helpVar.asp
03/07/11 02:10p 8319 helpViewConfig.asp
Found 17 file(s). Total size 49242 bytes.
Directory of \Secure\infiniiVision\web\image
03/07/11 02:10p 2192 agilent.gif
03/07/11 02:10p 892 down-over.gif
03/07/11 02:10p 892 down.gif
03/07/11 02:10p 43 filltrans.gif
03/07/11 02:10p 1581 instrumentBanner.gif
03/07/11 02:10p 25781 instrumentImage.jpg
03/07/11 02:10p 1064 keyboard.gif
03/07/11 02:10p 94 line-heading.gif
03/07/11 02:10p 2576 lxi.jpg
03/07/11 02:10p 26492 m2XX2A.jpg
03/07/11 02:10p 28410 m2XX4A.jpg
03/07/11 02:10p 27057 m3XX2A.jpg
03/07/11 02:10p 29031 m3XX4A.jpg
03/07/11 02:10p 6716 popupMenu.jpg
03/07/11 02:10p 4062 popupMenu_wvga.jpg
03/07/11 02:10p 3850 softkey.jpg
03/07/11 02:10p 2558 softkey_wvga.jpg
03/07/11 02:10p 893 up-over.gif
03/07/11 02:10p 893 up.gif
03/07/11 02:10p 1535 web-enable.gif
Found 20 file(s). Total size 166612 bytes.
Directory of \Secure\infiniiVision\web\lib
03/07/11 02:10p 176653 edtftpj.jar
03/07/11 02:10p 1897479 plugin.jar
Found 2 file(s). Total size 2074132 bytes.
Directory of \Secure\infiniiVision\web\navbar
03/07/11 02:10p 405062 PantherTabs.psd
03/07/11 02:10p 48 bluebar.gif
03/07/11 02:10p 1455 config-down.gif
03/07/11 02:10p 1881 config-over.gif
03/07/11 02:10p 1862 config.gif
03/07/11 02:10p 1430 help-down.gif
03/07/11 02:10p 1858 help-over.gif
03/07/11 02:10p 1834 help.gif
03/07/11 02:10p 1425 image-down.gif
03/07/11 02:10p 1894 image-over.gif
03/07/11 02:10p 1856 image.gif
03/07/11 02:10p 1663 printpage-down.gif
03/07/11 02:10p 2132 printpage-over.gif
03/07/11 02:10p 2110 printpage.gif
03/07/11 02:10p 1450 remote-down.gif
03/07/11 02:10p 1861 remote-only.gif
03/07/11 02:10p 1899 remote-over.gif
03/07/11 02:10p 1453 saverecall-down.gif
03/07/11 02:10p 1910 saverecall-over.gif
03/07/11 02:10p 1885 saverecall.gif
03/07/11 02:10p 1541 status-down.gif
03/07/11 02:10p 1964 status-over.gif
03/07/11 02:10p 1972 status.gif
03/07/11 02:10p 1446 utilities-down.gif
03/07/11 02:10p 1910 utilities-over.gif
03/07/11 02:10p 1858 utilities.gif
03/07/11 02:10p 1453 welcome-down.gif
03/07/11 02:10p 1924 welcome-over.gif
03/07/11 02:10p 1865 welcome.gif
Found 29 file(s). Total size 452901 bytes.
Directory of \Secure\infiniiVision\fpga
08/29/11 09:50p 283776 FPGA2000A.bin
08/29/11 09:50p 480148 FPGA3000A.bin
06/10/10 07:46a 72668 gpibFPGA.bin
10/24/10 09:51p 72668 lanFPGA.bin
Found 4 file(s). Total size 909260 bytes.
Directory of \Secure\Startup
11/15/11 09:26a 53 infiniivision.lnk
Found 1 file(s). Total size 53 bytes.
Directory of \Secure\cal
11/15/11 09:31a 76 sernum.dat
11/15/11 08:22a 27244 framecal.dat
11/15/11 08:22a 75031 callog.txt
11/15/11 08:22a 772 factorycal.dat
Found 4 file(s). Total size 103123 bytes.
Directory of \Secure\System
11/15/11 09:26a <DIR> Licensing
Found 1 file(s). Total size 0 bytes.
Directory of \Secure\System\Licensing
11/15/11 09:26a <DIR> Store
Found 1 file(s). Total size 0 bytes.
Directory of \Secure\System\Licensing\Store
<*snip*>
Found 14 file(s). Total size 8167 bytes.
Directory of \Application Data
09/07/06 10:00a 69 desktop.ini
Found 1 file(s). Total size 69 bytes.
Directory of \profiles
10/30/11 03:35a <DIR> default
Found 1 file(s). Total size 0 bytes.
Directory of \Documents and Settings
10/30/11 03:35a 53248 default.vol
Found 1 file(s). Total size 53248 bytes.
Directory of \My Documents
09/07/06 10:00a 69 desktop.ini
Found 1 file(s). Total size 69 bytes.
Directory of \Program Files
09/07/06 10:00a 69 desktop.ini
10/30/11 03:35a <DIR> Agilent
10/30/11 03:35a 19 Command Prompt.lnk
Found 3 file(s). Total size 88 bytes.
Directory of \Program Files\Agilent
10/30/11 03:35a <DIR> IO Libraries Suite
Found 1 file(s). Total size 0 bytes.
Directory of \Program Files\Agilent\IO Libraries Suite
10/30/11 03:35a <DIR> bin
10/30/11 03:35a <DIR> Drivers
Found 2 file(s). Total size 0 bytes.
Directory of \Program Files\Agilent\IO Libraries Suite\bin
10/30/11 03:35a 13312 portmap.exe
Found 1 file(s). Total size 13312 bytes.
Directory of \Program Files\Agilent\IO Libraries Suite\Drivers
10/30/11 03:35a 102400 AgilentLan488Server32.dll
Found 1 file(s). Total size 102400 bytes.
Directory of \Windows
10/30/11 03:35a 206 FTPD.tmp
10/30/11 03:35a <DIR> StartUp
10/30/11 03:35a <DIR> Fonts
10/30/11 03:35a <DIR> Favorites
10/30/11 03:35a 52 System.mky
10/30/11 03:35a 276 SystemLog.xml
10/30/11 03:35a 0 ApplicationLog.xml
10/30/11 03:35a 52 default.mky
10/30/11 03:35a 0 initobj.dat
10/30/11 03:35a <DIR> Recent
10/30/11 03:35a <DIR> Programs
10/30/11 03:35a <DIR> Desktop
10/30/11 03:35a <DIR> www
10/13/11 11:34p 61440 nk.exe
10/13/11 11:19p 246784 kernel.dll
10/13/11 11:36p 643072 coredll.dll
10/13/11 11:34p 4096 oalioctl.dll
10/13/11 11:36p 640000 k.coredll.dll
10/13/11 11:20p 59392 fpcrt.dll
10/13/11 11:20p 59392 k.fpcrt.dll
10/13/11 11:36p 244736 filesys.dll
10/13/11 11:21p 10240 romfsd.dll
10/13/11 11:36p 676864 gwes.dll
10/13/11 11:21p 209920 mgtt_o.dll
10/13/11 11:21p 4096 device.dll
10/13/11 11:21p 14336 udevice.exe
10/13/11 11:21p 63488 devmgr.dll
10/13/11 11:21p 7168 regenum.dll
10/13/11 11:21p 14336 busenum.dll
10/13/11 11:21p 48128 pm.dll
10/13/11 11:20p 14848 servicesEnum.dll
10/13/11 11:20p 28160 servicesd.exe
10/13/11 11:36p 11264 services.exe
10/13/11 11:20p 4096 servicesStart.exe
10/13/11 11:20p 37888 notify.dll
10/13/11 11:21p 90112 exfat.dll
10/13/11 11:21p 11776 diskcache.dll
10/13/11 11:36p 54784 fatutil.dll
10/13/11 11:36p 54784 k.fatutil.dll
10/13/11 11:20p 55808 shell.exe
10/13/11 11:20p 10752 shellcelog.dll
10/13/11 11:20p 7168 toolhelp.dll
10/13/11 11:20p 7168 k.toolhelp.dll
10/13/11 11:21p 38912 zlib.dll
10/13/11 11:36p 38912 console.dll
10/13/11 11:36p 70144 cmd.exe
10/13/11 11:36p 12288 net.exe
10/13/11 11:36p 388096 commctrl.dll
10/13/11 11:36p 88576 commdlg.dll
10/13/11 11:20p 9728 prnport.dll
10/13/11 11:20p 9728 k.prnport.dll
10/13/11 11:36p 5120 prnerr.dll
10/13/11 11:36p 5120 k.prnerr.dll
10/13/11 11:20p 15872 pcl.dll
10/13/11 11:20p 15872 k.pcl.dll
10/13/11 11:20p 131584 fsdmgr.dll
10/13/11 11:21p 21504 mspart.dll
10/13/11 11:20p 23552 ceddk.dll
10/13/11 11:20p 23552 k.ceddk.dll
10/13/11 11:36p 4608 netmui.dll
10/13/11 11:20p 22016 cxport.dll
10/13/11 11:20p 55296 iphlpapi.dll
10/13/11 11:20p 55296 k.iphlpapi.dll
10/13/11 11:20p 39424 ws2.dll
10/13/11 11:20p 39424 k.ws2.dll
10/13/11 11:20p 9216 ws2instl.dll
10/13/11 11:20p 9216 wspm.dll
10/13/11 11:20p 9216 k.wspm.dll
10/13/11 11:20p 10752 nspm.dll
10/13/11 11:20p 10752 k.nspm.dll
10/13/11 11:20p 52736 ws2k.dll
10/13/11 11:20p 33792 ws2serv.dll
10/13/11 11:20p 32256 ssllsp.dll
10/13/11 11:20p 32256 k.ssllsp.dll
10/13/11 11:20p 97280 schannel.dll
10/13/11 11:20p 97280 k.schannel.dll
10/13/11 11:20p 56320 credsvc.dll
10/13/11 11:20p 40448 ipseccfg.exe
10/13/11 11:20p 132608 afd.dll
10/13/11 11:20p 4608 dnsapi.dll
10/13/11 11:20p 4608 k.dnsapi.dll
10/13/11 11:20p 13824 netapi32.dll
10/13/11 11:20p 135168 ndis.dll
10/13/11 11:36p 215552 netui.dll
10/13/11 11:20p 22528 ndisuio.dll
10/13/11 11:20p 29184 dhcp.dll
10/13/11 11:20p 335360 tcpstk.dll
10/13/11 11:20p 152576 redir.dll
10/13/11 11:20p 39936 netbios.dll
<*continued in next post due to 20k character forum post limit*>
<*continued from last post due to 20k character forum post limit*>
10/13/11 11:20p 163840 wldap32.dll
10/13/11 11:20p 27136 lpcd.dll
10/13/11 11:20p 6656 lpcrt.dll
10/13/11 11:20p 13824 ping.exe
10/13/11 11:20p 14848 ipconfig.exe
10/13/11 11:20p 11264 ndisconfig.exe
10/13/11 11:20p 14848 route.exe
10/13/11 11:20p 21504 netstat.exe
10/13/11 11:20p 11776 tracert.exe
10/13/11 11:21p 29184 serial.dll
10/13/11 11:21p 25088 usbd.dll
10/13/11 11:21p 18944 usbhid.dll
10/13/11 11:34p 20992 usbmsc.dll
10/13/11 11:34p 21504 usbdisk6.dll
10/13/11 11:21p 14848 usbprn.dll
10/13/11 11:21p 29184 hidparse.dll
10/13/11 11:21p 9216 kbdhid.dll
10/13/11 11:21p 5120 conshid.dll
10/13/11 11:36p 6144 MouHid.dll
10/13/11 11:21p 7168 mmtimer.dll
10/13/11 11:21p 7168 k.mmtimer.dll
10/13/11 11:36p 34816 eventlog.dll
10/13/11 11:36p 6144 eventlogMsgs.dll
10/13/11 11:21p 4608 uiproxy.dll
10/13/11 11:20p 12800 secur32.dll
10/13/11 11:20p 12800 k.secur32.dll
10/13/11 11:20p 194560 kerberos.dll
10/13/11 11:20p 194560 k.kerberos.dll
10/13/11 11:20p 44032 msasn1.dll
10/13/11 11:20p 44032 k.msasn1.dll
10/13/11 11:36p 278528 crypt32.dll
10/13/11 11:36p 278528 k.crypt32.dll
10/13/11 11:20p 24576 cryptdll.dll
10/13/11 11:20p 24576 k.cryptdll.dll
10/13/11 11:20p 6656 winsock.dll
10/13/11 11:20p 6656 k.winsock.dll
10/13/11 11:20p 6144 credprov.dll
10/13/11 11:20p 41472 spnego.dll
10/13/11 11:20p 41472 k.spnego.dll
10/13/11 11:22p 478720 ole32.dll
10/13/11 11:22p 198144 oleaut32.dll
10/13/11 11:22p 99328 dcomssd.dll
10/13/11 11:22p 8704 dllhost.exe
10/13/11 11:22p 327168 rpcrt4.dll
10/13/11 11:22p 355840 imaging.dll
10/13/11 11:36p 142848 mlang.dll
10/13/11 11:36p 136192 shlwapi.dll
10/13/11 11:36p 12800 IECEExt.dll
10/13/11 11:23p 754176 msxml3.dll
10/13/11 11:22p 201728 shdocvw.dll
10/13/11 11:36p 486400 wininet.dll
10/13/11 11:23p 19456 jsproxy.dll
10/13/11 11:36p 313856 urlmon.dll
10/13/11 11:36p 342528 vbscript.dll
10/13/11 11:36p 103424 httpd.dll
10/13/11 11:36p 78848 asp.dll
10/13/11 11:23p 51712 httpdadm.dll
10/13/11 11:23p 20992 telnetd.dll
10/13/11 11:23p 50688 ftpd.dll
10/13/11 11:23p 10240 timesvc.dll
10/13/11 11:36p 289792 ceshell.dll
10/13/11 11:36p 266240 explorer.exe
10/13/11 11:23p 11264 shcore.dll
10/13/11 11:36p 17408 control.exe
10/13/11 11:23p 7680 ctlpnl.exe
10/13/11 11:36p 155136 cplmain.cpl
10/13/11 11:36p 52224 intll.cpl
10/13/11 11:36p 49152 wceldcmd.exe
10/13/11 11:23p 12800 unldcmd.exe
10/10/07 11:58p 67088 mscoree.dll
10/11/07 12:01a 945176 mscoree3_5.dll
10/11/07 12:02a 256536 netcfagl3_5.dll
10/11/07 12:02a 168480 netcfd3dm3_5.dll
10/10/07 11:56p 22904 cgacutil.exe
10/13/11 11:34p 45568 SH600_NandFlash.dll
10/13/11 11:34p 12288 SH600_gpio.dll
10/13/11 11:34p 9216 SH600_spi.dll
10/13/11 11:34p 9728 SH600_i2c.dll
10/13/11 11:34p 8192 SH600_ADC.dll
10/13/11 11:34p 29184 P500_gmacndis.dll
10/13/11 11:35p 73216 SH600_ehci.dll
10/13/11 11:34p 57344 SH600_ohci.dll
10/13/11 11:35p 74240 ehci.dll
10/13/11 11:35p 4096 AgtFlashHelper.dll
10/13/11 11:34p 45568 Ssh600_nandflash.dll
10/13/11 11:35p 11776 p500_uboo.dll
10/13/11 11:35p 36864 TMCP500_CE6_DeviceSideUsb.dll
10/13/11 11:35p 13312 sh600_serial2.dll
10/13/11 11:35p 6656 MapMemoryIntoUserSpace.dll
10/13/11 11:35p 8704 GpibOverSPI_P500_CE6.dll
10/13/11 11:35p 223232 baldwin_ddi.dll
10/13/11 11:35p 126976 loadP500Flash.exe
10/13/11 11:35p 11776 ubootEnvironment.dll
10/13/11 11:35p 8192 ProcessStartupFolder.exe
10/13/11 11:35p 14336 CeCreateUserAccounts.exe
10/13/11 11:35p 36864 ConfigureNetworkNative.exe
10/13/11 11:35p 7168 processMgr.exe
10/13/11 11:35p 3584 rebootInfiniiVision.exe
10/13/11 11:36p 7168 regsvr32.exe
10/13/11 11:36p 37888 infiniiVisionInstallHelper.exe
10/13/11 11:36p 129536 infiniiVisionInstallService.exe
10/13/11 11:36p 36352 libmspack.dll
10/13/11 11:36p 24576 ubootTools.exe
10/13/11 11:36p 10240 compileImageForSplashScreen.exe
10/13/11 11:16p 188416 eGalaxTouch.exe
10/13/11 11:16p 100352 DrawTest.exe
10/13/11 11:16p 93696 Calbration.exe
10/13/11 11:16p 88064 UpdateEEPROM.exe
10/13/11 11:16p 17920 USBTouch.dll
10/13/11 11:19p 19167 ceconfig.h
10/13/11 11:36p 208590 wince.nls
10/13/11 11:36p 170825 default.fdf
10/13/11 11:36p 8763 initdb.ini
09/07/06 10:00a 134 close.2bp
09/07/06 10:00a 134 ok.2bp
09/07/06 10:00a 1030 stdsm.2bp
09/07/06 10:00a 838 viewsm.2bp
09/07/06 10:00a 2038 stdsm.bmp
09/07/06 10:00a 1654 viewsm.bmp
09/07/06 10:00a 176120 rsaenh.dll
09/07/06 10:00a 8779 sysroots.p7b
10/13/11 11:20p 50688 ntlmssp.dll
10/13/11 11:20p 79360 ntlmssp_svc.dll
09/07/06 10:00a 289940 arialbd.ttf
09/07/06 10:00a 228180 arialbi.ttf
09/07/06 10:00a 209248 ariali.ttf
09/07/06 10:00a 118868 arialk.ttf
09/07/06 10:00a 160724 arial.ttf
09/07/06 10:00a 169464 cour.ttf
09/07/06 10:00a 135848 tahoma.ttf
09/07/06 10:00a 961 httpd_default.htm
09/07/06 10:00a 1231 httpd-admin.htm
09/07/06 10:00a 4035 httpd-home.htm
09/07/06 10:00a 1710 httpd-logging.htm
09/07/06 10:00a 3281 httpd-netint.htm
09/07/06 10:00a 1816 httpd-newwebfinished.htm
09/07/06 10:00a 1482 httpd-newwebsite.htm
09/07/06 10:00a 3058 httpd-newwebvdirs.htm
09/07/06 10:00a 1234 httpd-sites.htm
09/07/06 10:00a 1385 httpd-ssl.htm
09/07/06 10:00a 1292 httpd-users.htm
09/07/06 10:00a 8470 httpd-vroot.htm
09/07/06 10:00a 2811 httpd-vrootlist.htm
09/07/06 10:00a 3587 httpd-website.htm
09/07/06 10:00a 1728 httpd-i-authlevel.htm
09/07/06 10:00a 2992 httpd-i-authoverview.htm
09/07/06 10:00a 2313 httpd-i-authtypes.htm
09/07/06 10:00a 2005 httpd-i-dirbrowse.htm
09/07/06 10:00a 1972 httpd-i-home.htm
09/07/06 10:00a 2069 httpd-i-logging.htm
09/07/06 10:00a 2460 httpd-i-overview.htm
09/07/06 10:00a 1030 httpd-i-permissions.htm
09/07/06 10:00a 1772 httpd-i-setpaths.htm
09/07/06 10:00a 1978 httpd-i-ssl.htm
09/07/06 10:00a 2446 httpd-i-upload.htm
09/07/06 10:00a 2570 httpd-i-userlists.htm
09/07/06 10:00a 3601 httpd-i-vdirs.htm
09/07/06 10:00a 1831 httpd-i-webadmin.htm
09/07/06 10:00a 4908 httpd-i-website.htm
09/07/06 10:00a 69 appdata.ini
09/07/06 10:00a 144 desktopdirectory.ini
09/07/06 10:00a 69 favorites.ini
09/07/06 10:00a 69 fonts.ini
09/07/06 10:00a 69 mydocuments.ini
09/07/06 10:00a 69 programfiles.ini
09/07/06 10:00a 69 programs.ini
09/07/06 10:00a 69 recent.ini
09/07/06 10:00a 69 startup.ini
09/07/06 10:00a 24 explore.lnk
09/07/06 10:00a 10786 WindowsCE.jpg
09/07/06 10:00a 19 cmd.lnk
09/07/06 10:00a 23 control.lnk
09/07/06 10:00a 739 copyrts.txt
09/07/06 10:00a 3116 asterisk.wav
09/07/06 10:00a 3388 close.wav
09/07/06 10:00a 2970 critical.wav
09/07/06 10:00a 2682 default.wav
09/07/06 10:00a 3946 empty.wav
09/07/06 10:00a 9204 exclam.wav
09/07/06 10:00a 5656 infbeg.wav
09/07/06 10:00a 1778 infend.wav
09/07/06 10:00a 2088 infintr.wav
09/07/06 10:00a 834 menupop.wav
09/07/06 10:00a 360 menusel.wav
09/07/06 10:00a 3388 openprog.wav
09/07/06 10:00a 1836 question.wav
09/07/06 10:00a 8508 startup.wav
09/07/06 10:00a 2712 windmax.wav
09/07/06 10:00a 2866 windmin.wav
09/07/06 10:00a 3388 recstart.wav
09/07/06 10:00a 3388 recend.wav
10/10/07 11:45p 16936 GAC_CustomMarshalers_v3_5_0_0_cneutral_1.dll
10/10/07 11:46p 349744 GAC_Microsoft.VisualBasic_v8_1_0_0_cneutral_1.dll
10/10/07 11:46p 34360 GAC_Microsoft.WindowsCE.Forms_v3_5_0_0_cneutral_1.dll
10/10/07 11:46p 185920 GAC_Microsoft.WindowsMobile.DirectX_v3_5_0_0_cneutral_1.dll
10/10/07 11:45p 941592 GAC_mscorlib_v3_5_0_0_cneutral_1.dll
10/10/07 11:46p 709656 GAC_System.Data_v3_5_0_0_cneutral_1.dll
02/09/09 06:51a 527552 GAC_System_v3_5_0_0_cneutral_1.dll
10/10/07 11:45p 60960 GAC_System.Drawing_v3_5_0_0_cneutral_1.dll
10/10/07 11:46p 77352 GAC_System.Messaging_v3_5_0_0_cneutral_1.dll
10/10/07 11:46p 20000 GAC_System.Net.IrDA_v3_5_0_0_cneutral_1.dll
10/10/07 11:45p 67112 GAC_System.Web.Services_v3_5_0_0_cneutral_1.dll
10/10/07 11:46p 280112 GAC_System.Windows.Forms_v3_5_0_0_cneutral_1.dll
10/10/07 11:45p 1038360 GAC_System.Xml_v3_5_0_0_cneutral_1.dll
10/10/07 11:46p 88088 GAC_System.Core_v3_5_0_0_cneutral_1.dll
10/10/07 11:46p 35904 GAC_System.Data.DataSetExtensions_v3_5_0_0_cneutral_1.dll
10/10/07 11:45p 42048 GAC_System.Runtime.Serialization_v3_5_0_0_cneutral_1.dll
10/10/07 11:45p 474152 GAC_System.ServiceModel_v3_5_0_0_cneutral_1.dll
10/10/07 11:46p 92704 GAC_System.Xml.Linq_v3_5_0_0_cneutral_1.dll
10/10/07 11:46p 345112 GAC_System.SR_v3_5_0_0_cneutral_1.dll
10/10/07 11:47p 63032 GAC_Microsoft.VisualBasic.SR_v8_1_0_0_cneutral_1.dll
10/13/11 11:34p 178176 SH600_ddi.dll
10/13/11 11:21p 23040 kbdmouse.dll
06/16/11 11:56p 102400 AgilentLan488Server32.dll
06/16/11 11:56p 44032 Agilent.Cdf.Core.Kernel.dll
06/16/11 11:57p 415744 Agilent.Cdf.Api.Unmanaged.dll
06/16/11 11:14p 169984 LxiMdnsResponder.dll
06/16/11 11:14p 11560 LxiMdnsResponderLicense.txt
06/16/11 11:58p 11776 Portability.dll
06/16/11 11:59p 13312 portmap.exe
06/16/11 11:59p 147968 Sicl32.dll
06/16/11 11:59p 81408 siclland.dll
06/16/11 11:59p 82432 siclrpc.dll
06/17/11 12:12a 9216 Agilent.Cdf.Core.Lxi.Web.ComServer.Interop.dll
06/16/11 11:14p 238080 OpenNETCF.dll
06/17/11 12:21a 1089536 Agilent.Cdf.Api.dll
06/17/11 12:21a 36352 Agilent.Cdf.Api.Gui.dll
06/16/11 11:19p 9099 PasswordFront.asp
06/16/11 11:19p 31371 home.asp
06/16/11 11:19p 2315 index.asp
06/16/11 11:19p 41690 modify_config.asp
06/16/11 11:19p 9677 navigation.asp
06/16/11 11:19p 7905 password.asp
06/16/11 11:19p 2268 top.asp
06/16/11 11:19p 23463 view_config.asp
06/16/11 11:19p 710 Default.asp
06/16/11 11:14p 12270 LXIIdentification.xsd
06/16/11 11:19p 38980 QualityLXI.jpg
06/16/11 11:19p 1004 CookieUtils.js
06/16/11 11:19p 2192 agilent.gif
<*holy crap... sorry... I should have just attached it*>
<*holy crap... sorry... I should have just attached it*>
06/16/11 11:19p 892 down-over.gif
06/16/11 11:19p 892 down.gif
06/16/11 11:19p 94 line-heading.gif
06/16/11 11:19p 3417 lxi.jpg
06/16/11 11:19p 893 up-over.gif
06/16/11 11:19p 893 up.gif
06/16/11 11:19p 1627 web-device.gif
06/16/11 11:19p 1535 web-enable.gif
06/16/11 11:19p 48 bluebar.gif
06/16/11 11:19p 1095 config-down.gif
06/16/11 11:19p 1068 config-over.gif
06/16/11 11:19p 1064 config.gif
06/16/11 11:19p 525 data-down.gif
06/16/11 11:19p 519 data-over.gif
06/16/11 11:19p 514 data.gif
06/16/11 11:19p 650 help-down.gif
06/16/11 11:19p 679 help-over.gif
06/16/11 11:19p 666 help.gif
06/16/11 11:19p 584 image-down.gif
06/16/11 11:19p 583 image-over.gif
06/16/11 11:19p 570 image.gif
06/16/11 11:19p 920 remote-down.gif
06/16/11 11:19p 907 remote-over.gif
06/16/11 11:19p 895 remote.gif
06/16/11 11:19p 620 welcome-down.gif
06/16/11 11:19p 623 welcome-over.gif
06/16/11 11:19p 614 welcome.gif
06/17/11 12:21a 6144 AgilentLxiWebService.exe
06/16/11 11:55p 70144 AgilentLxiWebComServer.exe
06/16/11 11:57p 32256 Agilent.Cdf.Core.Lxi.Web.ComServer.ProxyStub.dll
06/16/11 11:57p 58880 Agilent.Cdf.Core.Lxi.Web.ComServer.dll
06/17/11 12:21a 6144 AgilentLxiWebStartup.exe
10/13/11 11:16p 41 ConfigureNetwork.lnk
10/13/11 11:16p 99 usbUpdateApp.bat
10/13/11 11:16p 88 usbUpdateFpga.bat
10/13/11 11:36p 177 infiniiVision.txt
Found 365 file(s). Total size 26626785 bytes.
Directory of \Windows\StartUp
09/07/06 10:00a 69 desktop.ini
Found 1 file(s). Total size 69 bytes.
Directory of \Windows\Fonts
09/07/06 10:00a 69 desktop.ini
Found 1 file(s). Total size 69 bytes.
Directory of \Windows\Favorites
09/07/06 10:00a 69 desktop.ini
Found 1 file(s). Total size 69 bytes.
Directory of \Windows\Recent
09/07/06 10:00a 69 desktop.ini
Found 1 file(s). Total size 69 bytes.
Directory of \Windows\Programs
09/07/06 10:00a 69 desktop.ini
10/30/11 03:35a 19 Command Prompt.lnk
10/30/11 03:35a 24 Windows Explorer.lnk
Found 3 file(s). Total size 112 bytes.
Directory of \Windows\Desktop
09/07/06 10:00a 144 desktop.ini
Found 1 file(s). Total size 144 bytes.
Directory of \Windows\www
10/30/11 03:35a 58 current-httpd.log
10/30/11 03:35a <DIR> wwwpub
Found 2 file(s). Total size 58 bytes.
Directory of \Windows\www\wwwpub
10/30/11 03:35a 0 ApplicationLog.txt
10/30/11 03:35a <DIR> navbar
10/30/11 03:35a <DIR> Lxi
10/30/11 03:35a <DIR> image
10/30/11 03:35a 1004 CookieUtils.js
10/30/11 03:35a 23463 view_config.asp
10/30/11 03:35a 2268 top.asp
10/30/11 03:35a 7905 password.asp
10/30/11 03:35a 9677 navigation.asp
10/30/11 03:35a 41690 modify_config.asp
10/30/11 03:35a 2315 index.asp
10/30/11 03:35a 31371 home.asp
10/30/11 03:35a 9099 PasswordFront.asp
10/30/11 03:35a 961 default.htm
Found 14 file(s). Total size 129753 bytes.
Directory of \Windows\www\wwwpub\navbar
10/30/11 03:35a 614 welcome.gif
10/30/11 03:35a 623 welcome-over.gif
10/30/11 03:35a 620 welcome-down.gif
10/30/11 03:35a 895 remote.gif
10/30/11 03:35a 907 remote-over.gif
10/30/11 03:35a 920 remote-down.gif
10/30/11 03:35a 570 image.gif
10/30/11 03:35a 583 image-over.gif
10/30/11 03:35a 584 image-down.gif
10/30/11 03:35a 666 help.gif
10/30/11 03:35a 679 help-over.gif
10/30/11 03:35a 650 help-down.gif
10/30/11 03:35a 514 data.gif
10/30/11 03:35a 519 data-over.gif
10/30/11 03:35a 525 data-down.gif
10/30/11 03:35a 1064 config.gif
10/30/11 03:35a 1068 config-over.gif
10/30/11 03:35a 1095 config-down.gif
10/30/11 03:35a 48 bluebar.gif
Found 19 file(s). Total size 13144 bytes.
Directory of \Windows\www\wwwpub\Lxi
10/30/11 03:35a <DIR> Identification
Found 1 file(s). Total size 0 bytes.
Directory of \Windows\www\wwwpub\Lxi\Identification
10/30/11 03:35a 12270 LXIIdentification.xsd
10/30/11 03:35a 710 Default.asp
Found 2 file(s). Total size 12980 bytes.
Directory of \Windows\www\wwwpub\image
10/30/11 03:35a 1535 web-enable.gif
10/30/11 03:35a 1627 web-device.gif
10/30/11 03:35a 893 up.gif
10/30/11 03:35a 893 up-over.gif
10/30/11 03:35a 3417 lxi.jpg
10/30/11 03:35a 94 line-heading.gif
10/30/11 03:35a 892 down.gif
10/30/11 03:35a 892 down-over.gif
10/30/11 03:35a 2192 agilent.gif
10/30/11 03:35a 38980 QualityLXI.jpg
Found 10 file(s). Total size 51415 bytes.
Total Files Listed:
1094 File(s) 102902884 bytes.
81 Dir(s) 27090944 bytes free
The registry seems off-limits since windows seems to refuse to copy any file that's open and apparently there's no way around that. :-//Usually in WindowsCE systems the registry is part of the nk.bin image and can't be changed. It is loaded at boot time from flash in memory, like all the other programs in the \windows directory.
Here's the output of `dir /s /a \` (firmware 2.00)Maybe not a good idea to post it all in this forum. You can still edit it: pastebin.com and then a link.
I only wish FrankBuss would elaborate on how to utilize that UART...
The serial port location:
http://i.imgur.com/yYMV75t.jpg (http://i.imgur.com/yYMV75t.jpg)
All you need are some jumper wires, if you don't want to drill a hole. Fits nicely through the USB connector hole 8)
http://i.imgur.com/9gnsuQh.jpg (http://i.imgur.com/9gnsuQh.jpg)
You can then stop the u-boot with space (can be difficult, you have to be fast, use something like HTerm which has a useful "repeat" function to send a sequence automatically until you stop it, or just hold down space while you boot it). Then you can boot the image from network like this:Code: [Select]set serverip 192.168.11.108
dhcp 0x4000000 nk.bin;bootm 0xf8050000
Where 192.168.11.108 is your own server, where TFTP is running and providing nk.bin. You should see something like this:Code: [Select]BOOTP broadcast 1
DHCP client bound to address 192.168.11.106
Using smsc device
TFTP from server 192.168.11.108; our IP address is 192.168.11.106
Filename 'nk.bin'.
Load address: 0x4000000
Loading: **#################################################################
#################################################################
...
You get the nk.bin from the nk.bin.comp from the firmware update cab-file with the bincompress.exe tool, which is included in the evaluation version of the WindowsCE development environment. Use http://www.t-hack.com/wiki/index.php/NK.BIN_toolset (http://www.t-hack.com/wiki/index.php/NK.BIN_toolset) to take a look at the content of nk.bin and to modify it.
There is no file consistency check afaik. There is no need to use jtag also, just use the infiniivisionstartupoverride.txt method desribed in previous posts and you'll be able to run a patched scope app from usb flash drive whithout opening the case. There is more that enough info posted in this thread already, just nobody wants to post that final "here is .zip, unpack it to usb flash and use" ;)
Funny situation - dissecting Rigol and Hantek in public is ok, but Agilent's name invokes some kind of shame (or fear?) )))
lol you think making a hack public will double or triple the hardware price?! Are you serious? So I guess all the other scopes/phones/tablets/games/consoles/computers/EVERYTHING ELECTRONIC have all doubled and tripled in price right? Since they have ALL been hacked since there was something to hack! Man, guess Ill be paying $599 for my $299 iPhone next time I upgrade since they jailbroke it.There is no file consistency check afaik. There is no need to use jtag also, just use the infiniivisionstartupoverride.txt method desribed in previous posts and you'll be able to run a patched scope app from usb flash drive whithout opening the case. There is more that enough info posted in this thread already, just nobody wants to post that final "here is .zip, unpack it to usb flash and use" ;)
Funny situation - dissecting Rigol and Hantek in public is ok, but Agilent's name invokes some kind of shame (or fear?) )))
Few reasons:
1. There is security risk when we publish it.
2. Agilent and their engineers are really helpful when I need real assistence.
3. On this forum were hack offered for $$$, so it is under supervision for sure.
4. This thread is in the top when you Google "Agilent DSOX hack".
5. Hack will double or triple the price of hardware.
lol you think making a hack public will double or triple the hardware price?! Are you serious? So I guess all the other scopes/phones/tablets/games/consoles/computers/EVERYTHING ELECTRONIC have all doubled and tripled in price right? Since they have ALL been hacked since there was something to hack! Man, guess Ill be paying $599 for my $299 iPhone next time I upgrade since they jailbroke it.There is no file consistency check afaik. There is no need to use jtag also, just use the infiniivisionstartupoverride.txt method desribed in previous posts and you'll be able to run a patched scope app from usb flash drive whithout opening the case. There is more that enough info posted in this thread already, just nobody wants to post that final "here is .zip, unpack it to usb flash and use" ;)
Funny situation - dissecting Rigol and Hantek in public is ok, but Agilent's name invokes some kind of shame (or fear?) )))
Few reasons:
1. There is security risk when we publish it.
2. Agilent and their engineers are really helpful when I need real assistence.
3. On this forum were hack offered for $$$, so it is under supervision for sure.
4. This thread is in the top when you Google "Agilent DSOX hack".
5. Hack will double or triple the price of hardware.
And to you other "statements"
1) Nope, no security risk here, my scope is just as safe and secure as it was. Are you thinking that if the hack got out to the public that some malicious person might write a "virus" for my scope? Well who's to say I trust that the individuals on this site trying to sell me a hack arent going to do the same thing?! Or that they messed up somewhere and they made a mistake that hasnt been found and it might brick my scope?! This is why its better to let everyone look at your work if youre going to do this sort of thing.
2) Yes, they still are and always will be. They are paid to be so. They want to keep selling products. 99.9999% of the owners of electronic devices never hack or mod them anyway.
3) Most feel its insulting to reverse engineer some other work and then try and charge for it. I would never pay to jailbreak my iPhone or mod my Wii for example.
4) So?
5) You have to be kidding me... Already responded to this in the beginning of this post.
Benemorius, did you tryied change de splash screen?
did you get any results with yours tests?
Yes, changing the splash screen worked.
I did not attempt to overwrite any .exe or .dll files but I see no reason to doubt that it will work too. Running the firmware from USB is slower (longer boot time and occasional menu lag) and you have to remember not to pull the flash drive or else it crashes, but otherwise it works about like normal. I'm happy enough with that that I'd rather not overwrite any other files until I have NAND access, despite all indications being that there's nothing to worry about really.
Yes, changing the splash screen worked.
I did not attempt to overwrite any .exe or .dll files but I see no reason to doubt that it will work too. Running the firmware from USB is slower (longer boot time and occasional menu lag) and you have to remember not to pull the flash drive or else it crashes, but otherwise it works about like normal. I'm happy enough with that that I'd rather not overwrite any other files until I have NAND access, despite all indications being that there's nothing to worry about really.
There is more that enough info posted in this thread already, just nobody wants to post that final "here is .zip, unpack it to usb flash and use" ;)
Funny situation - dissecting Rigol and Hantek in public is ok, but Agilent's name invokes some kind of shame (or fear?) )))
The boot time is annoying, I need to restore backup of my USB two times, because the files on flash became corrupted.
The boot time is annoying, I need to restore backup of my USB two times, because the files on flash became corrupted.
That's interesting. I've used my scope a lot and haven't encountered any problems with corruption. It doesn't seem like any of the files there are regularly written anyway. I wonder if a different flash drive would change anything?
I only wish FrankBuss would elaborate on how to utilize that UART...
The serial port location:
http://i.imgur.com/yYMV75t.jpg (http://i.imgur.com/yYMV75t.jpg)
All you need are some jumper wires, if you don't want to drill a hole. Fits nicely through the USB connector hole 8)
http://i.imgur.com/9gnsuQh.jpg (http://i.imgur.com/9gnsuQh.jpg)
You can then stop the u-boot with space (can be difficult, you have to be fast, use something like HTerm which has a useful "repeat" function to send a sequence automatically until you stop it, or just hold down space while you boot it). Then you can boot the image from network like this:Code: [Select]set serverip 192.168.11.108
dhcp 0x4000000 nk.bin;bootm 0xf8050000
Where 192.168.11.108 is your own server, where TFTP is running and providing nk.bin. You should see something like this:Code: [Select]BOOTP broadcast 1
DHCP client bound to address 192.168.11.106
Using smsc device
TFTP from server 192.168.11.108; our IP address is 192.168.11.106
Filename 'nk.bin'.
Load address: 0x4000000
Loading: **#################################################################
#################################################################
...
You get the nk.bin from the nk.bin.comp from the firmware update cab-file with the bincompress.exe tool, which is included in the evaluation version of the WindowsCE development environment. Use http://www.t-hack.com/wiki/index.php/NK.BIN_toolset (http://www.t-hack.com/wiki/index.php/NK.BIN_toolset) to take a look at the content of nk.bin and to modify it.
Hi, here is info if someone want to make a NAND dump with JTAG debugger:
To Enable JTAG, you need this SPEAr600 TEST[2:0] pin configuration:
TEST_0=1, TEST_1=1, TEST_2=0
With debugger I did 128MB dump from NAND:
0000:0000-005F:FFFF empty, just 0xFF
0060:0000-00C0:9F61 NK.BIN.COMP, size 12623714 bytes (FW 02.20)
02C2:0000- ???? Other data/files
Now we have NAND dump and need to:
1) hack MD5/RSA file consistency check to enable another files to modify
2) hack RSACryptoServiceProvider::VerifyData() or function which use it (AGILEN~1.003)
With Uboot write modificaton into NAND. Then just install licenses with any signature :-)
Now I'm not able to find MD5/RSA file consistency check. Please help.
You don't really need to pay, all the required info is in this thread. You can just boot using a USB flash drive to unlock everything.Someone needs to throw together a thorough walk through for those that arent as savvy in this area.
How to hack the firmwareNice. So what can you do with it from this point?
1. Unpack the firmware *.cab by 7zip
2. Unpack infiniiVisionSetup.cab ( e.g. with WinCE CAB Manager 3.0)
Find \Secure\infiniiVision\infiniiVisionCore.dll
3. Change at location 0x277e50 in infiniiVisionCore.dll
byte sequence 04 00 a0 e1 to byte sequence 00 00 a0 e3
4. Enable startup Overide by creating USB flash with following structure in root of USB drive (copy structure from Secure folder from point 2)
Edit in Startup folder file infiniivision.lnk to contains following sequence "62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"
Replace in infiniiVision folder infiniiVisionCore.dll with patched infiniiVisionCore.dll file
5. Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
6. Plug the USB drive to scope and turn it ON
7. There will be red message in letf top corner "Unfinalized Software" and "System Concerns detected: OS version is not correct. Please reload system firmware"
Applications needed:
WinCE CAB Manager http://www.ocpsoftware.com/products.php (http://www.ocpsoftware.com/products.php)
7Zip http://www.7-zip.org/ (http://www.7-zip.org/)
Anyone have succeeded hacking the bandwidth from 70 to 100 or even 200 MHz?The "-l All" in plesa's hack should enable all licenses. But if you buy a 200 MHz license, you get some new 300 MHz probes. Maybe the scope tests the probe types.
How to hack the firmware
1. Unpack the firmware *.cab by 7zip
2. Unpack infiniiVisionSetup.cab ( e.g. with WinCE CAB Manager 3.0)
Find \Secure\infiniiVision\infiniiVisionCore.dll
3. Change at location 0x277e50 in infiniiVisionCore.dll
byte sequence 04 00 a0 e1 to byte sequence 00 00 a0 e3
4. Enable startup Overide by creating USB flash with following structure in root of USB drive (copy structure from Secure folder from point 2)
Edit in Startup folder file infiniivision.lnk to contains following sequence "62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"
Replace in infiniiVision folder infiniiVisionCore.dll with patched infiniiVisionCore.dll file
5. Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
6. Plug the USB drive to scope and turn it ON
7. There will be red message in letf top corner "Unfinalized Software" and "System Concerns detected: OS version is not correct. Please reload system firmware"
Applications needed:
WinCE CAB Manager http://www.ocpsoftware.com/products.php (http://www.ocpsoftware.com/products.php)
7Zip http://www.7-zip.org/ (http://www.7-zip.org/)
I'm assuming to back this out you just install the latest official firmware and call it a day?This is based on the method plesa described in reply #142 in this thread and boots from the USB flash drive. If you unplug the USB flash drive, it boots the old firmware from the internal scope flash. You can add some copy commands in the startup script on the flash drive to install it permanently.
Anyone have succeeded hacking the bandwidth from 70 to 100 or even 200 MHz?The "-l All" in plesa's hack should enable all licenses. But if you buy a 200 MHz license, you get some new 300 MHz probes. Maybe the scope tests the probe types.
BTW: the 16 channel digital input doesn't need any electronics, it is just ground and the input signals, and you can plug-in an old 40 pin IDE cable.
Fo the badwidth upgrade you will need to replace the mainboard, it is not software upgrade only.
Anyone have succeeded hacking the bandwidth from 70 to 100 or even 200 MHz?The "-l All" in plesa's hack should enable all licenses. But if you buy a 200 MHz license, you get some new 300 MHz probes. Maybe the scope tests the probe types.
BTW: the 16 channel digital input doesn't need any electronics, it is just ground and the input signals, and you can plug-in an old 40 pin IDE cable.
Looks like there are different bandwidth upgrades. I know this one, from 100 MHz to 200 MHz (http://www.newark.com/agilent-technologies/dsox3bw24/license-b-w-upg-100-mhz-to-200/dp/31T9060). But right, for the bandwidth upgrade to 350 MHz (http://www.datatec.de/cgi-bin/shop/lshop.cgi?action=showdetail&artnum=dsox3bw32), it is not just software and the scope has to be sent to a service center. I guess they really change the mainboard and not set just some jumper, because of the high price :)
The datasheet for the 350 MHz update (http://cp.literature.agilent.com/litweb/pdf/5990-7759EN.pdf) says, that the old 200 MHz update is obsolete, maybe new scopes are shipped with this license now without the need to buy it. And the 350 MHz hardware update allows an additional software license update to 500 MHz.
Looks like there are different bandwidth upgrades. I know this one, from 100 MHz to 200 MHz (http://www.newark.com/agilent-technologies/dsox3bw24/license-b-w-upg-100-mhz-to-200/dp/31T9060). But right, for the bandwidth upgrade to 350 MHz (http://www.datatec.de/cgi-bin/shop/lshop.cgi?action=showdetail&artnum=dsox3bw32), it is not just software and the scope has to be sent to a service center. I guess they really change the mainboard and not set just some jumper, because of the high price :)
The datasheet for the 350 MHz update (http://cp.literature.agilent.com/litweb/pdf/5990-7759EN.pdf) says, that the old 200 MHz update is obsolete, maybe new scopes are shipped with this license now without the need to buy it. And the 350 MHz hardware update allows an additional software license update to 500 MHz.
There is some big red text in the PDF on the first page: "Obsolete as of July 25".The datasheet for the 350 MHz update (http://cp.literature.agilent.com/litweb/pdf/5990-7759EN.pdf) says, that the old 200 MHz update is obsolete, maybe new scopes are shipped with this license now without the need to buy it. And the 350 MHz hardware update allows an additional software license update to 500 MHz.Where do you see it's obsolete? The document you linked to certainly doesn't.
Good to know about the IDE connector! I can´t find the pin out anywhere. Do you have this info to share?See reply #196 from plesa.
The "-l All" in plesa's hack should enable all licenses...You can try it: it doesn't accept the command line parameters without the patch.
If this command enable all licenses, what does the changes in infiniiVisionCore.dll do?
There is some big red text in the PDF on the first page: "Obsolete as of July 25".The datasheet for the 350 MHz update (http://cp.literature.agilent.com/litweb/pdf/5990-7759EN.pdf) says, that the old 200 MHz update is obsolete, maybe new scopes are shipped with this license now without the need to buy it. And the 350 MHz hardware update allows an additional software license update to 500 MHz.Where do you see it's obsolete? The document you linked to certainly doesn't.
Anyone get the bandwidth upgrade with this hack? Mine enabled all the features but the bandwidth. And yes, the "-l All" in Plesa's hack is there there.
Anyone get the bandwidth upgrade with this hack? Mine enabled all the features but the bandwidth. And yes, the "-l All" in Plesa's hack is there there.
Yes. upped from 100 MHz to 200 MHz on DSO-X2014
Anyone get the bandwidth upgrade with this hack? Mine enabled all the features but the bandwidth. And yes, the "-l All" in Plesa's hack is there there.
Yes. upped from 100 MHz to 200 MHz on DSO-X2014
Dammit. Every time I'm pretty sure I'll be getting a Rigol, I come in this thread and read something compelling enough to make me reconsider.
Dammit. Every time I'm pretty sure I'll be getting a Rigol, I come in this thread and read something compelling enough to make me reconsider.
It's a beautiful scope, I started with a Rigol, then switched to Agilent and I don't have plans to go back to Rigol for a long period of time, unless there is a very huge reason.
David.
Rigol are doing 4 channel 2000 series scopes now, which should be much cheaper than the 4000 series. Even with the eBay used shop it is hard to justify an Agilent with smaller memory and higher cost, even if the interface is a bit more fluid. Even so, they are just such nice scopes...DS2000 series with 4 Channel? :o
Rigol are doing 4 channel 2000 series scopes now, which should be much cheaper than the 4000 series. Even with the eBay used shop it is hard to justify an Agilent with smaller memory and higher cost, even if the interface is a bit more fluid. Even so, they are just such nice scopes...I've been wondering why Rigol hasn't had a 4 channel 2000 series scope...
HA! Snap a shot of the Enterprise and post it! I wanna see that one!I second that one!
The option SCPIPS could also be the remote logging option to debug the SCPI commands.Ha ha ha! Awesome! Thanks for posting that!
And for all Trekkies
see the attachment :)
Yes i also think this could be a easter egg.
It a littlebit hard to find out in which case this picture / function will be started.
Maybe i can find more about this in the disassembly.
I did the hack with a very old and low capacity USB drive and it works fine.
Today I tried with a low cost PNY 8 GB thumbdrive and the system does not recognize the PNY.
Is there a limitation on the USB thumbdrive size ?
Has anybody tried with a 8 GB thumdrive ?
David.
I am using a 4GB stick, FAT16 does support partition size above 2GB if you format it with 64KB cluster size.I did the hack with a very old and low capacity USB drive and it works fine.
Today I tried with a low cost PNY 8 GB thumbdrive and the system does not recognize the PNY.
Is there a limitation on the USB thumbdrive size ?
Has anybody tried with a 8 GB thumdrive ?
David.
See the above post on formatting FAT16. Vanilla FAT doesn't support partition sizes over 2GB.
But... the low capacity USB thumdrive is a FAT32 and it works. :scared:All I know is that it didn't work until I reformatted to FAT16.
David.
kilobyte,
Thanks for the reply. My understanding is that I should extract the contents of infiniivisionSetup.cab, then take contents of the "Secure" folder and copy *only* Secure folder contents to Flash root drive. I have done this, but my folder structure looks a little bit different than what you have listed.
Are there any files, other than contents of "Secure" folder(including modified infiniivisionCore.dll) + startupoverride text file that should be on the flash disk?
Muahahaha! :-DD
Agilent DSOX2000/3000 Easteregg Spaceship Screensaver (https://www.youtube.com/watch?v=A4zTj5a7cGU#ws)
Here is it the Enterprise Screensaver.
I did take a look in the dsox4000 dll and there are a lot more debug information and resources.
I opened the 4000 infiniivision with a resource hacker and I was able to extract bitmaps and Winform dialogs.
After disassembling the dll I searched for the text TREK and found the reference to this in a subfunction with other references to ...Screensaver...
So i tried it on my scope and bingo.
Regards
Kai
kilobyte,
Thanks for the reply. My understanding is that I should extract the contents of infiniivisionSetup.cab, then take contents of the "Secure" folder and copy *only* Secure folder contents to Flash root drive. I have done this, but my folder structure looks a little bit different than what you have listed.
Are there any files, other than contents of "Secure" folder(including modified infiniivisionCore.dll) + startupoverride text file that should be on the flash disk?
Did you copy whole structure from extracted \3000XSeries.02.35.2013061800.cab\infiniiVisionSetup.cab ? The whole content of \Secure\ folder must be copied to USB flash.
Also check presence of the Startup folder with modified infiniivision.lnk which contains sequence "62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"
But... the low capacity USB thumdrive is a FAT32 and it works. :scared:
David.
I test my usb stick on a dsox2024a at work today.
The DSO is only some month old (July 2013).
It's a pity but it didn't load the firmware from usb stick.
The LED on the flash drive has flashed at startup but after that there was no reaction compared to my DSOX.
Maybe they have changed something in the bootloader or something else.
I think i will buy the LAN Module(as a Christmas gift ;D), maybe with this its possible to do more research on the scope.
Tried on two July build 3000x scopes and the USB boot method works. Everything except bandwidth upgrade (100MHz still 100MHz and 350MHz still 350MHz) being available.
One is v2.35 and the other v2.30 firmware.
Tried on two July build 3000x scopes and the USB boot method works. Everything except bandwidth upgrade (100MHz still 100MHz and 350MHz still 350MHz) being available.
One is v2.35 and the other v2.30 firmware.
I think the USB port is a bit flaky. There were problems with scopes endlessly cycling the LEDs on boot when a USB stick is inserted. Until a couple of firmware updates ago mine would never show the splash screen if a USB stick was inserted. Comments here about needing FAT16 or FAT32 and not more than 7.9GB etc might just be down to the scope liking some sticks more than others.
The scope isn't going to spend a lot of time checking or waiting for a USB stick during boot.
I test my usb stick on a dsox2024a at work today.
The DSO is only some month old (July 2013).
It's a pity but it didn't load the firmware from usb stick.
The LED on the flash drive has flashed at startup but after that there was no reaction compared to my DSOX.
Maybe they have changed something in the bootloader or something else.
I think i will buy the LAN Module(as a Christmas gift ;D), maybe with this its possible to do more research on the scope.
Tried on two July build 3000x scopes and the USB boot method works. Everything except bandwidth upgrade (100MHz still 100MHz and 350MHz still 350MHz) being available.You can upgrade 100MHz version only to 200MHz, and 350MHz can go up to 500MHz. (it should..)
One is v2.35 and the other v2.30 firmware.
You can upgrade 100MHz version only to 200MHz, and 350MHz can go up to 500MHz. (it should..)
I've noticed that scope hangs if there is missig full path to launcher in .lnk file (in startup folder).
For example if you forgot to add "\usb" to launcher path in the .lnk file on USB stick or if you replaced .lnk file in flash memory with one from usb stick; containing "\usb" path, scope will hang. (I did this by mistake)
If you have used "-All" switch, You probably lost 30 trial option.
In case You don't like a little star you can add separate license switches (-l AUTO, -l MSO,.....).
There are two hidden options -l VID and -l CABLE. You can find them by pressing analyse button ;)
Enjoy!
It's working on 2000 series, You can find it when you press Analyse button. When you add that switch launcher returns: *** Installing License: Cable Calibration.You are right, it is also working on 3k series as well.
-l VID adds HD video trigger and -l CABLE adds that cable calibration option which i'm not shure what's it for, didn't try that option yet.
Has anyone tested going back to stock after modding the firmware? Any issues there? What about with re-enabling previously purchased upgrades?The original licenses purchased with scope still remains on scope itself.
But... the low capacity USB thumdrive is a FAT32 and it works. :scared:
David.
I made my scope work with the 8GB USB drive.
I had to create a primary partition of 7.65 GB (it won't work with 7.7 or higher), and format it to FAT32.
:-BROKE
David.
Plesa, can You please look at 0x007D51C8 in core file, You might find more switches that might work on 3000 series which don't work on 2000 series.
But... the low capacity USB thumdrive is a FAT32 and it works. :scared:
David.
I made my scope work with the 8GB USB drive.
I had to create a primary partition of 7.65 GB (it won't work with 7.7 or higher), and format it to FAT32.
:-BROKE
David.
Well 7.65GB partition was not working all the time, I just randomly set a partition of 7GB and now it boots every single time.
David.
Plesa, have You by any chance figured out what infiniium mode means ???
Plesa, have You by any chance figured out what infiniium mode means ???
I suppose that it is related to some compatibility with Infinium family scope and their SCPI commands, I guess.
I find it... interesting how so many people SEEM TO BE genuinely upset that they are unable to get more scope than they paid for.
If they bought the scope expecting to do the free upgrade, i.e. that was part of the deliberation when deciding which one to get, I can understand that. For example I am now seriously considering getting an Agilent for my personal use because you can get the free upgrade, otherwise it just isn't worth it.
Upset might be a bit of a strong word. Disappointed would be more accurate.QuoteI know in the EU that the "you bought it, you own it" rule applies, but here in the US, that isn't the case. It should be, but it isn't. Might not be as bad as in the states, but it's bad enough.
Damn straight. The EU isn't ruled by corporations.
Any chance the aero command run on 2000X?Unfortunatly AERO does not work on 2000 series, i belive decoding is done by FPGA in cooperation with MEGAZOOM IV (Codename: "Baldwin" i belive), so it's not available in 2000 series.
Maybe the software is there, just locked too.
Why different numbers in the lnk file? (Plesa has 254 and Wersi 62)
what does this command?
Any chance the aero command run on 2000X?
Maybe the software is there, just locked too.
Why different numbers in the lnk file? (Plesa has 254 and Wersi 62)
what does this command?
Any chance the aero command run on 2000X?
Maybe the software is there, just locked too.
Why different numbers in the lnk file? (Plesa has 254 and Wersi 62)
what does this command?
Is there any usage of AERO at home lab?
Check the infiniivisioncore.dll file for support on 2k family. I do not see it.
The number is the ammount of characters in .lnk file
I checked all functions of scope and did not find anything related to Tomography option (TOM), so it can be related to some upcoming software package like Agilent Spectrum Visualiser (ASV), I guess.
There two additional options FRC (FlexRay Complance) and TEL (Telecom Mask Test) , both not working.
if you can borrow LAN module, you can copy modified infiniivisioncore.dll and infiniivision.lnk to internal flash
Just tried the hack on a DSOX3034A that I got last week. I think the build week is 43 of 2013 (late October-ish, there is a 1343 under the QR code on the serial #, MAC addr sticker on the back of the unit). The firmware version that came with it is 02.36.2013091301.
Unfortunately, I'm not having any luck getting it to boot from the USB stick with the hacked Core DLL file. I also tried to get it to boot without modifying any of the files except for the override .txt file, again with no luck.
The scope appears to read information from the USB drive (can see the led flashing). Next, all I get is it cycling through lighting up the channel buttons, intensity and wave gen, run stop and single and then ref, math, digital and serial. It goes through about 8 cycles and then reboots itself. No matter what I have tried, I have seen no change in behavior when trying to boot from the usb flash drive.
To verify that the scope can handle the formatting of the drive, I booted the scope without the usb flash drive plugged in. After the scope was up and operating normally, I plugged in the usb drive and was able to browse the directories via the Save/Recall button.
Not really asking for any one to figure this out, just trying to document another data point for a relatively new scope.
I'd be interested to know if anyone else with a newer scope that came with firmware > 2.35 is having any success with the hack.
Thanks for info. Could you try to downgrade the firmware to the latest version available on website 2.35 and try it again?
Your reported firmware seems to be not released for field.
As BOB reported, I tried some really slow USB sticks (<5MB/s) and it is not working, strange.
Huh, mine is still running 2.35. What did they do in version 2.36 I wonder.
I doubt that. Arent there already confirmed people in this thread with brand new scopes running 2.36 with a successful hack?Huh, mine is still running 2.35. What did they do in version 2.36 I wonder.
Perhaps in 2.36 they've addressed the license hack? I think there's little doubt Agilent reads this forum.
I doubt that. Arent there already confirmed people in this thread with brand new scopes running 2.36 with a successful hack?There are.
Thought so. Thanks for confirming.I doubt that. Arent there already confirmed people in this thread with brand new scopes running 2.36 with a successful hack?There are.
I doubt that. Arent there already confirmed people in this thread with brand new scopes running 2.36 with a successful hack?There are.
How to hack the firmware
1. Unpack the firmware *.cab by 7zip
2. Unpack infiniiVisionSetup.cab ( e.g. with WinCE CAB Manager 3.0)
Find \Secure\infiniiVision\infiniiVisionCore.dll
3. Change at location 0x277e50 in infiniiVisionCore.dll
byte sequence 04 00 a0 e1 to byte sequence 00 00 a0 e3
4. Enable startup Overide by creating USB flash with following structure in root of USB drive (copy structure from Secure folder from point 2)
Edit in Startup folder file infiniivision.lnk to contains following sequence "62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"
Replace in infiniiVision folder infiniiVisionCore.dll with patched infiniiVisionCore.dll file
5. Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
6. Plug the USB drive to scope and turn it ON
7. There will be red message in letf top corner "Unfinalized Software" and "System Concerns detected: OS version is not correct. Please reload system firmware"
Applications needed:
WinCE CAB Manager http://www.ocpsoftware.com/products.php (http://www.ocpsoftware.com/products.php)
7Zip http://www.7-zip.org/ (http://www.7-zip.org/)
I found "OpenFreely" as the hexeditor to modify infiniiVisionCore.dll. Does the date/time of the edited file have to be identical to the original? Right now the edited file has today's date.
tnx
j
I doubt that. Arent there already confirmed people in this thread with brand new scopes running 2.36 with a successful hack?There are.
I don't know the username or password.
Oh, I guess I missed that part of this hack. The USB drive with the custom firmware resides on the USB drive so it has the be left connected to the scope all the time doesnt it?Yes. If the USB is removed the unit will reboot itself in few seconds.
I don't know the username or password.
Check page 12
I have the VGA/LAN module for my MSOX2024, any chance you could write out your steps to doing this? Not having to have the USB drive taking up the port would be very nice.I don't know the username or password.
Check page 12
Thank you! I was searching for "password" in the thread, not "pass". Happy to report I've been able to modify the built-in files and don't have to boot from USB key anymore.
I have the VGA/LAN module for my MSOX2024, any chance you could write out your steps to doing this? Not having to have the USB drive taking up the port would be very nice.I don't know the username or password.
Check page 12
Thank you! I was searching for "password" in the thread, not "pass". Happy to report I've been able to modify the built-in files and don't have to boot from USB key anymore.
Are you referring to this post?I don't know the username or password.
Check page 12
Some "oil into the fire":
telnet login/pass:
infiniivision
skywalker1977
Telnet to the scope
I have the VGA/LAN module for my MSOX2024, any chance you could write out your steps to doing this? Not having to have the USB drive taking up the port would be very nice.
196#\Secure\infiniiVision\infiniivisionLauncher.exe -l MSO -l DVM -l ADVMATH -l AERO -l AUDIO -l AUTO -l COMP -l EMBD -l Flex -l Mask -l MEMUP -l PWR -l SGM -l VID -l WAVEGEN -l EDK -l memMax -l BW20
copy \usb\temp\infiniiVisionCore.dll \Secure\infiniiVision
attrib -r \Secure\startup\infiniivision.lnk
copy \usb\temp\infiniivision.lnk \Secure\startup
33#\windows\cmd.exe \usb\autorun.cmd
at USB root create autorun.cmd withcopy \usb\temp\infiniiVisionCore.dll \Secure\infiniiVision
attrib -r \Secure\startup\infiniivision.lnk
copy \usb\temp\infiniivision.lnk \Secure\startup
\Secure\infiniiVision\infiniivisionLauncher.exe
(no need to say that files in \temp and all startup override stuff must be present too of course)mwilson, can you please try this:
edit USB .lnk toCode: [Select]33#\windows\cmd.exe \usb\autorun.cmd
at USB root create autorun.cmd with
[...]
This can help people w/o LAN/telnet installing the hack - just boot from such prepared USB stick once.
18#\usb\temp\foo.cmd
So is it better to try and do a "permanent" hack via the USB port instead of doing it via the network port?
But as far as risk goes, you could potentially brick your scope using either method if it were going to happen correct?
mwilson, can you please try this:Should that be "34#\windows\cmd.exe \usb\autorun.cmd"?
edit USB .lnk toCode: [Select]33#\windows\cmd.exe \usb\autorun.cmd
at USB root create autorun.cmd with
mwilson, can you please try this:Should that be "34#\windows\cmd.exe \usb\autorun.cmd"?
edit USB .lnk toCode: [Select]33#\windows\cmd.exe \usb\autorun.cmd
at USB root create autorun.cmd with
16#\usb\autorun.cmd
Replying to my own post... ::) I didn't notice the space between the "exe" and the "\usb". Do spaces count for the command line length?mwilson, can you please try this:Should that be "34#\windows\cmd.exe \usb\autorun.cmd"?
edit USB .lnk toCode: [Select]33#\windows\cmd.exe \usb\autorun.cmd
at USB root create autorun.cmd with
Replying to my own post... ::) I didn't notice the space between the "exe" and the "\usb". Do spaces count for the command line length?mwilson, can you please try this:Should that be "34#\windows\cmd.exe \usb\autorun.cmd"?
edit USB .lnk toCode: [Select]33#\windows\cmd.exe \usb\autorun.cmd
at USB root create autorun.cmd with
(But note that as previously discussed the WinCE cmd.exe doesn't take a file argument like this, so the question of whether the number is correct for this particular example is rather academic...)
(But note that as previously discussed the WinCE cmd.exe doesn't take a file argument like this, so the question of whether the number is correct for this particular example is rather academic...)
Does adding a /C switch help? "CMD /C <command>" is the usual way (since DOS days, with COMMAND.COM) to get the command processor to accept a command as a parameter, and the CE docs suggest it's supported...
17#\usb\autorun.cmd
In \usb\autorun.cmd:dir /s \
\windows\processMgr.exe kill infiniivisionLauncher.exe
dir /s \
\windows\processMgr.exe kill infiniivisionLauncher.exe
dir /s \
\windows\processMgr.exe kill infiniivisionLauncher.exe
dir /s \
\windows\processMgr.exe kill infiniivisionLauncher.exe
dir /s \
\windows\processMgr.exe kill infiniivisionLauncher.exe
dir /s \
\windows\processMgr.exe kill infiniivisionLauncher.exe
dir /s \
\usb\infiniiVision\infiniiVisionLauncher.exe -l DIS -l SGMC -l CABLE
The "kills" get rid of any other infiniivisionLauncher.exe that may have started up. It could be the booting is taking too long and the scope decided to start the built in infiniivisionLauncher.exe as a back up. But I don't really know.Any news/comments about the 2.36 FW shipping on newer scopes (as per https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg340097/#msg340097 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg340097/#msg340097))?
The warning message about firmware issue remains on screen all the time, or only seen after boot?
Georg
P.S. I waiting for my DSOX3032.
Any news/comments about the 2.36 FW shipping on newer scopes (as per https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg340097/#msg340097 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg340097/#msg340097))?
No, but the user who reported this firmware has only three post and seems to be no longer online. He did not tried the downgrade to 2.35.
Only after boot up, you need to press button to accept it. And the self test did not passed. But we did not encountered any issue with hacked software.
62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS -l BW50
\
+-infiniiVision
+-fpga
+-upgrade
+-web
+-css
+-help
+-image
+-include
+-web-socket-js
+-lib
+-Lxi
+-Identification
+-navbar
+-Startup
infiniivisionStartupOverride.txt
I'm still following this thread, but haven't had anything to contribute to the discussion, so have been lurking.
I'm reluctant to downgrade the FW without a path back to the factory FW or a newer FW. I've been watching the agilent website for newer firmware (since 2.35 was released in june, I was hoping there'd be some update soon-ish).
Do you have the Ethernet option? Can you poke around in Telnet?
This .lnk remove the * symbol in the about screen. There is more options but some of them are not working.
255#\usb\infiniiVision\infiniivisionLauncher.exe -l MSO -l MEMUP -l memMAX -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l EDK -l WAVEGEN -l AERO -l VID -l ADVMATH -l DVM -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC
Only after boot up, you need to press button to accept it. And the self test did not passed. But we did not encountered any issue with hacked software.
It should pass all self tests and calibrations... at least they do pass fine for me...
Do you have the Ethernet option? Can you poke around in Telnet?
Unfortunately, I do not have the Ethernet module and it's not in the budget to buy any upgrades until later in the year.
This .lnk remove the * symbol in the about screen. There is more options but some of them are not working.
255#\usb\infiniiVision\infiniivisionLauncher.exe -l MSO -l MEMUP -l memMAX -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l EDK -l WAVEGEN -l AERO -l VID -l ADVMATH -l DVM -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC
I've seen references to 255#, 256#, 62#. What do these prefix numbers mean?
Hi guys,
So I have read the whole thread. I want to make sure I understand something correctly though.
You can use the shortcut's without modifying the dll? Is that correct?
Thanks all for your work on this.
-Matt
This .lnk remove the * symbol in the about screen. There is more options but some of them are not working.
255#\usb\infiniiVision\infiniivisionLauncher.exe -l MSO -l MEMUP -l memMAX -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l EDK -l WAVEGEN -l AERO -l VID -l ADVMATH -l DVM -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC
I've seen references to 255#, 256#, 62#. What do these prefix numbers mean?
Read the whole thread. Briefly it is ammount of characters in link.
There were several request for the digital probe schematic.The original probe cannot be dissassembled without damage.
So I just found schematic in the Agilent documents
http://cp.literature.agilent.com/litweb/pdf/5968-4632E.pdf (http://cp.literature.agilent.com/litweb/pdf/5968-4632E.pdf)
I saw lot of the probes on ebay and grabbers as well, pretty cheap.
The type is N6459 (8 channels) and N6450 (16 channels)
This .lnk remove the * symbol in the about screen. There is more options but some of them are not working.
255#\usb\infiniiVision\infiniivisionLauncher.exe -l MSO -l MEMUP -l memMAX -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l EDK -l WAVEGEN -l AERO -l VID -l ADVMATH -l DVM -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC
Did anyone look inside the lan/vga adapter?
Not just simple resistors?
With the stick in I can see it being accessed when the scope is starting up, after a second or two from reading from it though it moves immediately into it's normal boot cycle and then comes up clean on the internally installed firmware. Any suggestions?
With the stick in I can see it being accessed when the scope is starting up, after a second or two from reading from it though it moves immediately into it's normal boot cycle and then comes up clean on the internally installed firmware. Any suggestions?
Which FW are you on?
Until a few days ago, Newark showed the N6450-60001 16 ch. logic cable assembly for around ~ USD $600. I no longer see the cable assembly anywhere on-line without purchasing the full DSOX3MSO upgrade kit. Impeccable timing, isn't it? Can anyone else spot its availability?
Now, I know that a DSOX2002A with the hack can become in a DSOX2022A, but its real BW is only 160MHz (-3dB).
Thnaks this type seems to have the same pinout and hopefully will be compatible.Until a few days ago, Newark showed the N6450-60001 16 ch. logic cable assembly for around ~ USD $600. I no longer see the cable assembly anywhere on-line without purchasing the full DSOX3MSO upgrade kit. Impeccable timing, isn't it? Can anyone else spot its availability?
I was looking for the logic cable assembly as well. I ended up buying the one below off ebay the other day for my DSOX3k. It shipped within 12 hours. I'll have it in my hands tomorrow and can report back.
http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160 (http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160)
Hi
I know that the DSOX200*A can be upgrade to DSOX201*A [DSOX2BW1*], and the DSOX201*A can be upgrade to DSOX202*A [DSOX2BW2*].
Now, I know that a DSOX2002A with the hack can become in a DSOX2022A, but its real BW is only 160MHz (-3dB).
Is this also the real BW for a DSOX202*A? The datasheet says 200MHz (-3dB warranted).
Please, can someone with a DSOX201*A or a DSOX202*A measure its bandwidth (without probe, straight to BNC, using a 50 Ohm Feed Through)?
Thanks.
Note: Also, I remember read in the forum that all have the same input stage.
The input stage is based on the LMH6518?
I tested the badwidth and upgrade on 3k series and it was accordng to spec. I used the "FreeElectron" Jim Williams pulse generator. See one of my post in this thread.
How did you measure and calculate BW?
Did you use the Agilent offer for free bandwith upgrade?
Just a quick check with a sweepgenerator my 2012A with BW20 drops off at ~250MHz.Exactly, that's what I wanted to know.
Make sure you're using good probes if you're not using straight coax, the supplied ones for me was only 150MHz...
Until a few days ago, Newark showed the N6450-60001 16 ch. logic cable assembly for around ~ USD $600. I no longer see the cable assembly anywhere on-line without purchasing the full DSOX3MSO upgrade kit. Impeccable timing, isn't it? Can anyone else spot its availability?
I was looking for the logic cable assembly as well. I ended up buying the one below off ebay the other day for my DSOX3k. It shipped within 12 hours. I'll have it in my hands tomorrow and can report back.
http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160 (http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160)
Or catch them through the forum at a good discount: https://www.eevblog.com/forum/buysellwanted/fs-hpagilent-logic-pods/msg189290/#msg189290 (https://www.eevblog.com/forum/buysellwanted/fs-hpagilent-logic-pods/msg189290/#msg189290)Until a few days ago, Newark showed the N6450-60001 16 ch. logic cable assembly for around ~ USD $600. I no longer see the cable assembly anywhere on-line without purchasing the full DSOX3MSO upgrade kit. Impeccable timing, isn't it? Can anyone else spot its availability?
I was looking for the logic cable assembly as well. I ended up buying the one below off ebay the other day for my DSOX3k. It shipped within 12 hours. I'll have it in my hands tomorrow and can report back.
http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160 (http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160)
Is it includng grabbers and the grounding extension?Or catch them through the forum at a good discount: https://www.eevblog.com/forum/buysellwanted/fs-hpagilent-logic-pods/msg189290/#msg189290 (https://www.eevblog.com/forum/buysellwanted/fs-hpagilent-logic-pods/msg189290/#msg189290)Until a few days ago, Newark showed the N6450-60001 16 ch. logic cable assembly for around ~ USD $600. I no longer see the cable assembly anywhere on-line without purchasing the full DSOX3MSO upgrade kit. Impeccable timing, isn't it? Can anyone else spot its availability?
I was looking for the logic cable assembly as well. I ended up buying the one below off ebay the other day for my DSOX3k. It shipped within 12 hours. I'll have it in my hands tomorrow and can report back.
http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160 (http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160)
Tested on a MSOX and work perfectly.
Until a few days ago, Newark showed the N6450-60001 16 ch. logic cable assembly for around ~ USD $600. I no longer see the cable assembly anywhere on-line without purchasing the full DSOX3MSO upgrade kit. Impeccable timing, isn't it? Can anyone else spot its availability?
I was looking for the logic cable assembly as well. I ended up buying the one below off ebay the other day for my DSOX3k. It shipped within 12 hours. I'll have it in my hands tomorrow and can report back.
http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160 (http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160)
Travisc, please provide us with an update as to whether or not your logic cable is working. Thank you!
Until a few days ago, Newark showed the N6450-60001 16 ch. logic cable assembly for around ~ USD $600. I no longer see the cable assembly anywhere on-line without purchasing the full DSOX3MSO upgrade kit. Impeccable timing, isn't it? Can anyone else spot its availability?
I was looking for the logic cable assembly as well. I ended up buying the one below off ebay the other day for my DSOX3k. It shipped within 12 hours. I'll have it in my hands tomorrow and can report back.
http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160 (http://www.ebay.com/itm/HP-Agilent-54620-61801-54620-61601-54620-68701-POD-KIT-/121237102705?ssPageName=ADME:L:OC:CA:3160)
Travisc, please provide us with an update as to whether or not your logic cable is working. Thank you!
Just an update to the logic cable assembly I purchased off eBay. I received it today. I tested all 16 lines with my DSOX3 series scope and they worked fine. The quality of the cables, wires, and probes are excellent. The probes and connectors all have little Agilent logos on them. The parts were well packed, and the bags they came in had Agilent part and lot numbers on them. It's the real deal. I'm very happy with them.
There isnt by chance any way to enable 16 digital lines for the X-2000 series instead of the 8 is there?
Has anyone ordered a new DSOX-3034A from Newark or TEquipment.net in the US? I wonder if it is likely to have firmware 2.35 or 2.36 on it....
@travisc: you got your DSOX-3034A just last week; was that from a US distributor?
I just tested, original Firmware 2.36 did not work for USB boot, just resulted in cyclic blinking of the buttons with no software being started.
Then, I "updated" to the latest firmware available from the Agilent homepage (2.35) - as suggested by the scope itself.
Now, USB boot works perfectly fine.
Stick is a SanDisk Extreme USB 3.0 16GB.
Thanks for testing!! There were several user who affraid to downgrade scope to 2.35. Was there any warnining message?
Prior downgrade I reccomneds to reset scope to factory default, this help during my downgrading experiment with firmwares prior 2.35.
It should be LAN module for 181 USDWait, so Im confused. That LAN module you linked to says that it was replaced by the DSOXLAN-FG, if I already have the DSOXLAN module in my MSOX2024A does that mean that there is a new/updated LAN/VGA module. The link for the DSOXLAN-FG module says: "This part is not available for direct sale but an instrument repair is orderable through our service center. Please contact Agilent to inquire about returning your instrument for repair."
http://www.home.agilent.com/myagilent/faces/partDetail.jspx?partNumber=75019-68705&imageStatus=NO&_afrLoop=1455775011571000&_afrWindowMode=0&_afrWindowId=null#%40%3F_afrWindowId%3Dnull%26_afrLoop%3D1455775011571000%26imageStatus%3DNO%26partNumber%3D75019-68705%26_afrWindowMode%3D0%26_adf.ctrl-state%3D39lnsndix_58 (http://www.home.agilent.com/myagilent/faces/partDetail.jspx?partNumber=75019-68705&imageStatus=NO&_afrLoop=1455775011571000&_afrWindowMode=0&_afrWindowId=null#%40%3F_afrWindowId%3Dnull%26_afrLoop%3D1455775011571000%26imageStatus%3DNO%26partNumber%3D75019-68705%26_afrWindowMode%3D0%26_adf.ctrl-state%3D39lnsndix_58)
I just contacted Agilent on the DSOXLAN-FG module and apparently those links that were posted were not supposed to be exposed to the general public. He explained that the DSOXLAN-FG is a part reference for the entire assembly that is sold to us as the DSOXLAN. He said there is nothing different about its merely an internal part number.
Hi folks, I'm going to take advantage of the Agilent promo --- I have ordered a DSOX3k + LAN module. The items are back-ordered 4 wks, so it'll be a bit of a wait...but I expect it to be loaded with v2.36 firmware. Following what I've read here, I will telnet in, copy the files to a local USB, and share them here. Hopefully we find a way to make v2.36 work from USB boot with configured options! Thanks people for all the ideas shared so far! :)Why not just downgrade?
Why not just downgrade?
Why not just downgrade?
Well, since we know that works already it is easy last resort. I think it will be fun to try 2.36; several people are curious to see the core dll, so I can help with that effort. And, eventually 2.36 might be on Agilents website for download.
Hi,
I just wonder if I miss something?
Base on the Quote from: plesa on November 03, 2013, 10:24:37 PM
Instead of moving the startup on the USB key just live on the local disk
<snip>
To reverse the change infiniiVisionCore.old to infiniiVisionCore.dll
Restart ...
eurofox
Muahahaha! :-DD
Agilent DSOX2000/3000 Easteregg Spaceship Screensaver (https://www.youtube.com/watch?v=A4zTj5a7cGU#ws)
Here is it the Enterprise Screensaver.
I did take a look in the dsox4000 dll and there are a lot more debug information and resources.
I opened the 4000 infiniivision with a resource hacker and I was able to extract bitmaps and Winform dialogs.
After disassembling the dll I searched for the text TREK and found the reference to this in a subfunction with other references to ...Screensaver...
So i tried it on my scope and bingo.
Regards
Kai
Hi folks, I'm going to take advantage of the Agilent promo --- I have ordered a DSOX3k + LAN module. The items are back-ordered 4 wks, so it'll be a bit of a wait...but I expect it to be loaded with v2.36 firmware. Following what I've read here, I will telnet in, copy the files to a local USB, and share them here. Hopefully we find a way to make v2.36 work from USB boot with configured options! Thanks people for all the ideas shared so far! :)
I just contacted Agilent on the DSOXLAN-FG module and apparently those links that were posted were not supposed to be exposed to the general public. He explained that the DSOXLAN-FG is a part reference for the entire assembly that is sold to us as the DSOXLAN. He said there is nothing different about its merely an internal part number.
My DSOXLAN modul that I have ordered from Datatec a couple of weeks ago was marked with DSOXLAN FG.
My Agilent DSO-X 3034A arrived earlier in the month and it took until today to get a DSOXLAN module for it. The scope is running v2.36 firmware as has been the case for recent folks. It's been a pleasure to use so far, and I'm looking forward to unlock a little extra potential.
For the purpose of exploring v2.36, here is some details (for the complete file listing, see attached FileList.txt):
Directory of \Secure\infiniiVision
01/01/86 12:04a <DIR> web
01/01/86 12:04a <DIR> fpga
10/10/07 06:45p 46624 System.Drawing.dll
10/10/07 06:45p 214552 mscorlib.dll
05/05/13 09:21a 82432 Agilent.Cdf.Api.Licensing.dll
05/05/13 09:21a 160256 Agilent.Cdf.Api.Lxi.dll
05/05/13 09:21a 85504 Agilent.Cdf.Api.Security.dll
05/05/13 09:21a 28160 Agilent.Cdf.Api.SystemManagement.dll
05/05/13 09:21a 163840 Agilent.Cdf.Api.dll
05/05/13 09:21a 9216 Agilent.Cdf.Core.Lxi.Web.ComServer.Interop.dll
08/24/12 03:16p 238080 OpenNETCF.dll
05/16/13 08:43p 13312 WebPageData.dll
08/24/12 03:16p 398336 SetupConverter.exe
01/01/86 12:04a 1152032 splashImage.bin
08/24/12 03:17p 251392 dnssd_CE.dll
08/24/12 03:17p 355840 libcups2.dll
08/24/12 03:17p 83968 libcups2backend.dll
09/13/13 11:10a 215040 vncServer.exe
08/24/12 03:20p 21504 websockify.exe
09/13/13 11:17a 17312416 infiniiVisionCore.dll
09/13/13 11:10a 12104 infiniiVisionLauncher.exe
09/13/13 11:10a 180736 infiniiVisionWebCom.dll
The infiniiVisionCore.dll is the same size (in bytes) as the previous v2.35 release, however the two files are different.
The bytes previously mentioned to patch at location 0x277e50 are not there. My best guess (just by comparing, and noting the same sequence of bytes) is that they are now at 0x277e30.
I patched the bytes at 0x277e30, and setup the USB boot key as per the instructions here. I tried 3 different USB keys: SanDisk Cruzer 2GB, Kingston DataTraveler 4GB, Transcend 32GB. All were USB 2.0 drives, and formatted FAT32. None of these drives worked. During boot, groups of LEDs on front of the scope would flash in sequence and after a short while the scope would restart and try again. Removing the USB drive, the scope would boot as normal.
I am not sure if I patched the infiniiVisionCore.dll correctly as it is different to v2.35. I have uploaded the .dll here. (http://wikisend.com/download/130184/infinii236.zip) I hope a more knowledgeable person could look at it and provide some comments. If more files are needed, just let me know. @plesa @abyrvalg hoping you guys might be able to take a look.
Reading back through the thread, people have had success with:
"a podunk 4G USB stick I got from Digikey"
SanDisk Extreme USB 3.0 16GB
Kingston 4GB microSD with adaptor
DaneElec 2GB SD with cheapo USB card reader
Integral 8GB
Hoping I will not have to downgrade --- I will keep trying with other USB drives...
Sparky
plesa, do you know where is the problem exactly? USB startup override itself doesn't work anymore? Or some problems with patching?
I didn't read all 28 of the pages on this thread but it seems that no one mentioned the fact that agilent has a promo on the X series that is buy one option and all other options are free. You can also jump one bandwidth up from your current purchased bandwidth. Looks like the promo ends march 31, perhaps longer too with new s scopes.
Sparky, let's partition the problem a bit: try booting from USB w/o any patches first (original dll, no added params in .lnk) - the scope should start normally (but slower) using files on USB.
Read the whole thread. 2.36 is not possible to patch the same way. To hack the scope you need to downgrade the firmware to 2.35 as few members does.
Thanks Sparky for sharing the new dll version.
I copied the dll to my usb stick and i was able to start it but the dll hack at the right position is not working.
Also i didn't see any changes i the near of the Unfinalized Software output.
I will spend some more time today in the evening.
plesa, do you know where is the problem exactly? USB startup override itself doesn't work anymore? Or some problems with patching?Currently I do not have the 2.36 but we have discussion and there is blocked USB booting capability. Thats why it can be really dangerous to try to patch it.
If someone has the dll extracted you can send it to me for investigation.
I didn't read all 28 of the pages on this thread but it seems that no one mentioned the fact that agilent has a promo on the X series that is buy one option and all other options are free. You can also jump one bandwidth up from your current purchased bandwidth. Looks like the promo ends march 31, perhaps longer too with new s scopes.Yea its been mentioned a couple times in multiple threads, the only issue is many of us have already spent close to or more than the amount Agilent now gives all the options for. Unless there is going to be some plan for crediting those that have already bought hundreds in upgrades this upgrade "deal" just feels like spit in your face.
I didn't read all 28 of the pages on this thread but it seems that no one mentioned the fact that agilent has a promo on the X series that is buy one option and all other options are free. You can also jump one bandwidth up from your current purchased bandwidth. Looks like the promo ends march 31, perhaps longer too with new s scopes.Yea its been mentioned a couple times in multiple threads, the only issue is many of us have already spent close to or more than the amount Agilent now gives all the options for. Unless there is going to be some plan for crediting those that have already bought hundreds in upgrades this upgrade "deal" just feels like spit in your face.
FWIW I still havent modded my MSOX2024. I havent needed any of the upgrades I hadnt already purchased. But seeing as how I have had my scope for less than a year and in two weeks for what I paid for 3 upgrades I could have gotten them ALL?! That stings a bit and angers many.I didn't read all 28 of the pages on this thread but it seems that no one mentioned the fact that agilent has a promo on the X series that is buy one option and all other options are free. You can also jump one bandwidth up from your current purchased bandwidth. Looks like the promo ends march 31, perhaps longer too with new s scopes.Yea its been mentioned a couple times in multiple threads, the only issue is many of us have already spent close to or more than the amount Agilent now gives all the options for. Unless there is going to be some plan for crediting those that have already bought hundreds in upgrades this upgrade "deal" just feels like spit in your face.
I get what you're saying, but not fully. The stuff you paid for still does what you paid for it to do, and it was enough of a deal that you willingly paid for those options.
I also get that you feel you're being treated unfairly because of the dramatic cost difference between what you paid per option vs. what someone will pay per option until this deal ends. Technology always gets cheaper, though maybe you didn't expect it to get SO cheap so quickly, I guess.
Either they are about to announce a new scope or line of scopes, or they're doing the rare "Can I More Money Overall If I Lower The Price And Sell More" test. This is what Steam Sales prove time & time again; that more net revenue is gained by selling at a lower price. Maybe Agilent is giving that a go.
I'd put my money on new hardware coming soon, though.
FWIW I still havent modded my MSOX2024. I havent needed any of the upgrades I hadnt already purchased. But seeing as how I have had my scope for less than a year and in two weeks for what I paid for 3 upgrades I could have gotten them ALL?! That stings a bit and angers many.I didn't read all 28 of the pages on this thread but it seems that no one mentioned the fact that agilent has a promo on the X series that is buy one option and all other options are free. You can also jump one bandwidth up from your current purchased bandwidth. Looks like the promo ends march 31, perhaps longer too with new s scopes.Yea its been mentioned a couple times in multiple threads, the only issue is many of us have already spent close to or more than the amount Agilent now gives all the options for. Unless there is going to be some plan for crediting those that have already bought hundreds in upgrades this upgrade "deal" just feels like spit in your face.
I get what you're saying, but not fully. The stuff you paid for still does what you paid for it to do, and it was enough of a deal that you willingly paid for those options.
I also get that you feel you're being treated unfairly because of the dramatic cost difference between what you paid per option vs. what someone will pay per option until this deal ends. Technology always gets cheaper, though maybe you didn't expect it to get SO cheap so quickly, I guess.
Either they are about to announce a new scope or line of scopes, or they're doing the rare "Can I More Money Overall If I Lower The Price And Sell More" test. This is what Steam Sales prove time & time again; that more net revenue is gained by selling at a lower price. Maybe Agilent is giving that a go.
I'd put my money on new hardware coming soon, though.
As far as new hardware goes, maybe. Doesnt help me at all though as now the resale value of these scope will be hurt badly as any upgrades wont be worth nearly as much seeing as how the entire suite can be bought for $500 or the thing can be modded for free. It would be interesting to see if they did come out with new scopes as arent 2000X and 3000X series only 3 years old? Seems fast to refresh two lines of oscilloscopes. But mayeb thats where all the competition has driven things.
Sparky, let's partition the problem a bit: try booting from USB w/o any patches first (original dll, no added params in .lnk) - the scope should start normally (but slower) using files on USB.
44#\usb\infiniiVision\infiniivisionLauncher.exe
Sparky, looks like your test is incorrect: if you are using 100% original .lnk then it points to internal folder (\Secure\infiniiVision), so you are starting the same process just a bit differently. You need to try .lnk with modified folder path, but no feature options (they'll cause troubles with unpatched dll):Code: [Select]44#\usb\infiniiVision\infiniivisionLauncher.exe
Did you try to kill the InfinivisionLaucher as well?
Can you post the processes running on the 2.36?
In 10 days I will have the permanent options enabled, I suppose everybody know about this promotion from Agilent. :)Just the general stuff. What was it they charge for all the options? I remember something like €500?
In 10 days I will have the permanent options enabled, I suppose everybody know about this promotion from Agilent. :)Just the general stuff. What was it they charge for all the options? I remember something like €500?
Sparky, try attrib -s -h \Windows\ProcessStartupFolder.exe, then copy, maybe some attribute prevents copiing. If attrib fails, try without -s also.
If none will work, try pulling out \Windows\cmd.exe for study - maybe there is some restriction right in the shell itself.
What did 2.36 bring for updates anyway? Is there even any reason to try and keep it?
Sparky, you have the 2.36 app extracted already, so you can try booting it from USB after downgrade just for curiosity. Please report the results if any.
Is any calibration maintained when running the hacked>?
Is it still possible to save screen images to the USB memory stick?
im wondering what are these units are calibrated for, its full hardware capability or for marketed bandwith?
I have all the licenses excluding band. It's still 100MHz instead of 200MHz. My oscilloscope was originally 100MHz. Maybe thats the problem?
This is how my file look like:
62#\usb\secure\infiniiVision\infiniivisionLauncher.exe -l MSO -l memMax -l MEMUP -l EMBD -l AUTO -l COMP -l SGM -l MASK -l EDK -l RML -l ASV -l SGMC -l BW20 -l DIS -l SCPIPS -l VID -l CABLE
Still no 200MHz band.
I just got in my email the upgrade code for all the options from Newark, when I go home after work I will upgrade my puppy X3000. It was $760 and not $800 as advertised on the Agilent website.
Thanks Agilent for giving me this opportunity.
Here again the link for the upgrade promotion:
http://www.home.agilent.com/agilent/editorial.jspx?cc=US&lc=eng&ckey=2430287&nid=-33573.970736.00&id=2430287 (http://www.home.agilent.com/agilent/editorial.jspx?cc=US&lc=eng&ckey=2430287&nid=-33573.970736.00&id=2430287)
Huh, I wonder when a chinese manufacturer will come up with these boards...
Finally found one (a DSOXLAN) on eBay for a good price. Now I just hope the one they send me is in good condition.There are still 3 left if anyone else is looking.
http://www.ebay.com/itm/291108310383 (http://www.ebay.com/itm/291108310383)
Yay!!!Shows "All options enabled" at power up.
Just got a customer return DSO-X3000 returned back from Agilent calibration date 2 Jan 2014, they upgraded it to firmware 2.36.
Downgraded to 2.35 from the Agilent website, edited the DLL and created a USB drive and now it's all options enabled!!
Got the 'WARNING: Unfinalised software' message but otherwise perfect!!
Very happy bunny indeed :)
Anybody now want a Rigol 2072 all options enabled brand new in box never used??!!
Helpful link...
https://dl.dropboxusercontent.com/u/2063383/DSOX3000%20hack.zip
QuoteHuh, I wonder when a chinese manufacturer will come up with these boards...QuoteFinally found one (a DSOXLAN) on eBay for a good price. Now I just hope the one they send me is in good condition.There are still 3 left if anyone else is looking.
http://www.ebay.com/itm/291108310383 (http://www.ebay.com/itm/291108310383)
I recently purchased a couple of 'real' DSOXLAN from a Chinese seller for less than half retail including free shipping. Seller had 8 of them that I had reported on in the 'Buy/Sell/Wanted' area, but all are gone now. I just got them in today and happily all has tested well with both of them. The $200 US is not too bad of a price for a 'factory' module, and you get the VGA as a bonus, something that would be very difficult to hack. Hopefully the seller will find a few more modules to sell.
I was the one that bought the last of his stock, was a bit surprising how banged up the module is on the sides. Guess these things were passed around a lot in the lab they came from.
Parse error in script
Microsoft VBScript runtime error: '800a01ad'
Description: ActiveX component can't create object: 'infiniiVisionWebCom.ScopeInfo'
In file: scopeInfo.asp
On line: 4
I bought the bundle. But unfortunately I do have the 1 GHz MSO version, so I can't try what you want to know without deleting the perpetual license file for the MSO.
I did notice that you can still install the undocumented options though so I imagine that the bandwidth and mixed signal options still work. You won't need all the other command line parameters anymore.
I just got an email back from the seller stating that his web store inventory was incorrect, that he does not have them available any longer.Anyone looking for a reasonable price DSOXLAN ($200 US) can check this site out.http://www.168electronics.com/agilent-dsoxlan-2000-30000-infiniivision-x-lanvga-module-p-66.html (http://www.168electronics.com/agilent-dsoxlan-2000-30000-infiniivision-x-lanvga-module-p-66.html)(no relationship with the seller)
I purchased two already from his eBay store and they both work perfectly. They are both a little bit tattered, like they were stored in a bin together and moved about a bit, but fully functional. I have not purchased any from his web store, but notice he accepts PayPal, so the buyer protection should be there.
picked up a new dso-x 2002 from frys for $1000 today, updated firmware to 2.35, applied usb with a transcend 4GB usb formatted as FAT16, worked fine.
Muahahaha! :-DD
Agilent DSOX2000/3000 Easteregg Spaceship Screensaver (https://www.youtube.com/watch?v=A4zTj5a7cGU#ws)
Here is it the Enterprise Screensaver.
I did take a look in the dsox4000 dll and there are a lot more debug information and resources.
I opened the 4000 infiniivision with a resource hacker and I was able to extract bitmaps and Winform dialogs.
After disassembling the dll I searched for the text TREK and found the reference to this in a subfunction with other references to ...Screensaver...
So i tried it on my scope and bingo.
Regards
Kai
Today i was at the embedded world fair here in Nürnberg/Germany and i could try the Screensaver Easteregg with the text TREK which will work as seen in my video.
After I started the Preview it will show some credits.
It was a little bit sad that i didn't have a possibility to make a video of this.
It would be nice if someone which have a DSOX4000 available take a video of this easteregg.
I rarely look at parallel busses or that many digital signals at once.
picked up a new dso-x 2002 from frys for $1000 today, updated firmware to 2.35, applied usb with a transcend 4GB usb formatted as FAT16, worked fine.
neato
I am considering making a LAN board from my DSOX2x.
Where are you located?
How much do you think it could cost at the end? possible with the shipment (to brazil). If I could afford it I'm interested (I've just bought too much gears, so I'm little in trouble about money next 2 months... :) ).
This magjack was from the board posted earlier in this forum
At a rough guess, the PCB would be about £3-4, the magjack about £8, (nearly double those for $US) plus shipping.Please put me on your list...
But first, could someone with a pukka one confirm that it is 1.6mm PCB, or are we talking thinner stuff?
Yes, the PCB must 1.6 mm thick
Module is working with some restrictions described in my previous post, only LEDs no lit
Module is working with some restrictions described in my previous post, only LEDs no lit
I just tried out the LAN functions today and noticed some weird errors with the hacked USB method. If I boot from the hacked drive I get hit with errors like these on web page access:QuoteParse error in script
Microsoft VBScript runtime error: '800a01ad'
Description: ActiveX component can't create object: 'infiniiVisionWebCom.ScopeInfo'
In file: scopeInfo.asp
On line: 4
Other network functions are fine like telnet, VNC, java and HTML5 based (http://xxx/rfp.html (http://xxx/rfp.html)) remote panels. So it looks like only dynamically generated pages are bad.
If there is any spare board, I would like one, with the magjack, if possible. These kind of things are hard to come by in Brazil.
It wouldn't boot most of the time (screen stayed dark, LEDs cycled), so I got it repaired on warranty.So they did not tell you the exact reason? How old was that scope?
Just received my msox2024a via agilent's ebay certiprime store. Fantastic scope and of course even more fantastic with the license stuff from this thread (thanks much to the major contributors!).
Now, I'm look at the dsoxlan diy projects and I am going to run some protoboards soon, so figure I may as well roll my own lan adapter board.
My #1 question though is the center tap voltage requirement on the phy side. Looking at pictures/video of the real dsoxlan board I can see what appears to be a 11 ohm resistor (marked 110 on the video) and capacitor joined together to the 2 joined center taps of the amp magjack. This would imply the other end of the cap (likely a 0.01uf) is going to ground and the other end of the 11 ohm resistor is going to VCC (3.3V or ??).
The georgd board appears to have the center taps of his magjack going through a 1uf cap and then to GND on the edge connector?
So, if someone has a real dsoxlan board, what is the other end of the 11 ohm resistor connected to? GND (seems unlikely) or one of the edge pins or one of the regulators on the board?
cheers,
george.
Sort of surprising considering how many very intelligent people buy and use this kind of tool.I just assumed most of the people/companies who could readily afford that type of tool don't really need to be hacking options.
Yes, the vast majority have no need nor desire to hack their scope, nor would most even think to look for one. Agilent know that and rely on that. If a hack did eventually happen, I doubt they would bat much of an eyelid.
Does anybody know what a "(d)" following the license names means?
I got my scope back from repairs and most licenses were marked like that, see attached screenshot.
Well, what exactly happens when you turn on your scope?
Did you try this?
1) Save the *.cab file on the USB flash disc.
2) Insert the USB flash disc into scope's USB port.
3) Turn on the scope.
4) The scope might boot up from the USB flash disc.
Please note that I do not know if this works. You are doing everything at your own risk!
Unless numbers work in a completely different way in Germany; you have a higher firmware version than what is available on their site for us to upgrade to.
It will take a while for the boards to come through, but once I have them and have figured out the actual costs...
Item | Cost | |
Bare PCB to UK address | £2.50 | |
Built PCB to UK address | £9.60 | |
Bare PCB to US address | £4 | |
Built PCB to US address | £13.50 |
Anybody??
For the LED, If this
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg445541/#msg445541 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg445541/#msg445541)
was not helpful, surely I will. Datasheet?
< snip >
...This halves the boot time (compared to the USB drive) but more importantly allows the webpage access to work. As someone else in this thread found, if you boot from a USB drive the webpage stuff doesn't work and reports an error.
cheers,
george.
Here's the 'patch' to make the dsox recognise the lan card:
surprised nobody is already came up with a sketchup .stl file
No LAN/VGA errors/warning when I boot my scope up. The only 'warning' is the license hack. I have installed the license hack into my scope - rather than booting from a USB flash drive (not sure if that makes any difference). Try booting yours without the USB flash drive (if that's how you are booting)... just as a test.I thought when you installed the hack directly to the scope it didnt give the warning and booted as normal?
cheers,
george.
weird.. double checked my soldering and measured all the values. All values OK and no shorts. Reseated the board, but still the 'concern' remains.. hmmm..
Pulling out the multimeter, I do measure some strange values at the magjack.. when looking at the card from the bottom, with the magjack to the left, I measure the following on the row of 6 pins :
highest pin (closest to capacitor, let's call it pin 1) to pin 2 = 0.4 ohms.
pin 1 to pin 3 also 0.4 ohms!
pin 1 to pin 4 also 0.4 ohms!
pin 1 to pin 5 also 0.4 ohms,
pin 1 to pin 6 0.1 ohms.
but i didnt make any shorts on the bottom side while soldering..maybe the casing of the magjack is shorting the traces together on the upper side of the board? There's no solder mask here..No.. between pins and magjack = OL.
No LAN/VGA errors/warning when I boot my scope up. The only 'warning' is the license hack. I have installed the license hack into my scope - rather than booting from a USB flash drive (not sure if that makes any difference). Try booting yours without the USB flash drive (if that's how you are booting)... just as a test.I thought when you installed the hack directly to the scope it didnt give the warning and booted as normal?
cheers,
george.
pins 1 and 6 are shorted on the PCB, so the 0R1 is expected there. 1 and 6 are also the center tap of the two channel magnetics, so you will see some connection between all pins when it's mounted on the PCB. But 0R4 is rather low.
The datasheet for the magjack is here:
http://www.farnell.com/datasheets/71713.pdf (http://www.farnell.com/datasheets/71713.pdf)
Another dunkemhigh LAN board soldered up and installed... but during boot it does give an error 'System concers detected -LAN/VGA option module fault'.
Maybe I should send mine to dunkemhigh to compare in his scope?
OK, I'll send it to you :-)
The 3.3V comes from the edge connect. Go back a few pages in this thread and you'll find the pinout that Zucca posted and voltages he measured...
I'm pretty sure (could be wrong...) that the dunkemhigh board has the center tap pins tied together and ONLY to a cap that is grounded on the other end - i.e. there is no DC bias being injected into the center tap.
Oh wow, so theres a 2.37 now? When did that come out? Last I had heard of was 2.36....
Welcome to Agilent MSOX3054A InfiniiVision - MY5113XXXX
>>*idn?
AGILENT TECHNOLOGIES,MSO-X 3054A,MY5113XXXX,02.37.2014052001
3) downgrade from 2.37 to 2.35: FAILED!
Quote3) downgrade from 2.37 to 2.35: FAILED!
Erk! That's a bit of a one-way trip. We should all be grateful you've tested that, at the expense of not being able to muck about with your kit now :(
were any or all the upgraded options kept, as they would be in a scope with original Agilent licenses?
I’m curious… Has anyone loaded the hacked 2.35 firmware internally to their scope (not just booted from USB), then updated to the 2.37 firmware. If so, were any or all the upgraded options kept, as they would be in a scope with original Agilent licenses?
Because the hack isn't really "installing" licenses, it's modifying the actual oscilloscope software to make it think certain licenses are enabled, the firmware upgrade will replace that oscilloscope software with a non-modified version, so the scope will no longer think the licenses are enabled...
How to hack the firmware
1. Unpack the firmware *.cab by 7zip
2. Unpack infiniiVisionSetup.cab ( e.g. with WinCE CAB Manager 3.0)
Find \Secure\infiniiVision\infiniiVisionCore.dll
3. Change at location 0x277e50 in infiniiVisionCore.dll
byte sequence 04 00 a0 e1 to byte sequence 00 00 a0 e3
4. Enable startup Overide by creating USB flash with following structure in root of USB drive (copy structure from Secure folder from point 2)
Edit in Startup folder file infiniivision.lnk to contains following sequence "62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"
Replace in infiniiVision folder infiniiVisionCore.dll with patched infiniiVisionCore.dll file
5. Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
6. Plug the USB drive to scope and turn it ON
7. There will be red message in letf top corner "Unfinalized Software" and "System Concerns detected: OS version is not correct. Please reload system firmware"
Applications needed:
WinCE CAB Manager http://www.ocpsoftware.com/products.php (http://www.ocpsoftware.com/products.php)
7Zip http://www.7-zip.org/ (http://www.7-zip.org/)
How to hack the firmware
1. Unpack the firmware *.cab by 7zip
2. Unpack infiniiVisionSetup.cab ( e.g. with WinCE CAB Manager 3.0)
Find \Secure\infiniiVision\infiniiVisionCore.dll
3. Change at location 0x277e50 in infiniiVisionCore.dll
byte sequence 04 00 a0 e1 to byte sequence 00 00 a0 e3
4. Enable startup Overide by creating USB flash with following structure in root of USB drive (copy structure from Secure folder from point 2)
Edit in Startup folder file infiniivision.lnk to contains following sequence "62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"
Replace in infiniiVision folder infiniiVisionCore.dll with patched infiniiVisionCore.dll file
5. Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
6. Plug the USB drive to scope and turn it ON
7. There will be red message in letf top corner "Unfinalized Software" and "System Concerns detected: OS version is not correct. Please reload system firmware"
Applications needed:
WinCE CAB Manager http://www.ocpsoftware.com/products.php (http://www.ocpsoftware.com/products.php)
7Zip http://www.7-zip.org/ (http://www.7-zip.org/)
These steps can be used in the 2.37 firmware?
These steps can be used in the 2.37 firmware?
How to hack the firmware
1. Unpack the firmware *.cab by 7zip
2. Unpack infiniiVisionSetup.cab ( e.g. with WinCE CAB Manager 3.0)
Find \Secure\infiniiVision\infiniiVisionCore.dll
3. Change at location 0x277e50 in infiniiVisionCore.dll
byte sequence 04 00 a0 e1 to byte sequence 00 00 a0 e3
4. Enable startup Overide by creating USB flash with following structure in root of USB drive (copy structure from Secure folder from point 2)
Edit in Startup folder file infiniivision.lnk to contains following sequence "62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"
Replace in infiniiVision folder infiniiVisionCore.dll with patched infiniiVisionCore.dll file
5. Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
6. Plug the USB drive to scope and turn it ON
7. There will be red message in letf top corner "Unfinalized Software" and "System Concerns detected: OS version is not correct. Please reload system firmware"
Applications needed:
WinCE CAB Manager http://www.ocpsoftware.com/products.php (http://www.ocpsoftware.com/products.php)
7Zip http://www.7-zip.org/ (http://www.7-zip.org/)
These steps can be used in the 2.37 firmware?
No.
These steps can be used in the 2.37 firmware?
No. The structure and length of the new firmware cab is different.
My firmware is 2.37 I can drop to 2.35 firmware?
After getting a request from someone here what I did:
1) Upgrade from 2.35 to 2.37: OK!
2) Test SCPI on port 5024 with FW 2.37 (require LAN Module): OK!
3) downgrade from 2.37 to 2.35: FAILED!
A quick analysis of 2.37 shows that Startup Override functionality is disabled in ProcessStartupFolder.exe: it still looks for infiniivisionStartupOverride.txt file, but instead of executing lnk/exe files it runs "ipconfig.exe /all > ipconfig.txt" (what is it? a "tampered" mark?), then "rebootInfiniiVision.exe", which surprisingly results in reboot >:D 2.36 has the same problem I guess.:wtf: Nice find!
We should focus on downgrade I think.
My firmware is 2.37 I can drop to 2.35 firmware?
You should go back and read the last couple of pages...After getting a request from someone here what I did:
1) Upgrade from 2.35 to 2.37: OK!
2) Test SCPI on port 5024 with FW 2.37 (require LAN Module): OK!
3) downgrade from 2.37 to 2.35: FAILED!
So i did some tests with the "Unfinalized Software" Hack on the 2.37 Firmware.
On my Scope is currently the version 2.35 with the most options enabled by DSOAPP Bundle except the MSO Function.
I extracted the cab file of the 2.37 with this tool MSCEInf - CAB Analyzer (No Setup needed and free)
And searched for the same code location and it has moved to 0x27A9A0, changed the 4 byte to 00 00 A0 E3 and put the whole Infiniivision folder to the usb stick.
The Scope boots the 2.37 and the additional features are enabled. (see Screenshots)A quick analysis of 2.37 shows that Startup Override functionality is disabled in ProcessStartupFolder.exe: it still looks for infiniivisionStartupOverride.txt file, but instead of executing lnk/exe files it runs "ipconfig.exe /all > ipconfig.txt" (what is it? a "tampered" mark?), then "rebootInfiniiVision.exe", which surprisingly results in reboot >:D 2.36 has the same problem I guess.:wtf: Nice find!
We should focus on downgrade I think.
Maybe it's posible the change the exe with an older one that supports usb booting
Thank you for your reply, post too long, not scrutiny. Sorry.
So i did some tests with the "Unfinalized Software" Hack on the 2.37 Firmware.
...
The Scope boots the 2.37 and the additional features are enabled. (see Screenshots)
A quick analysis of 2.37 shows that Startup Override functionality is disabled in ProcessStartupFolder.exe: it still looks for infiniivisionStartupOverride.txt file, but instead of executing lnk/exe files it runs "ipconfig.exe /all > ipconfig.txt" (what is it? a "tampered" mark?), then "rebootInfiniiVision.exe", which surprisingly results in reboot >:D 2.36 has the same problem I guess.
We should focus on downgrade I think.
Hello guys!
I seemed to have a FW problem with the oscilloscope and had to upgrade the firmware unfortunately before I found this forum...
Now I have 2.37 fw revision.
I tried to downgrade by tricking the process into thinking the 2.35 files are 2.37 indeed by changing strings in INFINI~1.028
I have recalculated the MD5 for the infiniVIsionSetup.cab too to set it in the recipe.xml
I unpacked the .cab files with 7zip and packed them back with CABPACK.
It did not work, I get error message about the file loading unsuccessful.
I am not sure though if it was a wrong packing method I used, or something else.
Did anybody approach the downgrade process from this angle?
So i did some tests with the "Unfinalized Software" Hack on the 2.37 Firmware.
On my Scope is currently the version 2.35 with the most options enabled by DSOAPP Bundle except the MSO Function.
I extracted the cab file of the 2.37 with this tool MSCEInf - CAB Analyzer (No Setup needed and free)
And searched for the same code location and it has moved to 0x27A9A0, changed the 4 byte to 00 00 A0 E3 and put the whole Infiniivision folder to the usb stick.
The Scope boots the 2.37 and the additional features are enabled...
Tools to extract the firmware/kernel.
Weird, I haven't got it work yet, wonder why dunkemhigh's board is working. Maybe I should send mine to dunkemhigh to compare in his scope?
I don't have any problems with Telnet login.
But here the first login fail and the second login is working with putty.
Well, that explains why I couldnt find any error.. still, not being the only one with the error there must be something we're overlooking? :-//Weird, I haven't got it work yet, wonder why dunkemhigh's board is working. Maybe I should send mine to dunkemhigh to compare in his scope?
The board is here and in my scope. It works exactly the same as my board does - that is, there is no discernable problem. I don't get any warning on boot, and I can do the full remote control stuff without error.
This kind of suggests that mys scope is somehow different from everyone elses. I guess I could flog it with a $200 markup like that chap flogging E4's :)
The Webinterface works fine now.
... I ... wonder why dunkemhigh's board is working. Maybe I should send mine to dunkemhigh to compare...
The board is here and in my scope. It works exactly the same as my board does - that is, there is no discernable problem. I don't get any warning on boot, and I can do the full remote control stuff without error.
This kind of suggests that my scope is somehow different from everyone else...
Well, that explains why I couldnt find any error.. still, not being the only one with the error there must be something we're overlooking? :-//
When I'm home, I'll write down the serial of my scope, maybe by comparing we can figure out if it's a hardware thing? Too bad I dont know anybody with an original module to try and see if that works or not..
I believe dunkemhigh has a 2000X
QuoteI believe dunkemhigh has a 2000X
Yes, it is a DSO-X 2004A. Maybe that A is significant.
I've mentioned this before...
Hi
I am new in the forum. I designed a LAN board for my DSOX2004 using the gerber files posted in this theme. The LAN connector is different and i made some changes on the board. My problem is the same like with most of the people here - center tap of the isolation transformers. I tried everything, but i can't find where exactly is the 3.3V pin on the edge connector. I saw the pictures here with description of the pins but it didn't work for me. Anyway the PCB is working, but during boot procedure a get a message - "System concerned .... LAN Failure" or something like that.
If somebody knows which pin exactly is 3.3V i will appreciate it :)
(Sorry for the bad english)
First of all - thanks for the answers. The communication with the scope is OK. I tried few things from my browser and it works fine. Only the starting process of the scope is slower than normaly (maybe with 20-30sec). This i think is because of the tests that the system makes during boot for the LAN card. If LAN card is not responding properly the test is made few more times. Again - its not a big problem, but the boot of the scope is relatively slow and now is even slower.
When i try to connect the center taps together and connect them to 1,2 pin (shown on ZUCCA's pictures) i get the same error. I will try few more things and if i clear the error the PCB files will be changed and i will update my version of the project (altium files). By the way the connector that i use is:
http://www.tme.eu/bg/details/rj45-trafo-lt/syediniteli-rj/amphenol/lmj2018814100dl2t1b/ (http://www.tme.eu/bg/details/rj45-trafo-lt/syediniteli-rj/amphenol/lmj2018814100dl2t1b/)
Just for the record, my scope is an (unhacked) mso-x 2024a, so it's not a case of the 3000 being more fussy.
Just an idea: maybe it depends on sw version?
There is an FPGA in VGA part of original board, so it can be configured and then checked (or not checked, depending on sw inside the scope).
3. If you get to the point that you can boot from USB, it seems that the USB stick needs to stay in the scope. Is there a second USB port or does that mean you can't save stuff to the USB drive?
3. If you get to the point that you can boot from USB, it seems that the USB stick needs to stay in the scope. Is there a second USB port or does that mean you can't save stuff to the USB drive?
Thanks,
Is any calibration maintained when running the hacked>?
Is it still possible to save screen images to the USB memory stick?
Yes calibration is maintained, and
you can save/recall data to/from USB stick.
Georg
If you go the Keysight website to get the bundle, you have to pick a distributor to get a quote from. Then you get to call the distributor, and they will ship "stock" from their warehouse. Once you get whatever they ship in the mail, then presumably you use that to go to their website, put in a S/N,, and get back a license key.
How interesting, I just noticed that Keysight extended their bundle offer for the option pack until 12-6-2014.
And yes, if you ask your distributor for an additional discount, you probably get it.
At least in Germany they offered it.
All you need from the certificate that the distributor sends you is your "Agilent order Number" and "Agilent Certificate Number" and most distributors can give you that over the phone or email it to you after payment is made. Make sure that you ask first.
Do you have a LAN Module available?
Because you need to Replace first some Files to downgrade the Firmware.
Without these Steps it is not possible to change the ProcessStartupFolder.exe in the Windows directory
BR
Kai
Do you have a LAN Module available?
Because you need to Replace first some Files to downgrade the Firmware.
Without these Steps it is not possible to change the ProcessStartupFolder.exe in the Windows directory
BR
Kai
Ahhh.. reading back over the previous few pages again (and again, and again) it looks like the scope must be 2.35 in flash to be able to boot 2.37 from the USB stick.
I mistakenly thought your mod allowed me to boot a modified 2.37 from USB when the scope had 2.37 in flash.
I guess I need to get a LAN module and do some more reading then...
So I did the update to 2.37 and tried how to downgrad to V2.35.
The first step was a modified cab based on V2.35 and Infiniivision.cab from 2.37 to change the Windows folder with the ProcessStartupFolder.exe
The 2.37 Firmware has loaded the Firmware Update successfully but it takes a couple of minutes before the scope reboots.
This is the simples way to restore the \windows folder to an older version because ist write protected.
The next Step was to rename the 2.37 to 2.35 in the infiniiVisionLauncher and infiniiVisionCore and replaced these files directly over telnet from usb to the \sercure folder.
after a reboot i tried to load a V2.35 Firmware but this didn't works maybe the timestamp was also checked. :(
After I replaced the newest files in the \secure\infiniivision folder direcly with the 2.35 Files I was able to load the old v2.35 setup.
So its posible to go back to the V2.35 with the help of telnet access.
Many, many thanks sir. I owe you something nice from under my desk!!
How interesting, I just noticed that Keysight extended their bundle offer for the option pack until 12-6-2014.
And yes, if you ask your distributor for an additional discount, you probably get it.
At least in Germany they offered it.
Wooo well done Mr Kilobyte!!
...
Reboot and get firmware concerns message, scope still thinks it has 2.37, no problem.
Put Agilent 2.35 upgrade CAB onto USB stick and up(down)grade as normal. Lots of waiting, scope then reboots with 2.35 up and running.
Then reboot with USB stick with modified 2.37 files to get all options including MSO and full bandwidth.
Many, many thanks sir. I owe you something nice from under my desk!!
This process worked for me too, my scope that was shipped with 2.37 is now running 2.35. Now I just have to get to work and build the USB stick. Not sure why I am doing this as I bought the app bundle, still I can go from 350MHz to 500MHz. I think it just must be the curiosity...
I am really close of purchasing a new DSOX2004A (without any options) in the next couple of days.
However I am not sure about the following. Can please somebody confirm:Thanks!
- Is it still hackable? By reading this thread I think so - I just need to add a LAN board. Am I correct?
- The DSOX2004A (default is 70 Mhz) can be 'enhanced' to 200 Mhz?
- Any idea where to get the logic probes then (item # N6459-60001, I did not find a price for it). Are there any other (maybe older) logic probes from Agilent usable?
Yes I hacked a 2.37 scope using just a LAN card and telnet. Logic pods are easily bought on ebay for $200 or so. If anybody wants to borrow the LAN card for a day you can, just pay shipping both ways.
any body try with dsox2000 ver 2.38?
thanks
I can Start the Modified V2.38 (another Address must be used) from USB with V2.35 on the Scope.
I modified the keysight logo to a more known brand >:DThis is very impressive!
I wrote a little tool to extract the Bitmap data and the location from the dll, not finished yet but it works with 4byte aligned Bitmap data.
Wooo well done Mr Kilobyte!!
From the Agilent 2.35 upgrade CAB I extracted the files you said:
infiniiVisionLauncher.exe
infiniiVisionCore.dll
Put them on a USB stick, booted the 2.37 scope and got telnet access (infiniivision, skywalker1977)
Killed the running version (a step you didn't mention, probably because it was obvious to you!):
processmgr kill infiniiVisionLauncher.exe
Change to application directory
cd \secure\infiniivision
Copy those two old files:
copy \usb\infiniiVisionLauncher.exe
copy \usb\infiniiVisionCore.dll
Reboot and get firmware concerns message, scope still thinks it has 2.37, no problem.
Put Agilent 2.35 upgrade CAB onto USB stick and up(down)grade as normal. Lots of waiting, scope then reboots with 2.35 up and running.
Then reboot with USB stick with modified 2.37 files to get all options including MSO and full bandwidth.
Can you send me the 2.15 cab file ?my email address is dian.zi.mi@163.com
It is always said that Agilent/Keysight will swap boards if you want to upgrade from 100/200 to 350/500 Mhz. I am wondering if there is really a significant difference or if they just inject some software instead of swapping boards.
wait a few days and that could be changing... ;)
I'm curious too.
Maybe it has something to do with the two scopes that i can see on the dropcam livestream?
The looks very very similar. :)
I'll let it be a surprise.
wait a few days and that could be changing... ;)
Oh I hate it when you do this.
Mmmmh; Dave says "the 300/500MHz was a different front end." I am wondering what that means, especially to my already existing 200 Mhz version...
woah, a proper full bandwidth 1mV front end. What took them so long :PNo, it's still magnified : "2. Specifications are valid after a 30-minute warm-up period and ± 10 °C from firmware calibration temperature. 1 mV/div and 2 mV/div are a magnification of 4 mV/div setting. For vertical accuracy calculations, use full scale of 32 mV for 1 mV div and 2 mV/div sensitivity setting."
Hi!
Does anybody know where can I find the 2.35 firmware? The keystone website only lets you download the latest one (2.38)
Thanks!
Last year I was lucky enough to pick up a demo version of a 3034a. All the options where there when I got the unit and are listed with an astrix (*). I haven't updated the firmware yet, due to the fear of loosing my beloved/free options. Anyone know if an update will remove them?
The astrix (*) means that the options are either in DEMO MODE or the scope is a STORE DEMO, and thus in demo mode. There has been posts indicating that the store demo units have a runtime of 120 days, but I cannot say for sure. In either case, updating the firmware should not remove the demo, but again, I cannot say for sure...
Last year I was lucky enough to pick up a demo version of a 3034a. All the options where there when I got the unit and are listed with an astrix (*). I haven't updated the firmware yet, due to the fear of loosing my beloved/free options. Anyone know if an update will remove them?
The astrix (*) means that the options are either in DEMO MODE or the scope is a STORE DEMO, and thus in demo mode. There has been posts indicating that the store demo units have a runtime of 120 days, but I cannot say for sure. In either case, updating the firmware should not remove the demo, but again, I cannot say for sure...
The astrix (*) means that the options are either in DEMO MODE or the scope is a STORE DEMO, and thus in demo mode. There has been posts indicating that the store demo units have a runtime of 120 days, but I cannot say for sure. In either case, updating the firmware should not remove the demo, but again, I cannot say for sure...
Not necessarily. It could be in distributor mode. If the first item in the list is "All", it's a good bet. My scope has been this way for well over a year. The really cool part is if they put new features in future firmware that require licenses, a distributor scope will automatically turn them on when you upgrade the firmware.
(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=130718)
If I read you correctly, you have performed an update and still kept the options. In your opinion, the case would be the same for me?
If I read you correctly, you have performed an update and still kept the options. In your opinion, the case would be the same for me?You got a nice catch then with ALL functions enabled. Upgrading firmware should not disable any legitimate features, demo, distributor, or purchased. I see from the screenshot that your firmware is quite old. You'll have a great incentive to upgrade to the latest firmware, with many new capabilities, improved measurements, and bug fixes... Great Score!
Im happy to report the update went as expected.Excellent! :-+
Thank you for the confidence boost.
(http://i.imgur.com/DqepazH.png) (http://i.imgur.com/DqepazH.png)
Does anyone want to change the firmware new scope DSOX/MSOX 3000T ?Maybe if you like to buy me one of these... ;D
For the data that have to be modified see here
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg569677/#msg569677 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg569677/#msg569677)
From the Agilent 2.35 upgrade CAB I extracted the files you said:
infiniiVisionLauncher.exe
infiniiVisionCore.dll
Put them on a USB stick, booted the 2.37 scope and got telnet access (infiniivision, skywalker1977)I understood.
Killed the running version (a step you didn't mention, probably because it was obvious to you!):
processmgr kill infiniiVisionLauncher.exe
Change to application directory
cd \secure\infiniivision
Copy those two old files:
copy \usb\infiniiVisionLauncher.exe
copy \usb\infiniiVisionCore.dll
Reboot and get firmware concerns message, scope still thinks it has 2.37, no problem.
Put Agilent 2.35 upgrade CAB onto USB stick and up(down)grade as normal. Lots of waiting, scope then reboots with 2.35 up and running.
Then reboot with USB stick with modified 2.37 files to get all options including MSO and full bandwidth.
I still have many questions. :scared:
Where you find the version 2.35? (it is not available on the official website)
21#\usb\img.cmd
in the Startup\infiniiVision.lnk file of the usb key.\Windows\compileImageForSplashScreen.exe \usb\img.png \Secure\infiniiVision\splashImage.bin
But nothing append... Any clue ? Thanks !I modified the keysight logo to a more known brand >:D
A real HP/Agilent/Keysight product now ;)
I wrote a little tool to extract the Bitmap data and the location from the dll, not finished yet but it works with 4byte aligned Bitmap data.
I still have many questions. :scared:
Where you find the version 2.35? (it is not available on the official website)
3000 series 2.35 CAB here:
https://dl.dropboxusercontent.com/u/2063383/3000XSeries.02.35.2013061800.cab
Use this CAB file as a source of the two files that will replace the ones on your scope. Then use it to downgrade your scope to 2.35
No need to edit or modify the contents of any of the files yet. That will come later when you have downgraded to 2.35.
First i will update the scope to 2.35 firmware and then i will continue all the process that you wrote, right?YES
Does anyone want to change the firmware new scope DSOX/MSOX 3000T ?
I modified the keysight logo to a more known brand >:D
A real HP/Agilent/Keysight product now ;)
I wrote a little tool to extract the Bitmap data and the location from the dll, not finished yet but it works with 4byte aligned Bitmap data.
I upgraded to firmware 2.38, but the Keysight brand too ugly, want to switch back to Agilent, such as the picture red circle place. I would like to ask how to operate?
Does anyone want to change the firmware new scope DSOX/MSOX 3000T ?
The 3000T looks to be not hackable.
The nk.bin.comp is encrypted (Verisign DIGITAL ID) and it looks like the infiniivisioncore.dll is integrated in the nk.bin.comp file.I modified the keysight logo to a more known brand >:D
A real HP/Agilent/Keysight product now ;)
I wrote a little tool to extract the Bitmap data and the location from the dll, not finished yet but it works with 4byte aligned Bitmap data.
I upgraded to firmware 2.38, but the Keysight brand too ugly, want to switch back to Agilent, such as the picture red circle place. I would like to ask how to operate?
It's a bit complicated but i will create a short guide and some necessary file how to change the logo.
The 3000T looks to be not hackable.
The nk.bin.comp is encrypted (Verisign DIGITAL ID) and it looks like the infiniivisioncore.dll is integrated in the nk.bin.comp file.
If the 30 day period would mean 30x24 = 720 scope working hours, this would be fine for many peoples.
I did not check the PCB pictures (andy maybe something similar was mentioned in the 49 pages above), but somewhere there probably will be a real time clock running. What if this clock is being stopped? Or running very sloooooooooow by changing its crystal?
Then at least the off-time of the scope would not count, which could be sufficent in many cases.
I managed to get this hack to work with 200mhz bandwidth on my scope but has any one ever figured out how to load the hack to the internal flash?
I managed to get this hack to work with 200mhz bandwidth on my scope but has any one ever figured out how to load the hack to the internal flash?
I run it in the internal flash. The procedure *IS* documented way back in this loooong thread.... You'll need to look for it just like I did. Speeds up the boot time versus from a flash drive.
cheers,
george.
I'll try to summarize, but only from the point where you have a device with regular 2.35 firmware. If you have a newest version, you have to search this topic (access to scope file system with lan, and fake the firmware version to allow downgrade, then the scope will be able to boot on usb key).
What you need :
* the python script attached to this post (I am *NOT* the author of this useful script. Linux users : replace \ by /...)
* the 2.39 firmware from Agilent
Steps :
* extract Agilent .cab firmware with you favorite program
* extract infiniiVision.cab file : you have now an infiniiVision folder
* chdir to infiniivision folder, copy dosetup.py to this folder
* python dosetup.py (linux users should chande \ by / in _setup.xml file !!!)
* then chdir to Secure/infiniiVision
* open infiniiVisionCore.dll with hex editor, and at @0x27B0F4, change 04 00 a0 e1 by 00 00 a0 e3, then save (could be a good idea to make a backup before...)
* copy all the infiniiVision and Startup directories to an USB key
* add the infiniivisionStartupOverride.txt (attached to this post) at the root dir of your usb key
* edit Startup/infiniivision.lnk file to your needs (add the options that you want - mine is attached, for 2000 serie).
I hope this is clear (and accurate) and will help.
I haven't been able to find the post where someone installs it to internal flash. Maybe i just don't understand what to do.
Does someone has a link to 2.35 version official firmware?
For DSO-X 2002A
Dear all,
The hack works with 2.39 firmware, the new address in the dll is 0x27B0F4, and the values are always 00 00 A0 E3.
In the picture attached, the bandwidth did not work, because I had BW50, that I changed for BW20, which works fine now.
Edit : when I said "the hack", it means "booting on USB device on a scope with regular firmware 2.35 installed".
Dear all,
The hack works with 2.39 firmware, the new address in the dll is 0x27B0F4, and the values are always 00 00 A0 E3.
In the picture attached, the bandwidth did not work, because I had BW50, that I changed for BW20, which works fine now.
Edit : when I said "the hack", it means "booting on USB device on a scope with regular firmware 2.35 installed".
Do you need to downgrade the 2.39 ? Or will it boot direct from USB with 2.35 modified ?
David.
Which files are at root of USB stick?
Only infiniivisionstartupoverride.txt and directories "startut" and "infiniivision" ??
Please could you check this?
I've made something wrong but I don't understand what.
This is an archive of the USB Stick Root.
Thanks again
https://www.wetransfer.com/downloads/51b0840e5968daab35aeac63c9dafc6020150326133429/79eaa210a732573f595c7f0971a5d47320150326133429/1fe488 (https://www.wetransfer.com/downloads/51b0840e5968daab35aeac63c9dafc6020150326133429/79eaa210a732573f595c7f0971a5d47320150326133429/1fe488)
If somebody on this forum has an extra bare board or assembled card for the LAN module, please PM. I prefer bare board with silkscreen and soldermask.
You know sometimes when you have a PCB house making the PCBs for you they sent you more than one.
David.
This is the final schematic of my working lan card. I'm using an Digikey 1419-1021-ND for the magjack.
This is the final schematic of my working lan card. I'm using an Digikey 1419-1021-ND for the magjack.
Did you release the layout files or gerbers for this?
So its posible to go back to the V2.35 with the help of telnet access.
Has anyone used the FPGA programming port on the unit? My unit's flash is completely erased (was corrupted). When I turn the unit on, nothing at all happens.How did you manage to do this? What FPGA programming port do you mean? Are you sure the u-boot bootloader is corrupted, too? If not, you could enter commands with the serial port (see this post (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg260895/#msg260895) for the pins) and flash it again over network. Otherwise you really need to find and use some JTAG port.
Has anyone used the FPGA programming port on the unit? My unit's flash is completely erased (was corrupted). When I turn the unit on, nothing at all happens.How did you manage to do this? What FPGA programming port do you mean? Are you sure the u-boot bootloader is corrupted, too? If not, you could enter commands with the serial port (see this post (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg260895/#msg260895) for the pins) and flash it again over network. Otherwise you really need to find and use some JTAG port.
Does anybody have a link to download 2.37 or can I PM them for an email please :-)
Does anybody have a link to download 2.37 or can I PM them for an email please :-)
https://www.dropbox.com/s/y4y3d2xmj2gmgdb/2000XSeries.02.37.2014052002.cab?dl=0 (https://www.dropbox.com/s/y4y3d2xmj2gmgdb/2000XSeries.02.37.2014052002.cab?dl=0)
Looks like telnet password is changed too. It is generated from instrument id now (still possible to get it, but I don't have a 3000T to try anyway)
\
+-infiniiVision
+-fpga
+-upgrade
+-web
+-css
+-help
+-image
+-include
+-web-socket-js
+-lib
+-Lxi
+-Identification
+-navbar
+-Startup
infiniivisionStartupOverride.txt
Try lots and lots of different USB sticks, it's hit and miss which types work. For me it's been seriously hit and miss which sticks work with any particular scope. Never found one particular make that works with all scopes.
Sure! I think I've got it right, but I don't really have a way to verify this. It would help either eliminate one avenue, or fix the problem altogether.
I appreciate your offer, and I will look forward to the link.
QuoteSure! I think I've got it right, but I don't really have a way to verify this. It would help either eliminate one avenue, or fix the problem altogether.https://dl.dropboxusercontent.com/u/2063383/Agilent%20DSOX3000%20237%20cracked.zip
I appreciate your offer, and I will look forward to the link.
My startup is very clean and no different from the internal FW system startup.
:) ;) SUCCESS!!! ;) :)
I Have a fully functional scope booting from USB stick. I get no error messages during the boot, I just have to wait for the looping to start, and after approximately 6 or 7 loops, I get a message saying "booting from USB stick" on the second splash screen. This message is displayed in small red letters on the top left of the screen. Once the boot completes, I get an additional message in the center of the display. this one says "All options enabled" on the first line and "Press any key to continue" on the second line. The message goes away when I press a key.
The next thing I checked was the "About Oscilloscope" screen. Here I found a surprise. I have been populating the USB stick with the software I got from TopUser a few comments back. I had assumed the stuff to be derived from FW version 2.35. But Here I see the system version being 2.37. That's way cool. I may try to build a stick based on 2.39 later...
I went through some changes to my command line specification in infiniivision.lnk file. I ended up with the following command which enables the largest number of licenses:
86#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS -l CABLE -l TOM -l SGMC
Most of the enabled licenses have a '*' displayed next to them, but there is no expiration date indicated.
So here's what made the stuff work for me: I reformatted one of my USB sticks (on my Apple MacBook Pro) so the single partition present on the stick was modified from "MS-DOS (FAT)" which is FAT32 to "exFAT" which I believe is FAT16. I then loaded the files onto this stick in the order which I described in one of my earlier posts. That did the job. The USB stick I'm using is a very small one made by SanDisk, and it's a 8GB size.
That's way cool!
Thanks to all for the invaluable help.
Do these hacks work on the DSOX3000T series?No
So its posible to go back to the V2.35 with the help of telnet access.
Hi!
There is easier way to downgrade.
I have flashed 2.39 a long before I found this site. But now I have 2.35 with just PC and USB-key ;)
All has beed checked today on my MSO-X 2012 (originally it was standard 100MHz + MEMUP update with 2.39 firmware).
1. downgrade to 2.37 (it just works)
2. unpack 2000XSeries.02.37.2014052002.cab (ex with WinRAR)
3. extract file infiniiVisionLauncher.exe from infiniiVisionSetup.cab (2.37) (ex with WinCE CAB Manager)
4. unpack 2000XSeries.02.35.2013061800.cab (ex with WinRAR)
5. open infiniiVisionSetup.cab (from 2.35) file in WinCE CAB Manager, find infiniiVisionLauncher.exe on list and delete it
6. add infiniiVisionLauncher.exe (from 2.37 cab) to file list and set all properties like in old file (flags: uncheck all; location: \Secure\InfiniiVision; Hard-coded path checked)
7. file->save and exit WinCE CAB Manager
8. calc MD5 of edited infiniiVisionSetup.cab and update it in recipe.xml file
9. compress all files (ex with CabPack) from 2.35 firmware with edited infiniiVisionSetup.cab
10. flash new file
After this I reflashed scope once again with untouched 2.35 to update modified file but I don't know if it was necessary.
Also I don't know if there is possibility to downgrade directly from 2.39.
Now I have 2.35 in scope and 2.39 from USB (and I didn't need to use python script).
Starting scope from USB key:
NOT WORKS:
- Kingston DTSE9 (8GB)
- silicon power touch 830 (8GB)
- PQI connect 201 (16GB)
- all my no-name keys... (1GB..16GB)
WORKS:
- LEEF Spark 32GB
And I would like to thank everyone on this forum for files/instructions/descriptions.
Sorry guys I haven't read the full thread but I wondered if this worked on the MSOX3054A? Is the MSOX3054A a good buy (refurbished)?
Does the hack offer all that is included in dsox3appbndl?
Thanks, I'm still reading and trying to decide if this is as good a deal as it seems.
Sorry guys I haven't read the full thread but I wondered if this worked on the MSOX3054A? Is the MSOX3054A a good buy (refurbished)?
Does the hack offer all that is included in dsox3appbndl?
Thanks, I'm still reading and trying to decide if this is as good a deal as it seems.
Farnell are doing a very good deal on the MSOX3054 if you go to the trade counter, I think it's £2800+VAT. Even on the website they are 60% off list price or something crazy.
Sorry guys I haven't read the full thread but I wondered if this worked on the MSOX3054A? Is the MSOX3054A a good buy (refurbished)?
Does the hack offer all that is included in dsox3appbndl?
Thanks, I'm still reading and trying to decide if this is as good a deal as it seems.
Farnell are doing a very good deal on the MSOX3054 if you go to the trade counter, I think it's £2800+VAT. Even on the website they are 60% off list price or something crazy.
It's 3K + vat on the website, any way of getting 2800+ without actually travelling there in person?
Please, is anyone able to provide me with the 2.35 files for DSOX2000 series?
Thanks!!!!
Solved - 2000 firmware seems to be identical to the 3000 Firmware, thus Toplosers link above is fine.
LEDs aren't needed to make the card work - they are just pretty flashing lights...
Are you sure the PCB is seated well into the edge connector in the scope - it's pretty fine pitch. Contacts on the PCB clean and shiny?
My DIY lan card works just fine on my msox2024a with the latest firmware, so your card should work ok if it's all soldered well and making good contact on the main board.
I now believe the reason why it's not working is the mag jack.
Hi folks!
Can I unlock DSOX3104A with FW 2.41?
Mark.
...It might not matter much to others, but in 2.41 I'm happy they finally seem to have fixed the bug where the scope issues multiple netbios name queries back to a host connecting to the SCPI port. If there wasn't a netbios listener on the host, the scope would hang for about 8 seconds each time. Netbios has nothing to do with SCPI, or TCP connections for that matter.
I attached the release notes for v2.41. The enhancements/fixes over v2.40 are pretty minor, but 2.40 introduces some networking improvements:
+ negative duty cycle measurement
+ Ax+B operator now allows negative A
+ DVM handles channel invert more appropriately
Does anyone know if the options will expire if I set the clock forwards before starting the built-in trial? I set mine to 2115, started the trial, then set the clock back to 2015. Someone mentioned it earlier in the thread but I didn't see an answer, maybe wishful thinking... :-//
A quicker way is to do a binary compare and identify if and where the to-be-patched location has been moved to.
L:\
????Agilent Flash
? ????config
? ????wfmMem
????Secure
? ????infiniiVision
? ? ????fpga
? ? ????upgrade
? ? ????web
? ? ????css
? ? ????help
? ? ????image
? ? ????include
? ? ? ????web-socket-js
? ? ????lib
? ? ????Lxi
? ? ? ????Identification
? ? ????navbar
? ????Startup
????Temp
Is it correct ?
Wiljan, can I just confirm that over Telnet with FW 2.41 you are able to enable all licenses? You have to telnet and do the procedure each time you power up but it does work?Yes I have FW2.41 flashed in scope and a USB stick with FW2.37 modified.
Ok... got a bit futher 8)
So basic the scope do have FW2.41 installed
I hava a USB stict with the modified FW2.37
From telnet
\windows> cd \usb
\usb> cd infiniiVision
\usb\infiniiVision> processMgr.exe kill infiniivisionLauncher.exe
\usb\infiniiVision> infiniiVisionLauncher -l All
Our command line is -l All
*** Installing License: All Licenses
x3000a.vbs a-mx3054a-12345
x3000a.vbs 192.168.50.123
Ok... got a bit futher 8)
So basic the scope do have FW2.41 installed
I hava a USB stict with the modified FW2.37
From telnet
\windows> cd \usb
\usb> cd infiniiVision
\usb\infiniiVision> processMgr.exe kill infiniivisionLauncher.exe
\usb\infiniiVision> infiniiVisionLauncher -l All
Our command line is -l All
*** Installing License: All Licenses
Indeed, this morning I finally found a use for one my original RPi's that's been stuck in a drawer.
It all sits in the probe compartment and runs automatically at scope boot up.
The RPi is powered from a hub that's connected to the rear USB port. This hub also has the USB stick with the 2.37 code.
I wrote an "expect" script (attached) and added it to the rc.local so it runs on boot up.
In brief:
Install Rasbian Jessie
sudo apt-get install telnet
sudo apt-get install expect
Raspberry pi configuration in GUI (Note that you can always go back into the gui with startx from the command line)
set to cli only
wait for network
Place the attached x3000a.txt script in your /home/pi directory, and rename it to x3000a.
I recommend using a static IP address on the RPi and the scope so this will work without a DHCP server if you're off your LAN. It looks like some well meaning individual chose to change how static addresses are set up in RPi, rendering hundreds of pages on the subject obsolete. It's now in /etc/dhcpcd.conf
add to the bottom of /etc/dhcpcd.conf file
interface wlan0
static ip_address=192.168.50.123/24
static routers=192.168.50.1
static domain_name_servers=192.168.50.1
To make it work at boot, add the following to your /etc/rc.local file before the "exit 0", setting the IP address to your scope's:
/usr/bin/expect /home/pi/x3000a 192.168.50.123 &
One caveat: remove any USB stick in the front before boot, that appears as \usb with the rear one \usb2.
* extract Agilent .cab firmware with you favorite program (I used 7zip)
* extract infiniiVisionSetup.cab file : you have now an infiniiVisionSetup folder
* chdir to infiniivisionSetup folder, copy dosetup.py to this folder
* c:\Python27\python dosetup.py (linux users should chande \ by / in _setup.xml file !!!)
* then chdir to Secure/infiniiVision
* copy all the infiniiVisionand Startup directoriesdirectory to anUSB key (ie, there should be a single infiniiVision directory on the root of the USB key with a bunch of files and directories within it)
Thx Howardlong, script works here as well :) I made a small bat file with the IP address included
I have been thinking when having 2.41 on scope and loaded 2.37 from usb stick.
If it would be save to flash the 2.37 (and if that not possible since it's already loaded than take the FW2.35) first and then 2.37 ?
cd \secure\infiniivision
processmgr kill infiniivisionlauncher.exe
infiniivisionlauncher -l all
Thanks for your hard work Howard! I have one possibly stupid question, is this all possible without a DSOXLAN or home-made equivalent?
Thanks for your hard work Howard! I have one possibly stupid question, is this all possible without a DSOXLAN or home-made equivalent?
Do these hacks work on the DSOX3000T series?No
I followed the instructions HowardLong put up using the Lan connector and the VB script. Interestingly my scope is a 3024A but when I did the -l all option it downgraded me to 100Mhz. I had to change the command to "-l BW20 l-all"
This then worked. When I reboot after the script the network card needs its configuration reset to auto as all the options are lost. Within a few seconds though all is back up again.
What you created is fantastic, thank you.
Howard, did you buy the proper LAN adapter? Does the scope forget its network setting when you execute the script?
What would be the best firmware version to upgrade a DSOx2000 scope with current firmware version 1.21.2011072803? The only firmware on Keysight's page is 2.41 and that firmware does not seem to be hack-able.
I don' have a LAN card for my scope. I did some digging through this thread it looks like 2.35 is the best version. I will probably start by booting from a USB drive since its a bit safer see if it works out. I found the original 2.35 firmware in the thread I still need to find what needs to be modified to get the hack to work.
Also I saw a teardown of the agilent MSO probes, it doesn't look like there is any circuitry in them so would any header extension get MSO capability once the MSO function is unlocked?
There *IS* circuitry in the MSO probe - it's a 90k (nominal) resistor in series with the signal and INSIDE each of the flying lead (grey plastic ends) where the little ground pins go. So you can't just take a header and wires and call it done.
cheers,
george.
There *IS* circuitry in the MSO probe - it's a 90k (nominal) resistor in series with the signal and INSIDE each of the flying lead (grey plastic ends) where the little ground pins go. So you can't just take a header and wires and call it done.
cheers,
george.
That is correct. I also suspect that the wires in the ribbon cable itself may be resistive/lossy. If all you're doing is low speed stuff it's certainly possible you could sling something together, but georges80 is correct, the probes are not just a ribbon cable.
The weaved cable wires are not resistive/lossy. They are just nominal 0 ohm wires.
george.
The weaved cable wires are not resistive/lossy. They are just nominal 0 ohm wires.
george.
The weaved cable are resistive and forms lossy transmission line, patendted by HP enginner:
http://www.google.com/patents/US4777326 (http://www.google.com/patents/US4777326)
My cable has 120 cm long an has 180 Ohms.
Georg
The weaved cable wires are not resistive/lossy. They are just nominal 0 ohm wires.
george.
The weaved cable are resistive and forms lossy transmission line, patendted by HP enginner:
http://www.google.com/patents/US4777326 (http://www.google.com/patents/US4777326)
My cable has 120 cm long an has 180 Ohms.
Georg
Yes, you are correct, around 190 ohms for the data wire on the cable and zero ohms for the interleaved ground wires. Even more magic than I thought to maintain good impedance match along the cable.
...and thus an even better reason to source the correct cables for the scope if one purchased the none msox version.
cheers,
george.
I am trying to unlock Agilent 54831D Infiniium MSO. It is running Windows XP.
Did someone did this?
Can someone show me the way? Thanks.
It is Windows XP.
For the avoidance of doubt, the older 3000A also supports full decode on analogue and digital channels. :-+
I appreciate Daniel's presence and his valuable input. Hope he does not take your comment seriously.What?! Take what seriously exactly?
LOL anyone else find it odd that a Keysight/Agilent rep comments in a thread about hacking their device to get upgrades for free? Ha ha
Okay. But there was nothing offensive or "warding off" in the statement, so there was nothing "to be taken seriously". It was merely a humorous observation. I too enjoy the different stance they are taking on the matter. But dont forget, as MANY companies in MANY different industries are learning, be electronics, woodworking, guns, photography, crafts, you name it, it is done because it helps sell products. My guess is none of them are going anywhere despite any statements a random person on the internet might make. They are here because their company wants the representation here. Unless that changes, they arent going anywhere.LOL anyone else find it odd that a Keysight/Agilent rep comments in a thread about hacking their device to get upgrades for free? Ha ha
It is only odd if he was to encourage or help with a hack. In this case it is simply a refreshing change from the stance companies often take.
We're good, Ben. I also think it's ironic that I'm present on this thread (and yes, I think I'm using "ironic" correctly :-//)Ironic! Yes thats the term I was looking for, not odd. And glad I didnt offend you, I certainly didnt mean any offense with my post. I think it's kinda cool and forward thinking of a company to remember what it is like on the other side (the consumer/hobbyist side). These days the big selling idea fueled buy what is now coined "The Maker Movement" everyone expected things to be fully open source and its making a lot of startups lots of money doing so when they release new products. Its only a matter of time before all the big dogs join in. Having online representation is IMO a step in that direction. It can only help us all. :)
Honestly, I'm here with a Keysight username because I want to be here in a professional capacity and I'm in a place here that will make it sustainable. I've lurked for a long time on this blog and other social media sites, but decided to finally take the plunge and create an "official" account.
To be fair, I only responded to this thread because people were wondering what the cable looked like and I had found the thread while researching the current MSOs after my trusty old TEK died, sorry if it derailed the thread but I will give Keysight credit for being willing to respond to a thread of this nature.
sorry if I caused any derailment here.
Hi mongo,
I'll follow up with you on the message you sent us, I'm sorry that the MSO isn't living up to what you need.
Some history on this, when we started shipping the 2000 X-Series scopes there was no decoding at all. After a lot of customer feedback, we enabled serial decoding with the 2.30 firmware release, but the caveat was that the 2000 X-Series only have one of the MegaZoom ASICs. The digital lines and serial decoding use the same block in the ASIC, so it's a physical impossibility to enable the decoding and the digital channels simultaneously. The 3000T and up have two ASICs, which is why we support that in those scopes. It makes us sad, too.
I recently scored a cheap dsox2004a in ebay and upgraded the software to 2.35. I've read through the thread (a few times) but I'm stuck unpacking the cab file... I can extract it fine but I don't have a way to do the numerous copies necessary to create the /Secure file structure. I tried installing cab manager 3.0 but the website it gone and all the installers I can find are just bloatware... I work in linux mostly but can run Windows 8.1 in a vm. Does anyone have a python script to unpack the files using _setup.xml?
Thanks,
Elliot
Bumping this thread up.
Just wondering if anyone has further experimented with version 2.41. Being all licenses can be enabled without patching the DLL it seems like the only thing needed is an automatic way to restart the infiniivision.exe or to start it initially with -l all.(if it was linux it would be symbolic link time)
I realize 2.41 can have all options enabled via telnet quite easily but it would be much nicer to have it fully automatic.
I'd experiment myself but my scope has version 2.39 on it which is easy to downgrade etc. If I install 2.41 I will be stuck there. Running the newest firmware would be optimal but not at the expense of the ease of "liberation".
btw, I'd like to offer an "Infiniian" of thanks to all of those who pioneered the early work on this, there is amazing and very useful information in this thread.
To anyone who has an official or basic network card I think running the patched files directly off internal flash is a great option and it lets you run version 2.39.
Just bumped into this recently.
I looked for the "WinCE CAB MAnager", however it seems it isn't available anymore? :-//
Is there another similar tool available?
Strapping resistor encoding
Value - Voltage - Lr/Hr
0 - 0.00V - 10k / none
1 - 0.23V - 10k / 100k
2 - 0.69V - 46,4k / 121k
3 - 0.98V - 64,9k / 100k
4 - 1.25V - 100k / 100k
5 - 1.52V - 100k / 64,9k
6 - 1.81V - 121k / 46,4k
7 - 2.27V - 10k / 100k
8 - 2.50V - none / 10k
Strap 0 (CH 0) Channels:
0 - 2 Channels
1 - 4 Channels
Strap 1 (CH 1) Bandwidth
0 - 100MHz
1 - 200MHz
2 - 500MHz
3 - 1GHz
4 - 1.5GHz (4000 series only)
Strap 2 (CH 2) Sample Rate:
0 - 5GSa
1 - 4GSa
Strap 3 (CH 3) Gating ?
Strap 4 (CH 4) Board Revision ?
Strap 5 (CH 5) Family:
1 - 3000 series
2 - 4000 series
3 - 2000 series
Strap 6 (CH 7) MSO revision ? - not for 4000 series
Strap 7 (CH 6) External module - not for 4000 series:
0 - LAN
1 - GPIB
8 - No External Module
It does seem like you could go 100 to 200 MHz without needing to alter the firmware at all, and possibly enable the MSO option.No. My 3014A was already strapped to 200MHz. Straps are set to indicate hardware features. 20MHz hardware BW was downgraded by software to 100 MHz allowing the license-based upgrade.
Finding someone to open a 500 MHz model and take some detailed front end pics/measurements is what we need.... or a 350 Mhz model, as it is the same hardware as the 500 Mz model, just the firmware is crippling the scope to 350 Mhz.
When the DSOX3000A series was released by Agilent it only went to 500 MHz with 4 GS/s. Sometime later they released the 1 GHz model with 5 GS/s. This does back up the theory that there are more significant changes to the 1 GHz hardware. 200 to 500 MHz would already be an amazing upgrade. Finding someone to open a 500 MHz model and take some detailed front end pics/measurements is what we need.
I did start taking mine apart yesterday, but was short of time. Do I need to take the PSU off, or can you get to the board just by taking off the four screws that hold the back on, then the 8 or 9 T10 screws plus the 2xBNC nuts? That's what I tried but it didn't want to budge much, I then ran out of time.3000 series could be taken apart as easy as 1-2-3. Just screws and BNC nuts and ATX-like power connector. No need to remove PSU or line filter.
I haven't pulled my DSOX3014A apart yet to know for sure. I also suspect to know the true differences we'll need to remove the covers from the front ends(something Dave didn't do).I'll remove them on my 3014A and take photos. Too bad you can't read marking off any chip capacitor inside.
I also suspect to know the true differences we'll need to remove the covers from the front ends(something Dave didn't do).Do you have a 1GHz scope or SA to check PLL output clock (should be in 500-1000Mhz range)?
I did start taking mine apart yesterday, but was short of time. Do I need to take the PSU off, or can you get to the board just by taking off the four screws that hold the back on, then the 8 or 9 T10 screws plus the 2xBNC nuts? That's what I tried but it didn't want to budge much, I then ran out of time.3000 series could be taken apart as easy as 1-2-3. Just screws and BNC nuts and ATX-like power connector. No need to remove PSU or line filter.
If you'll go further to remove the main board, be sure to remove 13 more screws and detach 3 flex cables.
Service guide:
http://cp.literature.agilent.com/litweb/pdf/75019-97084.pdf (http://cp.literature.agilent.com/litweb/pdf/75019-97084.pdf)
What model do you plan to look inside?
Unit is MSOX3054A.Nice! For this scope a closeup photo of anti-aliasing filter would be very useful. You don't need to remove main board or desolder channel frontend shields. At the top of the shielding there are two thick diff traces going to ADC. Just under the shields there are 3-pole filter on these traces: cap + two inductors + another cap. Would be very good to get a sharp photo of these inductors to see a color of their dots and number of turns. There are plenty of room and a big side opening in the input shield.
If it's of any help, that PLL in an MSO X3104A is operating at 625MHz, as detailed here:I also suspect to know the true differences we'll need to remove the covers from the front ends(something Dave didn't do).Do you have a 1GHz scope or SA to check PLL output clock (should be in 500-1000Mhz range)?
PLL is on the top layer, just between two ADC chips. No need to remove the main board.
See the photo (circled). Both single-ended or differential probe will catch the frequency.
That could be acq. clock (1GHz) or memory clock (667MHz) PLL.
If it's of any help, that PLL in an MSO X3104A is operating at 625MHz, as detailed here:
https://www.eevblog.com/forum/blog/eevblog-683-rigol-ds1000z-ds2000-oscilloscope-jitter-problems/msg587159/#msg587159 (https://www.eevblog.com/forum/blog/eevblog-683-rigol-ds1000z-ds2000-oscilloscope-jitter-problems/msg587159/#msg587159)
Keysight firmly maintains the front ends are not all the same. For the 3000X series there is a 70/100/200 MHz version, a 350/500 MHz version and a 1 GHz version(with the higher sampling rate).
I'd also say that we're generally pretty conservative with our bandwidth ratings, so I'm interested to see what bandwidth you guys can coax out of the 70-200 MHz board.Hello Daniel! Thank you for not being angry at us for all these hardware modifications.
If it's of any help, that PLL in an MSO X3104A is operating at 625MHz, as detailed here:
Sorry, I didn't measure the inductors while I was in there, but I did take some photos. They're not the greatest quality in terms of lighting. I've put them here for you (18MB is way beyond the eevblog posting limit):If it's of any help, that PLL in an MSO X3104A is operating at 625MHz, as detailed here:
https://www.eevblog.com/forum/blog/eevblog-683-rigol-ds1000z-ds2000-oscilloscope-jitter-problems/msg587159/#msg587159 (https://www.eevblog.com/forum/blog/eevblog-683-rigol-ds1000z-ds2000-oscilloscope-jitter-problems/msg587159/#msg587159)
Thanks! Extremely useful. PLL inductor should be in 9-10nH range I suppose?
4GSa models should use 500 MHz then (1/8 of sampling rate). Needs to be confirmed too.
BTW, how did you manage to get register values? SPI bus tap? Any chance you've got some photos of 3104A's main board?
Space on that server is fairly limited, so don't expect the file to stick around for more than a week or two.Thanks again MarkL! Fetched that.
btw, I do have a spectrum analyzer good to 6 GHz and signal gen to 8 GHz for testing. I have no probe for the spectrum analyzer but am sure a small loop would still pickup the PLL frequency.PLL part is done thanks to MarkL who reported the exact frequency.
FWIW these are the pics of the 3054a. If you open them in photobucket (yes, I know :-\) then you can get higher definition.
Better snap here of the anti aliasing filter, photobucket seems to have dropped the resolution significantly even if you download it rather than use the embedded version. Orginal pics were at 20M pixels.All I download is 1024 x something, even marked by photobucket as "original".
Here is a part of MarkL's photo with the best view to 1GHz front stage.Hint taken, and I'm willing to take photos of any area you'd like in more detail if you want to describe it. But if it means unsoldering the front end shield, I'm afraid I'm not up for that. The scope is in daily use for business and has a service contract. I don't want to mess with it that much.
Looks like a "side ways" of AA filter are partially mounted here.
Would be nice to get any better photos :)
I have the 1 GHz version MSO-X 3104A and can take some pictures tomorrow.
Hint taken, and I'm willing to take photos of any area you'd like in more detail if you want to describe it. But if it means unsoldering the front end shield, I'm afraid I'm not up for that.
Works w/o issues at 5GSa and different donwnsample rates. Time measurements are perfect.Did you measure how hot it gets now? Be careful not to burn up your scope.
I'm now on chimera with 5GSa/s sample rate and 350MHz software bandwidth. Extra sample rate makes no real sense for this BW, but it's a step forward.
Did you measure how hot it gets now? Be careful not to burn up your scope.Nope. 5GSa version use the same heatsinks so I don't bother atm.
How do they do the 20 MHz bw limit? And is the upper end limited in a similar way.It's 200MHz upper limit, exactly as declared for this board. No low end limit here.
How do they do the 20 MHz bw limit? And is the upper end limited in a similar way.It's 200MHz upper limit, exactly as declared for this board. No low end limit here.
Is it possible to dump all internal files to USB drive on 2.41 without the LAN module? I'd like to examine the filesystem, but some time is required to make a DIY LAN.
As jumper values are used to set the model bandwidth/minimum displayed timebase but not the actual front end bandwidth it would seem the physical bandwidth limits are "programmed" via resistor/capacitor/inductor in the front end or a different front end ASIC is used for each of the model series and those fixed limits are simply selected via the processor.Right, I doubt too it is in done software. There is no reason for this jumper/resistor ladder to differentiate different models if the information about the model (bandwidth) is available in the software anyway.
OK, I verified that a DSOX3014A with a 100 MHz rated bandwidth has its -3dB point right around 130 MHz. If the same scope is then given then 200 MHz license its -3 dB point goes to 230 MHz.I think that software-based bandwidth reduction is made by digital filtering in ASIC.
OK, I verified that a DSOX3014A with a 100 MHz rated bandwidth has its -3dB point right around 130 MHz. If the same scope is then given then 200 MHz license its -3 dB point goes to 230 MHz.I think that software-based bandwidth reduction is made by digital filtering in ASIC.
Still there are frontend BW and system BW. I'll try to measure frontend BW by probing its output.
I hope some new pictures from 3104A or unsheilded 3054A would arrive soon.
When I get a moment I will take it apaaaart again and see how easy it is to remove a shield. Let me know what tests you'd like me to run. I could, for example, try to find out if the 350/500MHz bandwidth switch is implemented at the AFE.
Regarding the 50 ohm path, you mentioned earlier that this is different between various BW versions, what was it that leads you to this conclusion? I am not saying you're wrong, just interested to understand.
Let me know what tests you'd like me to run. I could, for example, try to find out if the 350/500MHz bandwidth switch is implemented at the AFE.If you have a sig gen and 1GHz scope with differential probe you can tap AFE's output just before and/or after output AA filter. Try to feed in 100 MHz, 500MHz and 1GHz sine signals of the same amplitude and measure output amplitude. I'll try to do the same on my 200MHz board. I think I'll be able to arrange such setup with an extra scope at the end of the week.
Is the same ASIC?
From the 3054a.
A simulation can give you some ideas. But yes, you need the correct values.
Ok, here ya go:I have the 1 GHz version MSO-X 3104A and can take some pictures tomorrow.Hint taken, and I'm willing to take photos of any area you'd like in more detail if you want to describe it. But if it means unsoldering the front end shield, I'm afraid I'm not up for that.
Thanks for your will to help!
Where are still much interesting with the shields intact:
- AA filter in fine details via the top side window (like Howardlong's);
- relays photo from the smaller bottom windows;
- photo of the board's bottom side (need to remove the main board);
- you can also try to read ASIC marking via the top window.
I'm pretty sure 3000 series 200-500MHz boards are trimmed of 1GHz 50 Ohm signal path routing. Like K201 unpopulated relay switching signal to the dead end.
This Dave's photo from 4000 series could be useful as a reference:
https://www.flickr.com/photos/eevblog/8181526726/in/album-72157631997535516/ (https://www.flickr.com/photos/eevblog/8181526726/in/album-72157631997535516/)
That's 200MHz board of 1.5GHz capable series. I think the alternative way for 50 Ohm coupling goes through K201 and further to that big 6 pin through-hole component. K203 may be left unpopulated on 1GHz board.
There's a large metal encased something, 6-pin thru hole device under the shield (img_4238.jpg). The number must be on the top. It's connected to the 50 ohm terminator and is numbered K504, K404, etc. Very likely it's the relay for the terminator. I don't see it in the 500Mhz and less photos.
Do you have any means to measure capacitors? Without desoldering ofc.
Yes, measured from a DSO610xA.Was you able to improve BW on your scope?
Not a good idea, is better measure everything off the board.I can't ask people to unsolder their scopes into pieces. Also, that's not absolutely necessary for the task.
From the 3054a.
Do you have any means to measure capacitors? Without desoldering ofc.
Could you please measure C520 and star's capacitors?
Without desoldering I've got (using Mastech MS8910 handheld smd tester):
C520 - 590pF
star center cap - 18 pF
star rays caps - all 39pF (maybe that's a sum).
How are you starting the firmware, and what version? Do you have a LAN card so you can telnet into the unit?ATM I don't have a LAN and my FW is 2.41.
I'm not too averse to desoldering to measure, I have a pretty decent E12 stock of Ls (WW as well as ML), Cs and Rs in stock if necessary. In the event of disaster, there's always another channel ;-)Nice! You seem to have a great reverser's setup. Although I feel I maybe asking too much about desoldering.
BTW, what do you think about these C-L-R networks? Are they some kind of feedback paths? I don't think they are direct signal paths.
Also, did you notice difference in MarkL's 1GHz AA filter?
They use a kind of parallel path C-R path in addition to usual LC ladder scheme.
Before I disassemble the scope and lift the shield again, can you identify all the parts you need to know?
How are you starting the firmware, and what version? Do you have a LAN card so you can telnet into the unit?ATM I don't have a LAN and my FW is 2.41.
I've never touched the software part yet.
I think I'll replicate most of the values from your photos on one of the channel and try to directly measure ASIC output bandwidth with another scope. I don't think the ASIC itself could be digitally controlled for BW limit.I'm not too averse to desoldering to measure, I have a pretty decent E12 stock of Ls (WW as well as ML), Cs and Rs in stock if necessary. In the event of disaster, there's always another channel ;-)Nice! You seem to have a great reverser's setup. Although I feel I maybe asking too much about desoldering.
I don't think inductors needed be measured since they are marked and you can tell their value by both marks and number of wire turns. But capacitors are real headache. I can't measure single pF's accurately.
BTW, what do you think about these C-L-R networks? Are they some kind of feedback paths? I don't think they are direct signal paths.
Also, did you notice difference in MarkL's 1GHz AA filter? They use a kind of parallel path C-R path in addition to usual LC ladder scheme.
I think you need to get a LAN card - you could then easily switch between 100 and 200 MHz bandwidth and probe to see where the bandwidth is actually changing.I expect to make a DIY board in a week.
How are you starting the firmware, and what version? Do you have a LAN card so you can telnet into the unit?ATM I don't have a LAN and my FW is 2.41.
I've never touched the software part yet.
I think I'll replicate most of the values from your photos on one of the channel and try to directly measure ASIC output bandwidth with another scope. I don't think the ASIC itself could be digitally controlled for BW limit.I'm not too averse to desoldering to measure, I have a pretty decent E12 stock of Ls (WW as well as ML), Cs and Rs in stock if necessary. In the event of disaster, there's always another channel ;-)Nice! You seem to have a great reverser's setup. Although I feel I maybe asking too much about desoldering.
I don't think inductors needed be measured since they are marked and you can tell their value by both marks and number of wire turns. But capacitors are real headache. I can't measure single pF's accurately.
BTW, what do you think about these C-L-R networks? Are they some kind of feedback paths? I don't think they are direct signal paths.
Also, did you notice difference in MarkL's 1GHz AA filter? They use a kind of parallel path C-R path in addition to usual LC ladder scheme.
I think you need to get a LAN card - you could then easily switch between 100 and 200 MHz bandwidth and probe to see where the bandwidth is actually changing.
How do you switch from 100 to 200Mhz with a LAN card?
i have that file still localy and remote on hotfile
https://hotfile.com/dl/131446259/df706bb/3000XSeries.01.10.2011031600.cab.html
I have the 1 GHz version MSO-X 3104A and can take some pictures tomorrow.
May be that helps you.
Can confirm that this is definitely the case. There's a hardware difference.Not sure if I have the right to ask, but I'll try ;)
http://www.filedropper.com/3000xseries01102011031600 (http://www.filedropper.com/3000xseries01102011031600):-+
And here are some details from under the can.
More details
So, I can re-assemble my scope?Sure. I don't think anything else is needed.
Or do you need anything else, while it is open
Ok, Up to your part with the 10 MHZ I got it done and 220 mV RMS confirmed on Channel 2.
But where would you expect the un-triggered 10 MHZ at Channel 1 and Channel 3?
While the Channel 2 will get 2510 MHz on the input?
Well there seems to be a 10 MHz signal in the hidingOh, thanks for the test!
Also I need to note my trigger went a little crazy displaying some voltage and/or time offset compared to displayed signal.
Hope user calibration will be able to fix it.
There are only two caps per channel that are changed which is pretty minimal - I was thinking of ordering several capacitor values around 2 to 2.2 pF so I can experiment if needed.
The inductor values appear to be easy to determine based off the color dot but am wondering how you decided on the CS series of parts versus say the HP series.
Do you see any value in upgrading the sample rate from 4 to 5 GS/s?
Lastly I am hoping Howard can do one more favor for us and that is to measure the 3dB point of his scope at both 350 and 500 MHz bandwidths so we know exactly what we should be aiming for.
Do you see any value in upgrading the sample rate from 4 to 5 GS/s?I don't think its a good idea for 500MHz BW because there are no such model in 3000 series and its software may behave erroneously in such a chimera. But you can give it a try if you want. It works.
Thank you for your efforts memset and to those who bravely opened up their scopes.
I was pondering a few things though before I order parts.
The resistor values are obviously all correct.
There are only two caps per channel that are changed which is pretty minimal - I was thinking of ordering several capacitor values around 2 to 2.2 pF so I can experiment if needed.
The inductor values appear to be easy to determine based off the color dot but am wondering how you decided on the CS series of parts versus say the HP series.
Do you see any value in upgrading the sample rate from 4 to 5 GS/s?
Lastly I am hoping Howard can do one more favor for us and that is to measure the 3dB point of his scope at both 350 and 500 MHz bandwidths so we know exactly what we should be aiming for.
How to install extra link to run firmware with custom command line:
------------------------------------------------------------------
1. Prepare infiniivision.lnk: add desired command line options after .exe file name and recalculate string length.
lnk format: N#\path\to\file.exe -command_options
N is 2-3 digits of length value of the following string, including '#' char.
After lnk file contents are edited replace N with corrent number.
Maximum lnk file size is 260 bytes including size field itself. Do not exceed this value!
!!! WARNING Maximum lnk file size is 260 bytes total !!!
!!! WARNING Incorrect lnk file contents may brick your unit !!!
2. Copy 3ka_v241_linkinstall.cab and infiniivision.lnk to the root folder of USB drive.
3. Insert USB drive to the unit and run software update process. Wait until device reboot.
!!! WARNING It's extremely dangerous to run cab files from unknown sources as they may contain malicious instruction to the unit !!!
4. Unit should reboot and work with extra warning about Unfinalized software.
How to remove extra link to revert to original firmware startup:
---------------------------------------------------------------
1. Copy 3ka_v241_linkinstall.cab to the root folder of USB drive.
2. Delete infiniivision.lnk from the root folder of USB drive or make sure it's not present there.
3. Insert USB drive to the unit and run software update process. Wait until device reboot.
4. Unit should reboot and work without any extra warnings.
Troubleshooting:
----------------
1. The hardest problem would be incorrect lnk file leading unit to hang on boot (brick!).
It's only possible to solve that by connecting to the unit via Telnet and removing that incorrect link file:
del \f \Secure\Startup\infiniivision_ext.lnk
I've done some research on how to install arbitrary command line without having the lan module on version 2.41 and came to this simple solution.
....
63#\secure\infiniivision\infiniivisionlauncher.exe -l all -l bw50
Hi Folks,
Does anybody know what kind of Windows CE version and SDK that the 3000 series scope uses? I am interested in hack to scope to run my own code. One example I had in mind is to write a program to enable telnet over USB connection.
Does anybody know what kind of Windows CE version and SDK that the 3000 series scope uses?2000, 3000, 4000 series are Microsoft Windows CE 6.0 R3 based. BSP for SPEARHEAD600 CPU is from Adeneo (not public).
!!! READ BEFORE USE !!!
!!! 3000A v2.41 ONLY ! 3000A v2.41 ONLY ! 3000A v2.41 ONLY !!!
I've done some research on how to install arbitrary command line without having the lan module on version 2.41 and came to this simple solution.
Will this work for MSO-X2014A V2.41 as well?
or will there be a need to a 2ka_v241_linkinstall.cab version?
So for those of you who have 2.41 and a dsoxlan card it looks like you could just copy the .lnk file you make from the USB drive to \Secure\Startup\infiniivision_ext.lnk using telnet or use memset's cab file upgrade.
At this point it is looking like there isn't too much incentive to stay on 2.39 or older unless you want to be able to boot directly from a USB drive.
I'd also say that we're generally pretty conservative with our bandwidth ratings, so I'm interested to see what bandwidth you guys can coax out of the 70-200 MHz board.
I've done some research on how to install arbitrary command line without having the lan module on version 2.41 and came to this simple solution.
...
96#\Secure\infiniiVision\infiniivisionLauncher.exe -l MSO -l BW50 -l memMAX -l ASV -l CABLE -l SGMC
I'm seeing the same thing. It was fine with 2.39 - not sure if it is 2.41 with a home brew dsox2lan or if it is using the external link. Either way mine still works fine via DHCP even though the IP information on screen is not displayed correctly.
Has anyone seen this before? Is the IP address shown (92.251.81.2) typical in the case of not being able to obtain IP address from DHCP server? Other instruments seem to be working fine...Default, DHCP-failed IP should be 196.254.x.y (/16 subnet mask). Maybe your unit have some static configuration defaulted in.
The LAN interface is configured according to how it was set up in the unanointed setup, but it shows nonsense once anointed...
...Maybe your unit have some static configuration defaulted in.
Just to confirm 100% the odd looking LAN settings only occur when using a infiniivision_ext.lnk with firmware 2.41...
Normaly the scope starts the \Windows\infiniivisionlauncher.exe.
The .lnk file points to \secure\infiniivision\infinnivisionlauncher.exe.
The files aren't the same!
Two years ago in this thread someone reported a problem with patched firmware running from USB stick and the WEB interface, the link below points to the solution:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg484234/#msg484234 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg484234/#msg484234)
Georg
processmgr kill infiniivisionlauncher.exe
copy \secure\InfiniiVisionCore.dll "\program files\infiniivision\InfiniiVisionCore.dll"
"\program files\infiniivision\infiniivisionlauncher.exe" -l all -l BW50 -l SCPIPS -l SGMC -l CABLE
7. Copy this file to "\secure\"50#\windows\cmd.exe /c \Secure\startinfiniivision.cmd
9. done!Normaly the scope starts the \Windows\infiniivisionlauncher.exe.
The .lnk file points to \secure\infiniivision\infinnivisionlauncher.exe.
The files aren't the same!
I have tested the following solution to run the Scope with all licenses and without lan-problems:
...
Has anyone entertained the idea of dumping the flash and adding our own public key.Personally I'm fine with the current solution. I really dislike the possibility of hacking the scopes without clear traces left because that will spoil the second hand market. Just imagine eBay flooded with unlegit scopes...
Has anyone entertained the idea of dumping the flash and adding our own public key.Personally I'm fine with the current solution. I really dislike the possibility of hacking the scopes without clear traces left because that will spoil the second hand market. Just imagine eBay flooded with unlegit scopes...
Well I don't see there being any flood of scopes with bogus licenses added. Not that many people will open their scope, jtag it to read the flash, alter it and then rewrite the flash. It could happen though. To that end I've already seen a DSOX2K on ebay that had all options enabled in firmware and they were open about advertising it - not something I support obviously. In my case my scope will never look 100% legit as the model # is DSOX3014A yet it will always show bandwidth as 350 or 500 MHz. The current hacks are easy enough and simple - but it seems the biggest issue with the DSOX2K/3K series is corrupted flash images or bad flash parts altogether, so anything we can do to help prevent that might be in our own best interest. I know I wouldn't mind having a 100% backup of my flash image.
Well I don't see there being any flood of scopes with bogus licenses added. Not that many people will open their scope, jtag it to read the flash, alter it and then rewrite the flash. It could happen though. To that end I've already seen a DSOX2K on ebay that had all options enabled in firmware and they were open about advertising it - not something I support obviously. In my case my scope will never look 100% legit as the model # is DSOX3014A yet it will always show bandwidth as 350 or 500 MHz. The current hacks are easy enough and simple - but it seems the biggest issue with the DSOX2K/3K series is corrupted flash images or bad flash parts altogether, so anything we can do to help prevent that might be in our own best interest. I know I wouldn't mind having a 100% backup of my flash image.
Trying to buy & flip hacked scopes is a good way to get a nasty-gram from our legal department. Don't do it. We can tell when a scope's been hacked and will fight to stop people from making money off of hacking our scopes.
I personally am all for buying and ...er... upgrading a scope, but don't try to make money off of it. It's been tried before and we intervened.
Do I have to make the Ethernet card first or is there a pre hacked software I can put into a USB key ?All the information is in this thread.
Thanks a lot ;)
Thanks for the answer :-+
Where can I find the 2.35 firmware ? There only 2.41 and and previous version on the keysight website.
http://www.keysight.com/main/software.jspx?cc=FR&lc=fre&nid=-32542.1150180&id=2014479&pageMode=CV (http://www.keysight.com/main/software.jspx?cc=FR&lc=fre&nid=-32542.1150180&id=2014479&pageMode=CV)
Shouldn't the link file be:
62#\Secure\infiniiVision\infiniivisionLauncher.exe -l all -l bw50
Shouldn't the link file be:
62#\Secure\infiniiVision\infiniivisionLauncher.exe -l all -l bw50
I don't think so, see https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg989301/#msg989301 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg989301/#msg989301)
Perhaps Howard had some other character in his original file
Looks like telnet password is changed too. It is generated from instrument id now (still possible to get it, but I don't have a 3000T to try anyway)
To be continued after arriving of the kit and some soldering... I hate to wait!You can use any suitable cut of 0.8mm pitch PCB edge connector for urgent repair. Only one half of the connector is needed to get the LAN to work.
So... what should it be? :-//Here is pin header pinout (wasn't found by me, check first pages for the source).
PA0PBZ, have you fix your scope ?
U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500
CPU: SPEAr600
DRAM: 128 MiB
Flash: 512 KiB
NAND: internal ecc 128 MiB
Debug serial initialized ........OK
RTC: 2016-9-3 20:57:30.34 UTC
Microsoft Windows CE Bootloader Common Library Version 1.4 Built May 7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008
System ready!
Preparing for download...
RTC: 2016-9-3 20:57:30.38 UTC
Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN
X
XXXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOXOXOOOOXXXOOOOOOOOOXOOOOXOXXOXXOXOXOXOXOXXXXOOXXXOOOOOOXXOXXOXXXXXXOOOXXXOXXOOXOXXOOOXOXOOOXXOOOXOOOOXOXOOOOOXOOOXOOXOXOXOXXXXXXXOXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOX
OOOXOOXOOOOXOOOOXOXOOOXXOOOOOOOOOXOOOOXOOOOOOXOXOOOOXOXOOOOOOOXXOOOOXOXOOOXOOOXOOXXOXOOOOXXXOXXXXXXOXOXXOXXXXXOXOXXOXXOOXXXOOXXOXXOXOOXXOXXXXOXXOOXOOOXOXXXXOOXXXOOOXOXOOOXOOXXXXXXXX
XXXXXOXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x15264A8, LaunchAddr = 0x80362000
Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000 Length=0x15264A8 Name="" Target=RAM
Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
RTC: 2016-9-3 20:57:33.31 UTC
Launching windows CE image by jumping at address 0x 362000
Windows CE Kernel for ARM (Thumb Enabled) Built on Mar 8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Oct 22 2015)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000 size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200 (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 00:30:D3:XX:XX:XX
Phy found addr 31 (ticks=6612)
WaitForLink Start (ticks=6614)
No Link (ticks=7617)
<--EDeviceInitialize
GMAC DMA status register = 0x0
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Running infiniiVisionInstallHelper
Failed to start/configure network.
Time for NANDFLASH to load: 1 ms.
Time for SNANDFLASH to load: 1 ms.
Our command line is
Performing Startup
Our command line is -l all -l bw50
Released build, Oct 22 2015, 11:30:59
Initializing FPGA...
****
FPGA Type: Wyoming
Ver: 2.011 Released
Build Time: Tue May 27 16:03:14 2014
Build Machine: TS2404M
****
Performing Startup
Released build, Oct 22 2015, 11:30:59
Initializing FPGA...
****
FPGA Type: Wyoming
Ver: 2.011 Released
Build Time: Tue May 27 16:03:14 2014
Build Machine: TS2404M
****
ERROR: c:\WINCE600\3RDPARTY\Agilent\HPP\Common\Drivers\sh600_serial\.\sh600_serial_drv.cpp line 661: SER2 SER Driver: does not support multiple Open()'s
Error opening UART Driver.
*** Installing License: All Licenses
*** Installing License: 500MHz Bandwidth
No option module detected
No option module detected
Front Panel UART driver reset -- Contact ChrisG
ERROR: c:\WINCE600\3RDPARTY\Agilent\HPP\Common\Drivers\sh600_serial\.\sh600_serial_drv.cpp line 661: SER2 SER Driver: does not support multiple Open()'s
Error opening UART Driver.
Front Panel UART driver reset -- Contact ChrisG
ERROR: c:\WINCE600\3RDPARTY\Agilent\HPP\Common\Drivers\sh600_serial\.\sh600_serial_drv.cpp line 661: SER2 SER Driver: does not support multiple Open()'s
Error opening UART Driver.
Front Panel UART driver reset -- Contact ChrisG
(This repeats until the cows come home)
U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500
CPU: SPEAr600
DRAM: 128 MiB
Flash: 512 KiB
NAND: internal ecc 128 MiB
Debug serial initialized ........OK
RTC: 2016-9-3 21:5:45.25 UTC
Microsoft Windows CE Bootloader Common Library Version 1.4 Built May 7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008
P500 Boot Loader Configuration :
Mac address .......... (00:30:D3:XX:XX:XX)
Ip address ........... (192.168.1.190)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (0)
Load image 1 at startup
Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
1 (0xd0600000)
2 (0xd1600000)
l) Load memory resident image Load image 1 now
1) Load memory resident image 1 now
2) Load memory resident image 2 now
3) Load memory resident image 3 now
d) Download from platform builder now
u) Start u-boot by resetting
v) Verify Images
I assume you haven't taken the unit apart at all.
How much longer until your lan card arrives, this must be driving you bonkers. Hopefully 2.41 can be reinstalled once it does arrive and that fixes it.I'm not really in panic mode yet :scared: it's one of the small lessons you learn getting older. The kit should have been posted the 26th but it got delayed a little bit so I now expect to get it Tuesday at latest. Then I of course have to assemble it, see if it works and then remove the link and hope that the scope boots again. I don't think there is anything wrong with the firmware because this scope came directly from Keysight, but then again what the problem is I have no idea yet. Oh well, another learning experience both for me and others that are following this thread.
I can stop the boot loader but then it has no useful options for me:An interesting thing to do is to load a patched version of the WindowsCE image, as I described here (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/125/). Probably also possible with an USB stick, not only from network. I did this for a patched telnetd version without password (before the password was published in this thread). You could backup and restore the NAND flash as well.
An interesting thing to do is to load a patched version of the WindowsCE image, as I described here (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/125/). Probably also possible with an USB stick, not only from network. I did this for a patched telnetd version without password (before the password was published in this thread). You could backup and restore the NAND flash as well.
Hi,
I took picture of the strap resistors of my 2002A. I change the 10K L1 to 46,6K. I was going to change H1 but I realize that I have not got H0.
What do you think. Should I put the good value to H0 too ? Do you know the value ?
I don't know it for the scope, but there are the tftpput and tftpget commands to load and write from a TFTP-server to RAM and from RAM (if the u-boot was compiled with support for it). And then there are the flash write and read commands: http://www.denx.de/wiki/view/DULG/UBootCmdGroupFlash (http://www.denx.de/wiki/view/DULG/UBootCmdGroupFlash) I used this for another embedded platform to flash the initial filesystem from TFTP and worked well.An interesting thing to do is to load a patched version of the WindowsCE image, as I described here (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/125/). Probably also possible with an USB stick, not only from network. I did this for a patched telnetd version without password (before the password was published in this thread). You could backup and restore the NAND flash as well.
Would you be willing to detail the command sequence needed to backup/restore the NAND flash?
Time for NANDFLASH to load: 1 ms.
Time for SNANDFLASH to load: 1 ms.
Our command line is
Performing Startup
Our command line is -l all -l bw50
Released build, Oct 22 2015, 11:30:59
Initializing FPGA...
****
FPGA Type: Wyoming
Ver: 2.011 Released
Build Time: Tue May 27 16:03:14 2014
Build Machine: TS2404M
****
Performing Startup
Released build, Oct 22 2015, 11:30:59
Initializing FPGA...
****
FPGA Type: Wyoming
Ver: 2.011 Released
Build Time: Tue May 27 16:03:14 2014
Build Machine: TS2404M
****
I try to match the DSOX3000 components with the DSOX2000 components but I am not sure about L4 and R2.
What is your opinion ?
What is the Agilent 2AD2-0001 ? Is that the ASIC and have we got a datasheet ?
Got the DSOXLAN kit today so I assembled and tested it and it works okay. However... Scope gets DHCP lease, I can ping it fine, it opens the telnet port, it acks at every telnet packet but it doesn't send anything back. Am I missing something essential here? I guess it should prompt for a login either directly after making the connection or after sending <Enter>, but nothing. :-//
Something goes really wrong in your case.
Yes, I was already wondering why I had 2 command line messages, and that would also explain why it complains about multiple open()'s. The only mystery is why does it do that?V 2.41 seem to scan Secure\Startup folder for any executable files like .lnk and starts all of them. If it finds none, default registry-based startup process is executed. Possibly in your case you're got two lnk files in startup folder or starter process falls back to default start (for unknown reason) after actually running the file from startup folder.
If the scope's OS isn't completely blocked you'll be able to get telnet welcome message (maybe in several minutes after connection). If so - you're saved.
Is the new 3000T "upgradable" in the same way?
Is the new 3000T "upgradable" in the same way?Should be even easier, up to 1GHz.
I waited for more than 15 minutes but the telnet connection didn't show anything, and the RS232 debug port is still flooded with the "does not support multiple Open()'s" message.Try to disconnect front panel's flex cables. Chances are low, but worth trying.
It looks like this is blocking the other processes from doing anything.
I try to match the DSOX3000 components with the DSOX2000 components but I am not sure about L4 and R2.
What is your opinion ?
What is the Agilent 2AD2-0001 ? Is that the ASIC and have we got a datasheet ?
That's an ASIC, yes.
Frontend seem to be very similar to 3000-series, further simplified to remove 50-ohm paths.
Both the anti-aliasing filter and low-pass filter are clearly seen and similar to 3000-series. Attenuated low-pass signal path is somewhat different though. I think you can boost it to 350-500MHz as 1-2-3, but that's not doing to be very useful without 50-Ohm coupled input.
Use 500MHz 3000-series component values as a reference for your upgrade and save all the original parts in separate marked containers to secure your way back. You'll need a signal generator to get this work properly done.
Try to disconnect front panel's flex cables. Chances are low, but worth trying.I already disconnected the front panel -> no difference
Probably you'll need to load patched CE core via COM port to fix this problem.I wonder if the 'startup' folder on USB is still valid, that way I could kill the infiniivision process - maybe.
Memset, have you trace the schematic of the front-end on paper ? Could you send me a picture ? Thanks .No, I don't have any schematics.
I wonder if the 'startup' folder on USB is still valid, that way I could kill the infiniivision process - maybe.I don't think its possible on V2.41. The better way should be to use patched core (with a patch to remove the main application from startup process).
Try to disconnect front panel's flex cables. Chances are low, but worth trying.I already disconnected the front panel -> no differenceQuoteProbably you'll need to load patched CE core via COM port to fix this problem.I wonder if the 'startup' folder on USB is still valid, that way I could kill the infiniivision process - maybe.
I'm reading the complete thread again and also looking into the CE boot process. If I could disable the automatic startup of infiniivison (either one of the 2 :) ) I would be fine.
The Flir E4, which also uses CE, has an early boot-up menu on the serial port that appears to allow an update from USBTry to disconnect front panel's flex cables. Chances are low, but worth trying.I already disconnected the front panel -> no differenceQuoteProbably you'll need to load patched CE core via COM port to fix this problem.I wonder if the 'startup' folder on USB is still valid, that way I could kill the infiniivision process - maybe.
I'm reading the complete thread again and also looking into the CE boot process. If I could disable the automatic startup of infiniivison (either one of the 2 :) ) I would be fine.
You did try the web interface on the one in a million chance it still happens to work right - you can use it to update firmware.
Has anyone looked into if there is a key sequence at boot that would force the bootloader to install new firmware? I am thinking something like that must exist, not sure it is meant for the end user of course.
If you can't inject a patched file via the serial port perhaps you could jtag the entire image, patch the file system and reflash it.
Has anyone looked into if there is a key sequence at boot that would force the bootloader to install new firmware? I am thinking something like that must exist, not sure it is meant for the end user of course.
Nope
Pages 6/7 of this thread seem to give enough info to boot an image into ram.
I know, but you have to interact with UBoot and it looks like I'm too stupid to find out how to do that :-//Press 'u' and stop u-boot while its booting. Or reset and try to stop u-boot earlier.
Press 'u' and stop u-boot while its booting. Or reset and try to stop u-boot earlier.
I think your chance for easy win is to load nk.bin from older version, like 2.35 since it use different startup logic. You can even try to load nk.bin from Eth and boot application from USB. Ethernet boot process was already described here.
#if defined CONFIG_ZERO_BOOTDELAY_CHECK
/*
* Check if key already pressed
* Don't check if bootdelay < 0
*/
if (bootdelay >= 0) {
if (tstc()) { /* we got a key press */
#ifdef CONFIG_AGILENTP500
if( getc() == ' '){ /* stop on space only */
puts ("\b\b\b 0");
abort = 1; /* don't auto boot */
}
#else
(void) getc(); /* consume input */
puts ("\b\b\b 0");
abort = 1; /* don't auto boot */
#endif
Uboot only stops on a spaceYes, it is. Just hit space while scope boots. If not sure, hold space and press power on.
U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500
CPU: SPEAr600
DRAM: 128 MiB
Flash: 512 KiB
NAND: fsmc-ecc1 128 MiB
In: serial
Out: serial
Err: serial
SerNum:serial number not programmed
Chip: BD Board Rev: 4
Net: smsc
Press space to stop autoboot: 0 0
p500> help
? - alias for 'help'
adc - performs A/D conversion on channel
base - print or set address offset
bdinfo - print Board Info structure
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
bootp - boot image via network using BOOTP/TFTP protocol
cdp - Perform CDP network configuration
cmp - memory compare
coninfo - print console devices and information
cp - memory copy
crc32 - checksum calculation
dcache - enable or disable data cache
dhcp - boot image via network using DHCP/TFTP protocol
echo - echo args to console
editenv - edit environment variable
erase - erase FLASH memory
expi - program EXPI Clock
flinfo - print FLASH memory information
fpga - loadable FPGA image support
fsinfo - print information about filesystems
fsload - load binary file from a filesystem image
go - start application at address 'addr'
help - print command description/usage
hwreset - Perform HW RESET of the CPU
icache - enable or disable instruction cache
iminfo - print header information for application image
imls - list all images found in flash
imxtract- extract a part of a multi-image
itest - return true/false on integer compare
loadb - load binary file over serial line (kermit mode)
loads - load S-Record file over serial line
loady - load binary file over serial line (ymodem mode)
loop - infinite loop on address range
ls - list files in a directory (default /)
md - memory display
mm - memory modify (auto-incrementing address)
mtest - simple RAM read/write test
mw - memory write (fill)
nand - NAND sub-system
nboot - boot from NAND device
nfs - boot image via network using NFS protocol
nm - memory modify (constant address)
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset - Perform RESET of the CPU
rtc - print time from RTC
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
saves - save S-Record file over serial line
setenv - set environment variables
sleep - delay execution for some time
source - run script from memory
splash - load splash image on display
tftpboot- boot image via network using TFTP protocol
version - print monitor version
U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500
CPU: SPEAr600
DRAM: 128 MiB
Flash: 512 KiB
NAND: internal ecc 128 MiB
Debug serial initialized ........OK
RTC: 2016-9-3 21:5:45.25 UTC
Microsoft Windows CE Bootloader Common Library Version 1.4 Built May 7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008
P500 Boot Loader Configuration :
Mac address .......... (00:30:D3:XX:XX:XX)
Ip address ........... (192.168.1.190)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (0)
Load image 1 at startup
Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
1 (0xd0600000)
2 (0xd1600000)
l) Load memory resident image Load image 1 now
1) Load memory resident image 1 now
2) Load memory resident image 2 now
3) Load memory resident image 3 now
d) Download from platform builder now
u) Start u-boot by resetting
v) Verify Images
>
This is what I see, could it be bad 'space' timing? Looks like I'm already in the next bootloader?Yes, for some reason all output after that NAND string is missing until you're booted into the next (CE) loader. It could be your RS232 adapter issue like buffer overflow, flow control turned on or something like that. Make sure any type of flow control is turned off in the port settings.
Then you try 'u' in CE loader, does it reboot and print more lines?
The rest is simple, there where 2 .lnk files in Secure\Startup, one infiniivision.lnk and one infiniivision_ext.lnk. Why? You tell me. Renamed infiniivision_ext.lnk to infiniivision_ext.xxx and rebooted the scope. Bingo! That's enough for this evening, I'll try the -l all -l bw50 tomorrow ;)
Now please excuse me, I'm going to play with my new toy 8)
Aftermath:
First I tested the options manually:
- processmgr kill infiniivisionlauncher.exe
- infiniivisionlauncher -l all -l bw50
That worked as expected so:
- ren infiniivision.lnk infiniivision.xxx
- ren infiniivision_ext.xxx infiniivision_ext.lnk
- reboot scope
Works fine, I didn't bother to change the 63# count as I was expecting it doesn't matter and it didn't.
Now please excuse me, I'm going to play with my new toy 8)
I am sure I've missed it somewhere, but do you know what did cause the problem?
Is the new 3000T "upgradable" in the same way?Should be even easier, up to 1GHz.
Post frontend pictures to make sure.
Any suggestions on how to unbrick it?
Stupid Muppet Bricked their scope :palm: Suggestions Welcome
Hello all, I used the USB boot file "3ka_v241_linkinstall.cab" with the intention of "cough, cough" upgrading my scope.
I thought I'd upgraded my scope to 2.41, but like a complete numpty, I didn't check, it was, in fact, running 2.37.
So, now I have a bricked scope. It loads, shows the boot screen, then black screen with "Agilent Technoliges", then the screen goes blank.
Any suggestions on how to unbrick it?
Just got a 2022A, used the 3ka_v241_linkinstall.cab and scope is bricked. Scope does have 2.41 firmware.
I#m assuming its due to the .lnk file not being the correct length as per previous posts. (#63 instead of #62).
I do have a LAN card but cant get a telnet connection. I've tried rebooting with the base 2.41 firmware and it hangs on the keysight logo screen. From here I can ping the scopes IP address, but still cant get a Telnet session.
Ideas?
Just got a 2022A, used the 3ka_v241_linkinstall.cab and scope is bricked. Scope does have 2.41 firmware.
I#m assuming its due to the .lnk file not being the correct length as per previous posts. (#63 instead of #62).
I do have a LAN card but cant get a telnet connection. I've tried rebooting with the base 2.41 firmware and it hangs on the keysight logo screen. From here I can ping the scopes IP address, but still cant get a Telnet session.
OUCH, you used the version for 3k series :(
Can you open scope or it has any warranty sticker? First I will try USB boot and in case it will fail dismantle scope and upload FW by PA0PBZ tool.
Description how to make USB bootable flash is almost on beginning of this thread. You do not need any hacked files, just extract files from 2.41 firmware.
Do not give up in case first flash will not work and try faster USB drive.
Thanks for that PAOPBZ, saw your previous posts on this. Think i've got a RS232 knocking around somewhere. Sigh....
Just so that ive got it straight, you cant boot 2.41 from USB?
OUCH, you used the version for 3k series :(AFAIK the firmware files for 2000 and 3000 series are the same - this will not be the problem.
Just confirming... I did a compare on 2000XSeries.02.41.2015102200.cab and 3000XSeries.02.41.2015102200.cab. They are identical.QuoteOUCH, you used the version for 3k series :(AFAIK the firmware files for 2000 and 3000 series are the same - this will not be the problem.
PAOPBZ,
What term package did you use? Im trying HTERM (recommended earlier in the thread) and I cant get it to pause the boot process.
This is the error its giving though:-
Performing Startup
Exception 'Raised E|ception' (-1-:Thread-Id=05d5000a(pth=84a19000), Proc-Id=05d4000a(pprc=8419cb08) 'infiniivisionlauncher.exe', VM-active=05d4000a(pprc=8419cb08) 'infiniivisionlauncher.exe'
PC=40068ag0(coredll.dll+0x00058ae0) RA=803782c8(kernel.dll+0x000062c8) SP=0002f9b0, BVA=0002fabc
PARSE ERROR: Argument: â¬l
$ Couldn't find match for argument
As per your experience it then goes into a loop with this:-
ERROR: c:\WINCE600\3RDPARTY\Agilent\HPP\Common\Drivers\sh600_serial\.\sh600_serial_drv.cpp line 661: SER2 SER Driver: does not support multiple Open()'s
U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500
CPU: SPEAr600
DRAM: 128 MiB
Flash: 512 KiB
NAND: internal ecc 128 MiB
Debug serial initialized ........OK
RTC: 2016-9-3 21:5:35.81 UTC
Microsoft Windows CE Bootloader Common Library Version 1.4 Built May 7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008
P500 Boot Loader Configuration :
Mac address .......... (00:30:D3:xx:xx:xx)
Ip address ........... (192.168.1.190)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (0)
Load image 1 at startup
Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
1 (0xd0600000)
2 (0xd1600000)
l) Load memory resident image Load image 1 now
1) Load memory resident image 1 now
2) Load memory resident image 2 now
3) Load memory resident image 3 now
d) Download from platform builder now
u) Start u-boot by resetting
v) Verify Images
>
Ive tried about 20 times so far to interrupt u-boot, no luck
When do you hit the space bar?
Did you use the same pinouts as shown here (board layout is different on my scope, probably as its a 2 channel version):-
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg260895/#msg260895 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg260895/#msg260895)
Im using only the TX and RX lines.
This part is a little concerning:
Ive tried about 20 times so far to interrupt u-boot, no luck
I was not able to interrupt uboot, but I could interrupt the ce loader, see my previous post.QuoteWhen do you hit the space bar?
Immediately after turning on the scope, just keep it pressed down for the auto repeat.QuoteDid you use the same pinouts as shown here (board layout is different on my scope, probably as its a 2 channel version):-
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg260895/#msg260895 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg260895/#msg260895)
Im using only the TX and RX lines.
Yes, I used the same pinout but... I hope you are also using the GND....? :-\
Im using a laptop, no mains.
Might try another UART board, just trying a cheapy FTDI I had lying around.
Found another FTDI board, worked first time! :-+
So im assuming I now have to use "download from platform builder", the scope picks up a DHCP address and I upload the compiled file (unfortunately im a Windows man, so will have to dig out a copy of Linux to compile it)?
Found another FTDI board, worked first time! :-+
Finally! :-+QuoteSo im assuming I now have to use "download from platform builder", the scope picks up a DHCP address and I upload the compiled file (unfortunately im a Windows man, so will have to dig out a copy of Linux to compile it)?
No... the compiled version is in this post: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1022267/#msg1022267 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1022267/#msg1022267)
Put it in a folder together with the nk.bin (how to get it is here: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1022248/#msg1022248 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1022248/#msg1022248) ) run the executable and it will wait for the scope asking for the nk.bin. Switch on the scope, halt the CE loader and use the Download from platform builder. The scope will boot and maybe or maybe not hang at the splash screen. Now you can get a telnet connection to remove the malicious .lnk file you copied over from the USB stick. Now the scope should boot as it did before. If you get this far we'll discuss the next step ;)
Okay, got that. Do I need to use 2.35, seeing as the original firmware was 2.41?
Okay, stupid question time. Which tool do I use to extract mk.bin from mk.bin.comp.
I feel a bit responsible for these recent 'issues', I supplied the 2 scopes that have been troublesome. They were both very recent returns repaired by Keysight and with 2.41 installed by Keysight. They seem to be doing something odd now, I've sold lots of other scopes with Keysight installed 2.41 that people have played with without problems.
I have one more of these recent 2.41 scopes on my desk. I have a LAN card as well. Is there anything I could look at to see why these recent versions are causing problems? Maybe delete or rename the rogue LNK file and then attempt the option installation?
I feel a bit responsible for these recent 'issues', I supplied the 2 scopes that have been troublesome. They were both very recent returns repaired by Keysight and with 2.41 installed by Keysight. They seem to be doing something odd now, I've sold lots of other scopes with Keysight installed 2.41 that people have played with without problems.
I have one more of these recent 2.41 scopes on my desk. I have a LAN card as well. Is there anything I could look at to see why these recent versions are causing problems? Maybe delete or rename the rogue LNK file and then attempt the option installation?
I feel a bit responsible for these recent 'issues', I supplied the 2 scopes that have been troublesome. They were both very recent returns repaired by Keysight and with 2.41 installed by Keysight. They seem to be doing something odd now, I've sold lots of other scopes with Keysight installed 2.41 that people have played with without problems.
The only one responsible for the 'issues' is the person bricking the scope unless you did set up a booby trap :)QuoteI have one more of these recent 2.41 scopes on my desk. I have a LAN card as well. Is there anything I could look at to see why these recent versions are causing problems? Maybe delete or rename the rogue LNK file and then attempt the option installation?
Use telnet to see if there is a infiniivision.lnk in Secure\Startup. If so, then using the USB key to copy the infiniivision_ext.lnk will end up in the scope trying to run the infiniivision exe twice and give you the problem we found.
o hostname
infiniivision
skywalker1977
cd \secure\startup
ren infiniivision.lnk infiniivision.xxx
63#\secure\infiniivision\infiniivisionlauncher.exe -l all -l bw20
copy usb\infiniivision.lnk
What were you lot playing about at ;)
For those using the infiniivision_ext.lnk the web interface has some issues unless a bunch of "work arounds" are done.
What were you lot playing about at ;)
That's not fair, we told you what to look for and you did :P Not much choice for me back when I tried to unlock it because I had no LAN module, so all I could try was the USB stick.
Anyway, maybe it's safer to change the USB stick method to use infiniivision.lnk and not infiniivision_ext.lnk.
A common thing of all the troubled scopes is that they had a short stay at Keysight recently, so my bet is that they are having a lot of fun reading this thread...
So maybe there are two versions of 2.41 floating around, or the contents of the original link file depend on how/when 2.41 was installed/upgraded etc.
...
...
A common thing of all the troubled scopes is that they had a short stay at Keysight recently, so my bet is that they are having a lot of fun reading this thread...
I've been looking at the firmware for the MSOX4k series (4.08). Much like 2.41 for the 2k/3k it has two different infiniivisionlauncher.exe files and the infiniivision.lnk file is not empty either.
Interestingly, the infiniiVisionLauncher.exe file in the secure/infiniivision directory crashes with an error when executed, so it doesn’t appear to be compatible with the 4K series. The infiniivisionlauncher.exe file that is used is located in the Program Files directory.
It appears as though the bytes to change in infiniivisioncore.dll start at location 0x407a50. Can someone confirm that location?
http://www.filedropper.com/4kcore (http://www.filedropper.com/4kcore)
Also, for those who have old versions of the firmware, for any model (2k, 3k, 4k).. PLEASE post them somewhere that doesn't delete the files after a couple of weeks.. All the filedropper links older than a few weeks are dead.
72#\Secure\infiniiVision\infiniivisionLauncher.exe -l all -l BW20 -l SCPIPS
Mainly because of all options plus 200MHz bandwidth, admittedly I don't know what SCPIPS is supposed to do.http://www.shapeways.com/search?q=dsoxlan&type=product (http://www.shapeways.com/search?q=dsoxlan&type=product)
- using the serial, interrupt the boot with space, which brings me to CE loader (not uboot, like I first thought)
- it tells me the scope has address 192.168.1.131, so I have to prepare a little network for that
- on a PC, start the CELoader tool from ninja user PA0PBZ, with a NK.BIN.COMP file from some firmware cab renamed to NK.BIN and placed next to it
- hit 'd' at the CE loader prompt to download it
- edit: I see it tries some DHCP, so above IP may not be the final one, I may attach it to my regular network
- anyway: how to specify the server?
- it should load the firmware and make the scope temporarily useable again
- telnet into the scope (perhaps configure network first?) and fix a dual link problem
- be good again
Did I get that correctly?
121#\Secure\infiniiVision\infiniivisionLauncher.exe -l DIS -l MSO -l MEMUP -l SCPIPS -l CABLE -l SGMC -l FLEXC -l TOM -l BW20
It's using "-l DIS" to enable most of them (instead of "-l all" which gives asterisk marks in the about box), then filling up the rest. You may want to edit your bandwidth at the end.:TheSteve
I have to say first many thanks for your effort and for all other members on front-end upgrade procedure.
I'm really thinking on doing a 3000T front-end upgrade from 100Mhz to 350 Mhz, and I would really appreciate some help from you. Are the parts needed the same as those for 3000A Series?
Has anyone completed a 3000T frontend upgrade?
All my regards.
How are you going to enable the 350MHz option in software first?On the basis that the 3000T has the same "return to service center" requirement as the 3000A when you go from 100MHz to 350MHz:
So going from 100MHz to 200MHz is a software only option but 100/200 to 350 is hardware enabled?
Thats very convenient.
I have a stock 500MHz, I keep watching here to make the big jump to the Ghz moon... so far no big news as I understand. Do you need high res pics of the 500Mhz front end? IMO no, in any case PM me I'll do my best to support you talented guys.what I understood is that:
That is also my understanding, plus that the sampling rate is 5GSa/s compared to 4GSa/s, so I don't know if there is anything different beyond the AFE such as ADC, FPGA or ASIC speed grades.I have a stock 500MHz, I keep watching here to make the big jump to the Ghz moon... so far no big news as I understand. Do you need high res pics of the 500Mhz front end? IMO no, in any case PM me I'll do my best to support you talented guys.what I understood is that:
1) the boards for 100 - 500 Mhz are the same, 350/500 Mhz are just using some different capacitor/inductor values at the front end compared to the 100/200 Mhz boards.
Thus upgrade 100->200 and 350->500 Mhz can be done by software. 100/200 -> 350/500 Mhz will just need a few some parts replaced.
2) the 1 GHz board is indeed different (addl. relay etc.), thus an 'upgrade' will not be possible (at least not an easy upgrade).
That is also my understanding, plus that the sampling rate is 5GSa/s compared to 4GSa/s, so I don't know if there is anything different beyond the AFE such as ADC, FPGA or ASIC speed grades.I have a stock 500MHz, I keep watching here to make the big jump to the Ghz moon... so far no big news as I understand. Do you need high res pics of the 500Mhz front end? IMO no, in any case PM me I'll do my best to support you talented guys.what I understood is that:
1) the boards for 100 - 500 Mhz are the same, 350/500 Mhz are just using some different capacitor/inductor values at the front end compared to the 100/200 Mhz boards.
Thus upgrade 100->200 and 350->500 Mhz can be done by software. 100/200 -> 350/500 Mhz will just need a few some parts replaced.
2) the 1 GHz board is indeed different (addl. relay etc.), thus an 'upgrade' will not be possible (at least not an easy upgrade).
One thing I had considered is whether or not the Teledyne relay is really required, or it can use the existing relays with some degradation to 1GHz. At the time we were looking at the part differences between the 100/200 and 350/500, I'm not aware of a full schematic being made, although I remember the question being asked among the interested parties. I can't remember if the Teledyne relay is an additional one, or a replacement of an existing relay. Either way, the boards are _definitely_ different, it's not just an unpopulated part. Trying to run bodge wires at this kind of frequency isn't going to end well, which is why I'm wondering if just running the existing relays out of spec and any appropriate L/C changes would be enough.
It's the bandwidth of the scope
00 = 70MHz
01 = 100MHz
02 = 200MHz
03 = 350MHz
05 = 500MHz
10 = 1000MHz
That is the analog bandwidth, tho. Check that vs x GSamples/second.It's the bandwidth of the scope
00 = 70MHz
01 = 100MHz
02 = 200MHz
03 = 350MHz
05 = 500MHz
10 = 1000MHz
Ah, so mine would be 2014A => 100MHz
I think that would means that it can accurately, within 2% accuracy, measure up to 20MHz sinewave
What about square wave, though? I had dug up an old EXO3 CMOS oscillator with max 20MHz squarewave clock pulse and it seems the resulting waves are quite jagged... maybe I need more expensive probe... hmmm
I had dug up an old EXO3 CMOS oscillator with max 20MHz squarewave clock pulse and it seems the resulting waves are quite jagged... maybe I need more expensive probe... hmmm
Yep pin 4 ground, and I've probed directly and still get some overshoot/undershoot...
The 200MHz version with digital enabled (MSOX) is almost double the price of what I currently have.... dayum...
That reminded me... the bandwidth is hardwired/board dependent was it?
I think that would means that it can accurately, within 2% accuracy, measure up to 20MHz sinewaveNo, you can measure 100MHz quite accurately as the sampling rate is much higher.
That reminded me... the bandwidth is hardwired/board dependent was it?
Yep pin 4 ground, and I've probed directly and still get some overshoot/undershoot...
The 200MHz version with digital enabled (MSOX) is almost double the price of what I currently have.... dayum...
That reminded me... the bandwidth is hardwired/board dependent was it?
If you can attach a screenshot we can see if it looks reasonable of not. It's never going to look perfect.
I believe that the 100MHz 2000 can be liberated to 200MHz in software, as can the MSO option, but I don't have any direct experience with the 2000.
I think that would means that it can accurately, within 2% accuracy, measure up to 20MHz sinewaveNo, you can measure 100MHz quite accurately as the sampling rate is much higher.
All of the 2000 series is 2GS/s, the 3000 (non T version) up to 500MHz is 4GS/s and the 3000 1GHz is 5GS/sThat reminded me... the bandwidth is hardwired/board dependent was it?
All the official options on the 2000 series can be upgraded with software with the fixes mentioned earlier in the thread. 3000 can be software upgraded to 500MHz, 1Ghz is hardware change.
189#\Secure\infiniiVision\infiniivisionLauncher.exe -l DIS -l MSO -l memMax -l MEMUP -l ADVMATH -l SGM -l SGMC -l AUTO -l COMP -l TOM -l EMBD -l VID -l COMP -l SCPIPS -l WAVEGEN -l MASK -l BW20
I can't believe no one on this thread ever mentioned using '--perf' on a 2000. It works miracles! (sort of...)
The command line description is:
--perf
make entry like performance
In other words: make a 2000 behave like a 3000.
It has always been there in plain sight. It will not enable specific 3000 licenses though, but it does enable extra maths, triggers and stats, including overlay stats. Just like a 'vanilla' 3000.
I can't believe no one on this thread ever mentioned using '--perf' on a 2000. It works miracles! (sort of...)
The command line description is:
--perf
make entry like performance
In other words: make a 2000 behave like a 3000.
It has always been there in plain sight. It will not enable specific 3000 licenses though, but it does enable extra maths, triggers and stats, including overlay stats. Just like a 'vanilla' 3000.
Sounds good. Exactly where does that command go and what is the actual syntax?
Does it get added to the -l ALL etc string in the Startup infiniivision.lnk file or ?? i.e. do we end up with -l ALL -l PERF or ??
Does it work with 2.39 or is it version specific.
In case I'm not the last noob to join the party, hope to close the boobytrap.
Here is a refined procedure, see attached. No benefit for existing users, this is rather for newcomers, to prevent bricking with the dual link problem.
The readme file is updated, all credits for the method in general to user "memset".
I've split the procedure into an install CAB which moves away the factory link (if present) and copies the .lnk file from USB, and an uninstall CAB which removes the added .lnk and restores the original link, if one was present.
The supplied .lnk file should be a useful template on how to set all options:Code: [Select]121#\Secure\infiniiVision\infiniivisionLauncher.exe -l DIS -l MSO -l MEMUP -l SCPIPS -l CABLE -l SGMC -l FLEXC -l TOM -l BW20
It's using "-l DIS" to enable most of them (instead of "-l all" which gives asterisk marks in the about box), then filling up the rest. You may want to edit your bandwidth at the end.
I've tested uninstall, install and more install to update on my 3014A. So far not tested on a 2000 series model, but according to previous postings that should work, too.
Use at your own risk, of course.
George,
Try to move the --perf to the front or remove all other parameters. I've heard before that some options don't work when appended to a long list. And double check your number before the #.
This should work: -l MSO -l DIS --perf --forcemaxmem
Make me think what more could be 'hidden' on 2000 and 3000?
Thank you by the help!
Even digital input selection for serial decoding should be possible, including I2S
QuoteEven digital input selection for serial decoding should be possible, including I2S
Would really like that one - wouldn't need to have the PC and Logic on standby.
QuoteEven digital input selection for serial decoding should be possible, including I2S
Would really like that one - wouldn't need to have the PC and Logic on standby.
Which FW version do you have? And are you able to patch it?
Can anyone explain me how it is possible to add options to the .lnk file without patching the internal v2.41 infiniiVisionCore.dll file? It first has to be 'unlocked', right?No patching required. The .lnk file starts a different executable, which allows command line parameters. The only and slight drawback is a nag message after boot.
Or did I miss something?
Can anyone explain me how it is possible to add options to the .lnk file without patching the internal v2.41 infiniiVisionCore.dll file? It first has to be 'unlocked', right?No patching required. The .lnk file starts a different executable, which allows command line parameters. The only and slight drawback is a nag message after boot.
Or did I miss something?
You need firmware 2.41 installed beforehand. It was reported to work with 2K scopes:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1100759/#msg1100759 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1100759/#msg1100759)
I have a 3024T that I'd love to up to 500Mhz.Would be really nice to get good pics from DSOX-T. T-versions should be relatively easy to push to 1Ghz by adding Teledyne attenuator relays. PCB topology should be "ghz-ready".
I will take pix of the board when I get back from holidays. I'm not at the level where I would be able to figure this out for myself, so I'd be relying on someone else taking the plunge first.
Can anyone explain me how it is possible to add options to the .lnk file without patching the internal v2.41 infiniiVisionCore.dll file? It first has to be 'unlocked', right?
Or did I miss something?
Interesting that they're using what appears to be the same board: on the 3000A the Teledyne relay didn't have any placement lands on the 500MHz and below units that I've seen.Maybe when they did the T version PCB they combined the versions
Let's start to put together the list for all the parts needed and I'm willing to look into modding to 1Ghz. :box:
There's a transistor there at Q501 also needed. I've tried looking for the marking (N1 v) and there are a few possible matches for that. Anyone know what that could be?Q501 should be Teledyne's control N-MOSFET. I think it's MMBF0201NL. Unfortunately, P-MOSFET Si2301CDS also fits for N1 marking, but only N-fet seems to be sane to use for relay switching control.
Is your scope still apart Mike?Sorry no.
Clearly, pcb cleaning is very very important.. Though, my question to you, is what cleaning agent would you recommend in this case?
Keysight probably isn't up for donating a 100 MHz scope to experiment on...
The easiest way would be someone with a 1Ghz scope do these measurements so we compile the BOM. Otherwise it would be a hit and miss operation for determining the right values.Even better option is to leak these values from scope's schematics. Or leak the schematics.
Clearly, pcb cleaning is very very important.. Though, my question to you, is what cleaning agent would you recommend in this case?Just don't use any cleaning agent and use very small amounts of no-clean flux for any soldering.
As a side note for all interested parties.. Moving the K503 relay into the K501 position requires hot air desoldering.Not necessary. It's possible to desolder these relays side by side using good soldering iron with some wide blade tip. Or even with common tip using additional wire to separate pin from its pad. Pretty doable without melting the whole package.
At this point I'd say it wouldn't be too bad too to mod a 3014T/3024T the same as has been done with the 3000A, the hardware would be 500 MHz but without the license you'd be stuck at 350 MHz.Another good thing about 1 GHz mod is getting the whole bandwidth without affecting any software licenses. You'll loose MSO license (if any), but scope will work at 1GHz and 5GSa/s out of the box - without any SW mods.
Another good thing about 1 GHz mod is getting the whole bandwidth without affecting any software licenses. You'll loose MSO license (if any), but scope will work at 1GHz and 5GSa/s out of the box - without any SW mods.
.....and I'm getting curiousousYou are not the only one. But........ the login id/password are currently unknown (or at least not public).
Sorry for this "beginner question", but what is the default userid/password for the 3024T. My googling didn't bring it up... ?Telnet password for T-series is unique and Serial / MAC address based.
Why does the MSO licence break?As far as I remember from my earlier experiments, 1GHz version use different MSO license. So if you change strapping to 1GHz, original MSO license will not be used anymore.
That's a shame. MSO is probably more useful to me at the moment than 1Ghz-l MSO than.
That's a shame. MSO is probably more useful to me at the moment than 1Ghz-l MSO than.
Hard to do on the 3000T model when we can't login.
user: "infiniivision"
pass: "skywalker1977"+hash(ModelName, SerialNumber, MACAddress)
Need to figure out how to hash that data exactly
Apart from that I don't think we know if it is possible to activate the options like that on a T model.I think it's all the same.
:memset - Is strapping for 1Ghz the same as for 350/500Mhz ? I was under this impression..
:Memset - Do you happen to have the values of your original parts in 3000A scope so I can compare it with mine's? I looked in the thread but I did see just values for upper bandwidth scopes.
Please don't, I don't need to buy any more scopes!
Please don't, I don't need to buy any more scopes!
Why not? Buying scopes is fun!
I think I saw some code example there:
https://repl.it/FLUQ (https://repl.it/FLUQ)
http://pastebin.com/2NJjMTxQ (http://pastebin.com/2NJjMTxQ)
Not sure whether it works or not.
I predict a rapid sales rise in the MSOX3014T.
I predict a rapid sales rise in the MSOX3014T.
Oh yes, I could have saved a good amount of money going with a 100MHz and no APP2BNDL :-DD
Anyway, no regrets, its a wonderful scope !!
EDIT: But boy it would be wonderful to get 500 MHz, I did not in the first place as that was a major price increase, but would be very very nice....
So I have logged into my 3024T!
The python script worked great.
I used infiniivision for the username and the hash as the password
Now what?
So I have logged into my 3024T!
The python script worked great.
I used infiniivision for the username and the hash as the password
Now what?
Let the game commence!
So I have logged into my 3024T!
The python script worked great.
I used infiniivision for the username and the hash as the password
Now what?
Let the game commence!
How much for that scope you mentioned under your desk?
If I understand correctly I can get 350Mhz without any hardware modifications, is that correct?Can I sense which of your instruments will get improved next ? :box:
If that is the case, what is the command for that? -bw35?
If I understand correctly I can get 350Mhz without any hardware modifications, is that correct?
If that is the case, what is the command for that? -bw35?
Ah ok, Well in that case, onto the Hardware mods.
Need to find those Teledyne relays!
I am thinking the MSO feature will not be lost if a T series 100/200/350/500 MHz scope is strapped for 1 GHz. The T series uses a single part number for the MSO upgrade. The A series used two numbers, one for the 100-500 MHz scopes and one for the 1 GHz. I expect the two versions use different licenses which could explain why the MSO feature was no longer enabled when memset tried it.
I predict a rapid sales rise in the MSOX3014T.
Oh yes, I could have saved a good amount of money going with a 100MHz and no APP2BNDL :-DD
Anyway, no regrets, its a wonderful scope !!
EDIT: But boy it would be wonderful to get 500 MHz, I did not in the first place as that was a major price increase, but would be very very nice....
It is starting to look like this might be a possible reality. Can you give us details on the internal file structure of the "T" series.
The hardware mod to 500 MHz so far looks identical to the 3000A series.
Attached is a dump of the file structure of my MSOX3024T (3 months old approx).
Directory of \Secure\infiniiVision
10/18/11 08:47p <DIR> web
10/18/11 08:47p <DIR> fpga
10/06/16 04:48p 1152032 splashImage.bin
12/29/15 10:27a 105160 symbols.tte
12/29/15 10:27a 1891 usbDemoData.html
12/29/15 10:27a 822702 usbDemoDataEye.png
12/29/15 10:27a 822702 usbDemoDataPlot.png
Found 7 file(s). Total size 2904487 bytes.
Attached is a dump of the file structure of my MSOX3024T (3 months old approx).
So, the infiniivisionlauncher.exe is missing from the \Secure\infiniiVision folder:Code: [Select]Directory of \Secure\infiniiVision
10/18/11 08:47p <DIR> web
10/18/11 08:47p <DIR> fpga
10/06/16 04:48p 1152032 splashImage.bin
12/29/15 10:27a 105160 symbols.tte
12/29/15 10:27a 1891 usbDemoData.html
12/29/15 10:27a 822702 usbDemoDataEye.png
12/29/15 10:27a 822702 usbDemoDataPlot.png
Found 7 file(s). Total size 2904487 bytes.
But apart from the Program Files\infiniiVision folder there is another infiniivisionlauncher.exe in the \Windows folder... Interesting.
Can you show the content of the infiniivision.lnk in the \Secure\Startup folder? I bet it is pointing to the launcher in Program Files.
As I expected it starts the launcher in the Program Files folder.
If you feel like doing a little experiment you can try the following:
taskkill /im infiniivisionLauncher.exe
\windows\infiniivisionlauncher.exe -bw35
Your hardware is not 350MHz but I wonder if it will show the 350MHz on the info screen, and also it could warn about 'unfinished software' like it does on the non-T version.
After that reboot the scope or kill the launcher again and start the one in Program Files\infiniiVision.
I'm not able to execute "taskkill" ? If I search for taskkill as an exe it is not found, and it is also not listed as a builtin command in the telnet ??
I'm not able to execute "taskkill" ? If I search for taskkill as an exe it is not found, and it is also not listed as a builtin command in the telnet ??
Sorry, not sure what OS was in my mind when I typed that, it should be:
ProcessMgr.exe kill infiniivisionLauncher.exe
But the "about" screen still says 200 MHz (assuming thats were you want me to look)
But the "about" screen still says 200 MHz (assuming thats were you want me to look)
Yes, I sort of expected that to change. Did you see the 350MHz in the listed options?
Can you try:
\windows\infiniivisionlauncher.exe --help?
That should show the valid options
Just noticed that there also is a infiniivisionlauncher.exe in the "program files\infiniivision" folder, but same size as the one in the windows folder (5632 bytes)
Just noticed that there also is a infiniivisionlauncher.exe in the "program files\infiniivision" folder, but same size as the one in the windows folder (5632 bytes)
Yes, that is the one that is started when you boot the scope, it is in the .lnk file in startup remember?
Well, I'm out of ideas for the moment, let's wait for a few other eyes, but it looks like the process is different in the T series.
Unfortunately not! it just gives:
\> ProcessMgr.exe kill infiniivisionLauncher.exe
\> \windows\infiniivisionlauncher.exe --help
Our command line is --help
cCanineCalMgr::cCanineUserCalFactors::cCanineUserCalFactors size 27872
cCanineCalMgr::cCanineServiceCalFactors::cCanineServiceCalFactors size 704
cCanineCalMgr::cCanineFactoryCalFactors::cCanineFactoryCalFactors size 708
System has been running 119.515244 seconds
also tried -help and -?, both with same result!
Just noticed that there also is a infiniivisionlauncher.exe in the "program files\infiniivision" folder, but same size as the one in the windows folder (5632 bytes)
\secure\infiniivision> infiniivisionlauncher.exe --help
Our command line is --help
USAGE:
infiniivision [--ExtTalClk] [--IntTalClk] [--4GSa] [--5GSa]
[--flushNetwork] [--gpibModule] [--lanModule]
[--debugTestAddress <debugTestAddress>] [--noAdcResync]
[--noBlanketInit] [--noScreenSaver] [--twoChan] [-f
<string>] [--sliceid2] [--sliceid1] [--sliceid]
[--mondll] [--disdcc] [--oldadcstartup] [--noadcreset]
[--forcemaxmem] [--newVga] [--invsoft] [--probecomp]
[--calChannel <Channel Number>] [--codeSnitch] [-u <3
character string>] ... [-l <3 character string>] ...
[--traceFlags <Base10 number>] [--str] [--ctrlDiagStr
<Binary string>] [--ctrlDiagVal <Base10 number>] [--perf]
[--msg] [--dflt] [--noScope] [--srv] [--] [--version]
[-h]
Where:
--ExtTalClk
--IntTalClk
--4GSa
--5GSa
--flushNetwork
--gpibModule
--lanModule
--debugTestAddress <debugTestAddress>
debug test address
--noAdcResync
disables periodic adc resync
--noBlanketInit
disables blanket init
--noScreenSaver
disables screen saver
--twoChan
-f <string>, --family <string>
product family
--sliceid2
enable slice id
--sliceid1
enable slice id
--sliceid
enable slice id
--mondll
enable monDLL
--disdcc
enable disDCC
--oldadcstartup
old ADC startup
--noadcreset
--forcemaxmem
--newVga
--invsoft
--probecomp
--calChannel <Channel Number>
Channel to calibrate (0 = ALL CHANS, 1=CHAN1, ect.)
--codeSnitch
collapse thread priorities for CodeSnitch
-u <3 character string>, --disableLicense <3 character string>
(accepted multiple times)
disable licence XXX
-l <3 character string>, --enableLicense <3 character string>
(accepted multiple times)
enable licence XXX
--traceFlags <Base10 number>
mask for DebugPrint
--str
CMD_LINE_STR_DEFAULT_STR_DB
--ctrlDiagStr <Binary string>
control system diagnostics
--ctrlDiagVal <Base10 number>
control system diagnostics
--perf
make entry like performance
--msg
logs generic diagnostics
--dflt
default setup
--noScope
no scope mode
--srv
runs scope in service mode
--, --ignore_rest
Ignores the rest of the labeled arguments following this flag.
--version
Displays version information and exits.
-h, --help
Displays usage information and exits.
infiniiVision
On my version (an old 2.35 firmware) the "--help" option works, see below for some interesting options to play with. On my scope you could enable all licences with "-l All", but maybe this was changed in later versions, and probably for the bandwidth you need some extra parameters.
I predict a rapid sales rise in the MSOX3014T.
But the "about" screen still says 200 MHz (assuming thats were you want me to look)
Yes, I sort of expected that to change. Did you see the 350MHz in the listed options?
Can you try:
\windows\infiniivisionlauncher.exe --help?
That should show the valid options
Killing the running instance of infinnilauncher.exe and running it again with other options, can brick the scope? As I'm an IT guy, I presume this might just either not work or just throw an exception about not recognising other parameters i might try.
Does anyone have the infiniivisionlauncher.exe from the A series at hand so I can try that as well, or should I just extract it from the latest .bin file?
\windows\infiniivisionlauncher.exe -l allYou can try to copy infiniivisionLauncher.exe from 3000A (not sure if it works for T) to USB, attach USB flash and run:
has no effect on enabled options without other changes.
Why do you think the Teledyne part is an attenuator?That's definitely an attenuator. In 1GHz model 50Ohm terminated DC path completely bypasses default R-L-C attenuation network and switches to this Teledyne relay for -20dB and to direct path for zero attenuation). Also, alternative input pins are used in frontend ASIC. That's why datasheet max vertical range is different for <1Ghz and 1GHz models at 50Ohm.
and in another pic showing the underside, and the following post showing the unpopulated version, it's a six pinner
How does that sound?Sounds right. I'm sure they used the same relay for the A and T. And the photo with the part number is particularly telling. I looked for a photo with the number but I missed it.
Quoteand in another pic showing the underside, and the following post showing the unpopulated version, it's a six pinner
I don't think it is showing the underside - looks to me like it's showing the top, just not populated.
If you check the two vias, no matter how you turn the board over they can't migrate from bottom left to top right. Just a small point of order :)
only the second one I showed
So who has a DSOX/MSOX3104A/T and is brave enough to measure a few critical parts for the greater good?Do you have a list of values you need and a picture of where they are located?
What if I throw in a bribe to make it happen?
So who has a DSOX/MSOX3104A/T and is brave enough to measure a few critical parts for the greater good?Do you have a list of values you need and a picture of where they are located?
What if I throw in a bribe to make it happen?
Do you have a list of values you need and a picture of where they are located?Hello! I'll prepare some pictures on this weekend.
:Memset Do you think we can easily find their values or should we think about highlighting them for measurement also?All resistors are directly marked, nothing but a good photo is required to identify them. And the photos are already here.
There is a resistor (??) missing in the lower bandwidth configs near the AD8034 and it has no marking (I've highlighted it in my pic).I can't see the pic but I've got your point. It's the same part as two on other side of afe block (near two big caps). Could be power inductor for relay.
Here's a high-res back AFE zone. I have more in different lighting angles. Let me know if this suits your needs or I'll prepare an archive with few of them and put it online.Good enough, but somewhat worse than your superb photo of the top layer. The interesting part is readable, but being on the periphery its blurred and causes some dizziness while looked at narrowly.
In my 3014T this component I'm talking about is missing (not-populated). I've reattached the image maybe you can see it now.
:Howardlong Not necessarily time consuming but needs at least a few advanced level tips. My setup is DSLR + tripod + off-bracket (wirelessly triggered lighting) flashes. Macro is not a must. For example I've shot these with 17-40 wide lens which offers 0.28m minimum focusing distance.
The most important thing is lighting. Off camera bracket flash offers different lighting angles and gives the ability to use small aperture (high F-stops) which provides larger DOF and sharpness.
heavy idling is detected on this thread
It won't be cheap though because of the needed Teledyne attenuators.
:TheSteve "The values to go to 500 MHz should be the same as the A series." -> This has been confirmed by me (100->350Mhz) - It's clear the 350Mhz limiting is done in the fpga as it's exactly there, and not limited by actual hardware. 350->500 is done by software license.
:memset has put a nice list for 1Ghz upgrade, although the values of the caps and inductors are unknown. Hoping for help here. This would be really a beer giving opportunity minimum. :)
I find this thread absolutely amazing and awful in the same time.
I spent few hours several of days reading through the pages.
It is an amazing job, knowledge, interactivity and solutions found.
It is awful for a new comer which would like to follow and understand the proposed solutions.
I have read so many times the same words similar with “read few pages back”, “somewhere in thread if you read it through”. It is totally unorganized from my point of view. It is awful.
I can understand that is related with how the solutions evolved based on tests, experiments, trails, communications, but once a solution is found, it should stay somewhere easy to be found by a new reader.
I have seen new comers on the topic asking the same questions and sometimes a good willing older user copied and pasted the solution, because the new user is lost in the forest of trials. After the solution was found, some other guys still had all kind of problems and others not. Then all these important info spread along many pages is a headache. It is like half of job done.
Why is it like that? Is it on purpose? Or is no one able to organize and publish the solution as top line, a header, a new thread, a link with simply steps organized? It would be helpful at least to understand why. In the end are not so many versions of the firmware. The version 2.35 is an important step and then comes later 2.41. Then is USB method for old and LAN card for new. USB requires downgrade for versions above 2.35 to the version 2.35. Then are all kind of tricks and mistakes done by different users. It is a headache.
I was thinking once reading through the pages, why is it so unorganized after the solutions were found and can someone tell if it is true at least the ideas below that came into my mind?
It is spread and unorganized, because:
- No one care to do it organized.
- It is easy to hide the solution/hack for the other search engines or other technical people outside the forum (from Agilent?), because they must spend also hours and go through so many pages to understand what solutions have been found here.
- After so many hours of trails and tests, the experienced users who found the solutions, decided that at least this is what other new readers can do when receive the solution for free without their own brain work: to read the pages back and find the solutions spread along the xx pages. That would be fine, but still is a big headache because is spread and twisted along so many pages. If it is meant to be free for others, then to whom does it help to not be organized?
Reading the pages back to find the solution produces only frustration until you find and understand the procedure.
....
While I understand your frustration, here are two reasons. Firstly, a forum simply doesn't work like a wiki does, where multiple editors can modify a single resource. Second, much of this is work in progress by several contributors. As you will have seen, over time solutions become more tailored, and there is usually room for further continuous improvement.Everything you said is correct.
This is not the only forum thread like this. Almost all hacking threads end up this way. If you've found one or two that don't then you have been lucky. I'm not excusing it, it's just that there isn't really a mechanism that allows several individuals to edit the first post of a thread in the same way that multiple editors can manage a wiki.
We have sometimes seen the first post of a thread being maintained by the OP, but that assumes that the OP's still interested in maintaining it, and will continue to be. It may well be that their original question has already been answered to their satisfaction. Again, this is the limitation of the single editor/post paradigm of a forum.
Sometimes you see well-meaning secondary threads attempting to summarise, but this rarely ends well, typically diluting the information across multiple threads, particularly if it is still a work in progress.
If you have a reasonable solution, then feel free to do it. What this isn't, although it's suggested in your post, is laziness or a deliberate attempt by contributors to obfuscate information. It's simply that a forum format doesn't lend itself to an immediate answer on a plate.
Problem: More administrative work to manage it...Exactly, someone still need to do it.
Thank you for your explanations, which are quite satisfactory.
In my opinion, I still consider it would be very useful if it would be open a dedicated thread only to verified solutions, described in detail by each user who verified/applied that particular solution and is willing to present it nice, monitored and closed by a moderator. Only the moderator would be able to append new verified solutions, if are nice and clear described. Definitely would be shorter and easier to follow.
All the other threads, as the present one for example, can be considered main research work, or the others collateral threads and it should be a final closed thread only with verified solutions.
But maybe no one is willing to invest time to prepare and maintain such thread, which is also understandable when the users are satisfied because already found for themselves a working solution after hours of trial and error.
Thank you for your explanations, which are quite satisfactory.
In my opinion, I still consider it would be very useful if it would be open a dedicated thread only to verified solutions, described in detail by each user who verified/applied that particular solution and is willing to present it nice, monitored and closed by a moderator. Only the moderator would be able to append new verified solutions, if are nice and clear described. Definitely would be shorter and easier to follow.
All the other threads, as the present one for example, can be considered main research work, or the others collateral threads and it should be a final closed thread only with verified solutions.
But maybe no one is willing to invest time to prepare and maintain such thread, which is also understandable when the users are satisfied because already found for themselves a working solution after hours of trial and error.
Thank you for your explanations, which are quite satisfactory.
In my opinion, I still consider it would be very useful if it would be open a dedicated thread only to verified solutions, described in detail by each user who verified/applied that particular solution and is willing to present it nice, monitored and closed by a moderator. Only the moderator would be able to append new verified solutions, if are nice and clear described. Definitely would be shorter and easier to follow.
All the other threads, as the present one for example, can be considered main research work, or the others collateral threads and it should be a final closed thread only with verified solutions.
But maybe no one is willing to invest time to prepare and maintain such thread, which is also understandable when the users are satisfied because already found for themselves a working solution after hours of trial and error.
Thank you for your explanations, which are quite satisfactory.
In my opinion, I still consider it would be very useful if it would be open a dedicated thread only to verified solutions, described in detail by each user who verified/applied that particular solution and is willing to present it nice, monitored and closed by a moderator. Only the moderator would be able to append new verified solutions, if are nice and clear described. Definitely would be shorter and easier to follow.
All the other threads, as the present one for example, can be considered main research work, or the others collateral threads and it should be a final closed thread only with verified solutions.
But maybe no one is willing to invest time to prepare and maintain such thread, which is also understandable when the users are satisfied because already found for themselves a working solution after hours of trial and error.
Hi,
there is also another reason for that, I think because also here is lot of gamblers which would like to reach lot of money for nothing, like hack some gear a sell for much more, but they are not usualy too much technicaly skilled and it's a litle barrier to do that. 8)
Daniel, could you please tell us and elaborate what is Keysight ready to do (legally) when you say "we've stepped in"?
I personally dislike the idea of making money out of hacks "buying -> hacking -> reselling".
But if I buy a device, no matter what is it, and own it, then is mine and I do what I want with it. If I want to hack it and reverse engineering it, then I do it and I see no legal reason why not as long as is for yourself and you do not make money out of it.
It is the same as iPhone and Jailbreak. Who has the biggest brain will win.
what will Keysight do if I decide to hack my own oscilloscope without selling it?
What will Keysight do if the guys from here decide to "upgrade" hardware their own oscilloscope by changing components, let's say to make it "better"? Is it anything illegal in that? If not, then why would it be for the software change/hack when smart guys change some bits around instead of components?
Of course I understand that Keysight is upset because some technical guys outside of the company found their "little secret" of certain Agilent/ Keysight oscilloscopes, but you should see it different. Maybe you just found a better way to improve your scope firmware security and why not, you may recruit your future development engineers from here.
I think many people will be happy if you can provide some answers to the questions above.
Take a look at this eBay item 172559013145
...
I have good reason to believe that it has been 'hacked'.
...
(It may have been an extreme teardown)
Greetings everyone,
Thanks for sharing so freely! I've got an MSO-X 3014A with 02.41 FW and spent the whole of yesterday unsuccessfully trying to get the scope to boot from a USB stick (using infiniivisionStartupOverride.txt, modified infiniivision.lnk, infiniiVision directory extracted from _setup.xml, etc.). FYI, I do not have the LAN extension card, so I can't telnet. Would telnet still be a possibility with 02.41 FW?
After scanning through the posts, it seems that it can't be done with 02.41 FW (correct?). I must downgrade to 02.35 FW (correct?). It also looks like my efforts were academic anyway, because 02.41 FW does not have an "infiniiVisionCore.dll" file. To make matters worse, I do not have the 02.35 FW, only 02.12 and 02.41.
Probably not right to ask publicly (in fear of the hole being fixed so feel free to ignore), but has anyone had any success with 02.41 FW?
Anyway, thanks and good luck!
Regards,
Pieter
I have tried several hours during several days to read this forum. It is not easy. It just make me the impression that I understood few things, but is not clear how shall I hack the scope to unlock all its features.
try to say the fun part, because is not, it makes you gray hair.
Hi group,
Take a look at this eBay item 172559013145
http://www.ebay.ca/itm/KEYSIGHT-Infiniivision-MSOX3034T-Mixed-signal-Oscilloscope-350Mhz-MEGA-ZOOM-/172559013145?hash=item282d519519:g:GqYAAOSwhlZYuQIj (http://www.ebay.ca/itm/KEYSIGHT-Infiniivision-MSOX3034T-Mixed-signal-Oscilloscope-350Mhz-MEGA-ZOOM-/172559013145?hash=item282d519519:g:GqYAAOSwhlZYuQIj)
I have good reason to believe that it has been 'hacked'.
Regards,
Jay_Diddy_B
(It may have been an extreme teardown)
BTW, is there the source code for u-boot for the scopes somewhere?I have it, I think for the 2000/3000X series. No idea how I got it and it's 55MB so a bit hard to attach.
Dropbox or Google drive and share the link, please?BTW, is there the source code for u-boot for the scopes somewhere?I have it, I think for the 2000/3000X series. No idea how I got it and it's 55MB so a bit hard to attach.
Dropbox or Google drive and share the link, please?
U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500
CPU: SPEAr600
DRAM: 128 MiB
Flash: 512 KiB
NAND: internal ecc 256 MiB
Debug serial initialized ........OK
RTC: 2017-3-11 19:20:23.24 UTC
Microsoft Windows CE Bootloader Common Library Version 1.4 Built May 7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008
P500 Boot Loader Configuration :
Mac address .......... (XX:XX:XX:XX:XX:XX)
Ip address ........... (192.168.1.175)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (0)
Load image 1 at startup
Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
1 (0xd0400000)
2 (0xd4400000)
l) Load memory resident image Load image 1 now
1) Load memory resident image 1 now
2) Load memory resident image 2 now
3) Load memory resident image 3 now
d) Download from platform builder now
u) Start u-boot by resetting
v) Verify Images
>Soft reset of CPU
Soft reset failed. Trying HW reset.
HW reset failed.
P500 Boot Loader Configuration :
Mac address .......... (XX:XX:XX:XX:XX:XX)
Ip address ........... (192.168.1.175)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (0)
Load image 1 at startup
Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
1 (0xd0400000)
2 (0xd4400000)
l) Load memory resident image Load image 1 now
1) Load memory resident image 1 now
2) Load memory resident image 2 now
3) Load memory resident image 3 now
d) Download from platform builder now
u) Start u-boot by resetting
v) Verify Images
BTW, is there the source code for u-boot for the scopes somewhere?I have it, I think for the 2000/3000X series. No idea how I got it and it's 55MB so a bit hard to attach.
50#\windows\cmd.exe /c \Secure\startinfiniivision.cmd
50#\windows\cmd.exe /c \Secure\startinfiniivision.cmd
must be placed in “\Secure\Startup\” using simple copy command.What do you want me to say? The Rigol specs sure look nice on paper.I've worked with the Rigol scopes a long time, it is still funny to see the 4000's stutter on the display (watch the traces they pause momentarily even in roll mode). We've had a flood of users all saying how deep memory is the essential feature and they want Mpts in their low end scopes but almost complete silence on what they want to use it for, specmanship is a sport in its own and the rest of us evaluate the produce for our uses and then get on with work.
Perhaps it has something to do with the performance (speed among others) of the Keysight compared to the 4k Rigol. I think to recall the Rigol is really terribly slow when you enable MSO or math functions or longer memory.
Because I started to play with that HEX editor when I patched the “infiniivisioncore.dll”, it seems the warning messages that we see are inside to that dll and in fact can be removed. Have a look at the screenshots below.
Has anyone tried to remove them?
“We've had a flood of users all saying how deep memory is the essential feature and they want Mpts in their low end scopes but almost complete silence on what they want to use it for”I need it and I used it for non-repetitive asymmetrical “long” time signals/events. More or less a DAQ with high speed digitizers would definitely fit better to such analysis, but they were too expensive and I need it once in a while, maybe couple up to several times per year, so occasionally and for the rest of time a simple DSO is just fine. In a previous job I had in my hands for 2 weeks a Yokogawa DL850E scopecorder which was quite good for what I needed, but was around 25K €, quite expensive, but 16 channels with continuous recording at 100MSa/s was good. We were almost ready to buy it together with other instruments, but some things changed in the company and the project of improving the lab stopped and later I left that company. In fact I wanted initially to transform a high end PC into s signal recorder by adding high speed digitizers and dedicated software. A second option was to use frame for digitizers from National Instruments, but the price with software and setup time came close to a ready-made system as the one from Yokogawa.
“I also believe that has something to do with how the memory is accessed in the scope”.You may be right, but perhaps Bud can help us more here.
“What's the waveform update rate of the Rigol at that memory depth anyway?”That is not fair and not a good comparison to decide over the acquisition of the signal. Here it is why.
“
Bandwidth upgrade for free!
Bandwidth upgrade for Rigol DS/MSO403X from 350 MHz up to 500 MHz, with a total value of € 2487.10 (incl. VAT)
All Options for free!
Get all options with a total value of € 3429,58 (incl. VAT) for free with the purchase of a new device. Offer valid until June 30th, 2017!
“
Do I smell here a Rigol-Agilent debate?
The only problem is at waveforms/s, which is not important for me.
Since I have read your discoveries I have a nail in my stomach and thoughts flies trough my head: is my scope also with open PLL? How can rely on any signal acquisition/measurement? How bad is it?...I haven't read the PLL thread in a long time but if I remember correctly it seemed that there were issues due to unstable voltage regulator which was because in some manufacturing batches an incorrect "equivalent" substitute part had been used. And that only some were affected by the issue and most didn't experience it.
Neither was my intention to say 1M wfm/s is the most important thing nor the best metric to measure scopes. But a consequence of the memory (and price) differences is due to this different design. (and really has nothing to do with it being fair or not)This mention about architecture, memory and price made me think. Would it be completely wrong to say that the Keysight Megazoom ASIC based scopes might actually be cheaper to manufacture than the Rigol DS4000 series scopes that use 5 pieces of expensive Xilinx Virtex 5 XC5VLX30-1FFG676C parts to implement similar functionality that in the Keysight scope is handled by their own ASIC?
Even if you don't need it and you measure something different, it is very useful if your scope can show you such glitches, and you can see it by accident before it gets a problem for a customer of your product.
What is the price of existing RAM memory chips in Agilent
@ BudOne method used to determine PLL stability during the Rigol thing was to capture a maximum length record from a known stable source such as a crystal oscillator, and then examine the FFT on an external computer.
I am really impressed about your work and your findings. I have only bravo and applause. It is a Master work.
https://www.eevblog.com/forum/projects/project-yaigol-fixing-rigol-scope-design-problems/ (https://www.eevblog.com/forum/projects/project-yaigol-fixing-rigol-scope-design-problems/)
Since I have read your discoveries I have a nail in my stomach and thoughts flies trough my head: is my scope also with open PLL? How can rely on any signal acquisition/measurement? How bad is it?...
You do need to be very specific, as there are ways to trigger on most problems with sufficient memory around the trigger to get context.Quote from: Someone“We've had a flood of users all saying how deep memory is the essential feature and they want Mpts in their low end scopes but almost complete silence on what they want to use it for”I need it and I used it for non-repetitive asymmetrical “long” time signals/events. More or less a DAQ with high speed digitizers would definitely fit better to such analysis, but they were too expensive and I need it once in a while, maybe couple up to several times per year, so occasionally and for the rest of time a simple DSO is just fine. In a previous job I had in my hands for 2 weeks a Yokogawa DL850E scopecorder which was quite good for what I needed, but was around 25K €, quite expensive, but 16 channels with continuous recording at 100MSa/s was good. We were almost ready to buy it together with other instruments, but some things changed in the company and the project of improving the lab stopped and later I left that company. In fact I wanted initially to transform a high end PC into s signal recorder by adding high speed digitizers and dedicated software. A second option was to use frame for digitizers from National Instruments, but the price with software and setup time came close to a ready-made system as the one from Yokogawa.
I will not provide here full details of the application(s), but I will provide below setup examples.
but I work in the range 40Hz-100KHz with repetitive and non-repetitive signals, at which, sometimes/occasionally I detect signal event superimpose noise/pulses of max, 100MHz and even narrower pulses. The problem is that I need to see if these non-repetitive abnormalities of high frequency are maintained for longer period of time.Filters and acquisition modes should be able to extract the information without needing to store all the high frequency information if that high frequency information is no useful.
Between samplings the ADC is blind and the points are shown only with interpolation.It depends which acquisition mode you are in, very few requests I've seen for deep memory couldn't be solved with peak detect or envelope mode. There are applications for deep memory where you are needing to extract the high frequency information but it tends to be limited to RF/telco uses.
Why is then the Rigol memory slow?Great, then its probably a good scope for you. Rent/borrow/evaluate (don't buy yet) one and share your thoughts about it with us. Or try one of the PC based scopes, at these lower sample rates they can often stream direct to the PC for practically infinite memory depths.
It is good enough.
The only problem is at waveforms/s, which is not important for me.
And then my focus was on memory size compared with overall price of the instrument. It still makes no sense for me to put so small RAM memory in DSO today, when you look at the price of memory on the market and compare it with overall price of the instrument and particularly how much each DSO company asks for memory upgrade; it is ridiculous.Memory is not cheap compared to the cost of the product, and just the memory alone is not the limiting factor. There is a long thread recently on this hence my dismay you bring it up again so quickly:
My case is with the non-repetitive asymmetrical signals during normal operation mode, which happens/repeat only under certain conditions, for example during startup of a device.
Hi,I saw on another thread that there is new 2000/3000 FW just out today.
I am considering a new x2002, but only if the hacks are still live. Otherwise it's the rigol..... can someone confirm the hacks are still golden with the latest firmware on that unit?
I notice the firmware files for the X series are also "ksx" files now, though they are not encrypted so you can rename to zip.In the Release Notes it says to rename to .cab for scopes with firmware older than 2.41
Oh finally a lower multiplier, useful for items like amplifiers (think uCurrent). I still wish it would be arbitrary for odd divisions.I think the range still needs to be larger in both directions. 0.001 seems arbitrary since all the scope is doing is helping with the math. A Tek AM502 amplifier, for example, ranges up to x100k and would need 0.00001.
I updated my scope to the 2.42 Firmware this week, because they now allow a probe attenuation down to 0.001 which is quite useful.
Telnet Login an the "\Secure\infiniiVision\infiniivisionLauncher.exe -l DIS -l MSO -l memMax -l MEMUP -l ADVMATH -l SGM -l SGMC -l AUTO -l COMP -l TOM -l EMBD -l VID -l COMP -l SCPIPS -l WAVEGEN -l MASK -l BW20" Hack still works on my scope.
I updated my scope to the 2.42 Firmware this week, because they now allow a probe attenuation down to 0.001 which is quite useful.
Telnet Login an the "\Secure\infiniiVision\infiniivisionLauncher.exe -l DIS -l MSO -l memMax -l MEMUP -l ADVMATH -l SGM -l SGMC -l AUTO -l COMP -l TOM -l EMBD -l VID -l COMP -l SCPIPS -l WAVEGEN -l MASK -l BW20" Hack still works on my scope.
But you still needing to alter the hex info on dll file, or just add these options on the command line?
Won't work on T series thoughMine is an A model (I have an 2002A and a 3014A), but the 3014 have the bundle... And I've been using the 2002A just a little, but this weekend It showed when booting, that the firmware has some kind of problem.... Maybe I finally will discover how is the warranties service around here...
Won't work on T series thoughMine is an A model (I have an 2002A and a 3014A), but the 3014 have the bundle... And I've been using the 2002A just a little, but this weekend It showed when booting, that the firmware has some kind of problem.... Maybe I finally will discover how is the warranties service around here...
(PS: it was not changed firmware, I occasionally boot with a usb stick, so this problem is not correlated)
Untouched firmwares:
2.35 (https://drive.google.com/file/d/0BzPC3Qe5sA9tX29aVEx6VTFpMFU/view?usp=drivesdk)
2.37 (https://drive.google.com/file/d/0BzPC3Qe5sA9tTHg1UlJzd3pCTm8/view?usp=drivesdk)
2.39 (https://drive.google.com/file/d/0BzPC3Qe5sA9tNEVjVUt3ZExFcFU/view?usp=drivesdk)
2.41 (https://drive.google.com/file/d/0BzPC3Qe5sA9tQURuM2k3S0Vrc3c/view?usp=drivesdk)
2.42 (https://drive.google.com/file/d/0BzPC3Qe5sA9tUHA0a3VIdzc4VTQ/view?usp=drivesdk)
U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500
CPU: SPEAr600
DRAM: 128 MiB
Flash: 512 KiB
NAND: internal ecc 128 MiB
Debug serial initialized ........OK
RTC: 2024-17-4 5:84:14.2 UTC
Microsoft Windows CE Bootloader Common Library Version 1.4 Built May 7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008
PHY not found.
System ready!
Preparing for download...
RTC: 2024-17-4 5:84:14.2 UTC
Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN
X
XXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXOOOOOOOOOXOOOOXOXXOXOXXOXOXOXOXXXXOOXXXOOOOOOXXOXXOXXXXXXOOOXXXOXXOOOXXXOXXOOOOXOOXXOOOXOOOOXOXOOOOOXOOOXOOXOXXOXOXXXXXXOXXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOXX
OOOXOOXOOOOXOOOOXOOXXOOXOOOOOOOOOXOOOOXOOOOOOXOXOOOOXOXOOOOOOOXXOOXOOXOXOOOXOOOXOOXXOXOXOOOXOXXXXXOXOXXXOXXXXOXOXXOOOXXXXOXXXXOXXXXXXXOXXXXXXOXXOXXOXXOOXXOXXXOXXXXOOOXXX
OOOXXXOXXOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXXXXOOOXOXOOXOOXXXXXXXXXXXXXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x1A80C40, LaunchAddr = 0x80362000
Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000 Length=0x1A80C40 Name="" Target=RAM
Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
RTC: 2024-17-4 5:84:14.5 UTC
Launching windows CE image by jumping at address 0x 362000
Windows CE Kernel for ARM (Thumb Enabled) Built on Mar 8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Sep 28 2016)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000 size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200 (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
LAN PHY NOT detected.
DeleteP500EnetRegistry:
\Comm\GMAC 0x0
\Comm\GMAC1 0x0
\Comm\Tcpip\Linkage 0x0
\Drivers\Virtual 0x0
\Drivers\BuiltIn\LIN 0x5
LIN: Data Valid
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Device load time:
NANDFLASH: 0 ms
SNANDFLASH: 0 ms
USB Hard Disk Drive: 0 ms
dir \ > \usb\root.txt
Does the 2000-X method of Firmware overload not working on EDUX1002A? hmmm...This method can brick the scope if it does not like the content of infiniivision.lnk and it has no LAN port to bring it back to life. Has anyone tried it?
My method, courtesy of someone whose name I can't remember right now from quite some post back, is to copy :
v241_link_install.cab
v241_link_uninstall.cab
infiniivision.lnk
to my USB drive after modifying infiniivision.lnk to suit my purpose.
On the scope after it loads, I go to Utility->File Explorer and browse to the USB stick then load the install cab.
The Mainboard and BT Module is originally the Same...The EDUX and DSOX mainboards are different (same PCB, but different/missing/additional components)
Hello,I suggest moving this discussion about 1000X series here: https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/ (https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/)
The EDUX1002A has the Same Firmware as the DSOX1102A/DSOX1102G...
Daves Firmware has the Version 01.01.2016092800, with Licenses: All, EMBD*, AUTO*,SGM,MASK,BW10,EDK,WAVEGEN,DiS*,DVM*,RML.
My EDUX1002A has the Same Firmware: 01.01.2016092800 with Licenses: EDK, RML.
The Mainboard and BT Module is originally the Same...
And the Boot Procedure is only the Same, with the DSOX, only the Product Configuration is different, and the installed licenses....
Like I've already mentioned, I used the link installer someone posted somewhere in this thread on my DSOX 2014A 2.41 Firmware and it's fine and dandy.
If anyone want, I can re-upload my known good configuration files and links from my usb pen-drive...
Disclaimer, of course, that any bricking that might occurs is out of my hands...
Like I've already mentioned, I used the link installer someone posted somewhere in this thread on my DSOX 2014A 2.41 Firmware and it's fine and dandy.could you pls upload the files here ?if you can paste some instructions about how to use ,it would be wonderful !
If anyone want, I can re-upload my known good configuration files and links from my usb pen-drive...
Disclaimer, of course, that any bricking that might occurs is out of my hands...
you mentioned "bricked the scope" ,i'm not good at english ,does it mean this way may be harmful to scope ,such as breaking the scope ?Yes, a wrong step or wrong link might lead to your scope being unusable, and you'd need to send it back to the factory for repair.
DE BD7JAT
Wow, thats it now huh? From what I recall it was quite a bit more complicated years ago when I looked into it. So this will work with any version of the X2000 series? I have a stock Agilent MSOX2024A that has a few options I paid for.you mentioned "bricked the scope" ,i'm not good at english ,does it mean this way may be harmful to scope ,such as breaking the scope ?Yes, a wrong step or wrong link might lead to your scope being unusable, and you'd need to send it back to the factory for repair.
DE BD7JAT
That being said... has anyone actually BRICKED their scope yet? I don't remember of one but eh... it's quite a long thread.
Also, I've attached the file all inside a zip. The steps are basically :
1) Extract all files (including the .lnk) to the root of your usb drive
2) From the scope's front panel, press Utility ->File Explorer -> Press to go to: <USB Drive label>(usually "usb")
3) From the drop down, scroll to the v241_link_install.cab to select
4) Press Load file
The scope will ask for your confirmation and then it will load/update and reboot.
FYI, my link file is :
160#\Secure\infiniiVision\infiniivisionLauncher.exe -l DIS -l MSO --perf -l MEMUP -l SCPIPS -l CABLE -l SGMC -l FLEXC -l TOM -l BW20 -l ADVMATH -l EMBD -l EDK -l VID
the other cab uninstall the link file and restores your previous setting.
Cheers
I updated my scope to the 2.42 Firmware this week, because they now allow a probe attenuation down to 0.001 which is quite useful.
Telnet Login an the "\Secure\infiniiVision\infiniivisionLauncher.exe -l DIS -l MSO -l memMax -l MEMUP -l ADVMATH -l SGM -l SGMC -l AUTO -l COMP -l TOM -l EMBD -l VID -l COMP -l SCPIPS -l WAVEGEN -l MASK -l BW20" Hack still works on my scope.
But you still needing to alter the hex info on dll file, or just add these options on the command line?
For the basic hack just add the options at the command line.
Do you have to telnet in every time you boot to run that command line?Of course. I kill some already running executable, then rerun it with other parameters (which enable licensed features). I gather from earlier messages that the firmware can be changed to make it start with those other parameters (probably by changing some embedded script somewhere), but, personally, I'd rather not do that.
When you have a 2000X don't forget to add the --perf parameter, but ADVMATH, TOM and all other 3000X specific licences will have no effect.
The following parameters will enable everything available on a 2000X with standard 2.4x firmware:
-l MSO -l BW20 -l DIS --perf --forcemaxmem
'System concerns detected: OS version is not correct. Please reload system firmware.'
This amounts to "you hax0r! go back to the crippled version!"
A bit of fiddling with the recipes and switches might make this message go away forever (as in, matching the OS version and firmware version check in software and hardware) but as it's not really hindering anything, why bother?
Look back in this very thread; here's many of the options:When you have a 2000X don't forget to add the --perf parameter, but ADVMATH, TOM and all other 3000X specific licences will have no effect.
The following parameters will enable everything available on a 2000X with standard 2.4x firmware:
-l MSO -l BW20 -l DIS --perf --forcemaxmem
Thanks.
Would be nice for us to, sometime, have an account somewhere of those parameters and what they relate to.
I see. Thank you for the explanation.Do you have to telnet in every time you boot to run that command line?Of course. I kill some already running executable, then rerun it with other parameters (which enable licensed features).
Ah well, I bought it with the options I actually use. I'm kind of a digital only man, and only the occasional brush with analog. The wavegen is probably nice to have, on occasion. The rest doesn't really interest me (although why they'd cripple memory use is beyond me ...).Yes, I also bought my scope with the features that are most useful for me (mostly analog ones like channels and bandwidth, and ponied up for the max memory :-[ ; got the AWG as a free bonus as an early adopter). I can see how this telnet method could be useful on the very rare occasion when I might need the various MSO/serial decode functions.
Would be nice for us to, sometime, have an account somewhere of those parameters and what they relate to.Look back in this very thread; here's many of the options:
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg338246/#msg338246 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg338246/#msg338246)
It should work as long as you have the 2.41 Firmware.Looks like 1000X series has a different firmware update approach. I tried running the uninstall.cab and 1000X does not know what to do with it. I changed the extension to .ksx (like the new 2.42 2000X / 3000X firmware) and the same error. I also created new .cab file trying to verify directory content of \Secure and write the content to \usb and I get the same error. Until a new firmware is released by Keysight for the 1000X series, it is an unknown territory...
Not sure if there's any new firmware since then... hmmm
As far as I've remembered, someone with 3000X also tried this method some time back with success, and the command in the switches in the link are taken from the 3000X series with trial and error to see which options works for the 2000X series.
New 1000X series is another different can of worms but might work... who wants to be the sacrificial lamb and test it on their 1000X ? :-/O
With version 2.41 there is no need for any hex editing of infiniivisioncore.dll.
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1189010/#msg1189010 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1189010/#msg1189010)With version 2.41 there is no need for any hex editing of infiniivisioncore.dll.
You sure of that? Tested? What steps are necessary then?
cheers,
george.
got 2012a stuck on splash and pairs of led cycling from bottom to top
What firmware version are you on, can you remember? If it is anything like the flash problem with the 3000A series it could be warranty.Sorry i can't remember but i guess old release , want to try to upgrade if ever corrupted flash , its enough to put cab image on usb stick
What firmware version are you on, can you remember? If it is anything like the flash problem with the 3000A series it could be warranty.Sorry i can't remember but i guess old release , want to try to upgrade if ever corrupted flash , its enough to put cab image on usb stick
and switch on or better unpack and boot ? yesterday i tried with cab on usb stick no more image splash but ''Agilent Tecnologies'' text in the middle of lcd .. but stuck too
without leds cycling.
For proper booting from USB you needs the same nor similar version. It was not possible to boot from USB when on flash was older or newer firmware ( I assume you have version <2.4). Also try different USB flash.
Do you remember if you firmware was with Keysight or Agilent logo?
For proper booting from USB you needs the same nor similar version. It was not possible to boot from USB when on flash was older or newer firmware ( I assume you have version <2.4). Also try different USB flash.
OK, so try all firmware which you will be able to download since 1.10 through 2.10, 2.20, 2.30, 2.35 and 2.35.
U-Boot 2010.03 (Jan 26 2011 - 12:37:34)Agilent P500
CPU: SPEAr600
DRAM: 128 MiB
Flash: 512 KiB
NAND: 128 MiB
In: serial
Out: serial
Err: serial
SerNum:serial number not programmed
Chip: BD Board Rev: 4
Net: smsc
Press space to stop autoboot: 0
## Booting kernel from Legacy Image at f8050000 ...
Image Name: PBOOT
Created: 2011-01-27 11:38:14 UTC
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 36703 Bytes = 35.8 KiB
Load Address: 00000000
Entry Point: 00000000
Uncompressing Kernel Image ... OK
Starting kernel ...
Debug serial initialized ........OK
Microsoft Windows CE Bootloader Common Library Version 1.4 Built Jan 27 2011 02:04:15
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008
System ready!
Preparing for download...
Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN
X
XXXXXOOOOXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXOOOOOOOOOXOOOOXOXOXXXOOXOXXOXXXXXXOOOXXXOOOOOXOOXOXXXOOOXXOOOXXOOOOXOOXOOXXOOOXOOOOOXOOOXOOOXXXXXXOXOXXOXXXXXXXOXXXXOOOXOOOOXOXOOOXOOOOXOXOXOOOOOOXOOOOXOXOOOOOXXOOOOOXX
OOOOXXOOOOOOOOOXOXOOOXOOOOOOOXXOOOOOXXOOOOXOXOXOOXOXOOOXOOOXOOOXXXOXOOOXOXXXXOXOOXXOXXOXXOOOXXOXOXXOXXXXXOOXOXXXXOXOOXOXOOOOXOOOOXOOOXOOXOOXOOOXOOXXXXXXXXXXXXXXOXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x1248684, LaunchAddr = 0x80362000
Completed file(s):
-------------------------------------------------------------------------------
- : Address=0x80361000 Length=0x1248684 Name="" Target=RAM
Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
Launching windows CE image by jumping at address 0x 362000
Windows CE Kernel for ARM (Thumb Enabled) Built on Jun 16 2009 at 10:08:15
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Apr 18 2012)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000 size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
-EDeviceLoadEeprom 00:30:D3:20:E7:70
Phy found addr 31 (ticks=2789)
WaitForLink Start (ticks=2790)
No Link (ticks=3793)
<--EDeviceInitialize
GMAC DMA status register = 0x0
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Running infiniiVisionInstallHelper
Failed to start/configure network.
Starting ProcessStartupFolder
running \Secure\Startup\infiniivision.lnk...
Ending ProcessStartupFolder
Before P/Invoke
Exception 'Undefined Instruction' (1): Thread-Id=03530006(pth=837d0a5c), Proc-Id=03500006(pprc=837d0744) 'infiniivisionLauncher.exe', VM-active=03500006(pprc=837d0744) 'infiniivisionLauncher.exe'
PC=4122dcf0(infiniivisioncore.dll+0x0051dcf0) RA=411b557c(infiniivisioncore.dll+0x004a557c) SP=0002f1d4, BVA=00000000
Exception 'Undefined Instruction' (1): Thread-Id=03530006(pth=837d0a5c), Proc-Id=03500006(pprc=837d0744) 'infiniivisionLauncher.exe', VM-active=03500006(pprc=837d0744) 'infiniivisionLauncher.exe'
PC=4122dcf0(infiniivisioncore.dll+0x0051dcf0) RA=411b557c(infiniivisioncore.dll+0x004a557c) SP=0002f1d4, BVA=00000000
System.MissingMethodException: Can't find PInvoke DLL 'infiniiVisionCore.dll'.
at Agilent.InfiniiVision.infiniiVisionLauncher.Main(String[] args)
Looks to me that it can't find the infiniiVisionCore.dll, do you get the same when booting 2.37 from USB?
Contact Keysight and try to find out if this (likely flash corruption) is covered by warranty, I know they do this for the 3000X series. If that is a dead end we can find other ways to boot the scope but you will need the LAN option or one of the clones.
U-Boot 2010.03 (Jan 26 2011 - 12:37:34)Agilent P500
CPU: SPEAr600
DRAM: 128 MiB
Flash: 512 KiB
NAND: 128 MiB
In: serial
Out: serial
Err: serial
SerNum:serial number not programmed
Chip: BD Board Rev: 4
Net: smsc
Press space to stop autoboot: 0
## Booting kernel from Legacy Image at f8050000 ...
Image Name: PBOOT
Created: 2011-01-27 11:38:14 UTC
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 36703 Bytes = 35.8 KiB
Load Address: 00000000
Entry Point: 00000000
Uncompressing Kernel Image ... OK
Starting kernel ...
Debug serial initialized ........OK
Microsoft Windows CE Bootloader Common Library Version 1.4 Built Jan 27 2011 02:04:15
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008
System ready!
Preparing for download...
Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN
X
XXXXXOOOOXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXOOOOOOOOOXOOOOXOXOXXXOOXOXXOXXXXXXOOOXXXOOOOOXOOXOXXXOOOXXOOOXXOOOOXOOXOOXXOOOXOOOOOXOOOXOOOXXXXXXOXOXXOXXXXXXXOXXXXOOOXOOOOXOXOOOXOOOOXOXOXOOOOOOXOOOOXOXOOOOOXXOOOOOXX
OOOOXXOOOOOOOOOXOXOOOXOOOOOOOXXOOOOOXXOOOOXOXOXOOXOXOOOXOOOXOOOXXXOXOOOXOXXXXOXOOXXOXXOXXOOOXXOXOXXOXXXXXOODeCompressFlash: CeCompressDecode() failed
CeDecompressFlashBlock failed
****** Data record 123 corrupted, ABORT!!! ******
Completed file(s):
-------------------------------------------------------------------------------
- : Address=0x80361000 Length=0x1248684 Name="" Target=RAM
Loading image 1 failed, trying next one
Loading image 2 from memory at 0xD1600000
BL_IMAGE_TYPE_UNKNOWN
Loading image 2 failed, trying next one
All images failed
Press r to reset
im not in hurry to contact keysight and this scope not my primary instruments i m using older scopes as primary..lets experiments
System concerns detected
OS Version is not correct, please reload system firmware.
Now want to add licenses to my scope. Try to disassembly the dll extracted from last update pack for my MSOX3000. I see that now this DLL have much increased size against same DLL by pack 2.42 for MSOX3000A (40mb against just 10mb)...
System.MissingMethodException: Can't find PInvoke DLL 'infiniiVisionCore.dll'.
at Agilent.InfiniiVision.infiniiVisionLauncher.Main(String[] args)
GMAC DMA status register = 0x0
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Running infiniiVisionInstallHelper
Failed to start/configure network.
Starting ProcessStartupFolder
ProcessStartupFolder: \usb\Startup\
running \usb\Startup\infiniivision.lnk...
System.MissingMethodException: Can't find PInvoke DLL 'AgilentLicensingUnmanaged.dll'.
at Agilent.Cdf.Api.Licensing.Compact.LicenseSupervisor.b.a.f()
at Agilent.InfiniiVision.infiniiVisionLauncher.Main(String[] args)
Ending ProcessStartupFolder
where's the _setup.xml file? cant find it
GMAC DMA status register = 0x0
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Running infiniiVisionInstallHelper
Running ConfigureNetworkNative
Loading \Agilent Flash\config\networkSettings.xml configuration file.
Waiting for network to configure.
<?xml version="1.0"?>
<networkConfig><dhcp>true</dhcp>
<ipAddress>146.223.229.241</ipAddress>
<subnet>255.255.255.0</subnet>
<gateway>146.223.229.1</gateway>
<dnsServer>192.25.42.10</dnsServer>
<hostName>a-dx2012a-64560</hostName>
<domainName></domainName>
<adapterName>GMAC1</adapterName>
</networkConfig>
Failed to start/configure network.
Starting ProcessStartupFolder
running \Secure\Startup\infiniivision.lnk...
Before P/Invoke
Ending ProcessStartupFolder
Exception 'Undefined Instruction' (1): Thread-Id=033f000e(pth=837d0a5c), Proc-Id=03f900ba(pprc=837d0744) 'infiniivisionLauncher.exe', VM-active=03f900ba(pprc=837d0744) 'infiniivisionLauncher.exe'
PC=4122dcf0(infiniivisioncore.dll+0x0051dcf0) RA=411b557c(infiniivisioncore.dll+0x004a557c) SP=0002f1d4, BVA=00000000
Exception 'Undefined Instruction' (1): Thread-Id=033f000e(pth=837d0a5c), Proc-Id=03f900ba(pprc=837d0744) 'infiniivisionLauncher.exe', VM-active=03f900ba(pprc=837d0744) 'infiniivisionLauncher.exe'
PC=4122dcf0(infiniivisioncore.dll+0x0051dcf0) RA=411b557c(infiniivisioncore.dll+0x004a557c) SP=0002f1d4, BVA=00000000
System.MissingMethodException: Can't find PInvoke DLL 'infiniiVisionCore.dll'.
at Agilent.InfiniiVision.infiniiVisionLauncher.Main(String[] args)
Using smsc device
TFTP from server 146.223.241.7; our IP address is 192.168.1.212; sending through gateway 192.168.1.35
Filename 'nk.bin.comp'.
Load address: 0x800000
Loading: T T T T T T T T T T
Mac address .......... (00:30:D3:20:E7:70)
Ip address ........... (192.168.1.36)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (0)
Load image 1 at startup
Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
1 (0xd0600000)
2 (0xd1600000)
l) Load flash resident image now
d) Download from ethernet now
u) Start u-boot by resetting
v) Verify Images
>System ready!
Preparing for download...
Downloading image from platform builder
Setting MAC address GMAC_MAC_ADDR_HI_LO[0] = 0x800070E7, GMAC_MAC_ADDR_HI_LO[1] = 0x20D33000
Auto Negotiation complete in 170353 iterations
Link up
AutoNegotiate Full Duplex
AutoNegotiate 100 Base T
Reading MAC address 0x30 0xD320 0xE770
Setting MAC address GMAC_MAC_ADDR_HI_LO[0] = 0x800070E7, GMAC_MAC_ADDR_HI_LO[1] = 0x20D33000
INFO: GMAC Ethernet controller initialized.
InitDHCP():: Calling ProcessDHCP()
ProcessDHCP()::DHCP_INIT
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)
!CheckUDP: Not UDP (proto = 0x00000002)
typing 'd' hangs after this messages .. . im monitoring with wiresharks there activity from scope ipaddress to pc ip
ps.s i start celoader.exe without params ..is that correct?
U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500
CPU: SPEAr600
DRAM: 128 MiB
Flash: 512 KiB
NAND: internal ecc 128 MiB
Debug serial initialized ........OK
RTC: 2016-9-3 21:5:45.25 UTC
Microsoft Windows CE Bootloader Common Library Version 1.4 Built May 7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008
P500 Boot Loader Configuration :
Mac address .......... (00:30:D3:XX:XX:XX)
Ip address ........... (192.168.1.190)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (0)
Load image 1 at startup
Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
1 (0xd0600000)
2 (0xd1600000)
l) Load memory resident image Load image 1 now
1) Load memory resident image 1 now
2) Load memory resident image 2 now
3) Load memory resident image 3 now
d) Download from platform builder now
u) Start u-boot by resetting
v) Verify Images
yes same subnet but with the advanced boot when i oress 'd' in wireshark i get request from ip 0.0.0.0 thats weird
nk.bin.comp
if i ping pc from scope
no dhcp installed
Quotenk.bin.comp
As far as I know you can't use nk.bin.comp, see above.Quoteif i ping pc from scope
How can you do that if you can't login?Quoteno dhcp installed
You need DHCP to give the scope an IP address
[0]: Address=0x80361000 Length=0x130656C Name="" Target=RAM
Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
Got EDBG_CMD_JUMPIMG
Got EDBG_CMD_CONFIG, flags:0x00000000
Launching windows CE image by jumping at address 0x 362000
Windows CE Kernel for ARM (Thumb Enabled) Built on Mar 8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built May 20 2014)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000 size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\GPIO\.\sh600_gpio_hw.cpp line 170: GPB driver, RegQueryDword('ISTPriority') failed, status:2
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\GPIO\.\sh600_gpio_hw.cpp line 170: GPB driver, RegQueryDword('ISTPriority') failed, status:2
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200 (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 00:30:D3:20:E7:70
Phy found addr 31 (ticks=2891)
WaitForLink Start (ticks=2893)
Link Detected (ticks=2896)
GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
Flushed Transmit Buffer
phyCfg->dwSpeed 0x64
<--EDeviceInitialize
GMAC DMA status register = 0x600004
GMAC Device enable interrupt
DriverStart
GMAC Device enable interrupt
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Autonegociation Start (ticks=4919)
+StartAutoNegotiation: pDeviceContext 0xd0578fa0
Autonegociation End (ticks=7930)
WaitForLink Start (ticks=7931)
Link Detected (ticks=7934)
GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
cable attached
Running infiniiVisionInstallHelper
Running launchNetworkServices
Starting Agilent LXI Services.
Time for NANDFLASH to load: 0 ms.
Time for SNANDFLASH to load: 0 ms.
System.MissingMethodException: Can't find an Entry Point 'RegisterNativeCompactLicensingCallbacks' in a PInvoke DLL 'Agilent.Cdf.Api.Unmanaged.dll'.
at Agilent.Cdf.Api.Licensing.Compact.LicenseSupervisor.g.a.c()
at Agilent.Cdf.Api.NativeInterop.RegisterNativeCallbacks()
at Agilent.InfiniiVision.infiniiVisionLauncher.Main(String[] args)
to assign ip by dhcp you set your scope ip 0.0.0.0 ?
OK now i was able to assign ip and load image to scope with celoader but still get errors
Are you using a NK.BIN from the same firmware version that is installed on the scope?
Windows CE Kernel for ARM (Thumb Enabled) Built on Jun 16 2009 at 10:08:15
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Mar 16 2011)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000 size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
-EDeviceLoadEeprom 00:30:D3:20:E7:70
Phy found addr 31 (ticks=2757)
WaitForLink Start (ticks=2759)
Link Detected (ticks=2762)
GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
Flushed Transmit Buffer
phyCfg->dwSpeed 0x64
<--EDeviceInitialize
GMAC DMA status register = 0x600004
GMAC Device enable interrupt
DriverStart
GMAC Device enable interrupt
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Running ceCreateUserAccounts...
Creating infiniivision user account: SUCCESS
Running infiniiVisionInstallHelper
Autonegociation Start (ticks=4786)
+StartAutoNegotiation: pDeviceContext 0xd0573960
Running ConfigureNetworkNative
Autonegociation End (ticks=7797)
WaitForLink Start (ticks=7798)
Link Detected (ticks=7801)
GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
cable attached
Loading \Agilent Flash\config\networkSettings.xml configuration file.
TIMEOUT waiting for IsNetworkReady
<?xml version="1.0"?>
<networkConfig><dhcp>true</dhcp>
<ipAddress>146.223.229.241</ipAddress>
<subnet>255.255.255.0</subnet>
<gateway>146.223.229.1</gateway>
<dnsServer>192.25.42.10</dnsServer>
<hostName>a-dx2012a-64560</hostName>
<domainName></domainName>
<adapterName>GMAC1</adapterName>
</networkConfig>
Failed to start/configure network.
Starting ProcessStartupFolder
ProcessStartupFolder: \usb\Startup\
running \usb\Startup\infiniivision.lnk...
Ending ProcessStartupFolder
Before P/Invoke
Our command line is -l All -l SCPIPS
Performing Startup
creating \Agilent Flash\webupdate\Released build, Mar 16 2011, 10:32:42
Initializing FPGA...
****
FPGA Type: Idaho
Ver: 1.087 Released
Build Time: Wed Jan 04 19:40:14 2012
Build Machine: DW3647M2
****
Programming LAN option module...
Module option FPGA DONE bit should be LOW at this pointKeyboard firmware version mismatch, 26 (binary) vs 31 (keyboard)
Programming keyboard firmware...
Initializing UART... ok
Unlocking flash memory... ok
Erasing flash memory... ok
Blank checking... ok
Writing memory... ok
Verifying memory... ok
New keyboard firmware version 1.026... ok
Keyboard Info: Firmware version 26, Board id 7, Board rev 2
Startup sequence is complete.
Saved configuration invalid
System has been running 81.905029 seconds
Start Up Sequence 58.996056
Memory Load 49%
System Physical Memory 38.336 / 79.695 MB
Process Virtual Memory 43.250 / 1024.000 MB
-----> InfiniiVision is running <-----
Anyone got recommendations (tips/tricks) on how to attack the InfiniiVision 1000 X-Series? Unlock the three licenses DSOX1EMBD, DSOX1B7T102 and DSOX1AUTO.
USB connection only, no firmware available yet.
Congratz. So I will guess that scope was using 1.10 before bricking :)
Keyboard firmware version mismatch, 26 (binary) vs 31 (keyboard)
thanks but i think this old version infiniivision/skywalker1977 password is incorrect ..cannot log in telnet
Anyone got recommendations (tips/tricks) on how to attack the InfiniiVision 1000 X-Series? Unlock the three licenses DSOX1EMBD, DSOX1B7T102 and DSOX1AUTO.
Our command line is -l All -l SCPIPS
I see you have been playing already :)
Done ..tried another nk.bin but crashed too ..so i put 2.35 inside a folder and with booted scope i did the update to 2.35 everything fine :P
Keysight 1000X hack attempts: https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/msg1154923/#msg1154923 (https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/msg1154923/#msg1154923)Anyone got recommendations (tips/tricks) on how to attack the InfiniiVision 1000 X-Series? Unlock the three licenses DSOX1EMBD, DSOX1B7T102 and DSOX1AUTO.
Does it have a RS232 console port? I'd start by logging the boot sequence.
Done ..tried another nk.bin but crashed too ..so i put 2.35 inside a folder and with booted scope i did the update to 2.35 everything fine :P
Well done... any idea what caused this? Probably not but good to see that you made it this far :-+
You might as well update a bit further to get the corruption prevention, 2.41 should be fine.
Keysight 1000X hack attempts: https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/msg1154923/#msg1154923 (https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/msg1154923/#msg1154923)Anyone got recommendations (tips/tricks) on how to attack the InfiniiVision 1000 X-Series? Unlock the three licenses DSOX1EMBD, DSOX1B7T102 and DSOX1AUTO.
Does it have a RS232 console port? I'd start by logging the boot sequence.
by the way this the orrible self made home lan card
Anyone have a good photo (high res, IC models visible) of the 2000 X series, PCB area where the LAN connects?Lan card have a edge connector 80pin its very well visible in the right hand side around the center in vertical
Are you working with firmware version 4.08.2016071801?
I've been trying at this, but even an unpatched infiniiVisionCore.dll from the firmware image is giving me issues. With CFF Explorer, you can see its header has the machine type set to MIPS R4000, yet the disassembled instructions only make sense if you treat it as ARM.
I don't remember if it is discussed before, but when --help, it has --4GSa and --5GSa, but seens to take no effect on DSOX2000.
I don't remember if it is discussed before, but when --help, it has --4GSa and --5GSa, but seens to take no effect on DSOX2000.
There's no need for --help, when you do something invalid like --eevblog it will spit out the options also :)
you mentioned "bricked the scope" ,i'm not good at english ,does it mean this way may be harmful to scope ,such as breaking the scope ?Yes, a wrong step or wrong link might lead to your scope being unusable, and you'd need to send it back to the factory for repair.
DE BD7JAT
That being said... has anyone actually BRICKED their scope yet? I don't remember of one but eh... it's quite a long thread.
Also, I've attached the file all inside a zip. The steps are basically :
1) Extract all files (including the .lnk) to the root of your usb drive
2) From the scope's front panel, press Utility ->File Explorer -> Press to go to: <USB Drive label>(usually "usb")
3) From the drop down, scroll to the v241_link_install.cab to select
4) Press Load file
The scope will ask for your confirmation and then it will load/update and reboot.
FYI, my link file is :
160#\Secure\infiniiVision\infiniivisionLauncher.exe -l DIS -l MSO --perf -l MEMUP -l SCPIPS -l CABLE -l SGMC -l FLEXC -l TOM -l BW20 -l ADVMATH -l EMBD -l EDK -l VID
the other cab uninstall the link file and restores your previous setting.
Cheers
The "trump" version of DSOXLAN PCB, with standalone pulse transformer and SMD RJ45 Jack. :D
If anyone have interest, I can present the gerbers of this pcb.
Well, I tested again today. It looks like on 1000X the recipe.xml file was renamed install.xml (Thanks Daniel for posting the FRA patch). Regenerated the .ksx file using makecab on windows and I was able to install the infiniiVision.lnk file from USB (Using v241_link_install.cab hack method). The only problem is that it activates 200MHz but does not take any other option like the 2000X / 3000X. I tried -l DIS, -l ALL, -l EMBD, -l COMP, -l AUTO... and I cannot enable serial decode. I even removed -l BW10 and still get 200MHz activated (but I think it is limited by hardware to 70-100MHz... I have a modded EDUX1002G).It should work as long as you have the 2.41 Firmware.Looks like 1000X series has a different firmware update approach. I tried running the uninstall.cab and 1000X does not know what to do with it. I changed the extension to .ksx (like the new 2.42 2000X / 3000X firmware) and the same error. I also created new .cab file trying to verify directory content of \Secure and write the content to \usb and I get the same error. Until a new firmware is released by Keysight for the 1000X series, it is an unknown territory...
Not sure if there's any new firmware since then... hmmm
As far as I've remembered, someone with 3000X also tried this method some time back with success, and the command in the switches in the link are taken from the 3000X series with trial and error to see which options works for the 2000X series.
New 1000X series is another different can of worms but might work... who wants to be the sacrificial lamb and test it on their 1000X ? :-/O
Yes, confirmed.
Please don' ask me "how", because our "serene" life will end quickly. Just read carefully all pages of this thread, from start to end. :D
Yes, confirmed.
Please don' ask me "how", because our "serene" life will end quickly. Just read carefully all pages of this thread, from start to end. :D
I wouldn't buy a T series scope hoping to hack the software options right now... I'm not aware that anybody has done it and yes I've read all the pages of this thread since the beginning.
Yes, confirmed.Huh, did I miss something? At least I'm not not aware of a way to unlock the T, deliberately bought a non-T last model year.
Please don' ask me "how", because our "serene" life will end quickly.C'mon, we've also had this.
ELIK, do you have a 3000T series oscilloscope? I read almost half of the posts and could not find references about someone who has played with a 3000T.
Hi group,
Take a look at this eBay item 172559013145
http://www.ebay.ca/itm/KEYSIGHT-Infiniivision-MSOX3034T-Mixed-signal-Oscilloscope-350Mhz-MEGA-ZOOM-/172559013145?hash=item282d519519:g:GqYAAOSwhlZYuQIj (http://www.ebay.ca/itm/KEYSIGHT-Infiniivision-MSOX3034T-Mixed-signal-Oscilloscope-350Mhz-MEGA-ZOOM-/172559013145?hash=item282d519519:g:GqYAAOSwhlZYuQIj)
I have good reason to believe that it has been 'hacked'.
Regards,
Jay_Diddy_B
(It may have been an extreme teardown)
Could anyone explain me exactly, what is the MAIN difference between MSOX3000T and MSOX3000A? :popcorn:
Jeez I would love to see a photo of the 'lazarus' 3000T now functional after that horrid treatment.
Does the 3000T have a VESA mount or was that a DIY enhncement?
Can anyone please measure the approx. height of knobs?
I want to try to find something like original...
Thanks!
Can anyone please measure the approx. height of knobs?
I want to try to find something like original...
Thanks!
about 13.2mm
All that is left in my PCOMG, that's prosto ofigenno, tovarisch!
Ha-ha-ha, yes, crazy job.Congratulations!
Thanks for knobs measuring
But how did you repair the case? I mean, at the back of the instrument. It looked exploded.
\windows> "\Program Files\infiniiVision\infiniivisionLauncher.exe" -l WAVEGEN
System has been running 1475.297974 seconds
*** Installing License: WaveGen license
System has been running 1484.592041 seconds
3. Copy the extracted infiniiVisionLauncher.exe to "\Program Files\infiniiVision\infiniivisionLauncher.exe" (via usb)Thank you for this information. Was there a file named infiniiVisonLauncher.exe in the target directory before you did the copy? What size does the extracted infiniiVisionLauncher.exe have?
Have you installed the new fw 7.10 before doing this test? Or are you using the infiniiVisionLauncher.exe from 7.10 in a scope with older fw?This is after upgrading the scope's FW to 7.10, did not try using the exe directly. Seem remembering --help not returning anything on 4.08.
Was there a file named infiniiVisonLauncher.exe in the target directory before you did the copy?Yes, there was a file with the same name. I just replaced it, but it wont be permanent. Going to try the 'modified startup lnk files' way.
What size does the extracted infiniiVisionLauncher.exe have?The extracted infiniiVisionLauncher.exe is 402376 bytes; the one in '\Program Files\InfiniiVision' is 5632 bytes; and another one in '\Secure\InfiniiVision' is 12104 bytes.
I have not yet been able to make it permanant,
I have not yet been able to make it permanant,
What do you mean ?
Ha-ha-ha, yes, crazy job.Vpechatlyaet.....
Thanks for knobs measuring
???No problem :) It's like "so impressive"
Please don't crypt your talk, it's a public forum.
Use traditional english.
Sorry, understand now. :DVery interesting. Is it DIY PCB or you mounted standard Tek connector?
Yes, channels 3 and 4 was moded for TEK differential probes like P5205.
I thought no one will notice... :o
I can do the pictures when open the tool next time.Perfect! Very interesting mod. And picture also.
Yes, you right. Little bit later will do it.Yes here was topic with Autoprobe interface description (hp patent actually), but 3000 series have lite version. There are +-12 and -+5V unregulated and 400mA on all ports summary
On the face pcb, the +12v and -12v is presented and stable (regulated) as I remember, will be good to use it.
1. Extract infiniiVisionLauncher.exe from 3000XSeriesT.7.10.2017042905.ksx -> infiniiVisionSetup\%InstallDir%\infiniiVisionLauncher.exe using the tools from abyrvalg's post
4. Execute "\Program Files\infiniiVision\infiniivisionLauncher.exe" -l WAVEGEN (or whatever options you want)
\windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp
To undo, one just needs to do a firmware update (with same version number).One thing I encountered in 7.10 and someone kind of confirmed it, is telnet login failing with "Logon Incorrect".The first login always return "Logon Incorrect". Just perform the login again, it should work the second time.
One thing I encountered in 7.10 and someone kind of confirmed it, is telnet login failing with "Logon Incorrect".
Let me know if anyone else encountered this and I can provide my take on it.
I did the A some years ago, it drops off brick wall like after 1.1 GHz. At 1GHz it was less than 0.8 dB down.You posted it up and came to a very similar result to the unit I measured:
Will see if I have the screenshot
Regarding the timebase quadrature encoder on the MSOX3000A, is it just mine/me, or does this very frequently miss clicks?
Regarding the timebase quadrature encoder on the MSOX3000A, is it just mine/me, or does this very frequently miss clicks?
I never noticed this, but let's see what others think.
I never noticed this, but let's see what others think.
I never noticed this, but let's see what others think.
Work well in my DSOX3034A
Could also be a cracked solder joint or PCB track near the encoder. One way to diagnose this is to see if it gets better or worse if you apply a slight sideways force in various directions while turningI never noticed this, but let's see what others think.
Work well in my DSOX3034A
It seems to be much worse very recently, I am thinking now it may be a physical fault, hopefully a bit of switch cleaner will resolve.
Could also be a cracked solder joint or PCB track near the encoder. One way to diagnose this is to see if it gets better or worse if you apply a slight sideways force in various directions while turningI never noticed this, but let's see what others think.
Work well in my DSOX3034A
It seems to be much worse very recently, I am thinking now it may be a physical fault, hopefully a bit of switch cleaner will resolve.
Regarding the timebase quadrature encoder on the MSOX3000A, is it just mine/me, or does this very frequently miss clicks? It's my only irritation in an otherwise slick UI. Other knobs work fine.I have an MSOX3104A and the timebase encoder gradually got worse over time with missing clicks. At about 2.5 years old it was so bad I sent it back to Agilent for repair. They confirmed the problem and replaced the encoder. Plus refreshed the cal (that was nice since I wasn't expecting it.)
In comparison, the MSO7000B and 54642D are perfect in this respect. Even the Tek MDO3000, renowned for its sedentary nature, doesn't actually miss QE inputs, although it might take a while to respond.
Regarding the timebase quadrature encoder on the MSOX3000A, is it just mine/me, or does this very frequently miss clicks? It's my only irritation in an otherwise slick UI. Other knobs work fine.I have an MSOX3104A and the timebase encoder gradually got worse over time with missing clicks. At about 2.5 years old it was so bad I sent it back to Agilent for repair. They confirmed the problem and replaced the encoder. Plus refreshed the cal (that was nice since I wasn't expecting it.)
In comparison, the MSO7000B and 54642D are perfect in this respect. Even the Tek MDO3000, renowned for its sedentary nature, doesn't actually miss QE inputs, although it might take a while to respond.
The encoder replacement was almost 3 years ago and now it's getting bad again. Fortunately I have a service agreement, but I think it will be going back again within the next couple of months.
After I repeatedly tested, the key is the vertical sensitivity is equal to less than 200mV, the input signal amplitude is greater than 1.3Vpp, and then as long as the waveform is offset by a certain value, it will be seriously distorted.
bincompress.exe /c patched_nk.bin patched_nk.bin.comp
And flash it by loadP500Flash via telnet in scope\windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp
211#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC
Just tried to upgrade my DSOX3032A firmware from 2.35 to 2.24 but scope refuses the upgrade with a message that the file format (.ksx) is unknown for it.just rename it to .cab
Could someone help me to post one of previous install package?
Thank you in advance.
Georg
Is it established that the only way to hack the 3000 series scope after firmware 2.4x is through the LAN? Is there a USB method which works without giving the OS error?It works with 2.41 and 2.42 https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg989285/?topicseen#msg989285 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg989285/?topicseen#msg989285)
Thank you everyone for all your work.
I will write up a little post about it, if it's of any interest?. :)I assume, this is just a rhetorical question, isn't it?
Yes, board is replaced in 200-350 and 500-1000. Actually, different boards have same PCB and same ASICs with different frontend and switches sets. So it is possible DIY (I'm don't now details)
maybe I missed something in this (very long) thread... but did anyone find out why the 100-200 (bandwidth upgrades) and 350-500 are given as 'field upgrades', while 200-350 and 500-1000 (are supposed to) require servicing ??? Was it 'just' to perform a (re)calibration, thereby justifying the steep prices ?? (ok, for 500-1000, there's apparently an acquisition board replacement with a 5GS/s board...)
You can do it with component level replacements from 100/200 to 350/500. I would not say it's for a beginner, it needs reasonable SMD rework soldering equipment and skills. Considering the cost of failure, it's a risky endeavour.I am so tempted to do this on my 3024a but I just don't want to take the risk on such an expensive piece of kit.
"board replaced for 200-350" ??? Are you sure ?? Many people have reported 3024 to 3054 upgrades without a problem... hence my question...
"board replaced for 200-350" ??? Are you sure ?? Many people have reported 3024 to 3054 upgrades without a problem... hence my question...
Just finished my DIY project, dsox lan interface with usb console interface.
What I've to do next is to buy a 3D printer :-DD
Just finished my DIY project, dsox lan interface with usb console interface.
What I've to do next is to buy a 3D printer :-DD
Just finished my DIY project, dsox lan interface with usb console interface.
What I've to do next is to buy a 3D printer :-DD
Sweet!!!
Just finished my DIY project, dsox lan interface with usb console interface.
What I've to do next is to buy a 3D printer :-DD
Did you join the 2 pins on the 'finger connector' for auto detect - can't tell since it's the 'other side' of the picture you posted.
No 3D printer really needed... I cut my original back/cover plate to hold my diy lan card - works just fine. Though I'm sure you could still use it as an excuse to get a 3D printer :)
cheers,
george.
gamalot,
I have a DSOX2014A and am looking to make a dsox lan interface. I think I missed somewhere in this little thread why a usb console interface might be useful. Could you please illuminate me.
thanks
There 2 simple reasons to have a USB console interface:
1) the board looks empty if there is a LAN interface only
2) Just in case the LAN interface doesn't work
There 2 simple reasons to have a USB console interface:
1) the board looks empty if there is a LAN interface only
2) Just in case the LAN interface doesn't work
2) doesn't work on the PC side?
So it is just a USB to ethernet converter? Confused. :-\
One more picture, no more confusion. ;DWow, your right, thats worth 1000 replies :)
There 2 simple reasons to have a USB console interface:
1) the board looks empty if there is a LAN interface only
One more picture, no more confusion. ;DWow, your right, thats worth 1000 replies :)There 2 simple reasons to have a USB console interface:
1) the board looks empty if there is a LAN interface only
Looks are definitely important, even in test equipment! Your board is really beautifully designed. Have any extra you want to get rid of?
... Now the problem is when the oscilloscope power is off, I can not see the virtual serial port on my PC, I need to modify the design to fix this bug.|O |O |O
It would, but it would likely take too long to be useful. If you're using the console port you probably want to be able to send a break within a second or two of power on when the bootloader runs. That means the port needs to exist and the terminal program should be ready and waiting.
I would think that the STM32F072 could be programmed to put out the req'd characters at the appropriate time after it's boot. It could certainly beat a human. You would have to set some non-volatile variable to whether you wanted it to do so or not. It wouldn't have to wait for the terminal to come up, maybe just bit-banging the transmit pin before even starting the terminal would be the easiestThink that more easy just feed STM from USB. And hope that cut pcb track and resold LDO to USB connector would be enough
Think that more easy just feed STM from USBAnd add a 500mA PTC fuse to the 5V line.
Thought I'd look at my suggestion of a few posts ago. I don't have a STM32F072. Just for fun I tested an Arduino nano and a Teensy 3.6 to see how long it takes them after power up to put out a character. The nano 1.45 seconds, the Teensy 402ms. I'm not ready to try this inside my scope yet.
Made a scope trace:
Is it processor start time on UART side only? Or with USB wakeup and send some info from terminal app on PC? (but IMO USB response strongly depending from PC, OS etc)This is just the time for his UART chip (which is really a 32 bit ARM microprocessor that contains a UART :) ) to boot up and serial.write(" ..") to the I/O pins. All the time is the normal boot stuff required for the chip to determine the voltages and clocks are stable enough to run. This would all happen before any USB comm is established. You just need to know what to print (spaces?) and when to print it to get the DSOX in the right state. You don't even care what the response is. After that you'd start the USB stuff and takeover the same I/O pins for the regular comm session.
This is just the time for his UART chip (which is really a 32 bit ARM microprocessor that contains a UART :) ) to boot up and serial.write(" ..") to the I/O pins. All the time is the normal boot stuff required for the chip to determine the voltages and clocks are stable enough to run. This would all happen before any USB comm is established. You just need to know what to print (spaces?) and when to print it to get the DSOX in the right state. You don't even care what the response is. After that you'd start the USB stuff and takeover the same I/O pins for the regular comm session.
I'm pretty sure the STM32F072 chip could do the same and beat the micro in the DSOX to the point the input is needed.
Can you kindly share the schematic and layout files of your network interface card? Thanks!
So - I've been a little busy, but as promised - the permanent mod for the 3000T series. :-+
After some testing, I found out that the registry edits to the regdb wasn't needed and all the mod takes is a exe, that call the infiniivisionlauncher.exe with our commandlines.
As I am no programmer, I found a source code in the CE sdk to do the job, compiled a exe and deleted the lnk in the startup folder, placing the exe here and copying the full infiniivisionlauncher.exe to the secure folder, as all exe's in the startup folder will be launched and as a result creating the "bootloop" problem.
I have created a zipfile with the needed exe's, a readme file and a script to do the job of copying.
The script will also copy a backup of cal-data to the usb stick, as I had a incident during all this testing, where the scope reported it gone, sp just to be safe. :-BROKE
Use it at your own risk! - But I have done quite some testing using the script, after reflashing firmware and no problems. :)
Hi,
Could someone check connection between LAN8700C and SPEAR600-2, please? I'm want to add LAN to 1000x series scope, but it don't have PHY, but it have unmounted connector with MII ethernet pins. I'm not sure about pull up and pull down resistors. I colored expected connections on Dave teardown pictures. Please measure value of pull up or pull down resistor on LAN8700C pins: 3, 9, 10,11, 12, 15, 16, 17,18 and 36 if they exist. Expected resistance between LAN8700C and SPEAR600-2 is around 51ohm.
I'm trying to find a copy of the DSOX2002A v2.35 firmware, but it doesn't appear to be available on the keysight website anymore. Has anybody got a saved copy they can share?
If anyone wants a quick and dirty USB to UART converter, just use one of the FTDI USB to serial cables. Their 3.3V version is PN: TTL-232R-3V3. It's around $20 at Digikey and others. It has a type A plug at the USB end and a single in line female 0.1" OC at the other end. You need to install the FTDI driver on your PC but is handles many (most) FTDI devices.SparkFun sells a similar cable for only $17.95. Available on amazon prime for the same price.
We use them all the time with Putty.
Den
DSOXLAN just showed up this morning for $201 at Newark. It was $402 yesterday !
Someone was watching over me (besides my wife) when I did not click the submit order button :)
Nope, no one has done it yet.
Not the 2000. I was wondering if the 3024 or 54 have the rf relay (Teledyne)
It's only a couple of bits ... in the right places. Thanks for answering my poorly worded post. This thread has me thinking in multiple parallel and orthogonal directions :) I did go back through the thread and found your comments from last year on the problem with sensing the relays.
I wonder how Tek pulled off using plain old Aromat relays for the TDS784D (1GHz) and lower BW models. The front ends are in overall Faraday cages and I suppose if they behave consistently, you can model and compensate for their transmission path. But then again, I've never compared high speed signal faithfulness of an Agilent to the Teks. I have compared Agilent triggers to Tek triggers but we don't want to go there. I still have a TDS694C that triggers up to 3GHz with ease.
On my system I have a WinCE Cab Manager 3 which I installed three years ago and used only one time then. Of course it has expired three years minus 30 days ago. Uninstall and Reinstall does not make a difference - it recognizes (even after deleting registry entries etc.) a preceding installation and will not work.Hi,
OCP Software, the creator of the WinCE Cab Manager does not exist anymore. So I dare to ask: does anybody have an idea how/where I can get a working version (probably this means hacked) of the WinCE Cab Manager 3?
If you have one, please copy to my dropbox here: https://www.dropbox.com/request/gXBLFQiV4J4YANQiyLZp (https://www.dropbox.com/request/gXBLFQiV4J4YANQiyLZp)
Thank you!
I am slowly getting familiar with my first 3D printer. :)
I am slowly getting familiar with my first 3D printer. :)Looks very nice.
Nice :-+
I am slowly getting familiar with my first 3D printer. :)
Color like... first channel. Hope you will make three else in known colors :))
BTW how your USB converter?
I am slowly getting familiar with my first 3D printer. :)Looks very nice.
How do you remove it from the housing, since the spring clips don't look accessible from the outside?
BTW how your USB converter?
It's a USB to UART converter connect to the console port on main PCB.
This version is isolated, so I feed them from both side. :)
This version is isolated, so I feed them from both side. :)
Yes, I see. Very interesting. For what 3d isolated channel?
You don't need isolation, just a series resistor to limit current drawn by the TXD line.This version is isolated, so I feed them from both side. :)
Yes, I see. Very interesting. For what 3d isolated channel?
There will be a problem if it's not isolated.
When the USB port has been connected to PC and oscilloscope has been turned off, the oscilloscope will steal power from the STM32 MCU I used as converter. :(
You don't need isolation, just a series resistor to limit current drawn by the TXD line.This version is isolated, so I feed them from both side. :)
Yes, I see. Very interesting. For what 3d isolated channel?
There will be a problem if it's not isolated.
When the USB port has been connected to PC and oscilloscope has been turned off, the oscilloscope will steal power from the STM32 MCU I used as converter. :(
Hi Guys,I think this thread is mostly for hacking the DSOX2000 and 3000 series... I don't recall reading anything about features
Interested in the 2000 X. Can someone give me the cliff notes for this thread? 72 pages will probably take a week to read from start to finish.
I'm looking at this:
https://www.keysight.com/en/pcx-x205206/infiniivision-2000-x-series-oscilloscopes?cc=US (https://www.keysight.com/en/pcx-x205206/infiniivision-2000-x-series-oscilloscopes?cc=US)
for reference about features.
Read the thread backwards. You will find the latest hack method around page 60-65Page numbers are meaningless as they depend on the user's posts-per-page setting - use post numbers
@mikeselectricstuff, you are right. Post number 1529 shows the steps and includes the link to download the CAB file. Read from there forward and backward to get some background information about the hack.Read the thread backwards. You will find the latest hack method around page 60-65Page numbers are meaningless as they depend on the user's posts-per-page setting - use post numbers
Are there issues with garbage on LAN with the USB method?
and remember, at scopes with firmware versions below 2.4x the flash will be corrupted after RND(TIME). The scope will not boot anymore and is bricked and needs to be serviced by Keysight. After firmware 2.4x the scope will detect this and repairs itself .... somehow.
Thus with 2.35 or 2.38 there is the constant danger, that your scope (DSOX2000a and DSOX3000a series) won't boot anymore at some day.
I’ve seen quite a few new R&S RTB 2000 series ones being returned with issues though, they seem to be having some teething problems. Good warranty support from R&S as well though.
I’ve seen quite a few new R&S RTB 2000 series ones being returned with issues though, they seem to be having some teething problems. Good warranty support from R&S as well though.
Not to hijack the thread but can you give us any more details on issues with the RTB2000 series ?
50/50 dead power supplies and touch screen faults. One with all inputs dead.
50/50 dead power supplies and touch screen faults. One with all inputs dead.
Thanks. I just got one and the power supply is humming (high pitch whine) when the scope is in standby mode. Sound like a vibrating ceramic cap or inductor.
50/50 dead power supplies and touch screen faults. One with all inputs dead.
Thanks. I just got one and the power supply is humming (high pitch whine) when the scope is in standby mode. Sound like a vibrating ceramic cap or inductor.
I *think* there may be a service note on that...
Pretty sure he is talking about an RTB2000, not a DSOX2000/3000(which does have an old service note about a power supply update because of an audible noise).
\windows\loadP500Flash -u ceImage1 \usb\nk_patched.bin.comp
<!-- Update CE Kernel (backup) -->
\windows\loadP500Flash -u ceImage2 \usb\nk_patched.bin.comp
<!-- Update bootloader -->
blah...blah...blah...
<!-- Update CE Kernel -->
\windows\loadP500Flash -u ceImage1 \usb\nk_patched.bin.comp
<install>
<!-- Set the ramdisk to 68MB -->
<ramdiskSize>71303168</ramdiskSize>
<!-- Stop the scope application -->
<killProcess>infiniivisionLauncher.exe</killProcess>
<killProcess>AgilentLxiWebService.exe</killProcess>
<killProcess>vncServer.exe</killProcess>
<killProcess>websockify.exe</killProcess>
<!-- ******** -->
<!-- Update CE Kernel -->
<installStep>
<file checksum="03929973A08EFEB08FB31DA8B2AAF200">nk.bin.comp</file>
<command>\windows\loadP500Flash -u ceImage1 %TEMP%\nk.bin.comp</command>
<onFailure>
<filePath>\Agilent Flash\config\errorLog.txt</filePath>
<message>Firmware update failed (0x0422). Please retry firmware update.</message>
<action>reboot</action>
</onFailure>
</installStep>
<!-- Reboot -->
<installStep>
<command>\windows\rebootInfiniivision.exe</command>
</installStep>
<boardLoadOptions>
<ECC>4</ECC>
</boardLoadOptions>
</install>
<!-- Update CE Kernel (backup) -->
<installStep>
<file checksum="03929973A08EFEB08FB31DA8B2AAF200">nk.bin.comp</file>
<command>\windows\loadP500Flash -u ceImage2 %TEMP%\nk.bin.comp</command>
<onFailure>
<filePath>\Agilent Flash\config\errorLog.txt</filePath>
<message>Firmware update failed (0x0420). Please retry firmware update.</message>
<action>reboot</action>
</onFailure>
</installStep>
<!-- Update bootloader -->
<installStep>
<file checksum="7ccacd88343adb62f9276a362bc7f5d3">updateBootLoaders2.exe</file>
<file checksum="33bb47d750ae3732cd8657f407008ef0">pboot_rel.bin</file>
<command>%TEMP%\updatebootloaders2.exe</command>
<onFailure>
<filePath>\Agilent Flash\config\errorLog.txt</filePath>
<message>Firmware update failed (0x0421). Please retry firmware update.</message>
<action>reboot</action>
</onFailure>
</installStep>
you mentioned "bricked the scope" ,i'm not good at english ,does it mean this way may be harmful to scope ,such as breaking the scope ?Yes, a wrong step or wrong link might lead to your scope being unusable, and you'd need to send it back to the factory for repair.
DE BD7JAT
That being said... has anyone actually BRICKED their scope yet? I don't remember of one but eh... it's quite a long thread.
Also, I've attached the file all inside a zip. The steps are basically :
1) Extract all files (including the .lnk) to the root of your usb drive
2) From the scope's front panel, press Utility ->File Explorer -> Press to go to: <USB Drive label>(usually "usb")
3) From the drop down, scroll to the v241_link_install.cab to select
4) Press Load file
The scope will ask for your confirmation and then it will load/update and reboot.
FYI, my link file is :
160#\Secure\infiniiVision\infiniivisionLauncher.exe -l DIS -l MSO --perf -l MEMUP -l SCPIPS -l CABLE -l SGMC -l FLEXC -l TOM -l BW20 -l ADVMATH -l EMBD -l EDK -l VID
the other cab uninstall the link file and restores your previous setting.
Cheers
Does this hack work with DSOX2012A ? I am planning to buy one :)Sure, it will work with all versions. However, I would strongly advice not to purchase one: The DSOX2000 series does not allow serial protocoll analysis on the digital channels (only analogue channels) and with only two analogue channels you will be stucked quickly (e.g. with a simple SPI protocol).
Does this hack work with DSOX2012A ? I am planning to buy one :)Sure, it will work with all versions. However, I would strongly advice not to purchase one: The DSOX2000 series does not allow serial protocoll analysis on the digital channels (only analogue channels) and with only two analogue channels you will be stucked quickly (e.g. with a simple SPI protocol).
My advice: either get a 2-channel 3000-series scope or go for the 4-channel version. The 2-channel version should be purchased only if it comes with a massive price reduction as selling this later will become very difficult.
Hugoneus, check this post for CPU JTAG https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg274963/#msg274963 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg274963/#msg274963)
Another possibility is BootROM USB flash loader mode:
ST's flash utility http://www.st.com/web/en/catalog/tools/PF257557 (http://www.st.com/web/en/catalog/tools/PF257557)
This mode should be activated by pulling BOOT_SEL pin (K18, check the picture) low at power on, but no reports on this so far. The PCB picture in JTAG post looks like there is a track in inner layer going to this pin, perhaps you can look closer. If it is tied straight to VCC then bad luck, otherwise try shorting it to GND and turning the scope on with USB cable attached to PC - does something pops up?
Also SPEAr600 RM says that ROM enters USB boot if normal (flash) boot fails regardless of BOOT_SEL state. But this requires primary bootloader in flash to be corrupted "correctly" so ROM doesn't recognize it (briefly shorting some flash DATA lines at power up is common way to simulate this state).
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1419736/#msg1419736
Looks like they had to take a serial interface from the scope and turn it into GPIB using an FPGA on this board.FPGAs are probably cheaper than mostly-obsolete dedicated GPIB chips these days
The message about the "System OS concerns detected...", that still comes up, that may be a check against the file that's in the flash, I'm not sure, but haven't figured out yet how to remove that message.. but I'm curious if that one doesn't appear if we flash the patched DLL into the ceimage1 in flash...? I will be trying that soon...
As far as the 'mobileVNC.exe', the reason I mentioned it is if anyone wanted to see the real 'Windows CE desktop', which is what this mobileVNC takes you to when you login with it.. the 'vncserver.exe' that the scope already runs, just gives you a VNC connection to control the scope itself.. I wanted to see if there was anything interesting to look at with the actual windows CE desktop... there really isn't much to see, I was hoping to be able to view some registry data from there, but no luck..
The latest firmware 2.43 (5 March 2018) according to the release notes:
2000 X-Series Enhancements
All 2000 X-Series oscilloscopes manufactured after
March 5, 2018 now have:
- Increased waveform update rate of
200,000 wfms/s
- Standard memory upgrade: 1 Mpts
- Standard segmented memory
- Additional trigger modes
- Additional math functions
Any 2000 X-Series oscilloscopes manufactured
before March 5, 2018 can be upgraded using the
DSOX2PLUS option.
See pages 16 and 18.
For more information
www.keysight.com/find/2000X-Series (http://www.keysight.com/find/2000X-Series)
infiniivisioncore.dll [snip] ** note: in 2.42, the dll is no longer on disk, so you have to patch this directly in the nk.bin, and write to flash **
...I wonder how much they will ask for the dsox2plus option...
Upgraded to 2.43 :)
Upgraded to 2.43 :)
That was quick :D Are you able to confirm the increased update rate?
From http://www.datatec.de/Keysight-Upgrade-2000X-Oszilloskop-2018.htm (http://www.datatec.de/Keysight-Upgrade-2000X-Oszilloskop-2018.htm)
Upgraded to 2.43 :)
That was quick :D Are you able to confirm the increased update rate?
From http://www.datatec.de/Keysight-Upgrade-2000X-Oszilloskop-2018.htm (http://www.datatec.de/Keysight-Upgrade-2000X-Oszilloskop-2018.htm)
Be honest, I don't know how. :-[
infiniivisioncore.dll [snip] ** note: in 2.42, the dll is no longer on disk, so you have to patch this directly in the nk.bin, and write to flash **
Where does one find the the dll in question?
All the best
infiniivision
skywalker1977
FYI:
The patch locations for firmware 2.43:
FYI:
The patch locations for firmware 2.43:
But 4000 series never had a 2.43 firmware, it started from fw 3.00.
Used MSO cables pop up for good deals all the time on ebay - it is totally worth buying the proper one.
Here are the various part numbers you're looking for for a 3000 series scope:
54620-68701 - original part #
N6450-60001 - newer part #
N2756A / N2756-60001 - updated logic probe cable, newest version.
No active logic but the original HP (etc.) part has a 90k series resistance. This give a good measure of protection against over-voltage, over-current and to some degree, ESD.
You could plug in anything that fits, including individual female 0.025" square connectors such as the ones on Chinese ribbon cables with male or female, or both, ends at real low prices.
Just use caution with any direct cable as it would hurt to blow the ASIC IF the connection from the front panel is not buffered :bullshit:
...
The 90k embedded in the logic probe tip makes a voltage divider with the 10k input impedance of the scope's logic inputs, so the combination makes a x10 probe. And the woven ribbon is a lossy transmission line, similar to a regular analog probe cable, to maintain signal integrity.
A cheap straight-thru 40-pin ribbon connector will give you the wrong voltage levels, and also would degrade the signal integrity if you're dealing with high speed signals. Not to mention expose the digital front end to more risk of damage, as you point out.
I would get the genuine cable and probes, even if it's somewhat pricey. The 54620-61601 is what was supplied by Agilent/Keysight when I ordered a 3000X with the logic option several years ago.
I'm just curious if anyone actually located where they have this probe resistance at, as someone already disassembled one of the pod modules, and there was nothing in it at all...maybe it's in the 40-pin IDE header, as I don't see any pics of anyone opening that up?
I got the 54620-61601 MSO probe set for my 3024A from ebay, it was new still in package, for $120....That's a good find. For some reason sellers of the later version of the cable are asking a lot more. They're all the same electrically.
I'm just curious if anyone actually located where they have this probe resistance at, as someone already disassembled one of the pod modules, and there was nothing in it at all...maybe it's in the 40-pin IDE header, as I don't see any pics of anyone opening that up?See below. The 90k resistor is the one with the strange symbol and you can see it in parallel with a compensation cap. There's also a 249R in series with the tip.
Also, btw, the newer/replacement probe packages do not have that braided cable as the older ones did, it's just straight up wire...You'll find that those "straight up wires" are tiny lossy coax, except for the outermost ones. This is the same logic probing system HP/Agilent/Keysight has been selling for 20+ years.
I know someone back in this thread did it on a 4k series.....Yes, thank you very much. This worked just fine and I can see everything I need. I am checking with Pinkus as he's been this route before.
are you sure the login/password is not just the basic ones as in the 3000A series? (ie the password+hash was ONLY for the newer 3000T series)
also remember, when launching telnet, the first user/login attempt will always fail, just type in garbage for user/pass, let it fail, then login again...
ie this combo:Code: [Select]infiniivision
skywalker1977
Ended up ordering a DSOX3014T+DSOXLAN and picked up a N6450-60001 from rebay, new. Now, I wait for Agilent^WKeysight to ship.. they estimate April(!@#!@#) currently. What's really insane is they let me trade in my dslogic/oscilloscope combo that I backed via kickstarter and never used to get 30% off. =)
Ended up ordering a DSOX3014T+DSOXLAN and picked up a N6450-60001 from rebay, new. Now, I wait for Agilent^WKeysight to ship.. they estimate April(!@#!@#) currently. What's really insane is they let me trade in my dslogic/oscilloscope combo that I backed via kickstarter and never used to get 30% off. =)
That is a wonderful trade-in! I traded in a pristine Agilent scope for a DSOX3024T about 18 months ago. They asked a lot of questions about the scope and wanted to be sure that it was working. Supposedly someone was going to pick up the Agilent scope from me but then they asked me to ship it from New Jersey to California. Luckily I got the distributor to pay the $150 shipping cost, but I pad FedEx about $30 for the packing.
Of course I was worried that something would go wrong in shipping, so I took photos of the scope running next to the the current day's New York Times front page. I did not want to get a bill from Keysight for $1400! Apparently it arrived OK, I never heard from them.
In any case, I 'm surprised that a "non-top tier" scope would get the 30% discount since the offer says "up to 30%". When I did my trade-in there was also a free MSO option but they would not allow the offers to be combined.
FYI:
The patch locations for firmware 2.43:Code: [Select]1) options patch: 0x280940: change "04 00 A0 E1" -> "00 00 A0 E3"
2) nag patch: 0x2a9f38: change "66 5A FF EB" -> "01 00 A0 E3"
Thanks for the info!
Could you also show us the checksum patch?FYI:
The patch locations for firmware 2.43:Code: [Select]1) options patch: 0x280940: change "04 00 A0 E1" -> "00 00 A0 E3"
2) nag patch: 0x2a9f38: change "66 5A FF EB" -> "01 00 A0 E3"
Hi,
I maked patch for infiniiVisionCore.dll directly in nk.bin in v2.42 (2017032900) FW for DSOX3000A. There 4 bytes for patch "04 00 a0 e1" to "00 00 a0 e3" in start address FBC7FFh and checksum in address D40457h changed from "EB" to "E9". Actually checksum contain 4 bytes, but changed only this last byte (first in file as it's little endian). Checksum algorithm is UByte8bit.
infiniiVisionCore.dll placed in Record [164]: Start in memory = 81111000h, Length = 55D528h, Chksum of original nk.bin = 2604E8EBh
In nk.bin file this block started in D4045Bh and ended in 129D982h
Then nk.bin compressed by bincompress
Code: [Select]
bincompress.exe /c patched_nk.bin patched_nk.bin.comp
And flash it by loadP500Flash via telnet in scope
Code: [Select]
\windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp
Think that replace nk.bin.comp in CAB file (with original name of course) should work also, but didn't try.
After this mod scope work normally and LAN also. I just make this start link in \secure\startup
Code: [Select]
211#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC
Don't included EDK and DVM as it is standard options in 2.42
Of course scope indicate that this FW is Ufinalized
Thanks laserK and Elik for advices.
\windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp
FYI:
The patch locations for firmware 2.43:Code: [Select]1) options patch: 0x280940: change "04 00 A0 E1" -> "00 00 A0 E3"
2) nag patch: 0x2a9f38: change "66 5A FF EB" -> "01 00 A0 E3"
So, doing these patches for 2.42 and above, requires going through a bunch of steps, which you really just need to walk through yourself, to see how it all works, versus writing up an entire novel on here trying to explain it...
You need to follow the steps for unpacking the firmware file, de-compressing the 'nk.bin' WindowsCE image, and locating the DLL within that image, you can just find it by using a hex editor, etc, and finding hex patterns...
As safar explained, the 'nk.bin' has checksums for blocks of data, so when you apply the patches into the DLL spots within the nk.bin (decompressed), you need to also fix the checksum for that block. It's a standard 'checksum' algorithm, using single byte as input data (ie versus 16-bit, 32-bit etc 'symbols' for checksum), ie in Safar's post he called it 'UByte8Bit', as other programs tend to say that as well..
A trial one I found that makes it easy is the '010 Editor', it does that checksum calc, as well as many others..
If I were you, I'd download the 2.42 firmware, unpack it, and follow the info that Safar mention in his post... once you can understand what he did, and the locations he patched, you can do it to 2.43 as well....
So, doing these patches for 2.42 and above, requires going through a bunch of steps, which you really just need to walk through yourself, to see how it all works, versus writing up an entire novel on here trying to explain it...
You need to follow the steps for unpacking the firmware file, de-compressing the 'nk.bin' WindowsCE image, and locating the DLL within that image, you can just find it by using a hex editor, etc, and finding hex patterns...
As safar explained, the 'nk.bin' has checksums for blocks of data, so when you apply the patches into the DLL spots within the nk.bin (decompressed), you need to also fix the checksum for that block. It's a standard 'checksum' algorithm, using single byte as input data (ie versus 16-bit, 32-bit etc 'symbols' for checksum), ie in Safar's post he called it 'UByte8Bit', as other programs tend to say that as well..
A trial one I found that makes it easy is the '010 Editor', it does that checksum calc, as well as many others..
If I were you, I'd download the 2.42 firmware, unpack it, and follow the info that Safar mention in his post... once you can understand what he did, and the locations he patched, you can do it to 2.43 as well....
Hi, yes I use IDA for find code and 010 Editor for patch.
I try to explain algorithm (with all steps as it can used by somebody else):
1. Get nk.bin.comp from FW files (ksx = cab) - I use WinRAR, but many arc programs can extract files from CAB
2. Decompress nk.bin.comp by "bincompress.exe /d nk.bin.comp nk.bin"
3. Extract infiniiVisionCore.dll with Remaker for WinCE5
4. Found code in IDA - Sorry, but I don't explain how as it need to write lot info here
5. With sync screens in IDA I look for patch hex code and for nearest area "signature" code also for find it in nk.bin (12..20 bytes for unique found result)
6. (As I lazy for remember bin structure I just to) Make DataTable with "viewbin.exe -d nk.bin > data.txt" - beware file is very big - about 113 MB for 2.43
7. Open nk.bin in Hex Editor and use "signature" code for found patch place (actually I use "find all" and if here is more than 1 result I try to expand "signature" for search)
8. Make patch in this place.
9. Open data.txt and find same "signature" - you found it in some Record [ ] block ([160] for 2.43). Here we need start Record signature for find it in Hex Editor, Record Length And Checksum (checksum is backwards in file as it LittleEndian code). Of course you can look for bin structure and make it more smart.
10. Find Record start signature - 4 bytes before start position is Checksum - compare it with data.txt. Here I bookmarked position.
11. Select block in editor with start on start Record position and Length from data.txt.
12. Calc checksum UByte8Bit
13. Turn back to bookmark and correct checksum (4 bytes before start, and remember for back order)
14. Save patched_nk.bin
15. Compress it to nk.bin.comp by "bincompress.exe /c nk.bin nk.bin.comp"
16. Flash scope, but kill process before
I attach all tools here
I make patched.bin.comp with PhillyFlyers info and with corrected checksum:
Patched2.43
You can flash it as usual by loadP500Flash via telnet in scope
Code: [Select]
\windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp
Checked on my DSOX3034A
Quote
I make patched.bin.comp with PhillyFlyers info and with corrected checksum:
Patched2.43
You can flash it as usual by loadP500Flash via telnet in scope
Code: [Select]
\windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp
Checked on my DSOX3034A
*** FYI ****
The file you posted is the 'uncompressed' and patched nk.bin, so make sure anyone, you do the
'bincompress /d patched_nk.bin patched_nk.bin.comp' first!! as you don't want to flash the uncompressed image, the scope will not boot...
************
Nice Safar! Great writeup, that's an awesome (and fast) writeup!
I am wondering: if these files were patched wrong, will the scope still start up (at least to allow the telnet access)?`
Nice Safar! Great writeup, that's an awesome (and fast) writeup!
U Welcome!
BTW, I try to find some points in IDA for patch message "LAN VGA option module fault", but it seems like one subroutine which select all "System concerns detected" error messages from different enter points. It difficult to understand source for me without real debugger.
I am wondering: if these files were patched wrong, will the scope still start up (at least to allow the telnet access)?`
So, doing these patches for 2.42 and above, requires going through a bunch of steps, which you really just need to walk through yourself, to see how it all works, versus writing up an entire novel on here trying to explain it...
You need to follow the steps for unpacking the firmware file, de-compressing the 'nk.bin' WindowsCE image, and locating the DLL within that image, you can just find it by using a hex editor, etc, and finding hex patterns...
As safar explained, the 'nk.bin' has checksums for blocks of data, so when you apply the patches into the DLL spots within the nk.bin (decompressed), you need to also fix the checksum for that block. It's a standard 'checksum' algorithm, using single byte as input data (ie versus 16-bit, 32-bit etc 'symbols' for checksum), ie in Safar's post he called it 'UByte8Bit', as other programs tend to say that as well..
A trial one I found that makes it easy is the '010 Editor', it does that checksum calc, as well as many others..
If I were you, I'd download the 2.42 firmware, unpack it, and follow the info that Safar mention in his post... once you can understand what he did, and the locations he patched, you can do it to 2.43 as well....
Hi, yes I use IDA for find code and 010 Editor for patch.
I try to explain algorithm (with all steps as it can used by somebody else):
1. Get nk.bin.comp from FW file (ksx = cab) - I use WinRAR, but many arc programs can extract files from CAB.
2. Decompress nk.bin.comp by "bincompress.exe /d nk.bin.comp nk.bin".
3. Extract infiniiVisionCore.dll with Remaker for WinCE5.
4. Open dll in IDA and find asm code for patch - Sorry, but I don't explain how as it need to write lot info here.
5. With sync screens in HexView of IDA I look for patch hex code and for nearest area "signature" code also for find it in nk.bin (12..20 bytes for unique found result).
6. (As I lazy for remember bin structure I just to) Make DataTable with "viewbin.exe -d nk.bin > data.txt" - beware output file is very big - about 113 MB for 2.43.
7. Open nk.bin in Hex Editor and use "signature" code for find patch place (actually I use "find all" and if here is more than 1 result I try to expand "signature" for search).
8. Make patch in this place.
9. Open data.txt and find same "signature" - you found it in some Record [ ] block ([160] for 2.43). Here we need start Record signature for find it in Hex Editor, Record Length And Checksum (checksum is backwards in file as it LittleEndian code). Of course you can look for bin structure and make it more smart.
10. Find Record start signature - 4 bytes before start position is Checksum - compare it with data.txt (remember for back order). Here I bookmarked position.
11. Select block in editor with start on start Record position and Length from data.txt.
12. Calc checksum UByte8Bit.
13. Turn back to bookmark and correct checksum (4 bytes before start, and remember for back order).
14. Save as patched_nk.bin.
15. Compress it to nk.bin.comp by "bincompress.exe /c nk.bin nk.bin.comp".
16. Flash scope, but kill infiniiVision process before.
17. Reboot scope.
I attach all tools here
88#infiniivisionLauncher.exe -l MSO -l BW20 -l DIS -l PLUS -l SCPIPS -l VID -l CABLE --perf
But the real reason I ordered it was for the extra trigger options as that’s what has bothered me the most about this scope since I’ve owned it. Five hundred dollar Chinese scopes had more extensive triggering options. That is now fixed! The menu options went from 5 to 12. Math options increased from 5 to 21! (see the photos for details). The upgrade also is supposed to include the record memory upgrade (to 1 Meg) and the segmented memory option. I already had these but I don’t feel cheated as the features I got are well worth the money spent.
For me, this is like having a new scope. Thanks Keysight!
(http://)
Quote
I make patched.bin.comp with PhillyFlyers info and with corrected checksum:
Patched2.43
You can flash it as usual by loadP500Flash via telnet in scope
Code: [Select]
\windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp
Checked on my DSOX3034A
*** FYI ****
The file you posted is the 'uncompressed' and patched nk.bin, so make sure anyone, you do the
'bincompress /d patched_nk.bin patched_nk.bin.comp' first!! as you don't want to flash the uncompressed image, the scope will not boot...
************
Ohhh, sorry, I will change it
tia,
george.
That is a wonderful trade-in! I traded in a pristine Agilent scope for a DSOX3024T about 18 months ago. They asked a lot of questions about the scope and wanted to be sure that it was working. Supposedly someone was going to pick up the Agilent scope from me but then they asked me to ship it from New Jersey to California. Luckily I got the distributor to pay the $150 shipping cost, but I pad FedEx about $30 for the packing.
Of course I was worried that something would go wrong in shipping, so I took photos of the scope running next to the the current day's New York Times front page. I did not want to get a bill from Keysight for $1400! Apparently it arrived OK, I never heard from them.
In any case, I 'm surprised that a "non-top tier" scope would get the 30% discount since the offer says "up to 30%". When I did my trade-in there was also a free MSO option but they would not allow the offers to be combined.
Indeed, I was surprised and this may be a one-off! It took a few days for them to approve it... their T&Cs for the trade in didn't suggest there were any limits other than certain frequency for frequency bands. i.e., 0-100Mhz could get 0-100Mhz at 30%, but 0-100Mhz for 1Ghz would get 5%. I offered up 3 possible trades in preference of dslogic/rigol1052e/rigol1054z. Once I submitted, however, I was informed that none were on their list of scopes and would be handled as a "custom trade in". Took about 2 days to get an approved response and they'd accepted the dslogic; no further questions were asked about it.
Heck, if they had said the 1052e, I was going to just buy a new one to trade in since I don't have my old one anymore, lol!
Now, the wait. I'm hoping they beat the heck out of their 1+ month lead time estimate.
-j
Quote
I make patched.bin.comp with PhillyFlyers info and with corrected checksum:
Patched2.43
You can flash it as usual by loadP500Flash via telnet in scope
Code: [Select]
\windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp
Checked on my DSOX3034A
*** FYI ****
The file you posted is the 'uncompressed' and patched nk.bin, so make sure anyone, you do the
'bincompress /d patched_nk.bin patched_nk.bin.comp' first!! as you don't want to flash the uncompressed image, the scope will not boot...
************
Ohhh, sorry, I will change it
Ok, so I assume the minimal steps are:
0) Install correct Firmware version first (i.e. in this case 2.43)
1) Download Safar's patched_nk_bin.comp file and copy to a USB stick and plug in.
2) Telnet into the scope.
3) Login infiniivision / skywalker1977
4) processmgr kill infiniivisionlauncher.exe
5) \windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp
6) Create a file on the USB stick called infiniivision.lnk with contents (e.g.) "88#infiniivisionLauncher.exe -l MSO -l BW20 -l DIS -l PLUS -l SCPIPS -l VID -l CABLE --perf"
7a) delete (or rename) any other lnk in \secure\startup folder. Should be only one file with lnk extension here.
7b) copy \usb\infiniivision.lnk to \secure\startup
8 ) reboot and good to go
Do I have the basic steps correct or ???
tia,
george.
Edited as per Safar. Thanks!!
Excuse me, after following your steps, will there be a "Firmware error" prompt at startup?
Excuse me, after following your steps, will there be a "Firmware error" prompt at startup?
No, something wrong. Tell all possible details. Which model? Is OS loaded? Can you connect scope via network?
1) Attempt to locate 'Xloader' in NOR flash... if fail, goto USB BOOT
if OK, goto step 2
2) Attempt to locate 'U-Boot' in NOR flash, if fail, goto UsB BOOT
if OK, goto step 3
3) boot up OS from NAND flash
USB-Flasher is available from the ST-Micro web-site under the SPEAR600 page..But is a compatible image available to flash with this tool ?
SorryExcuse me, after following your steps, will there be a "Firmware error" prompt at startup?
No, something wrong. Tell all possible details. Which model? Is OS loaded? Can you connect scope via network?
When you've the original LAN/VGA module installed there should be no warning but with the DIY module there is a little popup saying the LAN/VGA module has a fault but you can skip that by pressing any keyWhat I read, not on all scopes. The reason why this happens on some scopes and on some scopes not is still unknown.
When you've the original LAN/VGA module installed there should be no warning but with the DIY module there is a little popup saying the LAN/VGA module has a fault but you can skip that by pressing any keyThis means that the latest crack will not have the "Firmware incorrect" warning?
When you've the original LAN/VGA module installed there should be no warning but with the DIY module there is a little popup saying the LAN/VGA module has a fault but you can skip that by pressing any keyThis means that the latest crack will not have the "Firmware incorrect" warning?
When you've the original LAN/VGA module installed there should be no warning but with the DIY module there is a little popup saying the LAN/VGA module has a fault but you can skip that by pressing any keyWhat I read, not on all scopes. The reason why this happens on some scopes and on some scopes not is still unknown.
You don’t need to write corrupt flash data to enter USB loader. Just short some flash data pins with tweezers at poweron.
Edit: there is a BOOT_SEL pin also, search the thread.
USB-Flasher is available from the ST-Micro web-site under the SPEAR600 page..But is a compatible image available to flash with this tool ?
USB-Flasher is available from the ST-Micro web-site under the SPEAR600 page..But is a compatible image available to flash with this tool ?
Well, technically we have all of the 'pieces' in order to flash
cvrtbin -r -a start_in_hex -w 32 -l length_in_hex nk.bin
-w 32 is length of block (4 bytes)
Well, technically we have all of the 'pieces' in order to flash, as most of the pieces are in the firmware file... but we still have to construct the image files first, but I haven't figured all of the mapping out yet, unless someone else knows offhand the flat file arrangement of the NOR & NAND flashes...
I've dumped the NOR flash via JTAG, and see the XLOADER, UBOOT, PBOOT, and MAC address locations in there, but I haven't finished going over it..
to dump NAND I believe I have to configure the spear600 memory controller (FSMC) to be able to read NAND, and you have to read it out in pages... I haven't done anything with that yet...
Also, with that USB flasher tool it looks like you need to know exact mem locations, etc for each part, so we'd have to spell all that out... but from what I see, it should be do-able... but hopefully we'd never have to get that far down the rabbit hole...
It's probably not a common thing to have the NOR flash corrupted, I think all the issues people have mentioned about 'corrupt flash' have been with the NAND flash, which is all OS components.
UBOOT/CEBoot should still be available via RS232 to reload a new OS image (nk.bin), and fix the NAND flash from there...
dumprom -d files_dump -5 NK.nb0 >> map.txt
files_dump is subdirectory for files output (should be exist)dumpromx -f file_name -d files_dump -5 NK.nb0
files_dump - destination subdirectory (should be exist)
When you've the original LAN/VGA module installed there should be no warning but with the DIY module there is a little popup saying the LAN/VGA module has a fault but you can skip that by pressing any keyThis means that the latest crack will not have the "Firmware incorrect" warning?
Yes, last 2.43 FW DLL patched in two places in BIN file: NETWORK patch and NAG patch. NAG patch eliminate any FW warning messages (in start and in about screen IIR).
Edit: and these messages shows if you start infiniivisionloader.exe with any params (with normal unpatched DLL)
Hi, I'm new to this forum and its my first post. I'm too late to visit here and the discussions are extended to 70+ pages.
Is it finally the DSOX3000 hacked? My firmware version is 2.36.2013091201. I'm looking for bandwidth upgradation from 100MHz to any higher. If it is hackable, please any one redirect me to a right post.
Regards
Udhay
Hi, I'm new to this forum and its my first post. I'm too late to visit here and the discussions are extended to 70+ pages.
Is it finally the DSOX3000 hacked? My firmware version is 2.36.2013091201. I'm looking for bandwidth upgradation from 100MHz to any higher. If it is hackable, please any one redirect me to a right post.
Regards
Udhay
Hint: Print button at the top right gets it all into one page, then search using CTRL-F/CMD-F.
Hi, I'm new to this forum and its my first post. I'm too late to visit here and the discussions are extended to 70+ pages.
Is it finally the DSOX3000 hacked? My firmware version is 2.36.2013091201. I'm looking for bandwidth upgradation from 100MHz to any higher. If it is hackable, please any one redirect me to a right post.
Regards
Udhay
Hint: Print button at the top right gets it all into one page, then search using CTRL-F/CMD-F.
Short answer is yes, you can release ALL features of your scope. The 2000/3000 share the exact same firmware/software.
Read backwards and you'll get the latest information on the latest firmware update. You really need to get yourself a LAN card (either a DIY version of which gerbers etc are in this thread, OR, the Keysight VGA/LAN). The LAN card lets you telnet into the scope to initiate the steps necessary to release all the features . Again, read backwards from this point, won't take you more than 30 mins or so to get the most recent firmware update sequence (using a LAN card and an external USB flash drive).
cheers,
george.
Hi All,
I put together a 3-in-1 DSOX LAN board, to incorporate the LAN setup everyone is already using, plus a USB-UART
setup and JTAG buffer, to have all 3 interfaces available via the LAN card faceplate.
(Thanks to everyone on here that did the real work getting the LAN card figured out, all the hard work. I just
incorporated those setups, and tacked on an RS232 setup and JTAG setup.)
The USB uart setup pulls the 3.3v power for the chip from the HOST USB 5v power, so that the serial port can be up
and connected to, before the scope is powered on. This makes it super easy to power on the scope and immediately
halt in UBOOT. (hitting spacebar while you power on the scope)
The JTAG buffer setup just provides a nice buffered setup (same buffer setup that's been used in numerous other
jtag projects, etc)
I found that the 'SEGGER JLINK-EDU' is a very nice and super easy device to use, and it already has defines setup
for the SPEAR600. (no defined setup for programming flash or reading the NAND flash, as the SPEAR600-FSMC needs to
be setup manually, but you can easily dump the NOR flash, the most important anyhow).
JLINK-EDU is same as JLINK-BASE, but meant for non-commerical use, which is fine for us. And it's only $60 from
Digi-key and others.
In order to use JTAG, you have to pull up those two pins as was shown way back around page 6 I think of this
thread, so I added a dip-switch onto the board for all 3 locations, and you can actually run wires from those 3
pads to the board, and use the dipswitches to turn on/off those enable pins.
But since they are by default pulled LO by 81 ohm resistors, you have to remove them, and either replace with 10k,
or just leave open, and let the board do the pullup/pulldown.
You can also just build the board and only populate what you want, ie you can leave JTAG un-populated, and also
don't need to populate any of the LEDs, I just did that for fun, and it looks pretty when they light up :)
Attached are some pics of the board, the initial UBOOT menu (when halted via the serial port), etc..
(see the hackaday link for all the files)
https://hackaday.io/project/114593-dsoxlanplus (https://hackaday.io/project/114593-dsoxlanplus)
Hi guys, I have a DSO-X 3034A, unfortunately the firmware was down. The xloader, pboot and uboot works fine. I have updated the pboot and the uboot with the same file in the update packet 3000XSeries.02.43.2018020635.ksb (use uboot with uart to stop booting pboot progress and use kermit protocol to transfer files to memory and use cp command to overwrite the old pboot and uboot).And the nand memory should flash too, but I don't know how and where to get the nand data? In other words how can I fix it by my hand. Have any ideas? (PS: the nand has been erased and I don't have a lan module)Not sure but is "start usb" works in uboot prompt? (With USB flash connected)
the uboot don't support usb device and I used three versions uboot, the version from the factory (unknown),the version which in 3000XSeries.02.35.2013061800 certainly support boot from usb and the last update packet 3000XSeries.02.43.2018020635 version uboot.All of these cannot boot from the usb disk which can boot on my friend's same DSO-X 3034A with version 02.35.2013061800. I need to modify the lan board and submit to the factory to production, it may be a few days.Hi guys, I have a DSO-X 3034A, unfortunately the firmware was down. The xloader, pboot and uboot works fine. I have updated the pboot and the uboot with the same file in the update packet 3000XSeries.02.43.2018020635.ksb (use uboot with uart to stop booting pboot progress and use kermit protocol to transfer files to memory and use cp command to overwrite the old pboot and uboot).And the nand memory should flash too, but I don't know how and where to get the nand data? In other words how can I fix it by my hand. Have any ideas? (PS: the nand has been erased and I don't have a lan module)Not sure but is "start usb" works in uboot prompt? (With USB flash connected)
Otherwise you should take LAN for TFTP upload kernel.
Some of my licenses still show a * beside them, but i think that's because it has "valid" trial licenses in place when it was liberated.
Thank you to those who have shared.
-j
Some of my licenses still show a * beside them, but i think that's because it has "valid" trial licenses in place when it was liberated.
Thank you to those who have shared.
-j
In 3000A scope this sign * is appear if I use group license ("-All").
Cool deal with those offsets, yes, the 3KT firmware version is the same, I can't confirm it's the same _image_ for the 4K series though.
This is what my infiniivision.lnk looks like:
\secure\startup> type infiniivision.lnk
211#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC
\> dir \secure\startup
Directory of \secure\startup
03/03/18 07:18p 217 infiniivision.lnk
01/27/17 02:51p 0 orig.sav
5) \windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.compCan this step be run from a custom made install script instead of telnet? 1000X series does not have LAN interface.
5) \windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.compCan this step be run from a custom made install script instead of telnet? 1000X series does not have LAN interface.
Is the patch just to avoid the unfinished software error message or open all options? the infiniivisionLauncher application (or infiniivisionCore.DLL) on the 1000X does not take any options5) \windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.compCan this step be run from a custom made install script instead of telnet? 1000X series does not have LAN interface.
Think it possible, you need make some fake cab file with xml script.
Is the patch just to avoid the unfinished software error message or open all options? the infiniivisionLauncher application (or infiniivisionCore.DLL) on the 1000X does not take any options5) \windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.compCan this step be run from a custom made install script instead of telnet? 1000X series does not have LAN interface.
Think it possible, you need make some fake cab file with xml script.
This is what my infiniivision.lnk looks like:
\secure\startup> type infiniivision.lnk
211#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC
\> dir \secure\startup
Directory of \secure\startup
03/03/18 07:18p 217 infiniivision.lnk
01/27/17 02:51p 0 orig.sav
Strange. All looks correct.
Not sure for help but... I have absolutely the same string but file length is 215 bytes, not 217. It may be LFCR in the end disturb?
Hi guys - please allow me to ask one question: If I update my MSOX3024T with latest firmware 2.43 - is logging in via telnet still possible? Or possibly they modified the updates to prevent telnet access?
...snip....Code: [Select]
3000T series:
firmware 7.20
----------------
1) options patch: 0x486f3c --> "04 00 A0 E1" --> "00 00 A0 E3"
2) nag patch: 0x4f22c8 --> "A8 F1 93 E5" --> "01 00 A0 E3"
To understand how to apply these patches, best way is to follow safar's post, details here... they seem to have taken the same approach with all of the firmware's now, the DLL is NO longer on disk, it has to be modified directly in the Windows CE image (nk.bin)
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1453285/#msg1453285 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1453285/#msg1453285)
...snip....Code: [Select]
3000T series:
firmware 7.20
----------------
1) options patch: 0x486f3c --> "04 00 A0 E1" --> "00 00 A0 E3"
2) nag patch: 0x4f22c8 --> "A8 F1 93 E5" --> "01 00 A0 E3"
To understand how to apply these patches, best way is to follow safar's post, details here... they seem to have taken the same approach with all of the firmware's now, the DLL is NO longer on disk, it has to be modified directly in the Windows CE image (nk.bin)
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1453285/#msg1453285 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1453285/#msg1453285)
@PhillyFlyers, @Safar - Thank you.
7.20 on 3KT now has the nag gone.. I patched "options" and "nag".
Using Safar's instructions, it took me a bit to realize that I needed to use the offsets provided by Philly in infiiniivision.dll to get a signature to match in the uncompressed.bin, plus the viewbin's data dump to get the "Record" (Record[173 for 7.2/3KT), use the hex in that data dump to get the offset in nk.bin to find the beginning/end of the dll in the bin, patch up the 2 locations, update checksum, compress, copy to usb, flash via telnet... (hopefully this very quick chain of thought helps someone else later...).
What is unexpected is on boot I'm now seeing "System concerns detected: - Secure Storage is uninitialized. Please set instrument serial and licensing model numbers." as a per-boot popup. Once I close that, about shows the proper serial#/model/bandwidth and all options.
I'm using the simple loader that jeffrey helped with along with the patched offsets.
I don't see any direct reference to that string/message in the (printed) thread, although there are some similar messages.... I didn't get this before patching nk.bin -- did I hose the patch or just needed to expect "secure storage is uninitialized"?
Thanks,
-j
Heya All,
Does anyone know the scoop on the 4k series, in regards to the PCB and bandwidth upgrades?
Is it the same as the 2k/3k setup, where 200mhz can go up to 350mhz? ie is there different filters needed to go from 350 to 500, and then to 1Ghz or 1.5Ghz?
So if for example you have a DSOX4024, can it only go up to 350Mhz without frontend changes... just wondering what fun things can be done with a 4k series...
Heya All,
Does anyone know the scoop on the 4k series, in regards to the PCB and bandwidth upgrades?
Is it the same as the 2k/3k setup, where 200mhz can go up to 350mhz? ie is there different filters needed to go from 350 to 500, and then to 1Ghz or 1.5Ghz?
So if for example you have a DSOX4024, can it only go up to 350Mhz without frontend changes... just wondering what fun things can be done with a 4k series...
Can anyone give me a hint how to log in into my scope using telnet?
I am sitting in front of an DSOX3012T
On that scope the Firmware 2017.1026 is allready installed, never the less i prepared the hacked firmware to get all options.
Login into to scope using user infiniivision and pass skywalker1977 is not working, even when i try it more the one time.
Is there a need to flash an old firmeware to the scope to get the login running?
If yes it would be fine if someone will have an old working firmware
Kind regards
I do :)
I sold my DSOX3024a and purchased a DSOX4024a instead.
The larger screen (though unfortunately not higher resolution) and the touch (not always, but perfect for dragging or entering numbers/characters) are a really nice improvement over the 3000 series. And I compared it to an R&S RTB2004: the Keysight is way better suited for daily work (easier and quicker to use, more and better functionality, not artificially crippled as the RTB).
Btw, Keysight does have a nice offer of a DSOX4024a including a fresh calibration at the moment: (https://www.ebay.com/itm/183228321094 (https://www.ebay.com/itm/183228321094)) for approx. 3000 Euro including world wide shipping! This is a really nice deal! And you can make an offer. 10%-15% off is usually no problem at the Keysight store.
If you read the posts above: transforming it into a MSOX4024a with all options enabled is not too difficult.
I will do the 500Mhz modification in a month or maybe two and will make photos of all needed steps then and post them here.
Btw, Keysight does have a nice offer of a DSOX4024a including a fresh calibration at the moment: (https://www.ebay.com/itm/183228321094 (https://www.ebay.com/itm/183228321094)) for approx. 3000 Euro including world wide shipping! This is a really nice deal! And you can make an offer. 10%-15% off is usually no problem at the Keysight store.Was sold just a few hours after I mentioned it, for only 3200 USD = 2700 Euro. What a snatch! Congratulations to the buyer!
Well the buyer chickened out so it has been relisted - anyone else interested?
Well the buyer chickened out so it has been relisted - anyone else interested?
I don't see it?
https://www.ebay.com/itm/192545547880 (https://www.ebay.com/itm/192545547880)
https://www.ebay.com/itm/192545547880 (https://www.ebay.com/itm/192545547880)
"This item does not ship to Netherlands " :-//
That's why it didn't show up for me.
What does it really add over the 3000T, though?
What does it really add over the 3000T, though?
Bigger screen, builtin VGA and network, second waveform gen and 10 MHz ref in. Nothing I really need, the bigger screen is always nice of course. I'd just like to mod another scope and it would be fun to livestream the entire process.
What does it really add over the 3000T, though?
Bigger screen, builtin VGA and network, second waveform gen and 10 MHz ref in. Nothing I really need, the bigger screen is always nice of course. I'd just like to mod another scope and it would be fun to livestream the entire process.
Well, if it's just for fun, then by all means get it!
https://www.ebay.com/itm/192545547880 (https://www.ebay.com/itm/192545547880)
"This item does not ship to Netherlands " :-//
That's why it didn't show up for me.
https://www.ebay.com/itm/192545547880 (https://www.ebay.com/itm/192545547880)
"This item does not ship to Netherlands " :-//
That's why it didn't show up for me.
They will ship to the EU but you'll have to pay them some VAT on top of the listed price.
sold again for exactly $3200. Probably somebody asked them about the shipping and they changed it back. I was wondering too about the excluded shipping. Beside some African and some other obscure countries, Europe was completely excluded. Strange.
@Toploser: why should they add VAT for European countries when they ship from Malaysia (the auctions says: Item location: Keysight Factory, Penang, Malaysia)? (the only reason I can think of is, that the unit is already in an European Keysight facility).
Hello all, ...
(at my age I may never be able to replace it)
Hello all,
Thanks for asking SUKA_KRYSA,
I am continuing to research though Safar's recent reply indicates recover to factory-default 2.43 should be no problem.
Am I reading correctly that with the newer versions of the firmware, booting from "fixed" firmware on USB isn't possible; that 2.42 (or perhaps older) firmware could boot and run from USB -- but 2.43 cannot? I may not have the correct firmware version where I recall this changed.
The longer boot time (for me) would not be a problem.
Thank you
NorcalNerd
Work on my DSOX2002A continues. The front panel was able to operate. Remaining add main PCB components ...Cool! I assume you are the first who upgrades from 2 to 4 channels (at least I know nobody else).
Having that extra real estate sure would be nice, but why do they leave that stupid menu bar on the right of the screen that you can't hide? At least maybe they can improve this in future software if they care too.. but just seems like a pure waste of screen space..
Having that extra real estate sure would be nice, but why do they leave that stupid menu bar on the right of the screen that you can't hide? At least maybe they can improve this in future software if they care too.. but just seems like a pure waste of screen space..
I'm pretty sure that this is a limitation of the ASIC. I think it draws the pixels directly, so there is pretty much no chance that the screen will ever get any bigger.
But I have trouble getting a twin BNC connector from the main PCB :(These connectors are probably a custom Keysight part = unobtainium. But as you can see, these connectors does have unusual long connection wires (> 1 cm), you probably can use regular single BNC connectors (e.g. Amphenol 162109) and a peace of metal you need to mill and drill, where you then screw the mentioned Amphenol connectors to (such as the other photo shows).
Do you have an idea where is possible this twin BNC connector obtain?
Where on earth did they get the chips from? Are they bootleg from the foundry which Agilent used?
Thanks for asking SUKA_KRYSA,
I am continuing to research though Safar's recent reply indicates recover to factory-default 2.43 should be no problem.
Am I reading correctly that with the newer versions of the firmware, booting from "fixed" firmware on USB isn't possible; that 2.42 (or perhaps older) firmware could boot and run from USB -- but 2.43 cannot? I may not have the correct firmware version where I recall this changed.
The longer boot time (for me) would not be a problem.
Thank you
NorcalNerd
To be honest, I'm completely confused about what you want to do. As far as I understand, you got perfectly working scope, you've succesfully updated it to the latest firmware (2.43 in our case) and everything is fine for now. And you want to hack it by the Safar's method with no troubles e.g. breaking the scope, am I right?
If so, you don't need to decompress and compress that Patched2.43 file, you simply drop it onto the USB stick, boot up, telnet and further on. The only files that must be on the stick is infiniivision.lnk and patched_nk.bin.comp. Note: you create them on your PC, not on the scope via Telnet!
Don't know about older versions, I'm personally flashed straight on 2.43 and evertythibg works just fine. Boot time is the same.
The only issue is a repair/cal process. The patched firmware have no differences with the original one as long Keysight's certified technics don't digs into the code. Don't think they will do it with no reason, too much wasting their precious time. So I believe you can telnet again and overwrite infiniivision.lnk file with empty one before the call process. And again after. Great scheme, huh?
How to Installafter some minutes waiting and now my scope have 2.35 firmware . :wtf:
To update your oscilloscope's firmware, do one of the following:
Place the file on a USB flash drive, connect it to the oscilloscope, press [Utility] > File Explorer, select the file; then, press Load File.
If your oscilloscope is on the network: you can place the file on your computer, access the oscilloscope's Web Interface (see the User's Guide for details), click Instrument Utilities, select Firmware Version, browse to select the file; then, click Install.
How to hack the firmwarebut the link of WinCE CAB Manager is dead. :( anybody have this software ?
1. Unpack the firmware *.cab by 7zip
2. Unpack infiniiVisionSetup.cab ( e.g. with WinCE CAB Manager 3.0)
Find \Secure\infiniiVision\infiniiVisionCore.dll
3. Change at location 0x277e50 in infiniiVisionCore.dll
byte sequence 04 00 a0 e1 to byte sequence 00 00 a0 e3
4. Enable startup Overide by creating USB flash with following structure in root of USB drive (copy structure from Secure folder from point 2)
Edit in Startup folder file infiniivision.lnk to contains following sequence "62#\usb\infiniiVision\infiniivisionLauncher.exe -l All -l SCPIPS"
Replace in infiniiVision folder infiniiVisionCore.dll with patched infiniiVisionCore.dll file
5. Create infiniivisionStartupOverride.txt file in root of USB flash drive containing "True"
6. Plug the USB drive to scope and turn it ON
7. There will be red message in letf top corner "Unfinalized Software" and "System Concerns detected: OS version is not correct. Please reload system firmware"
Applications needed:
WinCE CAB Manager http://www.ocpsoftware.com/products.php (http://www.ocpsoftware.com/products.php)
7Zip http://www.7-zip.org/ (http://www.7-zip.org/)
Thanks for asking SUKA_KRYSA,
I am continuing to research though Safar's recent reply indicates recover to factory-default 2.43 should be no problem.
Am I reading correctly that with the newer versions of the firmware, booting from "fixed" firmware on USB isn't possible; that 2.42 (or perhaps older) firmware could boot and run from USB -- but 2.43 cannot? I may not have the correct firmware version where I recall this changed.
The longer boot time (for me) would not be a problem.
Thank you
NorcalNerd
To be honest, I'm completely confused about what you want to do. As far as I understand, you got perfectly working scope, you've succesfully updated it to the latest firmware (2.43 in our case) and everything is fine for now. And you want to hack it by the Safar's method with no troubles e.g. breaking the scope, am I right?
If so, you don't need to decompress and compress that Patched2.43 file, you simply drop it onto the USB stick, boot up, telnet and further on. The only files that must be on the stick is infiniivision.lnk and patched_nk.bin.comp. Note: you create them on your PC, not on the scope via Telnet!
Don't know about older versions, I'm personally flashed straight on 2.43 and evertythibg works just fine. Boot time is the same.
The only issue is a repair/cal process. The patched firmware have no differences with the original one as long Keysight's certified technics don't digs into the code. Don't think they will do it with no reason, too much wasting their precious time. So I believe you can telnet again and overwrite infiniivision.lnk file with empty one before the call process. And again after. Great scheme, huh?
To clarify, I was hoping to boot directly from USB where the USB stick would have Safar's patched_nk.bin.comp and the modified infinivision.lnk -- and then after the expected long "boot from USB" process, I would evaluate the new features -- assuming all worked as I expected, I would then proceed to flash Safar's firmware overwriting the Keysight 2.43, replacing the original infinivision.lnk with the modified link.
Is "boot from USB" possible if the 3024A was upgraded to Keysight's latest 2.43 or am I misreading the blog?
Thanks kindly,
NorcalNerd
Hello all,
5/ Save the original link and make the new startup link:
save the original infiniivision.lnk renaming it to something like "orig.sav".
NOTE: the \secure\startup folder should contain ONLY ONE .lnk file, named infiniivision.lnk, with the below command line (do not add quotes):
"211#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC"
U-Boot 2010.03 (Jan 26 2011 - 12:37:34)Agilent P500
CPU: SPEAr600
DRAM: 128 MiB
Flash: 512 KiB
NAND: 128 MiB
In: serial
Out: serial
Err: serial
SerNum:serial number not programmed
Chip: BD Board Rev: 4
Net: smsc
Press space to stop autoboot: 0
## Booting kernel from Legacy Image at f8050000 ...
Image Name: PBOOT
Created: 2011-01-27 11:38:14 UTC
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 36703 Bytes = 35.8 KiB
Load Address: 00000000
Entry Point: 00000000
Uncompressing Kernel Image ... OK
Starting kernel ...
Debug serial initialized ........OK
Microsoft Windows CE Bootloader Common Library Version 1.4 Built Jan 27 2011 02:04:15
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008
System ready!
Preparing for download...
Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN
X
XXXXOOOOXOOOOOOOOXOXXOOOOOOOOXOOXOXOOOOXXXOOOOOOOOOXOOOOXOXXOXXOXOOOXOXXXXXXOOXXOOOOOOXOOXXOXXOOOXOXXOOXXOXOOOXOOXOOXXOOOXOOOOXOXOOOOOXOOXOOOXOXXXXXOXOXOXOXXXXXXOXXXOOOXOOOOXXOOOOXOOOOXOXOXOOOOOOXOOOOXOXOOOOOXX
OOOOOXOOXOOXXOOOOOOOOOOXOOOXOOOOOOOXXOOOOOXXOOOOOOOXOOXXOOOXOOOOXOOOXOOXOOXOOXOXXOXOOXOXOXOXOOOXXOOXXXOOOOXXXXOXOOOXXOOOOOXOOOXOOOXOOXOOOXOOXOOXXXXXXXXXERROR: Checksum failure (expected=0x1ED617A computed=0x1ED617B)
****** Checksum failure on record 134, ABORT!!! ******
Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000 Length=0x12F9870 Name="" Target=RAM
Loading image 1 failed, trying next one
Loading image 2 from memory at 0xD1600000
BL_IMAGE_TYPE_UNKNOWN
Loading image 2 failed, trying next one
All images failed
Press r to reset
U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500
CPU: SPEAr600
DRAM: 128 MiB
Flash: 512 KiB
NAND: fsmc-ecc1 128 MiB
In: serial
Out: serial
Err: serial
SerNum:serial number not programmed
Chip: BD Board Rev: 4
Net: smsc
Press space to stop autoboot: 0
## Booting kernel from Legacy Image at f8050000 ...
Image Name: PBOOT
Created: 2015-05-07 8:18:27 UTC
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 37749 Bytes = 36.9 KiB
Load Address: 00000000
Entry Point: 00000000
Uncompressing Kernel Image ... OK
Starting kernel ...
Debug serial initialized ........OK
RTC: 2018-8-22 16:29:21.79 UTC
Microsoft Windows CE Bootloader Common Library Version 1.4 Built May 7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008
System ready!
Preparing for download...
RTC: 2018-8-22 16:29:21.83 UTC
Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN
X
XXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXXOOOOOOOOOXOOOOXOXOXOXXOXOXOXOXXXXOOXXXOOOOOOXXOXXOXXXXXXOOOXXXOXXOOOXXXOXXOOOOXOOXXOOXOXOOORewrite recommended, internal ECC corrected data at 0x1184
OXOXOOOOOXOOOXOOXOXOXOXXXXXXOXXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOXOOOX
OOXOOOOXOOOOXOOXXOOXOOOOOOOOOXOXOOOXOOOOOOXOXXOOOOXOXOOOOOOOXXOOXOOXOXOOOXOOOXOOXXOXOXOOOXOXXXXOXOXXOXXXXXOXOXXOOOXXXOXXXXXXOXXXXXXOXXXXOXOXXOXOOOXXXXOXXXXOOOXOOOXXXOXXOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOX
XOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXXXOXORewrite recommended, internal ECC corrected data at 0x233a
OOXXOOOXOOXXXXXXXXXXXXXXrom_offset=0x0.
XOXImageStart = 0x80361000, ImageLength = 0x1AD2DB8, LaunchAddr = 0x80362000
Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000 Length=0x1AD2DB8 Name="" Target=RAM
Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
RTC: 2018-8-22 16:29:25.19 UTC
Launching windows CE image by jumping at address 0x 362000
Windows CE Kernel for ARM (Thumb Enabled) Built on Mar 8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Feb 6 2018)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000 size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200 (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
ERROR: c:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 1460: RewriteEbootBlocks from 0x1184 to 0x233a
Rewriting Block at Sector Address 0x233a. 3346
Read Block SUCCEEDED 3375
Erased Block SUCCEEDED 3376
Completed rewriting Block SUCCEEDED 3418
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 00:30:D3:20:DA:0B
Phy found addr 31 (ticks=5178)
WaitForLink Start (ticks=5180)
Link Detected (ticks=5182)
GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
Flushed Transmit Buffer
phyCfg->dwSpeed 0x64
phyCfg->bFullDuplex 0x1
<--EDeviceInitialize
GMAC DMA status register = 0x600004
GMAC Device enable interrupt
DriverStart
GMAC Device enable interrupt
LIN: Data Valid
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Autonegociation Start (ticks=7208)
Autonegociation End (ticks=9713)
WaitForLink Start (ticks=9714)
Link Detected (ticks=9717)
GMAC Init : 100 Mbit/s FULL DUPLEX (MII)
cable attached
Running infiniiVisionInstallHelper
Running launchNetworkServices
Starting Agilent LXI Services.
Device load time:
NANDFLASH: 0 ms
SNANDFLASH: 0 ms
USB Hard Disk Drive: 0 ms
Summary of scan:
All FATs on volume agree
Percent Fragmentation: 0
Invalid Directories: 0
Invalid Files: 0
Invalid Clusters: 0
Lost Cluster Chains: 0
ScanVolume \Agilent Flash (NANDFLASH) 0.281000
Summary of scan:
All FATs on volume agree
Percent Fragmentation: 0
Invalid Directories: 0
Invalid Files: 0
Invalid Clusters: 0
Lost Cluster Chains: 0
ScanVolume \Secure (SNANDFLASH) 0.433000
SHIM DLL, LoadRealDll [PalIO.dll] for [AgilentPalIO.dll]
SHIM [AgilentPalIO.dll] Get Process Addresses
Our command line is
Performing Startup
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]
SHIM [AgilentPalSStorage.dll] Get Process Addresses
creating \Secure\bin\Released build, Feb 6 2018, 19:47:18
Initializing FPGA...
****
FPGA Type: Wyoming
Ver: 2.011 Released
Build Time: Tue May 27 16:03:14 2014
Build Machine: TS2404M
****
Programming LAN option module...
Module option FPGA DONE bit should be LOW at this point
Keyboard firmware version 32... ok
Keyboard Info: Board id 1, Board rev 3
Startup sequence is complete.
SHIM DLL, LoadRealDll [PalSysManagement.dll] for [AgilentPalSysManagement.dll]
SHIM [AgilentPalSysManagement.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalCaps.dll] for [AgilentPalCaps.dll]
SHIM [AgilentPalCaps.dll] Get Process Addresses
System has been running 27.213392 seconds
Start Up Sequence 12.658394
Memory Load 59%
System Physical Memory 42.645 / 73.230 MB
Process Virtual Memory 49.188 / 1024.000 MB
-----> InfiniiVision is running <-----
Update UBOOT at address f8010000.
Date in resource is newer than date stored in NOR
DO NOT DISTURB.
Sector 1 Erasing Writing succeeded
Sector 2 Erasing Writing succeeded
Sector 3 Erasing Writing succeeded
Verifying boot loader in NOR
ERROR: C:\WINCE600\3RDPARTY\Agilent\HPP\Common\Drivers\MapMemoryIntoUserSpace\.\MapMemoryIntoUserSpace.cpp line 153: VirtualFreeEx() failed
Updating UBOOT complete
Update PBOOT at address f8050000.
Date in resource is newer than date stored in NOR
DO NOT DISTURB.
Sector 5 Erasing Writing succeeded
Verifying boot loader in NOR
ERROR: C:\WINCE600\3RDPARTY\Agilent\HPP\Common\Drivers\MapMemoryIntoUserSpace\.\MapMemoryIntoUserSpace.cpp line 153: VirtualFreeEx() failed
Updating PBOOT complete
With the NK.bin from 2.43 it will fully boot.
I did the USB-Hack v02.37 and the hardware mod to my MSO3014A to get the 500MHz a year ago. Everthing is working fine :-+ I just wonder if the mod increases the noise of the input chanels. So I took a picture of all 4 chanels to compare with your scopes. Is the level of noise ok for a 500MHz scope or did the mod make it worse?
When i try to update with 2.41
I have not a network card, so i wan't to try with old version, but i don't find them in the web,.
Have you these version please?
But have you these firmware please?
Thank TheSteeve, but i read 3000series and i have a 2000 series
That read the usb stick, that say "Finishing update" with 2012" , the scope boot, i have the screen of the scope with this msg"system concerns detected:OSversion is not correct. Please reload system firmware". But when i pull the stick and i push a button the scope restart.
I observ that the usb stick blink when i touch the button, i think the scope read only the firmware in the usb stick.
The system version is 02.20.2012110802
When i pull the usb stick, the scope hang, an i have the warning msg with 2011 version
Someone have an idea to force the scope to copy the"modification" to his memory With usb only?Perhaps you can make cab with modified bin.comp but you should to modify also recipe XML script for correct checksum of bin.comp. I wrote it some times ago. Bin.comp flashed twice so you should correct XML in two places
Anybody tried to flash the scope to fw version 1.10 and use the leaked key?Are you asking about 1000X series scopes or 2000X/3000X?
Well I'm mostly interested from a technical point, as I don't have any of the three. But the private keys for the 2000x and 3000x licenses was leaked with the 1.10 firmware for the scopes, so I thought it was a possibility.Anybody tried to flash the scope to fw version 1.10 and use the leaked key?Are you asking about 1000X series scopes or 2000X/3000X?
When they diagnose and confirm it is NAND corruption then the cost of repair is ZERO.
Upgrade to 2.43 and the risk of corruption becomes almost zero.
I do :)
I sold my DSOX3024a and purchased a DSOX4024a instead.
The larger screen (though unfortunately not higher resolution) and the touch (not always, but perfect for dragging or entering numbers/characters) are a really nice improvement over the 3000 series. And I compared it to an R&S RTB2004: the Keysight is way better suited for daily work (easier and quicker to use, more and better functionality, not artificially crippled as the RTB).
If you read the posts above: transforming it into a MSOX4024a with all options enabled is not too difficult.
I will do the 500Mhz modification in a month or maybe two and will make photos of all needed steps then and post them here.
Hi Pinkus, I was wondering if you went ahead with the 500MHz to 1GHz mod for your 4k X-series scope?Hi Sparky,
Hi Pinkus, I was wondering if you went ahead with the 500MHz to 1GHz mod for your 4k X-series scope?Hi Sparky,
I would like to, however my DSOX4000, running with the latest firmware version, sometimes needs 2-3 attempts to boot up. I suspect an starting NAND corruption. Right now I am not sure what to do with this scope and how to fix it. This is right now more important than getting 500 Mhz or 1 GHz. Next will be to log the UART output and see it this helps to nail down the problem. Maybe mlans post might help to allow another firmware update with the latest version, even if I already have it installed. My hope is to rewrite NAND.
I will definitively post here if I did the upgrade (also the outcome of a firmware rewrite will be posted).
I just bought a DSOX2004A 70mhz scope. Can this scope be hacked up to 200mhz bandwidth. I can't seem to find anything relating to the bandwidth upgrade for the 2004a.
Maybe the resister config on the board?
Thank you all,Today I was hacked my scope dsox3014t,but the scope "User Cal Status" is always shown as "unprotected",What should I do?Very thank you all again.
^-^Thank you all,Today I was hacked my scope dsox3014t,but the scope "User Cal Status" is always shown as "unprotected",What should I do?Very thank you all again.
That is a byproduct of the hack. It is actually a good thing as it makes for an easy way to verify externally if licenses are valid/real or have been hacked.
I make patched.bin.comp with PhillyFlyers info and with corrected checksum:
Patched2.43 (https://drive.google.com/open?id=1I9oKjkdXK2EAJUqVkxMCGuBAsmk1ugyZ)
MD5 of file for check: 1CA34A1B837B075133BE53B379749BBB
You can flash it as usual by loadP500Flash via telnet in scopeCode: [Select]\windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp
Checked on my DSOX3034AFYI:
The patch locations for firmware 2.43:Code: [Select]1) options patch: 0x280940: change "04 00 A0 E1" -> "00 00 A0 E3"
2) nag patch: 0x2a9f38: change "66 5A FF EB" -> "01 00 A0 E3"
Dear Safar
I just recviced the 3014A with firmware 01.10
Updated the firmware to 2.43
And download the patch from you and push on the usb flash.
I telnet to 3014A with port 5024
After I type the code
\windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp
[/code]
No following action on screen or on the scope
Any suggestion for me to do for update for all option?
Thanks alot.I make patched.bin.comp with PhillyFlyers info and with corrected checksum:
Patched2.43 (https://drive.google.com/open?id=1I9oKjkdXK2EAJUqVkxMCGuBAsmk1ugyZ)
MD5 of file for check: 1CA34A1B837B075133BE53B379749BBB
You can flash it as usual by loadP500Flash via telnet in scopeCode: [Select]\windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp
Checked on my DSOX3034AFYI:
The patch locations for firmware 2.43:Code: [Select]1) options patch: 0x280940: change "04 00 A0 E1" -> "00 00 A0 E3"
2) nag patch: 0x2a9f38: change "66 5A FF EB" -> "01 00 A0 E3"
Stupid question.... I see the DSOX3000 series you can upgrade the front-end to 500mhz. Can the DSOX2000 series front-end be upgrade to 500mhz too? I would love to complete a front-end upgrade to my DSOX2014a to 500mhz. I have not seen a complete parts list.
Has anyone figured out how to get the DSOX2000 series to display 1 million waves?
I just got my first Keysight scope. Upgraded from the Rigol DS1054Z.
Congrats @Gandalf_Sr
The App Bundle license turns on all the things you'd ever need. There are a couple discovered by this form somewhere(like RML), but there's no real use for those other than for our developers/debugging.
I'm not sure that you need any particular version before the corruption, because this method overwrites the previous software, whatever it is. I must test it in the future (or someone else?)
To be useful, you need at least das U-boot working, of course, otherwise, you have a real brick. JTAG is the only one way to debrick it (or a soldering iron! :P)
contents of infiniivision.lnk (one line only)211 is the number of characters after #
211#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW20 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC
Questions
- What does that 211 number mean?
afair there is a maximum number of characters (255?) the scope will recognize. I remember that adding each single license resulted in some missing licenses as the string was too long.
Just use -l ALL -l BW20 -l SCPIPS and you are all set.
Doesn't -l PLUS work?
... After a bit of fun this seems optimum on a DSOX2014A with firmware 2.43:
80#infiniivisionLauncher.exe -l DIS -l MSO --perf -l BW20 -l SCPIPS -l CABLE -l VID
Some reasoning:
DIS adds a bunch of options like ALL without adding a * to each feature in the about screen
MSO does its name
--perf is req'd to get the Meas/Statistics button and screen shown at https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2166070/#msg2166070 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2166070/#msg2166070)
CABLE is req'd for Analyze/'Ratio and Phase Ref' menu
VID is req'd for extra video triggers and features
Any missed?
Our command line is -l ALL -l BW20 -l SCPIPS -l CABLE --perf
65#infiniivisionLauncher.exe -l ALL -l BW20 -l SCPIPS -CABLE --perf
Does anyone knows where to get the 64997A Oscilloscope Spectrum Visualizer (OSV) Software software?
Or is there a newer version?
This software is used with the ASV option.
Download does not work.
Any other options?
Thanks for the update.
I had to register before I could download it. Duh...
The Steve, I've my MSO-X 3012A hang and no display during start up. After read the thread I've done extracting through serial on the board and result as below. By the way I've no idea what is the version before the scope spoilts.I've done base from the thread using version 2.35 with USB and it show error as below:-
U-Boot 2010.03 (Jan 26 2011 - 12:37:34)Agilent P500
CPU: SPEAr600
DRAM: 128 MiB
Flash: 512 KiB
NAND: 128 MiB
In: serial
Out: serial
Err: serial
SerNum:serial number not programmed
Chip: BD Board Rev: 4
Net: smsc
failed: 597 0
Could not copy from NAND offset 0x60000. Error -74 With ECC
failed: 1192 597
Could not copy from NAND offset 0x60000. Error -74 NO ECC
FPGA programming FAILED!
Press space to stop autoboot: 0
## Booting kernel from Legacy Image at f8050000 ...
Image Name: PBOOT
Created: 2011-01-27 11:38:14 UTC
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 36703 Bytes = 35.8 KiB
Load Address: 00000000
Entry Point: 00000000
Uncompressing Kernel Image ... OK
Starting kernel ...
Debug serial initialized ........OK
Microsoft Windows CE Bootloader Common Library Version 1.4 Built Jan 27 2011 02:04:15
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008
System ready!
Preparing for download...
Loading image 1 from memory at 0xD0600000
ODeCompressFlash: CeCompressDecode() failed
EBOOT_ReadFlash failed
ERROR: Unable to read image signature.
BL_IMAGE_TYPE_UNKNOWN
Loading image 1 failed, trying next one
Loading image 2 from memory at 0xD1600000
ODeCompressFlash: CeCompressDecode() failed
EBOOT_ReadFlash failed
ERROR: Unable to read image signature.
BL_IMAGE_TYPE_UNKNOWN
Loading image 2 failed, trying next one
All images failed
Press r to reset
I just got DSOXLAN module. Anyone did through telnet with unit hang and no display issue?
Firmware version 2.50 was released today for the 2000A/3000A series.
Major release details:
Bug Fixes for both 2000A and 3000A
- Fixed an issue of an unrelated error message showing when adjusting the UART/CAN/LIN
baud-rate.
- Fixed an issue of the Reference Waveform file (.h5) incorrectly saving data with twice the
timebase delay when there is a non-zero delay on the displayed waveform.
- Fixed an issue of the inverted channel mode not displaying the waveform correctly in
Averaging Mode.
Changes for both 2000A and 3000A
- Due to a lack of browser support for Java-based applications, support for the legacy Javabased remote front panel has been removed. A modern HTML5-based remote front panel is available.
- As of version 2.50, the VNC server software for the remote front panel functionality is no
longer bundled with the scope software by default. Upgrading to 2.50 will not delete the
VNC server software from the scope, but new scopes will no longer ship with the VNC
server software installed. For scopes without the software installed, the Browser Web
Control page will provide a link for installing the software.
If anyone could please check my steps/understanding on my Jan 7 post -- a couple of questions I'd appreciate it much
Should I image the 3024A with 2.50 instead of 2.43?
Spring is here, I'll be out hiking...
Thank you,
NN
Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2084 on: January 07, 2019, 01:23:31 am »
ReplyQuoteModifyRemove
Hello again, and thanks for your help.
Acquiring a DSOXLAN, I'm finally ready to do the upgrade to my 3024A running "factory" 2.43, applying the latest patched 2.43 (and it is a rainy weekend) -- I have a couple of questions please.
1/ Can anyone clarify the contents of the link file to enable all features available in the patched firmware -- for the 3024A?
From previous responses, I am not clear on if my modified link contents (cmd line) is correct -- specifically, the preceding "211#..." which I think would have been OK if I had the 350MHz model, and appears to represent the length of the infiniivisionLauncher.exe cmd line not including the preceding "211#".
"211#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC"
The above (not for my scope) is indeed 211 characters in length so it makes sense (to me) I need to change that number.
Is the below correct (I removed "-l BW50" alone) -- with the # of characters now being 203? :
"203#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC"
As I am now clear I can revert back to the factory v2.43 if I am to sell the scope or send it in for cal, there's just one more thing:
2/ Should I expect the "unsealed instrument" warning to appear after in the liberated 2.43 -- and if so, can I ignore it (will it impact anything) or is there another patch to make that warning disappear?
Thank you kindly for verifying this and your help, best to all in 2019!
NorcalNerd
Hello guys,
I managed to telnet to port 23 on oscilloscope startup but after boot the session quits. What am I doing wrong?
I got a MSO-X 3034A, FW 2.50
I tried many times. Only at the first boot seconds I get a connection.
Does anybody still have the 2.43 Firmware file?
Firmware 2.43
https://mega.nz/#!lSJwDAzK!YQSZ0AnbJ7rloFFBDppx7iaGKqcftTBsGBUjhnez_bk
and the patched nk.bin for 2.43
https://mega.nz/#!1GIAlaqY!AbS8cnGSqtntFIgGVGeTM3YNNWoBcHaEUNvuj80B7kg
Firmware 2.43
https://mega.nz/#!lSJwDAzK!YQSZ0AnbJ7rloFFBDppx7iaGKqcftTBsGBUjhnez_bk
and the patched nk.bin for 2.43
https://mega.nz/#!1GIAlaqY!AbS8cnGSqtntFIgGVGeTM3YNNWoBcHaEUNvuj80B7kg
The hack works without the patched file, but with the patched file all RED errors will be NOT shown.Thanks a ton, this is very helpful. I guess I'm hung up on how to Telnet into the scope though. Without having it here next to me (still being half way across the country) I'm a bit confused about the connections required. I admit I know absolutely nothing about Telnet....
Ok, so I assume the minimal steps are:
0) Install correct Firmware version first (i.e. in this case 2.43)
1) Download Safar's patched_nk_bin.comp file and copy to a USB stick and plug in.
2) Telnet into the scope.
3) Login infiniivision / skywalker1977
4) processmgr kill infiniivisionlauncher.exe
5) \windows\loadP500Flash -u ceImage1 \usb\patched_nk.bin.comp
6) Create a file on the USB stick called infiniivision.lnk with contents (e.g.) "88#infiniivisionLauncher.exe -l MSO -l BW20 -l DIS -l PLUS -l SCPIPS -l VID -l CABLE --perf"
7a) delete (or rename) any other lnk in \secure\startup folder. Should be only one file with lnk extension here.
7b) copy \usb\infiniivision.lnk to \secure\startup
8 ) reboot and good to go
I'm going to test something out later today, I belive it should work just making the patched 'nk.bin.comp', and then re-packing all the files into a new cab file..Sounds good, I'm looking forward to hearing the results of your testing.
This cab packer seems to work awesome, I see the final created cab files look good.. so I'm going to try this out later today..this way we can just install the patched firmware from a UsB stick..
BUT, that still leaves you with having to modify the lnk file? so you may have to buy the homebrew lan board...
but if anyone wants to try this now, this tool is pretty sweet..
(you can get the full suite from here)
https://www.softpedia.com/get/File-managers/CabPack.shtml (https://www.softpedia.com/get/File-managers/CabPack.shtml)
FYI..This is great. Where exactly are these addresses? Are they on the scope, or are they in one of the files that come with the firmware? Please bear with me, I am a complete noob when it comes to this sort of thing.
here's the patches for 2.50 (3000A)Code: [Select]3000A series:
firmware: 2.50
------------------
1) options patch: 0x2815f4 --> "04 00 A0 E1" --> "00 00 A0 E3"
2) nag patch: 0x2aae50 --> "CD 59 FF EB" --> "01 00 A0 E3"
Ok Guys, got it all working:You are awesome! I'm currently in the process of drawing up my own LAN card in Altium. Is that all it is, just a couple of connectors and a few passives? I don't remember stumbling across your design, though I'm sure I must have at some point (I've been through most of this thread already). I don't know if I'll bother adding all three right away though, depending on the complexity. I'll be getting 10 bare boards for less than $20 delivered from my PCB house, so all I'll need to do is stuff the components.Code: [Select]1) patching the nk.bin.comp, fixing the two MD5 entries in the 'recipe.xml', and re-building the cab file with little CAB builder I posted worked perfect
(just make sure to choose MSZIP for the compression type)
2) the LAN connection did NOT get shutoff for me after I upgraded to the patched 2.50 FW.. it worked fine after the scope finished bootingup..
3) The initial upgrade wiped out any existing .lnk file, it went back to the stock empty .lnk file, which is why my options disappeared..
4) So I re-copied my .lnk file over to \Secure\Startup, (renamed the orignal empty one to some garbage name to basically get rid of it, or you can just delete it), and all options are back.
So as far as I can tell, there was nothing done to the Telnet session??? at least nothing different occured for me?
If anyone wants, I can post the CAB file patched for 2.50? you'll still have to fix your .lnk file to enable options again... but telnet works fine as usual...
So PCB GUY, only thing you need to do is buy a homebrew LAN card, guys on here can sell them privately if any still have the parts, or you can make one yourself, I posted the OshPark links for one I did back in this thread, that's the board I use now.. has LAN, USB, and JTAG all on the card..
So, if you want to use the 'patched' FW image I posted, you don't have to do any of the above steps except for #1 & #2 (and BTW your lnk contents look good)...and for step 2 ONLY need to copy the .lnk' file you don't need to do anything with the 'nk.bin.comp', as that is part of the patched 2.50 FW image...I have seen two different ways of doing this - one is simply running the OS from the flash drive, which I am not terribly interested in doing because I would like to be able to use a flash drive to capture screenshots. The other is a permanent change that does not require the USB drive to be plugged in for operation. Is this method the former or the latter?
but of course you still need to Telnet in.
The IP Address of the scope you set yourself, it's in the "I/O" submenu, I think you click "utility" first, then go there, I can't remember exactly, I always just push buttons until I get there :)Perfect, that clears that up!
Anyhow, you pick your IP address, gateway, & mask yourself. I always just LAN cable up my scope right to my laptop, but them both on some fake network segment you make up, obviously both at different IPs, but on the same net..
ie for mike like:
1) scope: 192.168.5.10
2) laptop: 192.168.5.1
3) mask:255.255.255.0
or something along those lines!
BTW, since you are a hardware guy, you should check out the mods on here to push your BW up to 500Mhz, just requires you taking apart the scope, breaking the warranty of course and replacing some surface mount components, it's honestly not bad if you have decent soldering tools?I considered it but I'm always hesitant to modify the hardware of such an expensive piece of equipment. Maybe someday, but probably not right away. 200MHz bw will most likely meet all of my needs for the near future.
I did it to mine as was not painful at all..
Also, once you get a homebrew LAN board in, it will give you a nag message that pops up about a LAN board malfunction or whatever it says, but that's just because our board doesn't have the VGA chip on it that the real board has, but doesn't matter, all we need is ethernet..I can put up with a recurring warning. I'd love to add VGA sometime though. I'll save that for a future rev!
And also, your other prior question, YeS, all that LAN board really needs is the ethernet connector and a few passives, all the other crap I added was just as a bonus, but not necessary at all. And you have to open up your scope anyhow to connect up any JTAG or USB boot stuff.. so LAN is really all you need.
Also, I love Altium, its a bad-ass tool, I'm slowly doing training to try and switch over to it, as I've been using nothing but eagle the last 10+ years. So i'm sooo used to it, but Altium has so much more power.My first few PCB designs were done in Eagle and I loved the tool, but once I started using Altium it was hard to look back. Altium has all sorts of functions and features that speed up the design process and significantly improve throughput and efficiency. There are definitely more bugs in Altium than in Eagle, but regardless it is still a great tool. I would highly recommend it to anyone who can afford a license. I am fortunate enough to have a license through my job.
Here ya guys go..
Patched 3000X 2.50 Firmware with 'options' and 'nag' patch already applied..
https://mega.nz/#!eqg0yYJK!l73FwnABwNBNsl_l_2fAC8Md8PCVEEBgZ-u0T1eNZ08
I have seen two different ways of doing this - one is simply running the OS from the flash drive, which I am not terribly interested in doing because I would like to be able to use a flash drive to capture screenshots. The other is a permanent change that does not require the USB drive to be plugged in for operation. Is this method the former or the latter?
So just install that update file I posted via USB drive (format it to FAT32)... you just browse to the USB drive via the I/O menu, and select the file and run it...Brilliant, that's way easier than I thought it was going to be. So to be clear:
once it reboots you should be able to telnet in a drop your lnk file, and then reboot,and all should be there...
Firmware 2.43
There's a list of the Telnet instructions hereThat's very helpful. The syntax looks familiar, I've used something very similar. So if I'm not mistaken, the commands I want to execute are:
https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/ren
I think what you posted looks correct, but I would try and rename the old one first by navigating to the secure folder then renaming it using the rename command.
I've ordered the stuff for the DIY LAN too. I have hacked my scope but want to get rid of the nag messages.
You can just add a new start.lnk file (any name you want) next to the empty official infiniiVision.lnk file.I already have the DSOX3APPBNDL installed, so I'm not sure my official infiniivision.lnk file is empty....
I got the re-built CAB file to work
<command>\windows\cmd.exe /c copy \usb\infiniivision.lnk \Secure\Startup\infiniivision_ext.lnk</command>
-<onFailure>
<filePath>\usb\errorLog.txt</filePath>
<message>lnk copy from USB failed.</message>
<!-- do not continue, without new valid link file -->
<action>reboot</action>
</onFailure>
</installStep>
<!-- Move away a perhaps existing factory link -->
-<installStep>
<command>\windows\cmd.exe /c ren \Secure\Startup\infiniivision.lnk infiniivision.lnk.original</command>
-<onFailure>
<filePath>\usb\errorLog.txt</filePath>
<message>No factory lnk to move away.</message>
<action>continue</action>
</onFailure>
</installStep>
For all Keysight 3000A uses who have the startupmessage:
Hi all,
I received my LAN boards in the mail today so I went ahead and built one up and plugged it in. I updated my scope to the patched v2.50 firmware that PhillyFlyers provided and that seemed to work just fine. I then went into the scope's I/O menu and got the IP address (I left it as auto-config, I hope that's ok) and took note of the given IP. I then connected my laptop to the LAN card via an ethernet cable and used PuTTY to telnet into the scope. I was able to log in. However, I then tried to run the following command:
ren \secure\startup\infiniivision.lnk \secure\startup\infiniivision.bak
This returned an error:
REN: Cannot form path from \secure\startup\infiniivision.bak. Name too long or malformed.
Suspecting it couldn't find the directory I simply typed "dir" and sure enough, "\secure" was not in there.
Directory of \
01/01/98 12:00p <DIR> Network
01/01/98 12:00p <DIR> usb
04/16/19 08:33a <DIR> Application Data
04/16/19 08:33a <DIR> profiles
04/16/19 08:33a <DIR> Documents and Settings
04/16/19 08:33a 23 Control Panel.lnk
04/16/19 08:33a <DIR> My Documents
04/16/19 08:33a <DIR> Program Files
04/16/19 08:33a <DIR> Temp
04/16/19 08:33a <DIR> Windows
Found 10 file(s). Total size 23 bytes.
1 Dir(s) 24293376 bytes free
Where is the "\secure" directory, exactly?
Thank you,
Matt
80#infiniivisionLauncher.exe -l DIS -l MSO --perf -l BW20 -l SCPIPS -l CABLE -l VID
A question:I presume it has something to do with SCPI (Standard Commands for Programmable Instruments).
What does SCPIPS (Infiniium Mode) do?
Ok,
This is interesting ... just updated my 2012A with Phillyflyers 2.5 firmware with patched comp file. Then added this lnk file to the old USB 2.41 lnk install hack ( On page 62, posted by Luminax )Code: [Select]80#infiniivisionLauncher.exe -l DIS -l MSO --perf -l BW20 -l SCPIPS -l CABLE -l VID
The scope is now fully unlocked and I have no red nag messages, this was done without telnet.
The 3000 series cannot be used in this way.
:palm:
Try the Keysight route first, as they will replace the full PCB as part of the service noteI should note, this scope is from 2013. I am just afraid they will deny any Nand flash problem and sending me a $3000 quote.
The 3000 series cannot be used in this way.
:palm:
Cannot be used in what way? I have a 3024 and I was able to update to the hacked firmware and install the other licenses.
Do you have to use LAN CARD and use Telnet to crack the version you said?
The current method of using #2201 cannot be successfully cracked.
I've never seen a nand corruption fault like that, post the boot log and we'll hopefully know for sure.So finally I took the time and disassembled my (99,9% of the time) non starting DSOX4024a and recorded the boot log:
U-Boot 2010.03 (May 18 2017 - 11:28:22)Agilent P500
CPU: SPEAr600
DRAM: 128 MiB
Flash: 512 KiB
NAND: fsmc-ecc1 256 MiB
In: serial
Out: serial
Err: serial
SerNum:serial number not programmed
Chip: BD Board Rev: 4
Net: smsc
Press space to stop autoboot: 0
## Booting kernel from Legacy Image at f8050000 ...
Image Name: PBOOT
Created: 2015-10-29 8:22:14 UTC
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 37935 Bytes = 37 KiB
Load Address: 00000000
Entry Point: 00000000
Uncompressing Kernel Image ... OK
Starting kernel ...
Debug serial initialized ........OK
RTC: 2019-5-19 17:56:28.13 UTC
Microsoft Windows CE Bootloader Common Library Version 1.4 Built Oct 29 2015 01:39:04
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008
image2 value is out of range 0 so it will be ignored.
It must be a hexadecimal integer between 0xd00000000 and 0xd7ffffff or between 0x800000000 and 0x87ffffff.
System ready!
Preparing for download...
RTC: 2019-5-19 17:56:28.18 UTC
Loading image 1 from memory at 0xD0400000
-->>> [Note: here it stops booting, no LEDs are lighting] <<<--
Of course I hoped my scope would start today that I have a comparison, but I had no luck. I tried it 100 times....Press space to stop autoboot:
p500> imls
Legacy Image at F8000000:
Image Name: XLOADER
Created: 2010-09-24 21:30:18 UTC
Image Type: ARM Linux Firmware (uncompressed)
Data Size: 5370 Bytes = 5.2 KiB
Load Address: d2800b00
Entry Point: d2800b00
Verifying Checksum ... OK
Legacy Image at F8010000:
Image Name: UBOOT
Created: 2017-05-18 3:33:11 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 195988 Bytes = 191.4 KiB
Load Address: 03f00000
Entry Point: 03f00000
Verifying Checksum ... OK
Legacy Image at F8050000:
Image Name: PBOOT
Created: 2015-10-29 8:22:14 UTC
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 37935 Bytes = 37 KiB
Load Address: 00000000
Entry Point: 00000000
Verifying Checksum ... OK
So finally I took the time and disassembled my (99,9% of the time) non starting DSOX4024a and recorded the boot log....
U-Boot 2010.03 (May 18 2017 - 11:28:22)Agilent P500
CPU: SPEAr600
DRAM: 128 MiB
Flash: 512 KiB
NAND: fsmc-ecc1 256 MiB
In: serial
Out: serial
Err: serial
SerNum:serial number not programmed
Chip: BD Board Rev: 4
Net: smsc
Press space to stop autoboot: 0
## Booting kernel from Legacy Image at f8050000 ...
Image Name: PBOOT
Created: 2015-10-29 8:22:14 UTC
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 37935 Bytes = 37 KiB
Load Address: 00000000
Entry Point: 00000000
Uncompressing Kernel Image ... OK
Starting kernel ...
Debug serial initialized ........OK
RTC: 2019-5-19 22:59:58.49 UTC
Microsoft Windows CE Bootloader Common Library Version 1.4 Built Oct 29 2015 01:39:04
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008
image2 value is out of range 0 so it will be ignored.
It must be a hexadecimal integer between 0xd00000000 and 0xd7ffffff or between 0x800000000 and 0x87ffffff.
P500 Boot Loader Configuration :
Mac address .......... (00:30:D3:20:29:C0)
Ip address ........... (192.168.1.164)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (0)
Load image 1 at startup
Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
1 (0xd0400000)
l) Load memory resident image Load image 1 now
1) Load memory resident image 1 now
2) Load memory resident image 2 now
3) Load memory resident image 3 now
d) Download from platform builder now
u) Start u-boot by resetting
v) Verify Images
[b]>System ready![/b]
Preparing for download...
RTC: 2019-5-19 23:0:52.60 UTC
All images failed
Press r to reset
After the system ready I sent a '3' just getting the message 'all images failed'.A portscan and testing the other ports showed no other telnet port except the SCPI Telnet port.
With V2.50 the Telnet port is only available for a short time before the infiniiVisionLauncher kills the service and starts the scope app.
But it is possible to kill the launcher if the login and process kill command is handled by a python script running directly after the network connection has been established. (ping /t)
using the launcher from here still allows to start the App with different Options
\Secure\infiniiVision\infiniiVisionLauncher.exe
Obviously these questions now came on my mind:
Can I write an image/file to the flash with the P500? This should help if it is just corrupted.
Or maybe the flash is somehow damaged. Thus:is this flash an external single memory chip or is it embedded?
Maybe I should have used option "d".
Anybody with experience/advise on this?
U-Boot 2010.03 (May 18 2017 - 11:28:22)Agilent P500
CPU: SPEAr600
DRAM: 128 MiB
Flash: 512 KiB
NAND: fsmc-ecc1 256 MiB
In: serial
Out: serial
Err: serial
SerNum:serial number not programmed
Chip: BD Board Rev: 4
Net: smsc
Press space to stop autoboot: 0
## Booting kernel from Legacy Image at f8050000 ...
Image Name: PBOOT
Created: 2015-10-29 8:22:14 UTC
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 37935 Bytes = 37 KiB
Load Address: 00000000
Entry Point: 00000000
Uncompressing Kernel Image ... OK
Starting kernel ...
Debug serial initialized ........OK
RTC: 2019-5-20 12:38:24.19 UTC
Microsoft Windows CE Bootloader Common Library Version 1.4 Built Oct 29 2015 01:39:04
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008
image2 value is out of range 0 so it will be ignored.
It must be a hexadecimal integer between 0xd00000000 and 0xd7ffffff or between 0x800000000 and 0x87ffffff.
System ready!
Preparing for download...
RTC: 2019-5-20 12:38:24.24 UTC
Loading image 1 from memory at 0xD0400000
O
BL_IMAGE_TYPE_BIN
X
XXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXXOOOOOOOOOXOOOOXOXXOOXXOXOXOXOXXXXOOXXXOOOOOOXXOXXOXXXXXXOOOXXXOXXOXXOOXXXOOOXOOOXOXOXOOXXOOOOXOXOOOOOXOOOXOOOXXXXXXXXOXOXOXXOXOXXXXXXXX
XOOOXOOOXOOXOOOOXOOOOXXOXOOOOOOOXOOOXOXOOOOOXXOOOOOXOOXOOXOOOOOOOOOOXOXOOXOOOOOOOXXOOOOOXXOOOOOOOXOXOXXOOXOXOOOXOOOOXOOXXXXOXOOOXOXXXOXOXOXXXXXXXOOXXXOOOXOXXXXXOXXXXXXXXOXXXXOXOXOXXXXOOOXXXOX
XXXXXOOOXOOOXXOXOOOXOXXXOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXXXXOXOOOXOXOOOOXOOOOXOOOXOOXOOXOOOXOOOOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXXXXXXXXXXXXXXXXXXXXOXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x53CEC54, LaunchAddr = 0x80362000
Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000 Length=0x53CEC54 Name="" Target=RAM
Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
RTC: 2019-5-20 12:38:33.84 UTC
Launching windows CE image by jumping at address 0x 362000
Windows CE Kernel for ARM (Thumb Enabled) Built on Mar 8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Oct 26 2017)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000 size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200 (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 00:30:D3:20:29:C0
Phy found addr 31 (ticks=3979)
WaitForLink Start (ticks=3981)
No Link (ticks=4984)
<--EDeviceInitialize
GMAC DMA status register = 0x0
LIN: Data Valid
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Running infiniiVisionInstallHelper
SHIM DLL, LoadRealDll [PalWin32.dll] for [AgilentPalWin32.dll]
SHIM [AgilentPalWin32.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]
SHIM [AgilentPalSStorage.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalSysManagement.dll] for [AgilentPalSysManagement.dll]
SHIM [AgilentPalSysManagement.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalCaps.dll] for [AgilentPalCaps.dll]
SHIM [AgilentPalCaps.dll] Get Process Addresses
AgilentLxiWebStartUp successfully started LXI web service.
Device load time:
NANDFLASH: 0 ms
SNANDFLASH: 0 ms
SHIM DLL, LoadRealDll [PalIO.dll] for [AgilentPalIO.dll]
SHIM [AgilentPalIO.dll] Get Process Addresses
System has been running 24.332512 seconds
Performing Startup
Initializing FPGA at base address 0x850000 or 8716288
****
FPGA Type: Oregon
Ver: 2.055 Released
Build Time: Mon Jul 31 17:34:24 2017
Build Machine: 12345678 (removed, might include show serial number)
****
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]
SHIM [AgilentPalSStorage.dll] Get Process Addresses
Exception 'Raised Exception' (-1): Thread-Id=04ac005e(pth=8992e2ec), Proc-Id=04640066(pprc=898b6000) 'infiniivisionLauncher.exe', VM-active=04640066(pprc=898b6000) 'infiniivisionLauncher.exe'
PC=40068ae0(coredll.dll+0x00058ae0) RA=803782c8(kernel.dll+0x000062c8) SP=0002cb34, BVA=0002cb98
Keyboard firmware version 35... ok
Keyboard Info: Board id 0, Board rev 2
Cal Date Sat Jan 12 00:47:44 2013
Startup sequence is complete.
No registry path: Drivers\USB\FunctionDrivers\USB488, no workaround
no workaround for USB phy
SHIM DLL, LoadRealDll [PalCaps.dll] for [AgilentPalCaps.dll]
SHIM [AgilentPalCaps.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalSysManagement.dll] for [AgilentPalSysManagement.dll]
SHIM [AgilentPalSysManagement.dll] Get Process Addresses
Building initial GUI layout...complete.
System has been running 38.022915 seconds
Start Up Sequence 13.690000
Memory Load 58%
System Physical Memory 66.188 / 115.957 MB
Process Virtual Memory 71.250 / 1024.000 MB
-----> InfiniiVision is running <-----
So @kilobyte mentioned problems with Telnet in v2.50 here:A portscan and testing the other ports showed no other telnet port except the SCPI Telnet port.
With V2.50 the Telnet port is only available for a short time before the infiniiVisionLauncher kills the service and starts the scope app.
But it is possible to kill the launcher if the login and process kill command is handled by a python script running directly after the network connection has been established. (ping /t)
using the launcher from here still allows to start the App with different Options
\Secure\infiniiVision\infiniiVisionLauncher.exe
But I don't see anyone else mentioning a problem with Telnet access, and @PhillyFlyers explicitly says that it is working fine (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2325420/#msg2325420).
Is the issue with Telnet access in v2.50 firmware still a question? Or enough people have used v2.50 with Telnet and say its all good? Hope we can clear that up! :)
Today I did the update from 2.43 to v2.50 on my own DSOX-3024A.
But before that I did a port scan with the old 2.43 and after the update with the 2.50
This is the second scope where the telnet port isn't available after the infiniivision launcher has starter.
But telnet is still available for a short time.
New firmware was released for the 3000T and 4000A series.
Version 7.30.2019051434
.....
Enhancements
This software revision includes the following new enhancements:
- Added Digitizer Mode where you specify the sample rate and memory depth instead of
having them automatically be determined by the time/division setting.
- Frequency Response Analysis (FRA):
o The sweep frequency range is no longer limited to decade values – it can now be
set to any frequency within the WaveGen’s limits.
o The “points per decade” setting has been changed to “total points” for ease of use.
o Chart:
Minor gridlines for the horizontal axis are now shown to improve readability
of the plot.
The chart’s horizontal display range is now independent of the Start/Stop
Frequency setting in the Setup Menu....
I suspect (but don't know for sure) that the reason the license screen has changed is because in the future you'll see more options that are subscription based. This is not something I approve of, but seems to be the way forward for so many things.
Also my scope is not responding to VNC anymore, only remote is one in Web browser
Also my scope is not responding to VNC anymore, only remote is one in Web browser
According to the Release Notes if the firmware previously had VNC server functionality, it should still have the VNC server functionality after the firmware upgrade. But maybe you need to reinstall the VNC software anyway?
https://www.keysight.com/upload/cmc_upload/All/Keysight_3000T_X_Series_Oscilloscope_Release_Notes_07_30.pdf (https://www.keysight.com/upload/cmc_upload/All/Keysight_3000T_X_Series_Oscilloscope_Release_Notes_07_30.pdf)
Changes
- As of version 7.30, the VNC server software for the remote front panel functionality is no
longer bundled with the scope software by default. Upgrading to 7.30 will not delete the
VNC server software from the scope, but new scopes will no longer ship with the VNC
server software installed. For scopes without the software installed, the Browser Web
Control page will provide a link for installing the software.
Hi,
where can I download the file "patched_nk.bin.comp",version 2.50?
Hi,
Thanks for reply.
After patched installer ,it's only need a replaced .link file?
What's the status of 3000T series option mods? If potential for options I'll read back through the 90 pages but I haven't been in the loop since my 2000A. TIA.
Has anyone cracked 3034T?I downloaded the upgrade firmware, referring to 3034A, I modified two places, but the LNK file can not open option.who can hlep me?
1) options patch: 0x486d00: change "04 00 A0 E1" -> "00 00 A0 E3"
2) nag patch: 0x4f24e0: change "A8 F1 93 E5" -> "01 00 A0 E3"
Thank You!
Worked perfectly :-+
For others wanting to do this, the Scopes for Dummies version as follows:
Download Phillyflier's patched firmware from post #2167 on page 87
Download Luminax's license patch from post #1529 on page 62
Extract license patch, open cmd window (if using MS Windows), navigate to license patch folder and rename infiniivision.lnk to .txt
Edit infiniivision.txt and replace text in the file with Odessa's modification from post#2197 on page 88
80#infiniivisionLauncher.exe -l DIS -l MSO --perf -l BW20 -l SCPIPS -l CABLE -l VID
Save and rename file back to .lnk
Copy firmware file (rename from .ksx to .cab if current scope fireware is older than v2.41) to FAT32 formatted USB drive
Copy licence files (2x .cab files and .lnk file) to same USB drive
Now go to your scope, turn on and plug in USB drive to front USB port
Press [Utility] > File Explorer, select the firmware file (3000XSeries.02.50.2019022736_patched.cab); then, press Load File, wait for scope to load and reboot.
Check firmware has updated to v2.5, if successful continue
Press [Utility] > File Explorer, select v241_link_install.cab file; then, press Load File, wait for scope to load and reboot.
Check licenses have all been added and if so... :clap: :phew:
Thank you to all those that made this possible 8)
Is there any more interest in DSOXLAN boards? I just managed to sell my last one.
Thanks very much!!! JeffreyLatter ,When I download firmware,The version is 3000XSeriesT.7.30.2019051434, my patch is:
option:00494E74 : 04 00 A0 E1 -> 00 00 A0 E3
nag :00502350: AC F1 93 E5 -> 01 00 A0 E3
i read P71,it must use "42.exe"?can not modify lnk file?
Thanks very much!!! JeffreyLatter ,When I download firmware,The version is 3000XSeriesT.7.30.2019051434, my patch is:
option:00494E74 : 04 00 A0 E1 -> 00 00 A0 E3
nag :00502350: AC F1 93 E5 -> 01 00 A0 E3
i read P71,it must use "42.exe"?can not modify lnk file?
Would someone be so kind and upload the patched nk.bin for firmware 3000XSeriesT.7.30.2019051434 ?!
Many thanks.
Jeffrey,
Yes, i still have the same error messages, including the one about "uninitialized secure storage" from message 2252: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2521839/#msg2521839 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2521839/#msg2521839)
I also did a Hardware Self Test and got the "Self test failed: Firmware Status" error as shown in the image below.
mlloyd1
pquadrat:Yes, it is a DSOX-3104T.
you were working on a "T" (touch) series, correct?
mlloyd1
*To enable features as described in this thread on recent firmware you need a DSOXLAN module or equivalent alternative. Enabling without a LAN module is no longer possible
I've skimmed through the thread and have learned a lot. Can anyone please confirm the following?
*Any oscilloscope still on Agilent firmware should be upgraded to modern firmware to prevent NAND issues and possibly add extra features
*To enable features as described in this thread on recent firmware you need a DSOXLAN module or equivalent alternative. Enabling without a LAN module is no longer possible
*When enabled there is a feature which allows downgrading of the oscilloscope back to stock for the purposes of warranty or selling it.
Is this current and correct for a 2000X series?
Does anyone happen to have original Agilent era firmware or a good source for older firmware versions?
...and does this DSOX3024A support higher Frequency?
Both of you were right: there is a time and password appears to fail first time. Now I have successfully cracked my DSOX3014T. Thanks!!!Glad to hear it!
Is it possible to enable the FRA (frequency response analysis) function on 3000A series?
According to the datasheet it seems that it doesn't exist but I am hoping it could still be possible
Keysight told me the answer is no.Agreed, it seems disappointing lower models get better features based on effectively the same hardware. It appears Keysight has trouble differentiating the very similar model ranges. Obviously there's always the option of adding it in a future firmware upgrade like they've done with various features or upgrades in the past.
I enabled everything on an MSO-X3024A that I have access to and FRA does not show up.
Really disappointing considering the nice function generator app that works just fine.
:(
mlloyd1
Hello guys, i am in a big disaster :palm: :palm: :palm::
I have update my DSOX 2024 to 2.5 firmware patched, with usb stick, but no licences was activated.
I have try to modifiy my infiniivision.ink and brick my scope in a continual restart. :scared: :scared: :scared:
I haved brick my scope before with a 2.35, and with the help of the community, i haved recovered my scope.
After several attemps the scope have reboot.
I have try the franckbusses serial port, but nothing appear in the terminal.
I have try with tera term, putty, and tty emulator: no way.
I have scope the RX and TX with my very old scope, when the dsox boot, i have a trame.
When i send a command, i have a trame : the serial connection work.
Why i haven' the boot sequence appearing in the terminal ?
Someone have one solution for enable licences please?
I haved all enabled, in the 2.35 firmware, and i can,t downgrade to.
I am in a very difficult situation, and a help will be very apreciate, please.
thank you by advance
Why i haven' the boot sequence appearing in the terminal ?
yes, i have an echo
yes, 115200 bauds, no parity, one stop bit, 8 data bits, but when i turn on my scope, nothing appear in the terminal
Is the oscilloscope DSOX3034T susceptible to hacking?If I read this thread correctly, yes.
Nobody can help me please ? I'm afraid to make a mistake and brick my scope another time.
How can i activate my licences please? i have order the db9 wire, for do that, but i need the wave generator and the logic analyzer for a project for my job urgently.
Can somedy help me to make this with an USB stick?
Thank you for jour help, no i haved unbrick it, but i was scared, because without, lan o serial connections, that was an pain.Maybe it's because you called the file .ink instead of .lnk? That's .LNK in lowercase letters. There's no i in there. If Windows sees it as a shortcut file you're good.
I wan't to unable my licences, i have try the 2.50 patched by Phillyfler and the
Luminax license patch, but only EDK, DVM, and RML, was activated.
I have try to modify the .ink and.. :palm: :palm: :palm: brick my scope
No i have change the include inside the infiniivision.inkThe file shouldn't be called "infiniivision.ink", but "infiniivision.lnk". The extension is not INK, it's LNK. You can capitalize the letters if you like as that will still work, but you can't spell it with an "i". I assume you named the file incorrectly and the .cab couldn't find the file it was expecting. Use the correct filename.
That is the good filename, i have not make mistake
Sorry, perhaps i have not understand.
Do you wan't to say that the original name of the patch is wrong
SorryYou wrote "infiniivision.ink". This is wrong. It should be "infiniivision.lnk" It's different. I don't know where you got "ink" from but I just downloaded the original file and it has the correct extension. See the screenshot attached to this post. The procedure isn't going to work if you don't follow the instructions precisely and are using the wrong file names.
That work :-- :-+, Thank you a lot :clap: :clap: :clap: i go to sleep 2 jours before go to my job.Glad to hear it worked out. I'm not sure what causes that message. Maybe reapplying the procedure after your job is done would improve the situation, but maybe others here have an idea why the issue arises.
I have only this message, i dont Know why, but all seem work
If keysight released the FRA option for the DSOX3000A series that would be an instant-buy for me. As keysight is active on this forum, maybe they can clarify if they will roll out this option in the future?The 3000T seems to have the option.
I'm thinking of selling my scope and switch to R&S as they provide a really nice FRA option.
Keysight ebay store promo on now, MSOX3104T fully loaded as far as I can see, US $6,848.28. Four now available (It was five, I just bought one!).
Keysight ebay store promo on now, MSOX3104T fully loaded as far as I can see, US $6,848.28. Four now available (It was five, I just bought one!).
Keysight Used MSOX3104T Oscilloscope, mixed signal, 4+16 channel, 1GHz - e-Promo Incl. Probes, Application Bundle and 1 year warranty (https://www.ebay.com/itm/193024964977)
I had to purchase it from my local ebay.co.uk site as from ebay.com it wouldn't let me pay or request invoice. Note that Keysight use DDP Incoterms so you pay taxes to them through an ebay invoice, so it arrives customs cleared.
Keysight ebay store promo on now, MSOX3104T fully loaded as far as I can see, US $6,848.28. Four now available (It was five, I just bought one!).
Keysight Used MSOX3104T Oscilloscope, mixed signal, 4+16 channel, 1GHz - e-Promo Incl. Probes, Application Bundle and 1 year warranty (https://www.ebay.com/itm/193024964977)
I had to purchase it from my local ebay.co.uk site as from ebay.com it wouldn't let me pay or request invoice. Note that Keysight use DDP Incoterms so you pay taxes to them through an ebay invoice, so it arrives customs cleared.
Keysight ebay store promo on now, MSOX3104T fully loaded as far as I can see, US $6,848.28. Four now available (It was five, I just bought one!).
Keysight Used MSOX3104T Oscilloscope, mixed signal, 4+16 channel, 1GHz - e-Promo Incl. Probes, Application Bundle and 1 year warranty (https://www.ebay.com/itm/193024964977)
I had to purchase it from my local ebay.co.uk site as from ebay.com it wouldn't let me pay or request invoice. Note that Keysight use DDP Incoterms so you pay taxes to them through an ebay invoice, so it arrives customs cleared.
Absolutely the best deal they have ever had on the scope. It has been that price in the past but did not have the app bundle or probes/MSO cable.
The 4000 series is more or less the same as the 3000A series with a larger screen.
There's also this MSOX4154A on eBay (https://www.ebay.com/itm/183868079044) (no probes; limited apps) for $9,116.40 . I don't have money to buy it but (for future reference) is it an exceptional deal? Or there's better to be had?
The 4000 series is more or less the same as the 3000A series with a larger screen.
There's also this MSOX4154A on eBay (https://www.ebay.com/itm/183868079044) (no probes; limited apps) for $9,116.40 . I don't have money to buy it but (for future reference) is it an exceptional deal? Or there's better to be had?
If you are looking for an upgrade, look at the 6000 X series, that is a real upgrade from the 3000 series.
The apps/software for 4000A are just a bit more extensive than 3000T. I'm not sure if there's any difference in probe support between 3000T and 4000A series...The 4000 series is more or less the same as the 3000A series with a larger screen.
There's also this MSOX4154A on eBay (https://www.ebay.com/itm/183868079044) (no probes; limited apps) for $9,116.40 . I don't have money to buy it but (for future reference) is it an exceptional deal? Or there's better to be had?
If you are looking for an upgrade, look at the 6000 X series, that is a real upgrade from the 3000 series.
Subscription based oscilloscope software? :palm:Not basic scope. Options and decodes. It might make sense for large companies.
Subscription based oscilloscope software? :palm:
Not basic scope. Options and decodes. It might make sense for large companies.It could make sense but as BillB points out correctly it tends to end up as some kind of horror show where you end up leasing the equipment you pay for. I was hoping the embedded world would escape this madness but it seems I may have been too optimistic.
Imagine you have 10 3000T scopes. You get them with some basic functions and protocols, and get few floating licenses for stuff you don't use every day, and shuffle them around as needed.
It is same as renting scopes for a project.
I don't have use for it, but I can see it being useful to some.
Keysight did this great: you can still buy perpetual license, or a temporary one that will expire. Your choice.
It seems that we will be able to get an maintenance license too for bundle. That would take care of upgrading bundle when they add new features that didn't exist when you bought bundle. If the price is right, I'll get that one for sure..
It seems that we will be able to get an maintenance license too for bundle. That would take care of upgrading bundle when they add new features that didn't exist when you bought bundle. If the price is right, I'll get that one for sure..
Yeah, that is incredible deal! I have MSOX3054A (only MSO and BW options I applied from here; others I got in app bundle) and I love it. The -T series definitely has more (& better?) software/apps but not something I could justify upgrading to at the moment.
There's also this MSOX4154A on eBay (https://www.ebay.com/itm/183868079044) (no probes; limited apps) for $9,116.40 . I don't have money to buy it but (for future reference) is it an exceptional deal? Or there's better to be had?
Yeah, that is incredible deal! I have MSOX3054A (only MSO and BW options I applied from here; others I got in app bundle) and I love it. The -T series definitely has more (& better?) software/apps but not something I could justify upgrading to at the moment.
There's also this MSOX4154A on eBay (https://www.ebay.com/itm/183868079044) (no probes; limited apps) for $9,116.40 . I don't have money to buy it but (for future reference) is it an exceptional deal? Or there's better to be had?
I am in the same position, I have an MSOX3054A...
<snip>
I was looking at the MSOX4000s too: unlike he 3000 they offer USB HS decode. Then the loaded 3104T offer came in...
It seems that we will be able to get an maintenance license too for bundle. That would take care of upgrading bundle when they add new features that didn't exist when you bought bundle. If the price is right, I'll get that one for sure..
Is this for real that we will have to update our software bundle license to upgrade the 'scopes internal apps to get new features? Like the scope is going to have the old serial decode options as part of DSOXT3APPBNDL , and if you buy the new bundle D3000BDLA , then you get some new features? It's like the scope could potentially have two versions of each software app... it sounds kinda nuts...
Ahh, so may I ask your comparison of 3054A and 3104T? Is the software and features of 3000T a big step from 3000A? What do you love on 3000T that 3000A can't do? Just curious! :)
Ahh, so may I ask your comparison of 3054A and 3104T? Is the software and features of 3000T a big step from 3000A? What do you love on 3000T that 3000A can't do? Just curious! :)
Apart from few protocols and FRA they are exactly the same.
Biggest difference is in touch screen. Being able to type values directly is really helpful. Also you have zone trigger.
All the rest it is pretty much same scope to the user...
Ahh, so may I ask your comparison of 3054A and 3104T? Is the software and features of 3000T a big step from 3000A? What do you love on 3000T that 3000A can't do? Just curious! :)
50#\windows\cmd.exe /c \Secure\startinfiniivision.cmd
The start file contained:processmgr kill infiniivisionlauncher.exe
copy \secure\InfiniiVisionCore.dll "\program files\infiniivision\InfiniiVisionCore.dll"
"\program files\infiniivision\infiniivisionlauncher.exe" -l all -l BW20 -l SCPIPS -l SGMC -l CABLE
80#infiniivisionLauncher.exe -l DIS -l MSO --perf -l BW20 -l SCPIPS -l CABLE -l VID
Right - those were the instructions I was following. My mistake was that when I didn't see the options enabled, I assumed I still had to copy the .lnk file over.You do, by means of the .cab file. Open it up to see what it does.
U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500
CPU: SPEAr600
DRAM: 128 MiB
Flash: 512 KiB
NAND: internal ecc 128 MiB
Debug serial initialized ........OK
RTC: 2019-8-13 19:47:31.91 UTC
Microsoft Windows CE Bootloader Common Library Version 1.4 Built May 7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008
System ready!
Preparing for download...
RTC: 2019-8-13 19:47:31.95 UTC
Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN
X
XXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXXOOOOOOOOOXOOOOXOXXOXOXXOXOXOXOXXXXOOXXXOOOOOOXXOXXOXXXXXXOOOXXXOXXOOOXXXOOOXOOXOOXXOOXOXOOOOXOXOOOOOXOOOXOOXOXOXOXXXXXOXXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOXOOOXOOX
OOOOXXXOOOOXOOXOOXOOOOOOOOOXOXOOOXOOOOOOXOXOOOOOXXOOOOOOOXOXOXXOOXOXOOOXOOOXOOXOXXXOXOOOXOXXXXOXOXXOXXXXXOXOXXOOOXXXOXXXXXXOXXXXXXOXXXXOXOXOXOOOXXXXOXXXXXOOOXXOXXOOXXOX
XXOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXXXOXOOOXOXOOXOOXXXXXXXXXXXXOXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x1ACA724, LaunchAddr = 0x80362000
Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000 Length=0x1ACA724 Name="" Target=RAM
Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
RTC: 2019-8-13 19:47:35.40 UTC
Launching windows CE image by jumping at address 0x 362000
Windows CE Kernel for ARM (Thumb Enabled) Built on Mar 8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Feb 27 2019)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000 size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200 (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 00:30:D3:21:61:2F
Phy found addr 31 (ticks=3030)
WaitForLink Start (ticks=3032)
No Link (ticks=4047)
<--EDeviceInitialize
GMAC DMA status register = 0x0
LIN: Data Valid
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Running infiniiVisionInstallHelper
Failed to start/configure network.
Device load time:
NANDFLASH: 0 ms
SNANDFLASH: 0 ms
SHIM DLL, LoadRealDll [PalIO.dll] for [AgilentPalIO.dll]
SHIM [AgilentPalIO.dll] Get Process Addresses
Our command line is
Performing Startup
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]
SHIM [AgilentPalSStorage.dll] Get Process Addresses
Released build, Feb 27 2019, 20:34:05
Initializing FPGA...
****
FPGA Type: Wyoming
Ver: 2.011 Released
Build Time: Tue May 27 16:03:14 2014
Build Machine: TS2404M
****
No option module detected
Keyboard firmware version 32... ok
Keyboard Info: Board id 1, Board rev 3
@jeccylx I ran into the same kind of problem and I think the NAND chip is corrupted (reflashed many times with different firmware versions). I am replacing the NAND flash memory by a brand new one and I'll let you know whether or not it works.
Hello, I have a DSOX2002A since 2013. https://www.eevblog.com/forum/reviews/my-new-toy- (https://www.eevblog.com/forum/reviews/my-new-toy-))-agilent-dsox2002a-sex-on-a-stick!/25/Firmware 2.50 is available and can be installed through the menu system with no LAN required. As always there are no guarantees and you do this at your own risk but most if not all issues seem to stem from people not RTFM. Read the post linked below.
There is an old cracked firmware in my scope that somebody gave me back in 2013 or so. I loaded it into my scope and it works since then. All options from 2013 are unlocked for me. :-) My 5 year warranty expired in 2018.
Is there a new cracked firmware available now? Or is it more complicated and I need a LAN board to do some dangerous steps? Is there a danger of bricking my scope?
Yes, I have read last posts and the process seems to be dangerous and complicated for me now. Thanks for help.
Does anyone have an idea what the official bandwidth upgrades for the 3000T series cost? As far as I can tell no one lists the actual prices which is utterly annoying.
Hey Guys,A 100MHz to 500MHz hack? Is that even possible?
I consider to send my scope to Keysight for calibration.
The scope is hw and sw modded from 100Mhz to 500Mhz and has FW 2.50.
My plan is to reinstall the origial FW 2.50 before i sent it in.
Question: Can I always change back from the origial fw 2.50? Will there be leftovers of the fw hack after the FW update on the scope?
Do you think its a good idea to do a full calibration after the scope has been modified in general?
Regards B0B
I don't think so, because one can buy a bandwidth upgrade. So a hacked DSOX3014A probably behaves like a upgraded DSOX3014A.
The model number doesn't change when the BW is hacked via hardware or software. But if you send your scope back for an upgrade from 200 to 500 MHz the model number will change as they replace the entire mainboard.
Thank You!
Worked perfectly :-+
For others wanting to do this, the Scopes for Dummies version as follows:
Download Phillyflier's patched firmware from post #2167 on page 87
Download Luminax's license patch from post #1529 on page 62
Extract license patch, open cmd window (if using MS Windows), navigate to license patch folder and rename infiniivision.lnk to .txt
Edit infiniivision.txt and replace text in the file with Odessa's modification from post#2197 on page 88
80#infiniivisionLauncher.exe -l DIS -l MSO --perf -l BW20 -l SCPIPS -l CABLE -l VID
Save and rename file back to .lnk
Copy firmware file (rename from .ksx to .cab if current scope fireware is older than v2.41) to FAT32 formatted USB drive
Copy licence files (2x .cab files and .lnk file) to same USB drive
Now go to your scope, turn on and plug in USB drive to front USB port
Press [Utility] > File Explorer, select the firmware file (3000XSeries.02.50.2019022736_patched.cab); then, press Load File, wait for scope to load and reboot.
Check firmware has updated to v2.5, if successful continue
Press [Utility] > File Explorer, select v241_link_install.cab file; then, press Load File, wait for scope to load and reboot.
Check licenses have all been added and if so... :clap: :phew:
Thank you to all those that made this possible 8)
Hi,
The 2000 and 3000 are the same firmware. I used the 2.5 firmware posted by phillyflyers to upgrade to 2.5.
Then I created the lnk file using the code I posted and replaced the one in the hack posted by Luminax.
After the scope rebooted I ran the install.cab in Luminax's hack and that's it.
I also unlocked my 2004A using the above and it works perfectly, no nag messages, fully unlocked.
Edit: To answer your question about which firmware I started with, I used official 2.41 but I've flashed modded 2.43 and modded 2.5 whilst trying different things. The scope accepted them all without a problem.
You should be fine. As far as I'm aware anyone who ran into trouble neglected to follow instructions carefully. The upgrade works on 2000X models too.
It worked! I can't thank you enough! I owe you this!I'm just a parrot. Thank the people who made this all possible. Enjoy your scope! :)
I tried FERCSA's hack on my 1000X and it enables a lot of options, but most of them do not work. The options are in the firmware probably because they share codebase with other models, but the hardware is not the same. But definitely was a 1000X on steroids after the hack
I tried FERCSA's hack on my 1000X and it enables a lot of options, but most of them do not work. The options are in the firmware probably because they share codebase with other models, but the hardware is not the same. But definitely was a 1000X on steroids after the hack
https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/msg2062735/#msg2062735 (https://www.eevblog.com/forum/blog/eevblog-978-keysight-1000x-hacking/msg2062735/#msg2062735)I tried FERCSA's hack on my 1000X and it enables a lot of options, but most of them do not work. The options are in the firmware probably because they share codebase with other models, but the hardware is not the same. But definitely was a 1000X on steroids after the hack
sorry, I am late to this party and I am still reading the thread from the start, but I cannot figure out what FERCSA hack is. I did a search in the thread but FERCSA doesn't show up. Could you please explain which hack you are referring to?
thanks
It should be easy to transpose the hack to 3000/4000.PM sent
In the meantime, i'll try a different approach.
If anybody could provide me of an example of an official license, that would be awesome.
Me: The green arrow LED next to the Serial button does not come on when a serial decode is being displayed.
Support person: It's not supposed to. The arrow indicates what those extra controls are operating on: digital channels, math, or reference. They never apply to the serial stuff, so the light never comes on.
This might be a little old but looks like Keysight have new app bundles. Here is links related to 3000 A/T X-Series:
OLD: DSOXT3APPBNDL (https://www.keysight.com/en/pd-2494939-pn-DSOXT3APPBNDL/application-bundle-for-infiniivision-3000t-x-series-oscilloscopes?cc=US&lc=eng) $3600
NEW: D3000BDLA (https://www.keysight.com/en/pd-2990560-pn-D3000BDLA/ultimate-software-bundle-for-the-3000a-t-x-series?cc=US&lc=eng) $2530
I compared the app/software packages contained in each (listed in the brochure on each page) and didn't notice any difference. Are they the same and this is just a revised SKU? The new one is significantly cheaper -- is it missing something?
Or have the apps been revamped with new capability and you can only get it with purchasing the NEW app bundle? I hope not!!
Anyone know details of this?
Similar situation for the 4000A series.
Successfully updated and the firmware error message gone.I'm glad things worked out!
Thank you again!!!
Does the 4k patched file also work for MSOX3000T series :-// (because it has the same firmware revision number and date)?
Thanks in advance, Josef
Hey All,
the 3000T series is NOT quite the same, at least for the DLL, so here is the patched image for the 3kT series...7.20.2017102614
*** please notice: 3000T firmware is: 7.20.2017102614 *** (notice the 614 ending! ***
(*** 4000A firmware is: 7.20.2017102615 *** (notice the 615 ending! ***)
(same as before, patches and checksum already done)Code: [Select]1) options patch: 0x486f3c --> "04 00 A0 E1" --> "00 00 A0 E3"
2) nag patch: 0x4f22c8 --> "A8 F1 93 E5" --> "01 00 A0 E3"
just unzip this file, and flash it to your scope (*MUST* already have the above firmware installed!)
http://www.mediafire.com/file/y18w4c6hxw85jt8/3kT_7.20_nk.bin.zip (http://www.mediafire.com/file/y18w4c6hxw85jt8/3kT_7.20_nk.bin.zip)
MD5 of the extracted .comp file: <1B 76 32 CE FF 69 62 85 38 20 D3 E6 D2 5F E4 BC>
DSOX 1000X Series: FW: 01.20.2019061038_patched https://mega.nz/#!DuIxzA7Q!8wYfTlHPuc4hF3UFPLoq0FOgylfsSVur4B5YSdCTn2I (https://mega.nz/#!DuIxzA7Q!8wYfTlHPuc4hF3UFPLoq0FOgylfsSVur4B5YSdCTn2I)AFAIK DSOX 1000X Series cannot be hacked using the infiniivision.lnk method. The only known software hack is the modded firmware by FARCSA.
md5: <5A48A3492AD5BB23336236FDC6A12738>
Please let me know if there are any issues with any of these!Unfortunately on a DSOX4000a: yes, there are issues
Thank you PhillyFlyers ! ! !
Keysight posted 7.31 just 4 days ago and the 7.30 cab is gone.
Just a reminder to always archive every new version :)
Sorry about the tools problem but glad you found a possible cause !
Have you tried the "010 Editor" ? It seems quite capable but I don't know if it has all the tools you need. Comparisons, searches and checksums in any form are straightforward.
So let's try this again... please try them and let me know....
DSOX 3000T Series: FW: 7.31.2020012842_patched https://mega.nz/#!37BkWaCQ!JFJtIdT1p4m1BtULjw503jLpQDMjIV_cyzHRglBET-0 (https://mega.nz/#!37BkWaCQ!JFJtIdT1p4m1BtULjw503jLpQDMjIV_cyzHRglBET-0)
md5: <63DDE0129A9516C81DCF380F228BB08A>
Great thread. I am not sure I am getting this right, but would hacking a DSOX2000 (using the USB-only method, which seems simpler to me) change the serial number of the oscilloscope?Using the USB method on my DSOX3034A did not change my serial number.
Is there any way to get back to the original configuration (serial number and official licenses already installed before hacking)Yes. Luminax's license patch from post #1529 on page 62 includes two .cab files. One is used to change the license file, the other one can be used to restore the original file. If you then installed an unpatched version of the firmware I'm assuming the scope would appear untouched.
Hi, i've some news about unbrick the 4000A series..(maybe someone know that :-+)
Would be awesome if @Pinkus can report back on PhillyFlyers's latest v7.31 for DSOX4000A series 8)I haven't installed 7.31 yet as the latest version doesn't show anything interesting for me. Thus I stay at 7.30 right now .... never change a running/working system if there is no need.
Hello everyone,
Just updated my fw to 7.31 thanks to @PhillyFlyers.
Everything was ok with the file provided by our collegue, though I'm unable to have the .lnk correctly installed. I can manually run the infiniivisionlauncher.exe with all the licenses but my .lnk file copied to /secure/startup does not work as intended (it loads the os but with basic options).
Do those who installed successfully 7.31 on 3000T series, used the v241_link_install cab ?
Thanks..
DSOX2012? Using " 3000XSeries.02.50.2019022736_patched.ksx",Why?
Ok,
So let's try this again... please try them and let me know....
I did NOT put any of the 7.30 patches up, as I assume just going with the latest 7.31 is fine? (I can put up 7.30 if anyone still wants it)
These firmwares have the usual patches for the license check and the 'unreleased/unfinalized software' things
*** Note: ***
Upgrading the firmware ALWAYS replaces the .lnk file with the stock one, I didn't look into putting our custom .ink files into the .CAB/.KSX file (even though I'm sure we can), so REMEMBER to SAVE OFF your .lnk file somewhere before doing the upgrade. This way after the upgrade is done, telnet in and copy/move your .lnk file back over..
DSOX 1000X Series: FW: 01.20.2019061038_patched https://mega.nz/#!mjB0FAQa!8wYfTlHPuc4hF3UFPLoq0FOgylfsSVur4B5YSdCTn2I (https://mega.nz/#!mjB0FAQa!8wYfTlHPuc4hF3UFPLoq0FOgylfsSVur4B5YSdCTn2I)
md5: <5A48A3492AD5BB23336236FDC6A12738>
DSOX 2000X Series: FW: 02.50.2019022736_patched https://mega.nz/#!HiBAEIrZ!gydBKQMpH93kKwPUog3e2dGR1eWTIglZbL2kwd6dRxk (https://mega.nz/#!HiBAEIrZ!gydBKQMpH93kKwPUog3e2dGR1eWTIglZbL2kwd6dRxk)
md5: <22E2508172382996B9ACF2852DB011F8>
DSOX 3000A Series: FW: 02.50.2019022736_patched https://mega.nz/#!zmBkHCba!TK5Vf0N0LCeR3vYwx1fa41OekFXqg1psCYN-eagnvdY (https://mega.nz/#!zmBkHCba!TK5Vf0N0LCeR3vYwx1fa41OekFXqg1psCYN-eagnvdY)
md5: <CB931D537544D51D4EFFF44633506780>
DSOX 3000T Series: FW: 7.31.2020012842_patched https://mega.nz/#!37BkWaCQ!JFJtIdT1p4m1BtULjw503jLpQDMjIV_cyzHRglBET-0 (https://mega.nz/#!37BkWaCQ!JFJtIdT1p4m1BtULjw503jLpQDMjIV_cyzHRglBET-0)
md5: <63DDE0129A9516C81DCF380F228BB08A>
DSOX 4000X Series: FW: 7.31.2020012900_patched https://mega.nz/#!7nQC0YYA!LN8kMBfHrh_OHCrrLKaHmJl6zxRhSQanycLwwnTLidA (https://mega.nz/#!7nQC0YYA!LN8kMBfHrh_OHCrrLKaHmJl6zxRhSQanycLwwnTLidA)
md5: <6F94C7500AF7D129B28F75DD0E35AE9D>
Please let me know if there are any issues with any of these!
Ok,
So let's try this again... please try them and let me know....
I did NOT put any of the 7.30 patches up, as I assume just going with the latest 7.31 is fine? (I can put up 7.30 if anyone still wants it)
These firmwares have the usual patches for the license check and the 'unreleased/unfinalized software' things
*** Note: ***
Upgrading the firmware ALWAYS replaces the .lnk file with the stock one, I didn't look into putting our custom .ink files into the .CAB/.KSX file (even though I'm sure we can), so REMEMBER to SAVE OFF your .lnk file somewhere before doing the upgrade. This way after the upgrade is done, telnet in and copy/move your .lnk file back over..
DSOX 1000X Series: FW: 01.20.2019061038_patched https://mega.nz/#!mjB0FAQa!8wYfTlHPuc4hF3UFPLoq0FOgylfsSVur4B5YSdCTn2I (https://mega.nz/#!mjB0FAQa!8wYfTlHPuc4hF3UFPLoq0FOgylfsSVur4B5YSdCTn2I)
md5: <5A48A3492AD5BB23336236FDC6A12738>
DSOX 2000X Series: FW: 02.50.2019022736_patched https://mega.nz/#!HiBAEIrZ!gydBKQMpH93kKwPUog3e2dGR1eWTIglZbL2kwd6dRxk (https://mega.nz/#!HiBAEIrZ!gydBKQMpH93kKwPUog3e2dGR1eWTIglZbL2kwd6dRxk)
md5: <22E2508172382996B9ACF2852DB011F8>
DSOX 3000A Series: FW: 02.50.2019022736_patched https://mega.nz/#!zmBkHCba!TK5Vf0N0LCeR3vYwx1fa41OekFXqg1psCYN-eagnvdY (https://mega.nz/#!zmBkHCba!TK5Vf0N0LCeR3vYwx1fa41OekFXqg1psCYN-eagnvdY)
md5: <CB931D537544D51D4EFFF44633506780>
DSOX 3000T Series: FW: 7.31.2020012842_patched https://mega.nz/#!37BkWaCQ!JFJtIdT1p4m1BtULjw503jLpQDMjIV_cyzHRglBET-0 (https://mega.nz/#!37BkWaCQ!JFJtIdT1p4m1BtULjw503jLpQDMjIV_cyzHRglBET-0)
md5: <63DDE0129A9516C81DCF380F228BB08A>
DSOX 4000X Series: FW: 7.31.2020012900_patched https://mega.nz/#!7nQC0YYA!LN8kMBfHrh_OHCrrLKaHmJl6zxRhSQanycLwwnTLidA (https://mega.nz/#!7nQC0YYA!LN8kMBfHrh_OHCrrLKaHmJl6zxRhSQanycLwwnTLidA)
md5: <6F94C7500AF7D129B28F75DD0E35AE9D>
Please let me know if there are any issues with any of these!
Just installing this firmware didn't help much for me for a DSOX3014T. Are there more steps needed other than using this firmware?
Ok,
So let's try this again... please try them and let me know....
I did NOT put any of the 7.30 patches up, as I assume just going with the latest 7.31 is fine? (I can put up 7.30 if anyone still wants it)
These firmwares have the usual patches for the license check and the 'unreleased/unfinalized software' things
*** Note: ***
Upgrading the firmware ALWAYS replaces the .lnk file with the stock one, I didn't look into putting our custom .ink files into the .CAB/.KSX file (even though I'm sure we can), so REMEMBER to SAVE OFF your .lnk file somewhere before doing the upgrade. This way after the upgrade is done, telnet in and copy/move your .lnk file back over..
DSOX 1000X Series: FW: 01.20.2019061038_patched https://mega.nz/#!mjB0FAQa!8wYfTlHPuc4hF3UFPLoq0FOgylfsSVur4B5YSdCTn2I (https://mega.nz/#!mjB0FAQa!8wYfTlHPuc4hF3UFPLoq0FOgylfsSVur4B5YSdCTn2I)
md5: <5A48A3492AD5BB23336236FDC6A12738>
DSOX 2000X Series: FW: 02.50.2019022736_patched https://mega.nz/#!HiBAEIrZ!gydBKQMpH93kKwPUog3e2dGR1eWTIglZbL2kwd6dRxk (https://mega.nz/#!HiBAEIrZ!gydBKQMpH93kKwPUog3e2dGR1eWTIglZbL2kwd6dRxk)
md5: <22E2508172382996B9ACF2852DB011F8>
DSOX 3000A Series: FW: 02.50.2019022736_patched https://mega.nz/#!zmBkHCba!TK5Vf0N0LCeR3vYwx1fa41OekFXqg1psCYN-eagnvdY (https://mega.nz/#!zmBkHCba!TK5Vf0N0LCeR3vYwx1fa41OekFXqg1psCYN-eagnvdY)
md5: <CB931D537544D51D4EFFF44633506780>
DSOX 3000T Series: FW: 7.31.2020012842_patched https://mega.nz/#!37BkWaCQ!JFJtIdT1p4m1BtULjw503jLpQDMjIV_cyzHRglBET-0 (https://mega.nz/#!37BkWaCQ!JFJtIdT1p4m1BtULjw503jLpQDMjIV_cyzHRglBET-0)
md5: <63DDE0129A9516C81DCF380F228BB08A>
DSOX 4000X Series: FW: 7.31.2020012900_patched https://mega.nz/#!7nQC0YYA!LN8kMBfHrh_OHCrrLKaHmJl6zxRhSQanycLwwnTLidA (https://mega.nz/#!7nQC0YYA!LN8kMBfHrh_OHCrrLKaHmJl6zxRhSQanycLwwnTLidA)
md5: <6F94C7500AF7D129B28F75DD0E35AE9D>
Please let me know if there are any issues with any of these!
Just installing this firmware didn't help much for me for a DSOX3014T. Are there more steps needed other than using this firmware?
Hi Stafil ,
I don't know for sure if the process for the 3000 series is the same as for 2000 series , but after installing patched firmware , is not necesary to install v241_link_install.cab file from usb along with infiniivision.lnk ?
I think the procedure must be like this in post 2433 on page 88 - https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2932770/#msg2932770 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2932770/#msg2932770)
If you already did that please ignore this post ...
Hey, thanks! I ended up getting a network card and following the steps your described. Basically just get the password from the password generator, telnet, and change the .lnk.
Thanks!
Hi all,
first I want to thank all the contributors here doing a great job!
I have been following this topic as a silent reader almost from the beginning, but losing track here and then...
Now it's overwhelming to read through 100 pages! :o :phew:
I searched this topic a lot for answers to my questions, but unfortunately I could not find the solution that I was looking for.
So maybe someone can help me?!
I was wondering if it is already possible to add the licenses/options to a MSOX3104T (i.e 3000T series) only by FW update via USB?
It's suggested that it could be done in post#2448, page 98 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2945740/#msg2945740 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2945740/#msg2945740))
by including the modified .lnk file, but obviously was not done yet. How could one implement the options in the .lnk permanently?
In post #2201, page 89 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2364363/#msg2364363 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2364363/#msg2364363))
such a process is described, but it seems this is only valid for a 2000A (maybe also 3000A), but not confirmed for 3000T series. Am I wrong?
And either way... what would be the options settings for 3000T series?
Regarding newest FW 7.31, I suspect D3000BDLA and WAVEGEN should enable all possible SW/HW features. Are there other (hidden/secret) switches to enable, to get everthing to work? How would the .lnk file would look like?
Any light into the dark would be highly appreciated!
Thanks!
You will have to mess about with the .CAB files.
The rough steps would be:
1. Download the patched version.
2. Rename it to .CAB and extract it
3. Go in the folder and extract infiniiVisionSetup.CAB
4. Go in that folder and open the "INFINI~1.064" file and add the options you need.
5. Save it and do the opposite of steps 3 & 2. I.e. re-create the CAB files.
Or just buy a LAN card and do it over telnet. That's what I did.
You will have to mess about with the .CAB files.
The rough steps would be:
1. Download the patched version.
2. Rename it to .CAB and extract it
3. Go in the folder and extract infiniiVisionSetup.CAB
4. Go in that folder and open the "INFINI~1.064" file and add the options you need.
5. Save it and do the opposite of steps 3 & 2. I.e. re-create the CAB files.
Or just buy a LAN card and do it over telnet. That's what I did.
Thanx stafil,
the steps 1 -4 I could also find out in the meantime by myself.
But the Options in INFINI~1.064 are empty, although my scope tells me I have MSO, MEMUP, SGM, EDK, ADVMATH, DVMCTR and RML.
If I would miss these options in the -lnk file, would they get lost then or are they fixed in FW?
BTW, one of the main questions still is: What are the valid options to include in .lnk for a 3000T?
I found some hints here in this topic, but only saying "... 3000T uses same as 4000A" or vice versa, but no details :-//
Or can the .lnk file on a 3000T also be applied (using v241_link_install.cab) like described here?
Post #2201, (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2364363/#msg2364363 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2364363/#msg2364363))
Thanx
sorry, I am late to this party and I am still reading the thread from the start, but I cannot figure out what FERCSA hack is. I did a search in the thread but FERCSA doesn't show up. Could you please explain which hack you are referring to?
Most of the licenses on the tv84 post, which works on my model (MSOX 3022T), seems to be inside of one of the new options given in the User Manual.
Sincerely, I am very happy with the D3000BDLA and WAVEGEN options, there is a lot o functionalities to be searched on them for a while.
PS: The -l ALL still works if wanted.
Most of the licenses on the tv84 post, which works on my model (MSOX 3022T), seems to be inside of one of the new options given in the User Manual.
Sincerely, I am very happy with the D3000BDLA and WAVEGEN options, there is a lot o functionalities to be searched on them for a while.
PS: The -l ALL still works if wanted.
You don't need to install DIS, just the ones missing in the D3000BDLA bundle.
From my table I would say ALL shouldn't work (and if it works by itself then that's a mystery for me).
The table should represent which licenses are inside others...
But you, owners of the equipment, should know that better than me.
Additionally, I would say that manual pages have other information that is not corroborated by the table (for example: VID - I think there is no bundle that contains VID option, except by explicitly enabling VID).
@arlvaljr
Please show a printscreen of your license list in the boot screen, with just D3000BDLA and WAVEGEN enabled.
That work :-- :-+, Thank you a lot :clap: :clap: :clap: i go to sleep 2 jours before go to my job.
I have only this message, i dont Know why, but all seem work
Hey, thanks! I ended up getting a network card and following the steps your described. Basically just get the password from the password generator, telnet, and change the .lnk.
Thanks!
@stafil: So your MSOX3104T is running firmware 7.31 and you still telnet into it?
I had very old 4.xx firmware on my 3000T series scope and telnet was working fine. However, after upgrading to firmware 7.31 I cannot telnet into it anymore. Telnet port becomes available for a few seconds before the main GUI app starts, but even this is not long enough for me to telnet into it. I've tried to use telnet_dso.py python script posted on this thread and even wrote my own python script, but still cannot get it. Does anyone have the same issue with newer firmware? I'm hesitant on trying to modify options if I cannot telnet into the scope to revert it.
Any suggestions are much appreciated!
-albertr
2. Have you been able to test the unlocked MSO feature with the actual MSO hardware cable? I'm happy to buy the ~$800 cable from Keysight but the $3100 SW unlock cost for it is a little prohibitive for home use!
If anyone could please check my steps/understanding on my Jan 7 post -- a couple of questions I'd appreciate it much
Should I image the 3024A with 2.50 instead of 2.43?
Spring is here, I'll be out hiking...
Thank you,
NN
Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2084 on: January 07, 2019, 01:23:31 am »
ReplyQuoteModifyRemove
Hello again, and thanks for your help.
Acquiring a DSOXLAN, I'm finally ready to do the upgrade to my 3024A running "factory" 2.43, applying the latest patched 2.43 (and it is a rainy weekend) -- I have a couple of questions please.
1/ Can anyone clarify the contents of the link file to enable all features available in the patched firmware -- for the 3024A?
From previous responses, I am not clear on if my modified link contents (cmd line) is correct -- specifically, the preceding "211#..." which I think would have been OK if I had the 350MHz model, and appears to represent the length of the infiniivisionLauncher.exe cmd line not including the preceding "211#".
"211#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC"
The above (not for my scope) is indeed 211 characters in length so it makes sense (to me) I need to change that number.
Is the below correct (I removed "-l BW50" alone) -- with the # of characters now being 203? :
"203#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC"
As I am now clear I can revert back to the factory v2.43 if I am to sell the scope or send it in for cal, there's just one more thing:
2/ Should I expect the "unsealed instrument" warning to appear after in the liberated 2.43 -- and if so, can I ignore it (will it impact anything) or is there another patch to make that warning disappear?
Thank you kindly for verifying this and your help, best to all in 2019!
NorcalNerd
Does the new firmware 2.50 work with the hack?
If anyone could please check my steps/understanding on my Jan 7 post -- a couple of questions I'd appreciate it much
Should I image the 3024A with 2.50 instead of 2.43?
Spring is here, I'll be out hiking...
Thank you,
NN
Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2084 on: January 07, 2019, 01:23:31 am »
ReplyQuoteModifyRemove
Hello again, and thanks for your help.
Acquiring a DSOXLAN, I'm finally ready to do the upgrade to my 3024A running "factory" 2.43, applying the latest patched 2.43 (and it is a rainy weekend) -- I have a couple of questions please.
1/ Can anyone clarify the contents of the link file to enable all features available in the patched firmware -- for the 3024A?
From previous responses, I am not clear on if my modified link contents (cmd line) is correct -- specifically, the preceding "211#..." which I think would have been OK if I had the 350MHz model, and appears to represent the length of the infiniivisionLauncher.exe cmd line not including the preceding "211#".
"211#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC"
The above (not for my scope) is indeed 211 characters in length so it makes sense (to me) I need to change that number.
Is the below correct (I removed "-l BW50" alone) -- with the # of characters now being 203? :
"203#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC"
As I am now clear I can revert back to the factory v2.43 if I am to sell the scope or send it in for cal, there's just one more thing:
2/ Should I expect the "unsealed instrument" warning to appear after in the liberated 2.43 -- and if so, can I ignore it (will it impact anything) or is there another patch to make that warning disappear?
Thank you kindly for verifying this and your help, best to all in 2019!
NorcalNerd
Does the new firmware 2.50 work with the hack?
I use the new firmware 2.50 to hack the 3024A,but I cannot open BW50
Thank you.If anyone could please check my steps/understanding on my Jan 7 post -- a couple of questions I'd appreciate it much
Should I image the 3024A with 2.50 instead of 2.43?
Spring is here, I'll be out hiking...
Thank you,
NN
Re: DSOX2000 and 3000 series - licence , have anyone tried to hack that scope ?
« Reply #2084 on: January 07, 2019, 01:23:31 am »
ReplyQuoteModifyRemove
Hello again, and thanks for your help.
Acquiring a DSOXLAN, I'm finally ready to do the upgrade to my 3024A running "factory" 2.43, applying the latest patched 2.43 (and it is a rainy weekend) -- I have a couple of questions please.
1/ Can anyone clarify the contents of the link file to enable all features available in the patched firmware -- for the 3024A?
From previous responses, I am not clear on if my modified link contents (cmd line) is correct -- specifically, the preceding "211#..." which I think would have been OK if I had the 350MHz model, and appears to represent the length of the infiniivisionLauncher.exe cmd line not including the preceding "211#".
"211#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW50 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC"
The above (not for my scope) is indeed 211 characters in length so it makes sense (to me) I need to change that number.
Is the below correct (I removed "-l BW50" alone) -- with the # of characters now being 203? :
"203#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC"
As I am now clear I can revert back to the factory v2.43 if I am to sell the scope or send it in for cal, there's just one more thing:
2/ Should I expect the "unsealed instrument" warning to appear after in the liberated 2.43 -- and if so, can I ignore it (will it impact anything) or is there another patch to make that warning disappear?
Thank you kindly for verifying this and your help, best to all in 2019!
NorcalNerd
Does the new firmware 2.50 work with the hack?
I use the new firmware 2.50 to hack the 3024A,but I cannot open BW50
You cannot and you never will this way. It has been said many times here before.
100 and 200 MHz is one mainboard, 350 and 500Mhz is different board. Only way to go to 500 MHz is to make changes to mainboard (with soldering iron, changing components) and then, with software set it to 500 MHz.
..............
Thank you.
I hacked a DSOX3034A,and its bandwidth reaches 500MHz.
But I see Keysight's web,200MHz to 350MHz for 3024A,does not need change board.
OK!..............
Thank you.
I hacked a DSOX3034A,and its bandwidth reaches 500MHz.
But I see Keysight's web,200MHz to 350MHz for 3024A,does not need change board.
Not correct.
DSOX3BW34 3000A X-Series 4-Channel Oscilloscope Bandwidth Upgrade: 200 MHz to 350 MHz:
Return to service center required
DSOX3BW54 3000A X-Series 4-Channel Oscilloscope Bandwidth Upgrade: 350 MHz to 500 MHz:
Upgrade instantly with the license-only upgrade. No return to service center required
From Keysight site.
I've done extracting through serial on the board And I meet the same problem with you.All the LEDs don't light on.It show the same error and stops at BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...If it is a NAND corruption problem, you can solve it following this guide: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/?topicseen#msg2136181 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/?topicseen#msg2136181)
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.Do you solve it with the DSOXLAN module?Can you share the procedure?
WaitForKeyboardEvent FAILED
WaitForKeyboardEvent FAILED
Keyboard firmware version mismatch, 35 (binary) vs 255 (keyboard)
Programming keyboard firmware...
Initializing UART...Exception 'Raised Exception' (-1): Thread-Id=0439001e(pth=89633780), Proc-Id=0436001e(pprc=8973daec) 'infiniivisionLauncher.exe', VM-active=0436001e(pprc=8973daec) 'infiniivisionLauncher.exe'
PC=40068ae0(coredll.dll+0x00058ae0) RA=803782c8(kernel.dll+0x000062c8) SP=0002cb34, BVA=0002cb98
SER2 Serial Port, new baud rate:0x2580 (UARTCLK:48000000 IBRD:0x138 FBRD:0x20)
SER2 Serial Port, new baud rate:0xe100 (UARTCLK:48000000 IBRD:0x34 FBRD:0x5)
ok
Unlocking flash memory... failed
Unsucessful programming of the keyboard (MicroCIdCheck failed)
Retry 1 keyboard firmware updating
Programming keyboard firmware...
Initializing UART...SER2 Serial Port, new baud rate:0x2580 (UARTCLK:48000000 IBRD:0x138 FBRD:0x20)
Programming LAN option module...
Option module FPGA programing DONE...
SER2 Serial Port, new baud rate:0xe100 (UARTCLK:48000000 IBRD:0x34 FBRD:0x5)
SHIM DLL, LoadRealDll [PalWin32.dll] for [AgilentPalWin32.dll]
SHIM [AgilentPalWin32.dll] Get Process Addresses
ok
Unlocking flash memory... failed
Unsucessful programming of the keyboard (MicroCIdCheck failed)
Retry 2 keyboard firmware updating
Programming keyboard firmware...
Initializing UART...SER2 Serial Port, new baud rate:0x2580 (UARTCLK:48000000 IBRD:0x138 FBRD:0x20)
SER2 Serial Port, new baud rate:0xe100 (UARTCLK:48000000 IBRD:0x34 FBRD:0x5)
ok
Unlocking flash memory... failed
Unsucessful programming of the keyboard (MicroCIdCheck failed)
SER2 Serial Port, new baud rate:0x1c200 (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
Front Panel UART driver reset -- Contact ChrisG
ERROR: c:\WINCE600\3RDPARTY\Agilent\HPP\Common\Drivers\sh600_serial\.\sh600_serial_drv.cpp line 661: SER2 SER Driver: does not support multiple Open()'s
Error opening UART Driver.
Front Panel UART driver reset -- Contact ChrisG
ERROR: c:\WINCE600\3RDPARTY\Agilent\HPP\Common\Drivers\sh600_serial\.\sh600_serial_drv.cpp line 661: SER2 SER Driver: does not support multiple Open()'s
Error opening UART Driver.
Sounds like the processor on the front panel packed it in during the update process.
You should be able to remove the front panel, replace the processor, then boot up the scope and it will auto-program the processor for you. The part # I've seen previously is R5F212A7SNFP or R5F212A7SNFP#V2.
I see something in a DLL file:
infiniiVisionWebCom.ScopeInfo.1 = s 'ScopeInfo Class'
{
CLSID = s '{DED1059F-0BB5-46D1-BDED-9A72968FD7AE}'
}
infiniiVisionWebCom.ScopeInfo = s 'ScopeInfo Class'
{
CLSID = s '{DED1059F-0BB5-46D1-BDED-9A72968FD7AE}'
CurVer = s 'infiniiVisionWebCom.ScopeInfo.1'
}
what does CLSID = s '{DED1059F-0BB5-46D1-BDED-9A72968FD7AE}' mean?
I believe that this information is very important,it is related to the change of scope model number.
And when I go into WinCE of DSOX2002A,I found a HostIDChangedHandler.exe file.when I run this exe file,it refers SecureDataTool!
I think you cannot run Bode plot with external awg. Ask for the wavegen license or your scope will miss a valuable toolJumped to this thread late, but can anyone point me a path to unlock some of the features of my DSOX3054T?
I ordered it with APPBNDL, but my distributor f*ed up and gave me the newer BDLA, which has all APPBNDL has but rest of WAVEGEN.
My distributor is not able to order a new license without hardware (some Keysight distro weirdness in China), and we don't have a plan for new hardware purchase.
The only he can do is to give me a credit of the same license in my next order, but that would be months if not years ahead.
I paid for WAVEGEN, and I want it enabled. How can I generate this option without risking bricking my scope?
Never mind. My distributor offered me one Rigol DG2052 per lost Keysight license to make up. Free 8-bit to 16-bit upgrade and 25MHz o 50MHz upgrades at the cost of some additional bench space is okay to me.
I think you cannot run Bode plot with external awg. Ask for the wavegen license or your scope will miss a valuable toolJumped to this thread late, but can anyone point me a path to unlock some of the features of my DSOX3054T?
I ordered it with APPBNDL, but my distributor f*ed up and gave me the newer BDLA, which has all APPBNDL has but rest of WAVEGEN.
My distributor is not able to order a new license without hardware (some Keysight distro weirdness in China), and we don't have a plan for new hardware purchase.
The only he can do is to give me a credit of the same license in my next order, but that would be months if not years ahead.
I paid for WAVEGEN, and I want it enabled. How can I generate this option without risking bricking my scope?
Never mind. My distributor offered me one Rigol DG2052 per lost Keysight license to make up. Free 8-bit to 16-bit upgrade and 25MHz o 50MHz upgrades at the cost of some additional bench space is okay to me.
I know there are other options, but OP paid for a feature and was given an alternative that is not the same value, that was my pointI think you cannot run Bode plot with external awg. Ask for the wavegen license or your scope will miss a valuable tool
Nah, I've never used it, and if I ever needed, there's the Analog Discovery for me.
At 20MHz, despite the beefy size and cost, the 8-bit Keysight doesn't stand a chance against 14-bit ADC and DAC.
Has anyone with a 3000 or 4000 series ever tried "CAKE" or "AFTER DUSK" as the screensaver text?
I saw CAKE mentioned previously but never saw a response. These don't work on my 1102G, but are in the DLL alongside TREK. Hopefully I can try them on my 3034T once I get it repaired.
Thanks, I saw a lot of that text from CAKE in the binary, and the AFTER DUSK is obviously a reference to the windows After Dark screen saver.
I've been digging into the R&S RTB2004 firmware and one thing I've noticed immediately is the complete lack of "Easter Eggs." They are all business.
Will this work on a DSOX2000A series scope??Has anyone with a 3000 or 4000 series ever tried "CAKE" or "AFTER DUSK" as the screensaver text?
I saw CAKE mentioned previously but never saw a response. These don't work on my 1102G, but are in the DLL alongside TREK. Hopefully I can try them on my 3034T once I get it repaired.
CAKE = Text with the developer names and other text which changes.
AFTER DUSK = Flying scopes with wing and scope probes.
https://cal.equipment/doc/HP_Agilent_Keysight/DSOX/
This link is void,who can give a new link?
Thank you!
CAKE = Text with the developer names and other text which changes.OK, this does not work on my DSOX2002A. :-( Are there any other possible secret passwords? (Yes, TREK works for me.)
AFTER DUSK = Flying scopes with wing and scope probes.
My scope uses the 2.50 hacked firmwareYes
What happens if I upgrade it to 2.60? Will I loose all licenses?
this is how I get the character count
when I press Serial decode key it starts the decoding but the green triangle light is not getting lit !I think that this is normal function. Can someone confirm it please?
Unit is Agilent DSO-X 2004A
It's normal.when I press Serial decode key it starts the decoding but the green triangle light is not getting lit !I think that this is normal function. Can someone confirm it please?
Unit is Agilent DSO-X 2004A
A question for the people who understands better the inner workings of these scopes than me:Yes,you can change boot screen back to Aglient.
Is there a way I can hack the 2.50 patched firmware to change branding/boot screen back to Agilent?
I confess it was a way more beautiful boot screen an logos =)
I discovered how to change the boot logo, but unfortunately I wasn't able to save the old firmware boot screen. It isn't avaiable in any firmware update I found. I know of one scope that has the old firmware here, but it will be a lot of work for just one screen :\Is that the one you want?
The latest 2000X firmware is 2.60 in KeySight web site.
Also the 3000X firmware.
Hi! Any hack for the MSO4000A series? ThanksI have helped my friend to hack MSOX4000A.
They are listed on ReadMe: Corrections on Help for foreign languages
They are listed on ReadMe: Corrections on Help for foreign languages
Ummm.. That's it.. I guess I'll stick to 2.50
If I remember correctly the password attempt always fails the first time. You may have to try twice before it'll let you in using Telnet.
Well, both 2000A and 3000A scopes will be 10 years old in February 2021. Is there a successor coming?I remember that question being asked many years back.
Well, both 2000A and 3000A scopes will be 10 years old in February 2021. Is there a successor coming?
To a certain extent, possibly. There are digital certificates there that have expiry.I can only speak for the 3000A because I have one: The purchased licenses do not expire.
Thank you all for the knowledge.
Another successful hacked DSO-x-2012A using USB only .
The trick is to have files in the main directory not in any sub folders. It fails every time when files are not in the main directory.
I followed these instructions from page 89 written by scribble - thank you man - much easier to have it all in one place.
Download Phillyflier's patched firmware from post #2167 on page 87
Download Luminax's license patch from post #1529 on page 62
Extract license patch, open cmd window (if using MS Windows), navigate to license patch folder and rename infiniivision.lnk to .txt
Edit infiniivision.txt and replace text in the file with Odessa's modification from post#2197 on page 88
80#infiniivisionLauncher.exe -l DIS -l MSO --perf -l BW20 -l SCPIPS -l CABLE -l VID
Save and rename file back to .lnk
Copy firmware file (rename from .ksx to .cab if current scope fireware is older than v2.41) to FAT32 formatted USB drive
Copy licence files (2x .cab files and .lnk file) to same USB drive
Now go to your scope, turn on and plug in USB drive to front USB port
Press [Utility] > File Explorer, select the firmware file (3000XSeries.02.50.2019022736_patched.cab); then, press Load File, wait for scope to load and reboot.
Check firmware has updated to v2.5, if successful continue
Press [Utility] > File Explorer, select v241_link_install.cab file; then, press Load File, wait for scope to load and reboot.
Electrolytic caps in the power supplies...? >:DWell, both 2000A and 3000A scopes will be 10 years old in February 2021. Is there a successor coming?
Did KS include a time bomb in the devices?
Ok.
False alarm.
It's be me stupid and sticky keyboard :horse:
full unlock and 500MHz
Thank you for all work you have done here.
and Thank you for help me to go trough even those who want to charge me 650 for someone else work. :-+
I try to contribute more to this forum to pay back
Who was trying to charge you $650 to hack your scope?Consider informing Dave. That's not even a silly overstepping of boundaries, but ruthless exploitative behaviour.
edit - I was sent a PM with the username of the person, all I can say is that it is disgusting that someone would offer such a service.
Who was trying to charge you $650 to hack your scope?Consider informing Dave. That's not even a silly overstepping of boundaries, but ruthless exploitative behaviour.
edit - I was sent a PM with the username of the person, all I can say is that it is disgusting that someone would offer such a service.
An update: I took the plunge and have now achieved a fantastic result (eventually, after a few pitfalls). Here they are, based on my experience in the hope they might be useful for others.
I based my procedure on Cretone’s list post 2504 for which many thanks (modified for the 3000A obviously). My own observations, setbacks, pitfalls etc in italics after each step
1. Download PhillyFlyers’ 3000A series patched firmware 2.50 from the web to a FAT32 USB stick.
The hosting site mega.nz was blocked by my ISP – I needed to temporarily switch DNS servers to Google’s public DNS (8.8.8.8 and 8.8.4.4) to overcome this
2. Plug the USB stick into the front USB port of the (running) scope, install the patched firmware via the standard firmware update procedure (Utility / File Explorer / goto USB / Load File). Once the reboot is complete, keep the scope powered up.
Flawless update, scope rebooted immediately, no visible changes or warning messages – excellent.
3. Create a file infiniivision.txt with a raw text editor on a PC containing the infiniivisionLauncher command line with the options required (not forgetting to adjust the character count, ie the no. of characters to the right of the #). Mine was:
93#"\Program Files\infiniiVision\infiniiVisionLauncher.exe" -l D3000BDLA -l BW20 -l MSO -l MEMUP
This was the biggest pitfall which took me a day to resolve. The syntax for each option is hyphen then lowercase l then space then option code. However, in most forum posts, the lowercase l looked to me like the pipe (vertical bar) character and even though I copied and pasted from the forum into my text editor and ended up (correctly) with lowercase ls, I was convinced it had translated them incorrectly and laboriously went through with a hex editor changing them back to pipes (unicode 7C). (Eventually, through Telnet / CMD, I found the syntax for the infiniivisionLauncher.exe command and the penny finally dropped)
4. Unplug the USB stick from the scope, save this infiniivision.txt file onto it, then replug it into the scope. The file should now be visible through Utility / File Explorer.
Don’t be tempted to try and load the file into the scope like in step 2 – it’s not firmware!
5. Time for Telnet: plug the scope into your local Ethernet, make sure the LAN config is set to automatic (Utility / I/O / LAN settings) wait for it to acquire an IP address (assuming you have a hub or similar with DHCP server capability connected). Then Telnet into the IP address shown on the I/O information screen, username and password as per previous posts. The Telnet window should then give the Windows CE command prompt:
Pocket CMD v 6.00
\>
Telnet was rock-solid throughout, and thanks to the patched firmware there seemed to be no restriction on having to time it to coincide with the boot-up phase of the scope. I was dreading the networking, being an amateur, but simply plugging in to a typical home broadband network with a DHCP-serving hub it was incredibly easy and the scope sorted out its config automatically within seconds. Alternatives are fiddling with static IP addresses, subnet masks etc and point-point Ethernet (scope – PC) with a crossover cable …
6. Use the Telnet / CMD session to backup the existing .lnk, then transfer the .txt file from USB and rename it to .lnk thus:
rename \Secure\Startup\infiniivision.lnk \Secure\Startup\infiniivision.bak
copy \usb\infiniivision.txt \Secure\Startup\infiniivision.txt
cd \Secure\Startup
rename infiniivision.txt infiniivision.lnk
An initial worry was that even dir /a /s did not reveal the \Secure directory, however using cd \Secure will navigate to it and then enable dir to list its contents. The original infiniivision.lnk file was present, but empty (0 bytes) and with the archive flag set - I backed it up nevertheless! Note the copy command requires the full path and filename for both source and destination – just specifying the destination directory isn’t sufficient. The cd into \Secure\Startup was necessary because attempting the rename from the root directory gave an error message that the command line (with the full path included in the filenames) was too long. Finally, there are lots of ‘i’s in infiniivision, I lost count of the number of times I forgot the double i in the middle.
Historically the advice on the forum has been to kill the running inifiniivision.exe instance before doing the file manipulation, but lately this step seems to have been omitted in most recommendations. I didn’t kill it, because I simply forgot all about that step. Leaving it running didn’t seem to cause any problems, but of course the scope requires a reboot to pick up the new .lnk file and enable the options.
7. Turn off the scope – a tense moment for potential bricking, as the die is now cast. Turned on again, flawless and fast boot up, with all the newly-enabled options present and correct on the About screen (and enabled on the appropriate buttons etc).
This happy result was only after I had fixed the l / | confusion in the .lnk file of course. When I was still blundering about with the pipe character, the scope booted up correctly (luckily) but naturally none of the additional options appeared on the About screen.
So thanks once again for all the contributions that helped me get to this point.
I have a horrible temptation to start poking about with the 350MHz hardware mods now ...
#!/usr/bin/env python
from hashlib import md5
from base64 import b64encode
# Type in the real parameters here
MODEL = "DSOX3014T"
SERIAL = "MY12345678"
MAC = "00-12-34-56-78-90"
def makepwd( model, serial, mac ):
mac = mac.translate( None, ':- ' ).upper()
hstr = md5( model + serial + mac ).digest()
pwd = b64encode( hstr, 'a1' )[7::-1]
print 'Model : {0}\nSerial: {1}\nMAC : {2}\nPasswd: {3}'.format(model, serial, mac, pwd)
return pwd
makepwd( MODEL, SERIAL, MAC )
Get the IP and MAC addresses from DHCP page of your WiFi/LAN router/DHCP server (the scope uses a DHCP client name such as "k-dx3014t-12345"). Modify the python script and run it. Use the same username (infiniivision) and the generated password and you can log in.104#"\Program Files\infiniiVision\infiniiVisionLauncher.exe" -l D3000BDLA -l BW20 -l MSO -l MEMUP -l WAVEGEN
(the D3000BDLA does not contain WAVEGEN option)...AFAIK the 1k series still cannot be hacked because the cmdline options do not work on that series scope? I believe that is what others have been saying on here?
It worked on DSO x 2004A !!
the Telnet is also back !
73
de VU2EHY
Wow, this is impressive.. someone did some excellent RE work and I would assume live debugging on the target. Did you do these patches yourself? I would love to know the debugging setup, ie what debugger did they use, etc...
This is not an easy small patch like all the others, this is some extensive patching and custom routines, etc... I'll have to spend some time looking at this one..
unless you of course can keep making these whenever updates come in? then I'll just stick to the easy ones :)
umm... Honestly, this is all I know, is making these patches and using the cmd-line options via the link file..
If you know something much easier, please explain how to do it! I really have no idea what the ":SYSTem:PRODuction:SSCRipt" is, or how you do it.... I only know the methods we've been using forever to enable the options... if there is a better and simpler way please explain and we can work on doing it that way!
Hello.
First of all, thank you so much for making this possible!
I have DSOX-3034T with WAVEGEN and MSO licenses installed (purchased) + VGA/LAN module. Original latest Firmware 7.35 installed
Can you please make a step by step guide + telnet commands?
I am new to this and afraid to make mistake and brick my scope.
Thank you.
Successfully upgraded mine, thanks to everyone, especially PhillyFlyers.I always wondered how hard it would be to add a Bode plot to the 2000X and 3000A series. All the other models have the capability and the software platform is fairly similar. It always struck me as odd Keysight ignored these two series despite the hardware being present.
It seems there is no option for Bode plot on MSOX3000A series, only 3000T series, even though the app note 5992-0593 "Power Supply Control Loop Response (Bode Plot) Measurements 5992-0593" shows an MSOX3054A ???
Successfully upgraded mine, thanks to everyone, especially PhillyFlyers.I always wondered how hard it would be to add a Bode plot to the 2000X and 3000A series. All the other models have the capability and the software platform is fairly similar. It always struck me as odd Keysight ignored these two series despite the hardware being present.
It seems there is no option for Bode plot on MSOX3000A series, only 3000T series, even though the app note 5992-0593 "Power Supply Control Loop Response (Bode Plot) Measurements 5992-0593" shows an MSOX3054A ???
Successfully upgraded mine, thanks to everyone, especially PhillyFlyers.I always wondered how hard it would be to add a Bode plot to the 2000X and 3000A series. All the other models have the capability and the software platform is fairly similar. It always struck me as odd Keysight ignored these two series despite the hardware being present.
It seems there is no option for Bode plot on MSOX3000A series, only 3000T series, even though the app note 5992-0593 "Power Supply Control Loop Response (Bode Plot) Measurements 5992-0593" shows an MSOX3054A ???
2000X and 3000A are same older platform. 3000T is same platform as 4000 and 6000, so it has it.
It might as well be that 2000X and 3000A simply have no resources (memory, CPU, ASIC) to put in other stuff.
Or it can be simply that that those are legacy products, on it's last leg, and significant new development is just not going to happen.
At this point 1200X series is much more powerful than 2000X, except for smaller form factor, which might be pro or con depending on usage..
There is an early implementation of the bode plotter on the 3000A models, hidden away in the power analysis package as the Power Supply Rejection Ratio (PSRR) analysis.Successfully upgraded mine, thanks to everyone, especially PhillyFlyers.I always wondered how hard it would be to add a Bode plot to the 2000X and 3000A series. All the other models have the capability and the software platform is fairly similar. It always struck me as odd Keysight ignored these two series despite the hardware being present.
It seems there is no option for Bode plot on MSOX3000A series, only 3000T series, even though the app note 5992-0593 "Power Supply Control Loop Response (Bode Plot) Measurements 5992-0593" shows an MSOX3054A ???
2000X and 3000A are same older platform. 3000T is same platform as 4000 and 6000, so it has it.
It might as well be that 2000X and 3000A simply have no resources (memory, CPU, ASIC) to put in other stuff.
Or it can be simply that that those are legacy products, on it's last leg, and significant new development is just not going to happen.
At this point 1200X series is much more powerful than 2000X, except for smaller form factor, which might be pro or con depending on usage..
even 1000X has FRA. I think it's just a software thing not a hardware limitation. This scope is definitely more powerful than some other new chinese scopes that do have FRA now. It must be a marketing issue perhaps. The actual software is probably in there already.
For instance, a pad pattern for a vertical mounting through hole micro USB connector could be added to a PC board design and connected to otherwise unused pins of a CPLD. In this case, you would have a 5 channel gang connection, which by programming can monitor any signals in the CPLD. Just alter the CPLD program to move your hardware probe points and reprogram without taking it off of the PC board.Welcome to the forum.
On your other comments about MSO, from what I read going through the site it appears that the 2000 series (which this board is from) has only 8 MSO channels because it has only one set of acquisition chips, whereas the 3000 series has two sets of acquisition chips and support 16 channels as a result. Is that right?Yes that is right! Dave compared the MSO on x2000 and X3000 https://www.youtube.com/watch?v=os1agF35jxU&t=498s (https://www.youtube.com/watch?v=os1agF35jxU&t=498s) @ 07:00
I gave up finding "lossy" cable after just few years.One way to get some lossy coax is to buy a used logic analyzer cable that's the tiny coax ribbon type (not the woven type). You can then peel it apart in singles or in groups as desired. The cable in the photo is a 16715-61601 which has 36 lossy coax runs, 1.3M long (it's in 2 ribbons, each having 18 each plus 4 regular conductors). The cable can be had for around US$25-$30 each (hint: try searching for "(hp,agilent) logic analyzer cable", not the part number).
...
Here ya guys go..
Patched 3000X 2.50 Firmware with 'options' and 'nag' patch already applied..
https://mega.nz/#!eqg0yYJK!l73FwnABwNBNsl_l_2fAC8Md8PCVEEBgZ-u0T1eNZ08
This one worked for me:
https://mega.nz/file/KrAXRK6A#QwokNVJB4Hd_DDPU8r7F17wyygPHiqXWBBvBlXcKhC0 (https://mega.nz/file/KrAXRK6A#QwokNVJB4Hd_DDPU8r7F17wyygPHiqXWBBvBlXcKhC0)
LA7SJA
Successfully upgraded mine, thanks to everyone, especially PhillyFlyers.
It seems there is no option for Bode plot on MSOX3000A series, only 3000T series, even though the app note 5992-0593 "Power Supply Control Loop Response (Bode Plot) Measurements 5992-0593" shows an MSOX3054A ???
Ok,
Here are the latest patched firmwares, for the 1000X, 2000X, 3000A, 3000T, 4000X......
These firmwares have the usual patches for the license check and the 'unreleased/unfinalized software' things
*** Note: ***
I have made these installs even EASIER, after the upgrade completes the install process will also make a backup of the oem lnk file that it installs during the upgrade, and then attempt to copy 'infiniivision.lnk' from the same USB stick you are doing the upgrade with...
so in otherwords, have your 'infiniivision.lnk' file READY, and on the root of your USB drive along with the patched firmware upgrade!
(this replaces having to telnet into your scope after the upgrade and having to put the .lnk file back on)
The install script at the end does these two actions:
copy \Secure\Startup\infiniivision.lnk infiniivision.lnk.original (backs up oem file being replaced)
copy \usb\infiniivision.lnk \Secure\Startup\infiniivision.lnk (copies .lnk file from your USB to the startup folder)
So have these TWO files on your USB:
1) infiniivision.lnk
2) upgrade_file.ksx
*** NOTE: FOR THE 1000X.... ************************************
This is 'BUD's' patched firmware!! All credit goes to him and the 1000x hacking folks! there is NO .LNK file required for this patch, just install the FW! I repeat, there is NO .lnk file required for the
1000x hacking
DSOX 1000X Series: FW: 01.20.2019061038_patched https://mega.nz/file/nrpW3T4Z#gLnn__QchpYL5FuQXLawyso2_ReaXgn-jF4MzcRZSAA
md5: <8D128F5691BCB7D178CFB8E48F3784B9>
*************************************************************
DSOX 2000X Series: FW: 02.60.20201011001_patched https://mega.nz/file/OjAhhAjI#o6s6Fi4cGhxN0v6jgJOVAxhNNk33qv_w46eiO_QyEhc
md5: <2B8FFCC4D5963FC9277AEBDD61CCC5B1>
DSOX 3000A Series: FW: 02.60.20201011001_patched https://mega.nz/file/KrAXRK6A#QwokNVJB4Hd_DDPU8r7F17wyygPHiqXWBBvBlXcKhC0
md5: <531BD46EF73E8C570922AF3AD4A9A8D9>
DSOX 3000T Series: FW: 7.35.2020120822_patched https://mega.nz/file/nmJliKrJ#iMkMhe6xWFkJLJH7rgbh-QoFvRjzfVbsXhOOgu-5osc
md5: <D430C8F87A3865B48E035A1B99B0A421>
DSOX 4000X Series: FW: 7.35.2020120823_patched https://mega.nz/file/q3ABzQ5b#BH08CEf_Q0T7Z3kQMOzmHZTGubIGKPanCiq8my69TyM
md5: <04D0B52B8400F03B3EA87B90DE8FC004>
Please let me know if there are any issues with any of these!
Kibabalu
For a DSO-X 2000A model I have to use
DSOX 3000A Series: FW: 02.60.20201011001_patched https://mega.nz/file/KrAXRK6A#QwokNVJB4Hd_DDPU8r7F17wyygPHiqXWBBvBlXcKhC0
md5: <531BD46EF73E8C570922AF3AD4A9A8D9>
right?
I have a question about the upgrades on Agilent 3000A:
now that I am on FW 2.6 and upgraded, what happens if a next firmware is released and I want to update the firmware?
Do the options disappear and need a patched firmware or I can install future firmwares with no issue?
Enhancements for 3000A
- New SCPI command to start the probe degauss operation for the N7026A and N2893A probes.
Enhancements for both 2000A and 3000A
- Completed software and built-in online help localization.
- New SCPI commands for clearing persistence data from the display and querying the run state.
Bug Fixes for both 2000A and 3000A
- Fixed network print issue where a valid printer address format was not accepted.
Here are the latest patched firmwares, for the 1000X, 2000X, 3000A, 3000T, 4000X......
These firmwares have the usual patches for the license check and the 'unreleased/unfinalized software' things
*** Note: ***
I have made these installs even EASIER, after the upgrade completes the install process will also make a backup of the oem lnk file that it installs during the upgrade, and then attempt to copy 'infiniivision.lnk' from the same USB stick you are doing the upgrade with... so in otherwords, have your 'infiniivision.lnk' file READY, and on the root of your USB drive along with the patched firmware upgrade!
(this replaces having to telnet into your scope after the upgrade and having to put the .lnk file back on)
So have these TWO files on your USB:
1) infiniivision.lnk
2) upgrade_file.ksx
DSOX 3000A Series: FW: 02.60.20201011001_patched https://mega.nz/file/KrAXRK6A#QwokNVJB4Hd_DDPU8r7F17wyygPHiqXWBBvBlXcKhC0
md5: <531BD46EF73E8C570922AF3AD4A9A8D9>
Please let me know if there are any issues with any of these!
the number 93 is wrong. I counted over 110 characters in your lnk fileHere are the latest patched firmwares, for the 1000X, 2000X, 3000A, 3000T, 4000X......
These firmwares have the usual patches for the license check and the 'unreleased/unfinalized software' things
*** Note: ***
I have made these installs even EASIER, after the upgrade completes the install process will also make a backup of the oem lnk file that it installs during the upgrade, and then attempt to copy 'infiniivision.lnk' from the same USB stick you are doing the upgrade with... so in otherwords, have your 'infiniivision.lnk' file READY, and on the root of your USB drive along with the patched firmware upgrade!
(this replaces having to telnet into your scope after the upgrade and having to put the .lnk file back on)
So have these TWO files on your USB:
1) infiniivision.lnk
2) upgrade_file.ksx
DSOX 3000A Series: FW: 02.60.20201011001_patched https://mega.nz/file/KrAXRK6A#QwokNVJB4Hd_DDPU8r7F17wyygPHiqXWBBvBlXcKhC0
md5: <531BD46EF73E8C570922AF3AD4A9A8D9>
Please let me know if there are any issues with any of these!
Thanks PhillyFlyers, I did the patch on my DSO-X 3034A and it works!
I used the following infiniivision.lnk file:
93#"\Program Files\infiniiVision\infiniiVisionLauncher.exe" -l D3000BDLA -l BW50 -l SCPIPS -l SEC -l MSO -l MEMUP -l WAVEGEN
It is now upgraded to 500 MHz and includes the very rich D3000BDLA, which includes D3000AUTA, D3000GENA, D3000AERA, D3000PWRA, D3000NFCA, and all hardware based serial decoding (RS-232, I2C etc.), mask testing, video analysis, and even advanced math.
This is already great, again thanks.
However, the last 3 options in the file (MSO, MEMUP and WAVEGEN) did not work.
Did I do something wrong? It would be nice to have WAVEGEN and MEMUP... ;-)
cheers
MT
Argh thanks TK, was wondering what that number was... ;-)I don't remember if it includes the '#' character in the count. Anyway, you can try moving the WAVEGEN option to the front and see what happens
Now I have:
122#"\Program Files\infiniiVision\infiniiVisionLauncher.exe" -l D3000BDLA -l BW50 -l SCPIPS -l SEC -l MSO -l MEMUP -l WAVEGEN
This installs MSO and MEMUP but not WAVEGEN. I checked the number of characters after # and it is indeed 122.
Bizarre. Any ideas?
Argh thanks TK, was wondering what that number was... ;-)I get 121 characters in your string; you might try with that number.
Now I have:
122#"\Program Files\infiniiVision\infiniiVisionLauncher.exe" -l D3000BDLA -l BW50 -l SCPIPS -l SEC -l MSO -l MEMUP -l WAVEGEN
This installs MSO and MEMUP but not WAVEGEN. I checked the number of characters after # and it is indeed 122.
Bizarre. Any ideas?
Nicely done!I remember some marketing material talking about a 1.5GHz 3000 series (extra bandwidth for USB2.0 measurements/decode) but it seems like that was pushed up/out to segment the market. Or perhaps it never quite worked reliably! Dunno.
The most interesting part is K504, it confirms they use a single PCB layout for 200 MHz to 1.5 GHz. If I ever get a 4000 series I will figure out the part swaps needed to mod to 1.5 GHz. It sure is hard to get a great deal on a 4000 series machine though, maybe Daniel has one he wants to sacrifice. I won't add any lights or water cooling to it though, just pure delightful bandwidth. >:D >:D >:D >:D
Not only marketing material. In some early manuals for 3000T series, 1.5 GHz was mentioned, and also realtime sampling and ETS is mentioned. I think it is just marketing segmentation. There is a considerable difference between 4000 and 3000A series. 3000T is literally identical, simply a hardware variant of 4000.Nicely done!I remember some marketing material talking about a 1.5GHz 3000 series (extra bandwidth for USB2.0 measurements/decode) but it seems like that was pushed up/out to segment the market. Or perhaps it never quite worked reliably! Dunno.
The most interesting part is K504, it confirms they use a single PCB layout for 200 MHz to 1.5 GHz. If I ever get a 4000 series I will figure out the part swaps needed to mod to 1.5 GHz. It sure is hard to get a great deal on a 4000 series machine though, maybe Daniel has one he wants to sacrifice. I won't add any lights or water cooling to it though, just pure delightful bandwidth. >:D >:D >:D >:D
Nicely done!I remember some marketing material talking about a 1.5GHz 3000 series (extra bandwidth for USB2.0 measurements/decode) but it seems like that was pushed up/out to segment the market. Or perhaps it never quite worked reliably! Dunno.
The most interesting part is K504, it confirms they use a single PCB layout for 200 MHz to 1.5 GHz. If I ever get a 4000 series I will figure out the part swaps needed to mod to 1.5 GHz. It sure is hard to get a great deal on a 4000 series machine though, maybe Daniel has one he wants to sacrifice. I won't add any lights or water cooling to it though, just pure delightful bandwidth. >:D >:D >:D >:D
... I was thinking back to the 3000A release!Not only marketing material. In some early manuals for 3000T series, 1.5 GHz was mentioned, and also realtime sampling and ETS is mentioned.Nicely done!I remember some marketing material talking about a 1.5GHz 3000 series (extra bandwidth for USB2.0 measurements/decode) but it seems like that was pushed up/out to segment the market. Or perhaps it never quite worked reliably! Dunno.
The most interesting part is K504, it confirms they use a single PCB layout for 200 MHz to 1.5 GHz. If I ever get a 4000 series I will figure out the part swaps needed to mod to 1.5 GHz. It sure is hard to get a great deal on a 4000 series machine though, maybe Daniel has one he wants to sacrifice. I won't add any lights or water cooling to it though, just pure delightful bandwidth. >:D >:D >:D >:D
When you do such drastic upgrade, how's trigger stability go ?
So have these TWO files on your USB:
1) infiniivision.lnk
2) upgrade_file.ksx
DSOX 4000X Series: FW: 7.35.2020120823_patched https://mega.nz/file/q3ABzQ5b#BH08CEf_Q0T7Z3kQMOzmHZTGubIGKPanCiq8my69TyM
md5: <04D0B52B8400F03B3EA87B90DE8FC004>[/b]
Please let me know if there are any issues with any of these!
So have these TWO files on your USB:
1) infiniivision.lnk
2) upgrade_file.ksx
Please let me know if there are any issues with any of these!
Things went south my my MSOX4054A. "System concerns detected: -[2] Firmware update failed (aux -v)"
Now this message pop up even using the official firmware “4000X.7.35.2020120823.ksx”.
Before update, version : 2.xx (I can not remenber)
After update, version: 7.35
Yep, big jump, maybe this is how this flaut come ?
infiniivision.lnk : 38#infiniiVisionLauncher.exe -l D4000BDLA
and
4000X.7.35.2020120823_patched.ksx
My friend has a DSOX3034A.
It has NAND corruption problem.
Now,I need 3000A v2.36 firmware to help my friend to repair it.
Can you send the 3000A v2.36 firmware to me?
Thank you.
Thank you,Mark.My friend has a DSOX3034A.
It has NAND corruption problem.
Now,I need 3000A v2.36 firmware to help my friend to repair it.
Can you send the 3000A v2.36 firmware to me?
Thank you.
This any good?
3000XSeries.02.35.2013061800.cab
https://www.dropbox.com/s/2jq5uskjo85smz8/3000XSeries.02.35.2013061800.cab?dl=0 (https://www.dropbox.com/s/2jq5uskjo85smz8/3000XSeries.02.35.2013061800.cab?dl=0)
I also have 2.37, but not 2.36.
I fixed 2-3 scopes with the NAND issue and I don't recall having to match the exact firmware that was installed to recover them. I know it is recommended in some posts, but I could not confirm it, as I repaired 2 scopes (probably with different firmware vesions) using the same USB driveThank you,Mark.My friend has a DSOX3034A.
It has NAND corruption problem.
Now,I need 3000A v2.36 firmware to help my friend to repair it.
Can you send the 3000A v2.36 firmware to me?
Thank you.
This any good?
3000XSeries.02.35.2013061800.cab
https://www.dropbox.com/s/2jq5uskjo85smz8/3000XSeries.02.35.2013061800.cab?dl=0 (https://www.dropbox.com/s/2jq5uskjo85smz8/3000XSeries.02.35.2013061800.cab?dl=0)
I also have 2.37, but not 2.36.
I also have 2.35 and 2.37,but not 2.36.
I fixed 2-3 scopes with the NAND issue and I don't recall having to match the exact firmware that was installed to recover them. I know it is recommended in some posts, but I could not confirm it, as I repaired 2 scopes (probably with different firmware vesions) using the same USB driveThank you,Mark.My friend has a DSOX3034A.
It has NAND corruption problem.
Now,I need 3000A v2.36 firmware to help my friend to repair it.
Can you send the 3000A v2.36 firmware to me?
Thank you.
This any good?
3000XSeries.02.35.2013061800.cab
https://www.dropbox.com/s/2jq5uskjo85smz8/3000XSeries.02.35.2013061800.cab?dl=0 (https://www.dropbox.com/s/2jq5uskjo85smz8/3000XSeries.02.35.2013061800.cab?dl=0)
I also have 2.37, but not 2.36.
I also have 2.35 and 2.37,but not 2.36.
Oh boy. I have some heavy duty learning to do. Thank you!Have you checked it is not a NAND corruption issue?
If I can’t figure it out, it may be for sale....
Oh boy. I have some heavy duty learning to do. Thank you!Have you checked it is not a NAND corruption issue?
If I can’t figure it out, it may be for sale....
Oh boy. I have some heavy duty learning to do. Thank you!
If I can’t figure it out, it may be for sale....
Oh boy. I have some heavy duty learning to do. Thank you!
If I can’t figure it out, it may be for sale....
I have a bit of a long shot for you to try with a special USB image - will send you a PM with a download link.
New Features for 2000A This software revision includes the following new capabilities: -Added support for the following new perpetual software licenses: D2000GENB, D2000AUTB, D2000BDLB
Hello, a new 2.65 firmware was released. https://www.keysight.com/zz/en/lib/software-detail/instrument-firmware-software/installing-infiniivision-2000-xseries-oscilloscope-firmware-2014479.html (https://www.keysight.com/zz/en/lib/software-detail/instrument-firmware-software/installing-infiniivision-2000-xseries-oscilloscope-firmware-2014479.html)
I wonder what this is.QuoteNew Features for 2000A This software revision includes the following new capabilities: -Added support for the following new perpetual software licenses: D2000GENB, D2000AUTB, D2000BDLB
7.40 was also released for the 3000t series etc.Yes,
|
QuoteIs it any patch for DSOX 2000X Series, Firmware 02.65?
Hi All,
I did all the new FWs... I'll have these posted up tomorrow...
(2.65 & 7.40)
Tried to update on my 4024A w/ patched 7.40, got the error message previously shared:Same here with a 3000T
"System concerns detected: -[2] Firmware update failed (aux -v)"
Switched out the license file for a default one without any options via Telnet and got the same thing. So remain on 7.35 with options unlocked.
If anyone has UART Pinout for 4000X please share and I will try and see if anything useful is being outputted.
If anyone has UART Pinout for 4000X please share and I will try and see if anything useful is being outputted.Its J3402. See photos attached. Thankfully Agilent fitted the connector already with pins.
Thanks Pinkus. Grabbed output from UART, seems to fail when trying to delete this symbols.tte file:
** BEGIN ** ExtractFileFromCabFile: auxInstallStep.exe
** END ** ExtractFileFromCabFile: auxInstallStep.exe: 43 ms
** BEGIN ** ProcessRecipeStep: \TEMP\{DDCB3794-591A-81FE-C17A-0BE1729F178D}\auxInstallStep.exe -v -s
=== Aux Step: -v -s ===
Skipped.
Deleting existing symbols.tte.old file.
Failed to moved symbols.tte.
ERR: 2
** END ** ProcessRecipeStep: \TEMP\{DDCB3794-591A-81FE-C17A-0BE1729F178D}\auxInstallStep.exe -v -s: 30 ms
I can't manually delete it either, located at \Secure\infiniivision
'del symbols.tte.old'
'Cannot remove symbols.tte.old'
Update
Was able to rename the file, looks like FW update is proceeding:
'rename symbols.tte.old symbols.tte.old2'
Update 2
Unlocked:
Thanks Pinkus. Grabbed output from UART, seems to fail when trying to delete this symbols.tte file:It looks like the auxInstallStep.exe in \TEMP\ stays forever until it successfully deletes the symbols.tte.old file. After the failed attempt to install 7.40 patched on my 3000T, it does not install any other firmware, not even the factory unpatched file.
** BEGIN ** ExtractFileFromCabFile: auxInstallStep.exe
** END ** ExtractFileFromCabFile: auxInstallStep.exe: 43 ms
** BEGIN ** ProcessRecipeStep: \TEMP\{DDCB3794-591A-81FE-C17A-0BE1729F178D}\auxInstallStep.exe -v -s
=== Aux Step: -v -s ===
Skipped.
Deleting existing symbols.tte.old file.
Failed to moved symbols.tte.
ERR: 2
** END ** ProcessRecipeStep: \TEMP\{DDCB3794-591A-81FE-C17A-0BE1729F178D}\auxInstallStep.exe -v -s: 30 ms
I can't manually delete it either, located at \Secure\infiniivision
'del symbols.tte.old'
'Cannot remove symbols.tte.old'
Update
Was able to rename the file, looks like FW update is proceeding:
'rename symbols.tte.old symbols.tte.old2'
Update 2
Unlocked:
TK - I used Telnet over LAN (4000X) to do the file rename. Not sure if it's possible via UART.I ordered the LAN adapter PCB to build one. Thanks!
Ok,Excuse me, My oscilloscope model is dsox2012A .
Here are the latest patched firmwares, for the 1000X, 2000X, 3000A, 3000T, 4000X......
These firmwares have the usual patches for the license check and the 'unreleased/unfinalized software' things
*** Note: ***
I have made these installs even EASIER, after the upgrade completes the install process will also make a backup of the oem lnk file that it installs during the upgrade, and then attempt to copy 'infiniivision.lnk' from the same USB stick you are doing the upgrade with...
so in otherwords, have your 'infiniivision.lnk' file READY, and on the root of your USB drive along with the patched firmware upgrade!
(this replaces having to telnet into your scope after the upgrade and having to put the .lnk file back on)
The install script at the end does these two actions:
copy \Secure\Startup\infiniivision.lnk infiniivision.lnk.original (backs up oem file being replaced)
copy \usb\infiniivision.lnk \Secure\Startup\infiniivision.lnk (copies .lnk file from your USB to the startup folder)
So have these TWO files on your USB:
1) infiniivision.lnk
2) upgrade_file.ksx
*** NOTE: FOR THE 1000X.... ************************************
This is 'BUD's' patched firmware!! All credit goes to him and the 1000x hacking folks! there is NO .LNK file required for this patch, just install the FW! I repeat, there is NO .lnk file required for the
1000x hacking
DSOX 1000X Series: FW: 01.20.2019061038_patched https://mega.nz/file/nrpW3T4Z#gLnn__QchpYL5FuQXLawyso2_ReaXgn-jF4MzcRZSAA
md5: <8D128F5691BCB7D178CFB8E48F3784B9>
*************************************************************
DSOX 2000X Series: FW: 02.65.20210307001_patched https://mega.nz/file/mzgGjBpC#yLNWn8cGjJlsLeH_fVZ3tYyPZILYJ3EtGK8F84oEFw8
md5: <AF47DDB93F9CC88911ADC65F4E55F97D>
DSOX 3000A Series: FW: 02.65.20210307001_patched https://mega.nz/file/j3hEzbCa#4sYGoVawZt62XnoC3ZZvUAEyf575Q6o_-iYIr-whH4w
md5: <B5EBDEEA00BCBF4DCE77D173F212B8F6>
DSOX 3000T Series: FW: 7.40.2021031200_patched https://mega.nz/file/rz5UXbrL#FXRPSRjLlFN16amBWt_Si74-nS8OjW5xWZPLqmBeynU
md5: <C1AA8839085890FC058D27C501AF4F08>
DSOX 4000X Series: FW: 7.40.2021031202_patched https://mega.nz/file/nrxwAb6R#gNp4CCdwl_oyhAzxuJSI9OopUPjbmnu7fn8E8ejeGDg
md5: <7C30FD851FB6A4B461130D61FE9C0E0C>
Please let me know if there are any issues with any of these!
The link file you used is for 3000 series.thanks so much .
for 2000 use this one
146#infiniivisionLauncher.exe -l MSO -l WAVEGEN --perf -l D2000AUTB -l D2000GENB -l D2000BDLB -l BW10 -l BW20 -l SCPIPS -l PLUS -l VID -l CABLE -l ASV
At the moment of power on, pause the oscilloscope to continue to start through UART, get the IP address(192.168.1.109) , IP address of my computer is configured as:192.168.1.1.
and then enter u-boot mode. After the operation is completed, I try to log in through Telnet, but I can't connect. I use my computer to connect directly through the network cable instead of through the router. If I use the homemade LAN card, do I have to go through the router?
I write the wrong ink file, which leads to the start failure of the oscilloscope .In this case, can homemade LAN card still be used? Or only the original LAN card of Agilent can be telnet?
At the moment of power on, pause the oscilloscope to continue to start through UART, get the IP address(192.168.1.109) , IP address of my computer is configured as:192.168.1.1.
and then enter u-boot mode. After the operation is completed, I try to log in through Telnet, but I can't connect. I use my computer to connect directly through the network cable instead of through the router. If I use the homemade LAN card, do I have to go through the router?
I write the wrong ink file, which leads to the start failure of the oscilloscope .In this case, can homemade LAN card still be used? Or only the original LAN card of Agilent can be telnet?
Don't make the situation worse: it's better to use it via the router. Are you able to ping the scope? No need to use an original card.
My network cable is direct connection network cable, not cross network cable. I don't have cross network cable, so I can't test it
I connected the oscilloscope through the routerMy network cable is direct connection network cable, not cross network cable. I don't have cross network cable, so I can't test it
Then you should connect via router/switch, just in case.
My guess is that it is trying to boot from a network server to download and flash a new firmware imageI connected the oscilloscope through the routerMy network cable is direct connection network cable, not cross network cable. I don't have cross network cable, so I can't test it
Then you should connect via router/switch, just in case.
When I use Ping or Telnet, UART receives a prompt: not UDP
What is the problem? Do I have any way to repair this oscilloscope?
yes ,I have succeeded. Download the firmware from the network, start it, and then fix the inkMy guess is that it is trying to boot from a network server to download and flash a new firmware imageI connected the oscilloscope through the routerMy network cable is direct connection network cable, not cross network cable. I don't have cross network cable, so I can't test it
Then you should connect via router/switch, just in case.
When I use Ping or Telnet, UART receives a prompt: not UDP
What is the problem? Do I have any way to repair this oscilloscope?
Hello,
Being new to the site, please be patient with me :-)
I have a DSOX4024A and I managed to unlock the options according to your messages, except the bandwidth which remains at 200 mhZ, even with the BW50 option.
Is it possible to unlock the BW apr soft or must it be done by Hard?
Thank you for your return
Jean-michel
Many thanks
It’s difficult to modify ?
Jm
Ok,
Here are the latest patched firmwares, for the 1000X, 2000X, 3000A, 3000T, 4000X......
These firmwares have the usual patches for the license check and the 'unreleased/unfinalized software' things
*** Note: ***
I have made these installs even EASIER, after the upgrade completes the install process will also make a backup of the oem lnk file that it installs during the upgrade, and then attempt to copy 'infiniivision.lnk' from the same USB stick you are doing the upgrade with...
so in otherwords, have your 'infiniivision.lnk' file READY, and on the root of your USB drive along with the patched firmware upgrade!
(this replaces having to telnet into your scope after the upgrade and having to put the .lnk file back on)
The install script at the end does these two actions:
copy \Secure\Startup\infiniivision.lnk infiniivision.lnk.original (backs up oem file being replaced)
copy \usb\infiniivision.lnk \Secure\Startup\infiniivision.lnk (copies .lnk file from your USB to the startup folder)
So have these TWO files on your USB:
1) infiniivision.lnk
2) upgrade_file.ksx
*** NOTE: FOR THE 1000X.... ************************************
This is 'BUD's' patched firmware!! All credit goes to him and the 1000x hacking folks! there is NO .LNK file required for this patch, just install the FW! I repeat, there is NO .lnk file required for the
1000x hacking
DSOX 1000X Series: FW: 01.20.2019061038_patched https://mega.nz/file/nrpW3T4Z#gLnn__QchpYL5FuQXLawyso2_ReaXgn-jF4MzcRZSAA
md5: <8D128F5691BCB7D178CFB8E48F3784B9>
*************************************************************
DSOX 2000X Series: FW: 02.65.20210307001_patched https://mega.nz/file/mzgGjBpC#yLNWn8cGjJlsLeH_fVZ3tYyPZILYJ3EtGK8F84oEFw8
md5: <AF47DDB93F9CC88911ADC65F4E55F97D>
DSOX 3000A Series: FW: 02.65.20210307001_patched https://mega.nz/file/j3hEzbCa#4sYGoVawZt62XnoC3ZZvUAEyf575Q6o_-iYIr-whH4w
md5: <B5EBDEEA00BCBF4DCE77D173F212B8F6>
DSOX 3000T Series: FW: 7.40.2021031200_patched https://mega.nz/file/rz5UXbrL#FXRPSRjLlFN16amBWt_Si74-nS8OjW5xWZPLqmBeynU
md5: <C1AA8839085890FC058D27C501AF4F08>
DSOX 4000X Series: FW: 7.40.2021031202_patched https://mega.nz/file/nrxwAb6R#gNp4CCdwl_oyhAzxuJSI9OopUPjbmnu7fn8E8ejeGDg
md5: <7C30FD851FB6A4B461130D61FE9C0E0C>
Please let me know if there are any issues with any of these!
Ok,
Here are the latest patched firmwares, for the 1000X, 2000X, 3000A, 3000T, 4000X......
These firmwares have the usual patches for the license check and the 'unreleased/unfinalized software' things
*** Note: ***
I have made these installs even EASIER, after the upgrade completes the install process will also make a backup of the oem lnk file that it installs during the upgrade, and then attempt to copy 'infiniivision.lnk' from the same USB stick you are doing the upgrade with...
so in otherwords, have your 'infiniivision.lnk' file READY, and on the root of your USB drive along with the patched firmware upgrade!
(this replaces having to telnet into your scope after the upgrade and having to put the .lnk file back on)
The install script at the end does these two actions:
copy \Secure\Startup\infiniivision.lnk infiniivision.lnk.original (backs up oem file being replaced)
copy \usb\infiniivision.lnk \Secure\Startup\infiniivision.lnk (copies .lnk file from your USB to the startup folder)
So have these TWO files on your USB:
1) infiniivision.lnk
2) upgrade_file.ksx
*** NOTE: FOR THE 1000X.... ************************************
This is 'BUD's' patched firmware!! All credit goes to him and the 1000x hacking folks! there is NO .LNK file required for this patch, just install the FW! I repeat, there is NO .lnk file required for the
1000x hacking
DSOX 1000X Series: FW: 01.20.2019061038_patched https://mega.nz/file/nrpW3T4Z#gLnn__QchpYL5FuQXLawyso2_ReaXgn-jF4MzcRZSAA
md5: <8D128F5691BCB7D178CFB8E48F3784B9>
*************************************************************
DSOX 2000X Series: FW: 02.65.20210307001_patched https://mega.nz/file/mzgGjBpC#yLNWn8cGjJlsLeH_fVZ3tYyPZILYJ3EtGK8F84oEFw8
md5: <AF47DDB93F9CC88911ADC65F4E55F97D>
DSOX 3000A Series: FW: 02.65.20210307001_patched https://mega.nz/file/j3hEzbCa#4sYGoVawZt62XnoC3ZZvUAEyf575Q6o_-iYIr-whH4w
md5: <B5EBDEEA00BCBF4DCE77D173F212B8F6>
DSOX 3000T Series: FW: 7.40.2021031200_patched https://mega.nz/file/rz5UXbrL#FXRPSRjLlFN16amBWt_Si74-nS8OjW5xWZPLqmBeynU
md5: <C1AA8839085890FC058D27C501AF4F08>
DSOX 4000X Series: FW: 7.40.2021031202_patched https://mega.nz/file/nrxwAb6R#gNp4CCdwl_oyhAzxuJSI9OopUPjbmnu7fn8E8ejeGDg
md5: <7C30FD851FB6A4B461130D61FE9C0E0C>
Please let me know if there are any issues with any of these!
I tried the corresponding patch file on my DSOX3012T machine, it can be upgraded normally, but the option has not changed, I am sure the accuracy of the lnk file, and then I try to log in to the device via telnet, and find that the password is wrong, which prevents me from logging in to the device. It is estimated that this is why the upgrade is not successful, whether the machine has changed the telnet password and all subsequent file operations have not been completedRead post https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg3563584/#msg3563584 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg3563584/#msg3563584)Ok,
Here are the latest patched firmwares, for the 1000X, 2000X, 3000A, 3000T, 4000X......
These firmwares have the usual patches for the license check and the 'unreleased/unfinalized software' things
*** Note: ***
I have made these installs even EASIER, after the upgrade completes the install process will also make a backup of the oem lnk file that it installs during the upgrade, and then attempt to copy 'infiniivision.lnk' from the same USB stick you are doing the upgrade with...
so in otherwords, have your 'infiniivision.lnk' file READY, and on the root of your USB drive along with the patched firmware upgrade!
(this replaces having to telnet into your scope after the upgrade and having to put the .lnk file back on)
The install script at the end does these two actions:
copy \Secure\Startup\infiniivision.lnk infiniivision.lnk.original (backs up oem file being replaced)
copy \usb\infiniivision.lnk \Secure\Startup\infiniivision.lnk (copies .lnk file from your USB to the startup folder)
So have these TWO files on your USB:
1) infiniivision.lnk
2) upgrade_file.ksx
*** NOTE: FOR THE 1000X.... ************************************
This is 'BUD's' patched firmware!! All credit goes to him and the 1000x hacking folks! there is NO .LNK file required for this patch, just install the FW! I repeat, there is NO .lnk file required for the
1000x hacking
DSOX 1000X Series: FW: 01.20.2019061038_patched https://mega.nz/file/nrpW3T4Z#gLnn__QchpYL5FuQXLawyso2_ReaXgn-jF4MzcRZSAA (https://mega.nz/file/nrpW3T4Z#gLnn__QchpYL5FuQXLawyso2_ReaXgn-jF4MzcRZSAA)
md5: <8D128F5691BCB7D178CFB8E48F3784B9>
*************************************************************
DSOX 2000X Series: FW: 02.65.20210307001_patched https://mega.nz/file/mzgGjBpC#yLNWn8cGjJlsLeH_fVZ3tYyPZILYJ3EtGK8F84oEFw8 (https://mega.nz/file/mzgGjBpC#yLNWn8cGjJlsLeH_fVZ3tYyPZILYJ3EtGK8F84oEFw8)
md5: <AF47DDB93F9CC88911ADC65F4E55F97D>
DSOX 3000A Series: FW: 02.65.20210307001_patched https://mega.nz/file/j3hEzbCa#4sYGoVawZt62XnoC3ZZvUAEyf575Q6o_-iYIr-whH4w (https://mega.nz/file/j3hEzbCa#4sYGoVawZt62XnoC3ZZvUAEyf575Q6o_-iYIr-whH4w)
md5: <B5EBDEEA00BCBF4DCE77D173F212B8F6>
DSOX 3000T Series: FW: 7.40.2021031200_patched https://mega.nz/file/rz5UXbrL#FXRPSRjLlFN16amBWt_Si74-nS8OjW5xWZPLqmBeynU (https://mega.nz/file/rz5UXbrL#FXRPSRjLlFN16amBWt_Si74-nS8OjW5xWZPLqmBeynU)
md5: <C1AA8839085890FC058D27C501AF4F08>
DSOX 4000X Series: FW: 7.40.2021031202_patched https://mega.nz/file/nrxwAb6R#gNp4CCdwl_oyhAzxuJSI9OopUPjbmnu7fn8E8ejeGDg (https://mega.nz/file/nrxwAb6R#gNp4CCdwl_oyhAzxuJSI9OopUPjbmnu7fn8E8ejeGDg)
md5: <7C30FD851FB6A4B461130D61FE9C0E0C>
Please let me know if there are any issues with any of these!
Sorry but I was typing wrong. Was reading too much posts. :)
I need the 2.35 firmware for the DSO4024A. if you have it please?
Sorry but I was typing wrong. Was reading too much posts. :)for the 4000A X-series scopes,the first firmware is 4000XSeries.03.00.201209XXXX.agx
I need the 2.35 firmware for the DSO4024A. if you have it please?
Hi Wp_WpV2.35 is for 2000X、3000X,not for 3000X-T and 4000X.
My issue is the flash got corrupted. I was reading a post how to fix it trhough serial connection.
And it said the 2.35 firmware was the last one that accepted the boot from USB.
Is there other method to fix my firmwre?
Or the 3.0 is the way to go'?
Do you have any of those file or the description of the method?what the firmware was on it is not important.
Pllease?
I do not know what the firmware was on it originally. I did not see that information in the serial com.
I have read the firmware version I transfer over to the unit has to be similar to the (corrupted) one on the NAND, or the boot may not get far.
????? How will I know wat was on it?
: Address=0x80361000 Length=0x4E09D90 Name="" Target=RAMYou will need to find the firmware version which bin file matches the Length.
I went to help
There is an option to load the bin from serial or ymodem mode.
I will read a bit so as suggested. ymodem I guess way faster than serial.
How can I get to find the bin file?
I have read the firmware version I transfer over to the unit has to be similar to the (corrupted) one on the NAND, or the boot may not get far.This is the most detailed post about how to repair a NAND corrupted scope: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/?topicseen#msg2136181 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/?topicseen#msg2136181)
????? How will I know wat was on it?
I was reading about how to load binary file over serial line (ymodem mode).
But I would need the firmware file. The one can boot from USB.
BudThe image you need to flash is not the full upgrade package. I think it is the nk.bin (or something similar) file. The network method is not telnet, is using bootp protocol to get the image to flash from a bootp server
So the question is who has the matching firmware?
Address=0x80361000 Length=0x4E09D90 Name="" Target=RAM
0x4E09D90(Hex)=81,829,264(dec)
I have a 4.08 version 48,886,006 in size when it is unpacked 62,130,090
7.4 version 49,908,286 is size when is unpacked 63,572,647
Am I wrong somewhere?
I was just reading about it.He probably read my comments somewhere about when my DSOX4000 had flash problems. My scope often started 1 times out of 10 when switched on, the other 9 times it hung after a while. Though it got worse and finally, sometimes it needed 100 tries. Sending a Reset through UBOOT will do the same but is quicker and healthier for the electronics than 100x switch-off / switch-on.
Pinkus.I asked Keysight about the repair and of course I also was afraid, that the examination alone would cost a fortune. But no, it was not. This is what they answered:
What was at the end? Because I contacted Keysight they not interested.
Only if I pay for the diagnostic, post, and at the end the new board. (thousands)
69#"\Program Files\infiniiVision\infiniivisionLauncher.exe" -l D3000USBB
Has anyone had any luck doing USB HS triggers or decode on the 3104T?
I can get full- and low-speed to work no problem.
I'm using an 1130A calibrated 1.5GHz probe with E2675A differential browser with 01131-62102 91 ohm tips. Scope's calibrated and passes self test. The same happens with an 1131A 3.5GHz probe with differential browser.
An MDO4104C with P6330 3.5GHz differential probe & TPA-BNC adapter decodes just fine.
Screenshots attached...
We could reproduce the issue and found out that the 4000A x-series scope is working fine, but the 3000T x-series scope, which you use, is not and we also got the red lines. Therefore we logged a defect report to our R&D and they will fix it in the next releases. To set the priority to our R&D correctly, could you please let me know if you have any deadline in your projects that prevents you from doing your work or are you able to work with the TEK scopes while we are fixing the issue?
Thank you very much for bringing this to our attention. We are always looking forward to customers feedback to improve our software and hardware.
Unfortunately I don't have good news to share.
R&D looked into the issue with the 3000T x-series scope and USB 2.0 HS and found out that 3000T x-series scopes can’t support USB High Speed due to HW limitations. SW support for USB HS was accidentally added in the 7.35 GUI along with the intended and working USB LS and FS support.
In summary, USB LS and FS all work in the following. As far as USB HS…
• The 3000T Series FPGA cannot handle USB HS.
• The 4000X Series has a secondary FPGA that handles USB HS in 1GHz+ models
• The 6000X Series can handle USB HS it in its main FPGA.
R&D is investigating the changes to remove USB HS support from the 3000T Series GUI (targeted for the 7.50 release) while Marketing is reviewing the changes needed to customer facing documents.
My apologies for the mistake which we did in our documentation and software. This will be corrected soon.
Do you also have a 4000X or 6000X series scope from us?
Let me know if I can assist you any further in getting a 4000X or 6000X scope from one of our partners in the UK or with any other question. I hope we didn't loose your trust and you are still interested in ditching the TEKs ;)
Turns out it's a bit more than a bug...QuoteUnfortunately I don't have good news to share.
R&D looked into the issue with the 3000T x-series scope and USB 2.0 HS and found out that 3000T x-series scopes can’t support USB High Speed due to HW limitations. SW support for USB HS was accidentally added in the 7.35 GUI along with the intended and working USB LS and FS support.
In summary, USB LS and FS all work in the following. As far as USB HS…
• The 3000T Series FPGA cannot handle USB HS.
• The 4000X Series has a secondary FPGA that handles USB HS in 1GHz+ models
• The 6000X Series can handle USB HS it in its main FPGA.
R&D is investigating the changes to remove USB HS support from the 3000T Series GUI (targeted for the 7.50 release) while Marketing is reviewing the changes needed to customer facing documents.
My apologies for the mistake which we did in our documentation and software. This will be corrected soon.
Do you also have a 4000X or 6000X series scope from us?
Let me know if I can assist you any further in getting a 4000X or 6000X scope from one of our partners in the UK or with any other question. I hope we didn't loose your trust and you are still interested in ditching the TEKs ;)
Sinisa,No I think you're right.. Only HS is problem. If it is technical, this is one place where hardware decode is a problem, not a solution..
It's just HS limitation, or I'm seeing it wrong?
You tell me they did all that and didn't test it just a bit.. You managed to find a problem, in what, 2 hours....
Turns out it's a bit more than a bug...QuoteUnfortunately I don't have good news to share.
R&D looked into the issue with the 3000T x-series scope and USB 2.0 HS and found out that 3000T x-series scopes can’t support USB High Speed due to HW limitations. SW support for USB HS was accidentally added in the 7.35 GUI along with the intended and working USB LS and FS support.
In summary, USB LS and FS all work in the following. As far as USB HS…
• The 3000T Series FPGA cannot handle USB HS.
• The 4000X Series has a secondary FPGA that handles USB HS in 1GHz+ models
• The 6000X Series can handle USB HS it in its main FPGA.
R&D is investigating the changes to remove USB HS support from the 3000T Series GUI (targeted for the 7.50 release) while Marketing is reviewing the changes needed to customer facing documents.
My apologies for the mistake which we did in our documentation and software. This will be corrected soon.
Do you also have a 4000X or 6000X series scope from us?
Let me know if I can assist you any further in getting a 4000X or 6000X scope from one of our partners in the UK or with any other question. I hope we didn't loose your trust and you are still interested in ditching the TEKs ;)
Turns out it's a bit more than a bug...QuoteUnfortunately I don't have good news to share.
R&D looked into the issue with the 3000T x-series scope and USB 2.0 HS and found out that 3000T x-series scopes can’t support USB High Speed due to HW limitations. SW support for USB HS was accidentally added in the 7.35 GUI along with the intended and working USB LS and FS support.
In summary, USB LS and FS all work in the following. As far as USB HS…
• The 3000T Series FPGA cannot handle USB HS.
• The 4000X Series has a secondary FPGA that handles USB HS in 1GHz+ models
• The 6000X Series can handle USB HS it in its main FPGA.
R&D is investigating the changes to remove USB HS support from the 3000T Series GUI (targeted for the 7.50 release) while Marketing is reviewing the changes needed to customer facing documents.
My apologies for the mistake which we did in our documentation and software. This will be corrected soon.
Do you also have a 4000X or 6000X series scope from us?
Let me know if I can assist you any further in getting a 4000X or 6000X scope from one of our partners in the UK or with any other question. I hope we didn't loose your trust and you are still interested in ditching the TEKs ;)
Maybe they want to trade your MSOX3104T for a MSOX4104A
what is MSOX3104GJust Google for this: Keysight "G models" (https://www.google.com/search?q=Keysight+%22G+models%22)
what is MSOX3104GJust Google for this: Keysight "G models" (https://www.google.com/search?q=Keysight+%22G+models%22)
Looks like it indicates the inclusion of "Frequency response analysis - Bode plot"
USB HS is a complex protocol, very verbose and probably cumbersome to debug on a DSO screen, except for some specific bug chasing using triggers. I use an old Lecroy CATC USB 2.0 protocol analyzer I got on eBay for around $150 and software is still available for download from Lecroy and it runs on Windows 10. It can capture full USB HS and some units even comes with exerciser that allows you to generate USB signals.
Hi guys,Follow instructions posted here: https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/?topicseen#msg2136181 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/?topicseen#msg2136181)
I'm trying to save a DSO-X 2012A with suspected NAND flash issue, before dealing with sending it to Keysight (already had a bit of back and forth with them and that RMA setup is ongoing...).
I'm trying to boot off a USB drive so that I can just boot in once and then update firmware to the latest one. So far I haven't had any luck booting off flash drive, wanted to check here to see if I'm missing any steps.
My process so far:
-Take a fresh flash drive, formatted FAT16
-Create file infiniivisionStartupOverride.txt with content "True" (excluding quotations)
-Extract contents of 2000XSeries.02.35.2013061800 to flash drive
-Plug in flash drive, power on scope
It seems to try something with the flash drive, I see some activity on the flash drive LED, and then the scope just cycles through the button LED's and does nothing. This is different from powering the scope without a USB, it will attempt to boot then power cycle. When I had the UART debug connected it would read the flash drive, but gave some error message that made it seem like I had missed something in the file structure. I have the UART cable removed for now, or I'd pull up the exact output. I've tried a few different flash drives, all with the same result.
The posts I've seen on booting from USB mentioned unpacking the CAB inside the firmware contents and editing some data, but that seemed oriented towards unlocking features, which I'm not trying to get into (yet), just get the scope working. Also, opening up that CAB shows a bunch of files ending in 3-digit numbers, no folder structure.
Anything I'm missing here?
I tried to follow those instructions, but I'm only given a few options for actions, not allowed to enter any commands. I've attached a txt file of the output I get when holding down space on power on. Pressing "u" to enter U-boot just ends in a HW reset.
I've reconnected the TTL UART cable, the message given after it reads the USB (when I'm trying to boot off USB) is "Incorrect Parameters" then it just spins for a while, and eventually power cycles.
Sorry, fixed file attached to this postIn this situation,you can not see P500 prompt.
I did it, I did it !!! :phew:which .lnk configuration did you end up using? You can add BW35 to enable 350MHz option
Many thanks to everyone, especially PhillyFlyers and his team! :-+
The most recent firmware they patched works as it should! 8)
I did it, I did it !!! :phew:which .lnk configuration did you end up using? You can add BW35 to enable 350MHz option
Many thanks to everyone, especially PhillyFlyers and his team! :-+
The most recent firmware they patched works as it should! 8)
Yes, you are right... 350MHz needs the hw modI did it, I did it !!! :phew:which .lnk configuration did you end up using? You can add BW35 to enable 350MHz option
Many thanks to everyone, especially PhillyFlyers and his team! :-+
The most recent firmware they patched works as it should! 8)
He was adding it before but it will never work as his scope is limited to 200 MHz without a hardware mod.
With HW mod,you can hack MSOX3024T to 500MHz。
With HW mod,you can hack MSOX3024T to 500MHz。
With HW mod,you can hack MSOX3024T to 500MHz。
Or 1 GHz, or even 1.5 GHz :)
https://www.eevblog.com/forum/testgear/keysight-3000t-scope-1-ghz-hardware-upgrade-mod/ (https://www.eevblog.com/forum/testgear/keysight-3000t-scope-1-ghz-hardware-upgrade-mod/)
500 MHz is much less work though.
Have you tested?I tested.
- Connected serial PC port to the PCB with settings 115200/8/0/1
- Connected serial PC port to the PCB with settings 115200/8/0/1
Okay, that´s the result I get....
U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500
CPU: SPEAr600
DRAM: 128 MiB
Flash: 512 KiB
NAND: fsmc-ecc1 128 MiB
In: serial
Out: serial
Err: serial
SerNum:serial number not programmed
Chip: BD Board Rev: 4
Net: smsc
Press space to stop autoboot: 0
## Booting kernel from Legacy Image at f8050000 ...
Image Name: PBOOT
Created: 2011-08-24 22:35:34 UTC
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 36045 Bytes = 35.2 KiB
Load Address: 00000000
Entry Point: 00000000
Uncompressing Kernel Image ... OK
Starting kernel ...
Debug serial initialized ........OK
Microsoft Windows CE Bootloader Common Library Version 1.4 Built Aug 24 2011 15:15:48
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008
System ready!
Preparing for download...
Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN
X
XXXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOXOXOOOOERROR: Checksum failure (expected=0x167CF58 computed=0x167D64E)
****** Checksum failure on record 13, ABORT!!! ******
Completed file(s):
-------------------------------------------------------------------------------
- : Address=0x80361000 Length=0x13064E8 Name="" Target=RAM
Loading image 1 failed, trying next one
Loading image 2 from memory at 0xD1600000
BL_IMAGE_TYPE_UNKNOWN
Loading image 2 failed, trying next one
All images failed
Press r to reset
NAND or no NAND Failure?
I have access to LS / FS USB decoding on mine. Perhaps HS is tied to Scope Bandwidth.
Easiest way to transfer files is with USB, will appear as a directory over Telnet.
I have access to LS / FS USB decoding on mine. Perhaps HS is tied to Scope Bandwidth.
Easiest way to transfer files is with USB, will appear as a directory over Telnet.
hello!Get the 3.3V version of the USB to TTL adapter or board. USB voltage still 5V, but RX and TX levels must be 3.3V
I have a DSO-X-2002A oscilloscope with problably a NAND problem, but i am not sure, could you guys help me? It stays like in the picture below...
I have some USB to TTL boards, could i connect it to the points in the pcb of the oscilloscope and conect via usb port in my pc to check the boot problem or i am missing something?
Nobody? :'(Nobody? There is plenty of information on this exact same thread on how to achieve what you are looking for. If by “easy way” you mean not even looking back posts, then you will not get any help here..,
These are 115 pages, and english isn´t my native language. That´s why a hint to the page would be helpful. But if you don´t want to help simply ignore my request.https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg3562918/#msg3562918 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg3562918/#msg3562918)
By the way: even I helped others with a link, see page 114... 🙄
TK,These are 115 pages, and english isn´t my native language. That´s why a hint to the page would be helpful. But if you don´t want to help simply ignore my request.https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg3562918/#msg3562918 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg3562918/#msg3562918)
By the way: even I helped others with a link, see page 114... 🙄
These are 115 pages, and english isn´t my native language. That´s why a hint to the page would be helpful. But if you don´t want to help simply ignore my request.below is initial steps, then read the link TK given above for latest s/w.
I read original 7.40 or PhillyFlyers packed, both .lnk shows: 56#"\Program Files\infiniiVision\infiniivisionLauncher.exe"You don't need to boot from the USB. Just copy the patched firmware and the desired infiniivision.lnk file (where you indicate which options you want to enable), power on the scope, when boot is finished, insert the USB drive, then go to utility -> file browser, select the patched firmware and voila, options enabled after scope reboots.
and now infiniiVisionLauncher.exe is in folder named [INSTALLDIR], which seems, during boot the [INSTALLDIR] content will be copied to \Program Files\infiniiVision\ before .lnk cmd be called.
Thus previous USB boot won't work, any work around? I'm not familiar with WINCE.
Does PhillyFlyers' pkg unlocked all features or need user to repack the pkg? what is the BW? which USB format tool shall be used? is Rufus (FreeDOS style boot) ok?
50#infiniivisionLauncher.exe -l all -l BW50 -l SCPIPS
...This license allows the scope to load earlier firmware versions. Tech support once generated this license for me which allowed me to back out a firmware upgrade that introduced a nasty bug. "FWD" probably means "firmware downgrade".
-l FWD F8AEAE82 ??
...
Seems you are telneting to port 5024 which is SCPI interface ( try entering *IDN? ). You should telnet to port 23.Thanks! 5024 is SCPI! I used SCPI but always through keysight I/O, never used windows telnet with a/c login. I thought telnet to port 23 shall ask me a/c and passwd but it just failed.
Each 3000T calculates a unique password(most of the time anyway).thx then how to get to the status where telnet asks for ac name and passwd? I got this:
With port 23, I didn’t telnet DSOX3014T either.Each 3000T calculates a unique password(most of the time anyway).thx then how to get to the status where telnet asks for ac name and passwd? I got this:
C:\>telnet 10.76.171.133 23
Connecting To 10.76.171.133...Could not open connection to the host, on port 23: Connect failed
C:\>
C:\dsox>celoader nk.bin 192.168.1.207
Hi Bud,
without IP address same result.
Why I don't receive, in Teraterm, sensible things but incomprehensible graphic signs?Do you use a voltage level converter RS232->5V (or 3.3V) ?
Is this normal?
Thanks for your patience ....... I'm just a hobbyist. :)
Thanks TKIt is not normal, serial signals on the DSO are 3.3V
for the tip but no progress.
I have tried all the nk0 files, of the Old Firmware in my possession: 1.10, 2.10, 2.20, 2.30, 2.35, 2.42.
I tried to replace the address "loady 0x0361000 115200" with "loady 0x80361000 115200"......Nothing !!
Why I don't receive, in Teraterm, sensible things but incomprehensible graphic signs?
Is this normal?
Thanks for your patience ....... I'm just a hobbyist. :)
Dear tv84,
I didn't understand the statement: Thread closed
Thanks for any clarification.
when the link was not removed yet, I think it was clear why ;) :-DDillogical
(Attachment Link) (Attachment Link)With port 23, I didn’t telnet DSOX3014T either.Each 3000T calculates a unique password(most of the time anyway).thx then how to get to the status where telnet asks for ac name and passwd? I got this:
C:\>telnet 10.76.171.133 23
Connecting To 10.76.171.133...Could not open connection to the host, on port 23: Connect failed
C:\>
(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=1297528;image)
So I made a file to let 3000T jump to WinCE desktop.
(Attachment Link)
Unfortunately I didn't have a USB keyboard or serial adapter with me, or I'd have unlocked some additional options.
I also write a file to let 4000A scope jump to WinCE desktop.
I also write a file to let 4000A scope jump to WinCE desktop.WP_WP: would you mind to share these file?
I found a paper with downloadable file to do similar things: https://ripitapart.com/2018/10/15/gaining-access-to-the-windows-ce-desktop-and-doom-on-the-keysight-dsox1102g-oscilloscope/ (https://ripitapart.com/2018/10/15/gaining-access-to-the-windows-ce-desktop-and-doom-on-the-keysight-dsox1102g-oscilloscope/)I also write a file to let 4000A scope jump to WinCE desktop.
Very nice, will you be posting the files?
DSOX 3000T Series: FW: 7.31.2020012842_patched
md5: <63DDE0129A9516C81DCF380F228BB08A>
...
My scope is an MSOX3104T with a "DSOXLAN" installed.
Normally, I would get a "LAN VGA option module fault" even with the older FW when it boots, but this has not caused it to crash.
However, with the newer 7.40 and 7.35 FW, as long as there is an attempt to load the web interface, the scope would crash immediately.
Wondering whether anyone else has encountered this issue? Thanks!
Does anyone by any chance have a copy of this file lying around? (the original link is no longer working)QuoteDSOX 3000T Series: FW: 7.31.2020012842_patched
md5: <63DDE0129A9516C81DCF380F228BB08A>
After updating to the latest 7.40.2021031200, I can no longer access the Web interface without the scope crashing.
This used to work with the older 7.31 FW.
My scope is an MSOX3104T with a "DSOXLAN" installed.
Normally, I would get a "LAN VGA option module fault" even with the older FW when it boots, but this has not caused it to crash.
However, with the newer 7.40 and 7.35 FW, as long as there is an attempt to load the web interface, the scope would crash immediately.
Wondering whether anyone else has encountered this issue? Thanks!
USB high speed decode and trigger doesn't work on 3000T. See up thread starting at post 2786 on page 112. Turns out there was a marketing/technical miscommunication.
LS and FS works.
Edit: even if HS did work, you'd need a 1GHz+ bandwidth scope. It does work on the 4000A and 6000X but they have hardware to support HS that the 3000T doesn't.
USB high speed decode and trigger doesn't work on 3000T. See up thread starting at post 2786 on page 112. Turns out there was a marketing/technical miscommunication.
LS and FS works.
Edit: even if HS did work, you'd need a 1GHz+ bandwidth scope. It does work on the 4000A and 6000X but they have hardware to support HS that the 3000T doesn't.
Looks like only the 1 GHz and 1.5 GHz 4000 series have the extra FPGA (U2303) and a few other IC's. Good thing I never had the chance to try modding a 4000 series to 1 or 1.5 GHz. It would probably be unhappy without the extra parts.
USB high speed decode and trigger doesn't work on 3000T. See up thread starting at post 2786 on page 112. Turns out there was a marketing/technical miscommunication.
LS and FS works.
Edit: even if HS did work, you'd need a 1GHz+ bandwidth scope. It does work on the 4000A and 6000X but they have hardware to support HS that the 3000T doesn't.
Looks like only the 1 GHz and 1.5 GHz 4000 series have the extra FPGA (U2303) and a few other IC's. Good thing I never had the chance to try modding a 4000 series to 1 or 1.5 GHz. It would probably be unhappy without the extra parts.
Presumably that means that certain 4000A bandwidth upgrades are RTB?
Edit: I guess so.
EEVBlog Flickr has a good photo of 200MHZ 4000X Series board with U2303 (bottom left between heatsinks) unpopulated:
https://www.flickr.com/photos/eevblog/8181558404/in/album-72157631997535516/ (https://www.flickr.com/photos/eevblog/8181558404/in/album-72157631997535516/)
Closeup: https://www.flickr.com/photos/eevblog/8181518941/in/album-72157631997535516/ (https://www.flickr.com/photos/eevblog/8181518941/in/album-72157631997535516/) U2300, U2402 also unpopulated.
If on PhillyFlyers FW:
User: infiniivision
Pass: skywalker1977
Works for me on 4000X, so I would guess it's the same for 3000T as they share codebase.
If there is no uboot, there are no options via software.It was a simple task on my 1000x , the SPI memory is a SOIC-8 chip on the back of the BLT module. Not sure what chip is used on the 3000 model.
You must reprogram the SPI memory with the bootloader. I'm not sure that you must take it out. Others may confirm that.
How to load SPI memory at all and with which files?
In 3000XSeries.cab there are bin files that are related to uboot ....
I see that SPEAr 600 is based on dual ARM926, is there a possibility to load a new uboot via JTAG interface or some other pins? I tried with debug pins from SPEAr 600 datasheet and some ARM programmers, but I don't have a connection ...
I don't know where to start ... :-//
Did you see this post?
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1458452/#msg1458452 (https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg1458452/#msg1458452)
It appears it may be possible to reflash the NOR (SPI) via USB. The USB Flasher utility seems to be still available from ST web site.
A bit of a challenge maybe in specifying a proper address in the scope memory map. You could try sending the OP a personal message.
end of SPI Flash F807FFFF NOR
PBoot F8050000 0x946F NOR
Uboot F8010000 0x2FDD4 NOR
XLOADER F8000000 0x153A NOR
start of SPI Flash F8000000 0x80000 NOR
I mean the start and stop addresses for XBoot, UBoot and PBoot in the NOR memory space. But it should be possible to figure them out from the firmware UBoot binary image. The below is from my records for the 1000x NOR:Code: [Select]end of SPI Flash F807FFFF NOR
PBoot F8050000 0x946F NOR
Uboot F8010000 0x2FDD4 NOR
XLOADER F8000000 0x153A NOR
start of SPI Flash F8000000 0x80000 NOR
The third column is the length of the data blobs.
I am pretty sure the leading "F8" should be removed if the USB Flasher utility is used.
Again , this is for the 1000x. I do not know the setup for the 3000 scope.
00000000 - XLOADER (contents up to aprox. offset 0x1540)
00010000 - UBOOT (contents up to aprox. offset 0x3F90C)
00040000 - Environment variables (contents up to aprox. offset 0x40520)
00050000 - PBOOT (contents up to aprox. offset 0x593B8)
00060000 - Environment variables (contents up to aprox. offset 0x60520) 2ND COPY
00070000 - MAC address
p500> nand read 800000 60000 45480
NAND read: device 0 offset 0x60000, size 0x45480
283776 bytes read: OK
p500> loady 900000 115200
## Ready for binary (ymodem) download to 0x00900000 at 115200 bps...
CCxyzModem - CRC mode, 1(SOH)/278(STX)/0(CAN) packets, 7 retries
## Total Size = 0x00045480 = 283776 Bytes
p500> crc 900000 45480
CRC32 for 00900000 ... 0094547f ==> 5f15252c
p500> cmp 800000 900000 45480
word at 0x00801070 (0x00008000) != word at 0x00901070 (0x00000000)
Total of 1052 words were the same
As can be seen, one byte (actually one bit!) in the existing fpga image was corrupted.p500> fpga 900000 45480
p500> run bootcmd
## Booting kernel from Legacy Image at f8050000 ...
Image Name: PBOOT
Created: 2015-05-07 8:18:27 UTC
.....
What you can do in the meanwhile is to run printenv from Uboot and compare the output against tv84's post right above this one.
U-Boot 2010.03 (May 18 2017 - 11:28:22) Agilent P500
CPU: SPEAr600
DRAM: 128 MiB
Flash: 512 KiB
NAND: fsmc-ecc1 128 MiB
In: serial
Out: serial
Err: serial
SerNum: serial number not programmed
Chip: BD Board Rev: 4
Net: smsc
BMP data is not valid. Use splash bmp
Press space to stop autoboot: 2
p500> printenv
bootcmd = tftp 0x4000000 nk.bin; bootm 0xf8050000
ramboot = dhcp 0x4000000 nk.bin; bootm 0xf8050000
bootdelay = 3
baudrate = 115200
serverip = 192.168.1.10
preboot = splash load; fpga; expi
gatewayip = 192.168.1.10
netmask = 255.255.255.0
usbtty = cdc_acm
fpgadata = 0xd0060000
fpgasize = 0x75394
splashdata = 0xd0000000
dispParm1 = 0x300 0x400 0x2625A00 0x1 0x3
dispParm2 = 0x20 0x4c 0x1 0x2 0x3
boardversion = 4
ps = 0
rtc = 0
erase_env = protect off 1: 4, erase 1: 4
store_uboot = protect off 1: 1-3; erase 1: 1-3; cp.b 0x800000 0xF8010000 $ {filesize}; protect on 1: 1-3; imi 0xF8010000
get_uboot_eth = dhcp 0x800000 u-boot_image.bin; run store_uboot
get_uboot_uart = loadb 0x800000 115200; run store_uboot
ethaddr = 00: 03: d3: 04: 10: 00
serialnum = serial number not programmed
chipversion = BD
nimages = 1
image1 = 0xd0400000
fsstart = 0x2c00000
numfilesystems = 1
lengthfilesystem1 = 0x5400000
lengthfilesystem2 = 0x0
ecc = 1
verify = n
ipaddr = 192.168.1.100
ethact = smsc
Environment size: 893/16380 bytes
p500>
p500> nand read 800000 60000 45480
NAND read: device 0 offset 0x60000, size 0x45480
283776 bytes read: OK
p500> loady 900000 115200
## Ready for binary (ymodem) download to 0x00900000 at 115200 bps ...
CCxyzModem - CRC mode, 2 (SOH) / 469 (STX) / 0 (CAN) packets, 4 retries
## Total Size = 0x00075394 = 480148 Bytes
p500> crc 900000 45480
CRC32 for 00900000 ... 0094547f ==> 3733a6e1
p500> cmp 800000 900000 45480
word at 0x00800144 (0x0000a000)! = word at 0x00900144 (0x0000a402)
Total of 81 words were the same
p500>
U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500
CPU: SPEAr600
DRAM: 128 MiB
Flash: 512 KiB
NAND: fsmc-ecc1 128 MiB
In: serial
Out: serial
Err: serial
SerNum:serial number not programmed
Chip: BD Board Rev: 4
Net: smsc
Press space to stop autoboot: 0
## Booting kernel from Legacy Image at f8050000 ...
Image Name: PBOOT
Created: 2015-05-07 8:18:27 UTC
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 37749 Bytes = 36.9 KiB
Load Address: 00000000
Entry Point: 00000000
Uncompressing Kernel Image ... OK
Starting kernel ...
U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500
CPU: SPEAr600
DRAM: 128 MiB
Flash: 512 KiB
NAND: fsmc-ecc1 128 MiB
In: serial
Out: serial
Err: serial
SerNum:serial number not programmed
Chip: BD Board Rev: 4
Net: smsc
Press space to stop autoboot: 0
## Booting kernel from Legacy Image at f8050000 ...
Image Name: PBOOT
Created: 2015-05-07 8:18:27 UTC
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 37749 Bytes = 36.9 KiB
Load Address: 00000000
Entry Point: 00000000
Uncompressing Kernel Image ... OK
Starting kernel ...
Debug serial initialized ........OK
RTC: 2021-3-7 23:26:40.8 UTC
Microsoft Windows CE Bootloader Common Library Version 1.4 Built May 7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008
System ready!
Preparing for download...
RTC: 2021-3-7 23:26:40.11 UTC
Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN
X
XXXXOOOOXXOOOOOOOOERROR: Checksum failure (expected=0x31D2860 computed=0x31BA795)
****** Checksum failure on record 7, ABORT!!! ******
Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000 Length=0x1ACB780 Name="" Target=RAM
Loading image 1 failed, trying next one
Loading image 2 from memory at 0xD1600000
O
BL_IMAGE_TYPE_BIN
X
XXXXOOOOXXOOOOOOOOERROR: Checksum failure (expected=0x31D2860 computed=0x31BBD0F)
****** Checksum failure on record 7, ABORT!!! ******
Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000 Length=0x1ACB780 Name="" Target=RAM
Loading image 2 failed, trying next one
All images failed
Press r to reset
U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500
CPU: SPEAr600
DRAM: 128 MiB
Flash: 512 KiB
NAND: fsmc-ecc1 128 MiB
In: serial
Out: serial
Err: serial
SerNum:serial number not programmed
Chip: BD Board Rev: 4
Net: smsc
Press space to stop autoboot: 0
## Booting kernel from Legacy Image at f8050000 ...
Image Name: PBOOT
Created: 2015-05-07 8:18:27 UTC
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 37749 Bytes = 36.9 KiB
Load Address: 00000000
Entry Point: 00000000
Uncompressing Kernel Image ... OK
Starting kernel ...
Debug serial initialized ........OK
RTC: 2017-5-19 23:17:58.87 UTC
Microsoft Windows CE Bootloader Common Library Version 1.4 Built May 7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008
System ready!
Preparing for download...
RTC: 2017-5-19 23:17:58.91 UTC
Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN
X
XXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXXOOOOOOOOOXOOOOXOXXOXOXXOXOXOXOXXXXOOXXXOOOOOOXXOXXOXXXXXXOOOXXXOXXOOOXXXOOOXOOXOOXXOOXOXOOOOXOXOOOOOXOOOXOOOXXXOXOXXXXXXOXXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOX
OOOXOOXOOOOXXXOOOOXOOXXOOXOOOOOOOOOXOXOOOXOOOOOOXOXOOOOXOXOOOOOOOXOXOXOOXOXOOOXOOOXOOXOXXOXOOOXOXXXXXOXOXXOXXXXOXOXXOOOXXOXXXXXXXOXXXXXXXOXXXXOXOXXOXOOOXXXXOXXXXXOOOXXOXX
OOXXOXXXOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXXXOXOOOXOXOOXOOXXXXXXXXXXXXXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x1ACB780, LaunchAddr = 0x80362000
Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000 Length=0x1ACB780 Name="" Target=RAM
Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
RTC: 2017-5-19 23:18:2.34 UTC
Launching windows CE image by jumping at address 0x 362000
Windows CE Kernel for ARM (Thumb Enabled) Built on Mar 8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Mar 7 2021)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000 size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200 (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 00:03:D3:04:10:00
Phy found addr 31 (ticks=3044)
WaitForLink Start (ticks=3045)
No Link (ticks=4048)
<--EDeviceInitialize
GMAC DMA status register = 0x0
LIN: Data Valid
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Running infiniiVisionInstallHelper
Failed to start/configure network.
Device load time:
NANDFLASH: 0 ms
SNANDFLASH: 0 ms
SHIM DLL, LoadRealDll [PalIO.dll] for [AgilentPalIO.dll]
SHIM [AgilentPalIO.dll] Get Process Addresses
Our command line is
Performing Startup
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]
SHIM [AgilentPalSStorage.dll] Get Process Addresses
creating \Agilent Flash\selftest\
creating \Agilent Flash\wfmMem\
creating \Agilent Flash\LxiMdns\Released build, Mar 7 2021, 23:23:02
Initializing FPGA...
****
FPGA Type: Wyoming
Ver: 2.011 Released
Build Time: Tue May 27 16:03:14 2014
Build Machine: TS2404M
****
No option module detected
Keyboard firmware version 32... ok
Keyboard Info: Board id 1, Board rev 3
Startup sequence is complete.
SHIM DLL, LoadRealDll [PalSysManagement.dll] for [AgilentPalSysManagement.dll]
SHIM [AgilentPalSysManagement.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalCaps.dll] for [AgilentPalCaps.dll]
SHIM [AgilentPalCaps.dll] Get Process Addresses
System has been running 23.916475 seconds
Start Up Sequence 13.584780
Memory Load 55%
System Physical Memory 39.672 / 73.277 MB
Process Virtual Memory 49.500 / 1024.000 MB
-----> InfiniiVision is running <-----
failed open \Secure\InfiniiVision\LudicrousSpeed.usb
no workaround for USB phy
U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500
CPU: SPEAr600
DRAM: 128 MiB
Flash: 512 KiB
NAND: fsmc-ecc1 128 MiB
In: serial
Out: serial
Err: serial
SerNum:serial number not programmed
Chip: BD Board Rev: 4
Net: smsc
Press space to stop autoboot: 0
p500> printenv
ramboot=dhcp 0x4000000 nk.bin;bootm 0xf8050000
baudrate=115200
usbtty=cdc_acm
fpgasize=0x75394
splashdata=0xd0000000
dispParm1=0x300 0x400 0x2625A00 0x1 0x3
dispParm2=0x20 0x4c 0x1 0x2 0x3
boardversion=4
ps=0
rtc=0
erase_env=protect off 1:4;erase 1:4
store_uboot=protect off 1:1-3;erase 1:1-3;cp.b 0x800000 0xF8010000 ${filesize};protect on 1:1-3;imi 0xF8010000
get_uboot_eth=dhcp 0x800000 u-boot_image.bin;run store_uboot
get_uboot_uart=loadb 0x800000 115200;run store_uboot
serialnum=serial number not programmed
ethact=smsc
bootdelay=0
bootaddr=0x700
loadaddr=0x00800000
chipversion=BD
nimages=2
image1=0xd0600000
image2=0xd1600000
fpgadata=0xd0060000
fimage=1
pbootdelay=0
numfilesystems=2
lengthfilesystem1=0x2800000
lengthfilesystem2=0x2800000
fsstart=0x2c00000
bootCeFlash=bootm 0xf8050000
uart2=115200
bootcmd=run keyrst;run bootCeFlash
preboot=fpga; expi 62500
keyrst=mw d8100400 6 1;mw d8100008 0 1;mw d8100008 2 1
bootfile=nk.bin.comp
filesize=C72BF2
blocksize=0xc80000
fileaddr=800000
gatewayip=146.223.241.1
netmask=255.255.255.0
serverip=146.223.241.68
stdout=serial
stdin=serial
stderr=serial
infiniiVisionCabFile=
infiniiVisionHostname=
infiniiVisionNetworkAdapter=
infiniiVisionInstallStatus=installing cab file
ethaddr=00:03:d3:04:10:00
manufacturer=
verify=n
ipaddr=192.168.1.100
Environment size: 1299/16380 bytes
p500>
l) Load memory resident image Load image 1 now
1) Load memory resident image 1 now
2) Load memory resident image 2 now
3) Load memory resident image 3 now
d) Download from platform builder now
u) Start u-boot by resetting
v) Verify Images
>
********* Image 1 *******************O
BL_IMAGE_TYPE_BIN
X
XXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXXOOOOOOOOOXOOOOXOXXOXOXXOXOXOXOXXXXOOXXXOOOOOOXXOXXOXXXXXXOOOXXXOXXOOOXXXOOOXOOXOOXXOOXOXOOOOXOXOOOOOXOOOXOOOXXXOXOXXXXXXOXXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOX
OOOXOOXOOOOXXXOOOOXOOXXOOXOOOOOOOOOXOXOOOXOOOOOOXOXOOOOXOXOOOOOOOXOXOXOOXOXOOOXOOOXOOXOXXOXOOOXOXXXXXOXOXXOXXXXOXOXXOOOXXOXXXXXXXOXXXXXXXOXXXXOXOXXOXOOOXXXXOXXXXXOOOXXOXX
OOXXOXXXOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXXXOXOOOXOXOOXOOXXXXXXXXXXXXXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x1ACB780, LaunchAddr = 0x80362000
Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000 Length=0x1ACB780 Name="" Target=RAM
******************************************************
Valid Image at 0xd0600000
*******************************************************
********* Image 2 *******************O
BL_IMAGE_TYPE_BIN
X
XXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXXOOOOOOOOOXOOOOXOXXOXOXXOXOXOXOXXXXOOXXXOOOOOOXXRewrite recommended, internal ECC corrected data at 0x2ff1
OXXOXXXXXXOOOXXXOXXOOOXXXOOOXOOXOOXXOOXOXOOOOXOXOOOOOXOOOXOOOXXXOXOXXXXXXOXXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOX
OOOXOOXOOOOXXXOOOOXOOXXOOXOOOOOOOOOXOXOOOXOOOOOOXOXOOOOXOXOOOOOOOXOXOXOOXOXOOOXOOOXOOXOXXOXOOOXOXXXXXOXOXXOXXXXOXOXXOOOXXOXXXXXXXOXXXXXXXOXXXXOXOXXOXOOOXXXXOXXXXXOOOXXOXX
OOXXOXXXOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXXXOXOOOXOXOOXOOXXXXXXXXXXXXXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x1ACB780, LaunchAddr = 0x80362000
Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000 Length=0x1ACB780 Name="" Target=RAM
******************************************************
Valid Image at 0xd1600000
*******************************************************
P500 Boot Loader Configuration :
Mac address .......... (00:03:D3:04:10:00)
Ip address ........... (192.168.1.176)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (0)
Load image 1 at startup
Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
1 (0xd0600000)
2 (0xd1600000)
l) Load memory resident image Load image 1 now
1) Load memory resident image 1 now
2) Load memory resident image 2 now
3) Load memory resident image 3 now
d) Download from platform builder now
u) Start u-boot by resetting
v) Verify Images
>
System Physical Memory 39.680 / 73.277 MB
Process Virtual Memory 49.500 / 1024.000 MB
-----> InfiniiVision is running <-----
will do USB phy workaround: CheckCRC
System Physical Memory 39.672 / 73.277 MB
Process Virtual Memory 49.500 / 1024.000 MB
-----> InfiniiVision is running <-----
failed open \Secure\InfiniiVision\LudicrousSpeed.usb
no workaround for USB phy
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]
SHIM [AgilentPalSStorage.dll] Get Process Addresses
** BEGIN ** ExtractFileFromCabFile: RECIPE.XML
** END ** ExtractFileFromCabFile: RECIPE.XML: 80 ms
PRE: "" -> ""
** BEGIN ** ExtractFileFromCabFile: infiniiVisionSetup.cab
** END ** ExtractFileFromCabFile: infiniiVisionSetup.cab: 17061 ms
** BEGIN ** ExtractFileFromCabFile: _setup.xml
** END ** ExtractFileFromCabFile: _setup.xml: 45 ms
** BEGIN ** ExtractFileFromCabFile: INFINI~1.176
** END ** ExtractFileFromCabFile: INFINI~1.176: 44 ms
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]
SHIM [AgilentPalSStorage.dll] Get Process Addresses
** BEGIN ** ExtractFileFromCabFile: RECIPE.XML
** END ** ExtractFileFromCabFile: RECIPE.XML: 25 ms
PRE: "" -> ""
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]
SHIM [AgilentPalSStorage.dll] Get Process Addresses
** BEGIN ** ExtractFileFromCabFile: RECIPE.XML
** END ** ExtractFileFromCabFile: RECIPE.XML: 17 ms
PRE: "" -> ""
** BEGIN ** ExtractFileFromCabFile: updateSplashImage.wvga.bin
** END ** ExtractFileFromCabFile: updateSplashImage.wvga.bin: 8 ms
GetNextUsbEvent, bOpenContextClosing
EventThread, ERROR ABORTED or INVALID HANDLE, exiting
GetSetupPacket, tmcDriverClosing 2
** BEGIN ** ExtractFileFromCabFile: auxInstallStep.exe
** END ** ExtractFileFromCabFile: auxInstallStep.exe: 406 ms
** BEGIN ** ProcessRecipeStep: \TEMP\{31CA0B68-CF95-6D80-4501-6A7EA5E27919}\auxInstallStep.exe -v
=== Aux Step: -v ===
Skipped.
** END ** ProcessRecipeStep: \TEMP\{31CA0B68-CF95-6D80-4501-6A7EA5E27919}\auxInstallStep.exe -v: 23 ms
** BEGIN ** ExtractFileFromCabFile: nk.bin.comp
** END ** ExtractFileFromCabFile: nk.bin.comp: 7175 ms
** BEGIN ** ProcessRecipeStep: \windows\loadP500Flash -u ceImage2 \TEMP\{31CA0B68-CF95-6D80-4501-6A7EA5E27919}\nk.bin.comp
SHIM DLL, LoadRealDll [PalSysManagement.dll] for [AgilentPalSysManagement.dll]
SHIM [AgilentPalSysManagement.dll] Get Process Addresses
FWUpdate: image 3 value not defined
0.000000 complete (Erasing)
100.000000 complete (Erasing)
0.000000 complete (Writing)
2.546880 complete (Writing)
5.093760 complete (Writing)
7.640639 complete (Writing)
10.187519 complete (Writing)
12.734399 complete (Writing)
15.281279 complete (Writing)
17.828158 complete (Writing)
20.375038 complete (Writing)
22.921918 complete (Writing)
25.468798 complete (Writing)
28.015677 complete (Writing)
30.562557 complete (Writing)
33.109437 complete (Writing)
35.656317 complete (Writing)
38.203196 complete (Writing)
40.750076 complete (Writing)
43.296956 complete (Writing)
45.843836 complete (Writing)
48.390715 complete (Writing)
50.937595 complete (Writing)
53.484475 complete (Writing)
56.031355 complete (Writing)
58.578234 complete (Writing)
61.125114 complete (Writing)
63.671994 complete (Writing)
66.218874 complete (Writing)
68.765753 complete (Writing)
71.312633 complete (Writing)
73.859513 complete (Writing)
76.406393 complete (Writing)
78.953272 complete (Writing)
81.500152 complete (Writing)
84.047032 complete (Writing)
86.593912 complete (Writing)
89.140791 complete (Writing)
91.687671 complete (Writing)
94.234551 complete (Writing)
96.781431 complete (Writing)
99.328310 complete (Writing)
100.000000 complete (Writing)
0.000000 complete (Verifying)
2.546880 complete (Verifying)
5.093760 complete (Verifying)
7.640639 complete (Verifying)
10.187519 complete (Verifying)
12.734399 complete (Verifying)
15.281279 complete (Verifying)
17.828158 complete (Verifying)
20.375038 complete (Verifying)
22.921918 complete (Verifying)
25.468798 complete (Verifying)
28.015677 complete (Verifying)
30.562557 complete (Verifying)
33.109437 complete (Verifying)
35.656317 complete (Verifying)
38.203196 complete (Verifying)
40.750076 complete (Verifying)
43.296956 complete (Verifying)
45.843836 complete (Verifying)
48.390715 complete (Verifying)
50.937595 complete (Verifying)
53.484475 complete (Verifying)
56.031355 complete (Verifying)
58.578234 complete (Verifying)
61.125114 complete (Verifying)
63.671994 complete (Verifying)
66.218874 complete (Verifying)
68.765753 complete (Verifying)
71.312633 complete (Verifying)
73.859513 complete (Verifying)
76.406393 complete (Verifying)
78.953272 complete (Verifying)
81.500152 complete (Verifying)
84.047032 complete (Verifying)
86.593912 complete (Verifying)
89.140791 complete (Verifying)
91.687671 complete (Verifying)
94.234551 complete (Verifying)
96.781431 complete (Verifying)
99.328310 complete (Verifying)
100.000000 complete (Verifying)
** END ** ProcessRecipeStep: \windows\loadP500Flash -u ceImage2 \TEMP\{31CA0B68-CF95-6D80-4501-6A7EA5E27919}\nk.bin.comp: 8151 ms
** BEGIN ** ExtractFileFromCabFile: updateBootLoaders2.exe
** END ** ExtractFileFromCabFile: updateBootLoaders2.exe: 318 ms
** BEGIN ** ExtractFileFromCabFile: pboot_rel.bin
** END ** ExtractFileFromCabFile: pboot_rel.bin: 355 ms
** BEGIN ** ProcessRecipeStep: \TEMP\{31CA0B68-CF95-6D80-4501-6A7EA5E27919}\updatebootloaders2.exe
Update XLOADER at address f8000000.
XLOADER is up to date. Skipping
Update UBOOT at address f8010000.
UBOOT is up to date. Skipping
Update PBOOT at address f8050000.
PBOOT is up to date. Skipping
** END ** ProcessRecipeStep: \TEMP\{31CA0B68-CF95-6D80-4501-6A7EA5E27919}\updatebootloaders2.exe: 96 ms
** BEGIN ** ExtractFileFromCabFile: nk.bin.comp
** END ** ExtractFileFromCabFile: nk.bin.comp: 7169 ms
** BEGIN ** ProcessRecipeStep: \windows\loadP500Flash -u ceImage1 \TEMP\{31CA0B68-CF95-6D80-4501-6A7EA5E27919}\nk.bin.comp
SHIM DLL, LoadRealDll [PalSysManagement.dll] for [AgilentPalSysManagement.dll]
SHIM [AgilentPalSysManagement.dll] Get Process Addresses
0.000000 complete (Erasing)
100.000000 complete (Erasing)
0.000000 complete (Writing)
2.546880 complete (Writing)
5.093760 complete (Writing)
7.640639 complete (Writing)
10.187519 complete (Writing)
12.734399 complete (Writing)
15.281279 complete (Writing)
17.828158 complete (Writing)
20.375038 complete (Writing)
22.921918 complete (Writing)
25.468798 complete (Writing)
28.015677 complete (Writing)
30.562557 complete (Writing)
33.109437 complete (Writing)
35.656317 complete (Writing)
38.203196 complete (Writing)
40.750076 complete (Writing)
43.296956 complete (Writing)
45.843836 complete (Writing)
48.390715 complete (Writing)
50.937595 complete (Writing)
53.484475 complete (Writing)
56.031355 complete (Writing)
58.578234 complete (Writing)
61.125114 complete (Writing)
63.671994 complete (Writing)
66.218874 complete (Writing)
68.765753 complete (Writing)
71.312633 complete (Writing)
73.859513 complete (Writing)
76.406393 complete (Writing)
78.953272 complete (Writing)
81.500152 complete (Writing)
84.047032 complete (Writing)
86.593912 complete (Writing)
89.140791 complete (Writing)
91.687671 complete (Writing)
94.234551 complete (Writing)
96.781431 complete (Writing)
99.328310 complete (Writing)
100.000000 complete (Writing)
0.000000 complete (Verifying)
2.546880 complete (Verifying)
5.093760 complete (Verifying)
7.640639 complete (Verifying)
10.187519 complete (Verifying)
12.734399 complete (Verifying)
15.281279 complete (Verifying)
17.828158 complete (Verifying)
20.375038 complete (Verifying)
22.921918 complete (Verifying)
25.468798 complete (Verifying)
28.015677 complete (Verifying)
30.562557 complete (Verifying)
33.109437 complete (Verifying)
35.656317 complete (Verifying)
38.203196 complete (Verifying)
40.750076 complete (Verifying)
43.296956 complete (Verifying)
45.843836 complete (Verifying)
48.390715 complete (Verifying)
50.937595 complete (Verifying)
53.484475 complete (Verifying)
56.031355 complete (Verifying)
58.578234 complete (Verifying)
61.125114 complete (Verifying)
63.671994 complete (Verifying)
66.218874 complete (Verifying)
68.765753 complete (Verifying)
71.312633 complete (Verifying)
73.859513 complete (Verifying)
76.406393 complete (Verifying)
78.953272 complete (Verifying)
81.500152 complete (Verifying)
84.047032 complete (Verifying)
86.593912 complete (Verifying)
89.140791 complete (Verifying)
91.687671 complete (Verifying)
94.234551 complete (Verifying)
96.781431 complete (Verifying)
99.328310 complete (Verifying)
100.000000 complete (Verifying)
** END ** ProcessRecipeStep: \windows\loadP500Flash -u ceImage1 \TEMP\{31CA0B68-CF95-6D80-4501-6A7EA5E27919}\nk.bin.comp: 8143 ms
** BEGIN ** ExtractFileFromCabFile: fpga2000a.bin
** END ** ExtractFileFromCabFile: fpga2000a.bin: 102 ms
** BEGIN ** ProcessRecipeStep: \windows\loadP500Flash -u fpga --target economy \TEMP\{31CA0B68-CF95-6D80-4501-6A7EA5E27919}\fpga2000a.bin
Hardware does not match the specified target (-t).
FPGA update failed!
** END ** ProcessRecipeStep: \windows\loadP500Flash -u fpga --target economy \TEMP\{31CA0B68-CF95-6D80-4501-6A7EA5E27919}\fpga2000a.bin: 398 ms
** BEGIN ** ExtractFileFromCabFile: fpga3000a.bin
** END ** ExtractFileFromCabFile: fpga3000a.bin: 234 ms
** BEGIN ** ProcessRecipeStep: \windows\loadP500Flash -u fpga --target performance \TEMP\{31CA0B68-CF95-6D80-4501-6A7EA5E27919}\fpga3000a.bin
SHIM DLL, LoadRealDll [PalSysManagement.dll] for [AgilentPalSysManagement.dll]
SHIM [AgilentPalSysManagement.dll] Get Process Addresses
** END ** ProcessRecipeStep: \windows\loadP500Flash -u fpga --target performance \TEMP\{31CA0B68-CF95-6D80-4501-6A7EA5E27919}\fpga3000a.bin: 688 ms
** BEGIN ** ExtractFileFromCabFile: cleanupFileSystem.exe
** END ** ExtractFileFromCabFile: cleanupFileSystem.exe: 287 ms
** BEGIN ** ProcessRecipeStep: \TEMP\{31CA0B68-CF95-6D80-4501-6A7EA5E27919}\cleanupFileSystem.exe
**** CleanupInfiniiVisionFolder ****
**** CleanupInfiniiVisionFolder ****
**** CleanupInfiniiVisionFolder ****
**** CleanupInfiniiVisionFolder ****
**** CleanupInfiniiVisionFolder ****
DELETED: \secure\infiniiVision\web\Lxi\Identification\Default.asp
DELETED: \secure\infiniiVision\web\Lxi\Identification\LXIIdentification.xsd
DELETED: \secure\infiniiVision\web\Lxi\Identification\
DELETED: \secure\infiniiVision\web\Lxi\
**** CleanupInfiniiVisionFolder ****
**** CleanupInfiniiVisionFolder ****
DELETED: \secure\infiniiVision\web\include\web-socket-js\WebSocketMain.swf
DELETED: \secure\infiniiVision\web\include\web-socket-js\swfobject.js
DELETED: \secure\infiniiVision\web\include\web-socket-js\web_socket.min.js
DELETED: \secure\infiniiVision\web\include\web-socket-js\
DELETED: \secure\infiniiVision\web\include\vnc.min.js
DELETED: \secure\infiniiVision\web\include\
**** CleanupInfiniiVisionFolder ****
DELETED: \secure\infiniiVision\web\css\AGBD____.TTF
DELETED: \secure\infiniiVision\web\css\KeysightSansBold.ttf
DELETED: \secure\infiniiVision\web\css\default.min.css
DELETED: \secure\infiniiVision\web\css\
**** CleanupInfiniiVisionFolder ****
DELETED: \secure\infiniiVision\web\help\helpBrowserWebControl.asp
DELETED: \secure\infiniiVision\web\help\helpGetImage.asp
DELETED: \secure\infiniiVision\web\help\helpHome.asp
DELETED: \secure\infiniiVision\web\help\helpHomeAdv.asp
DELETED: \secure\infiniiVision\web\help\helpInfoCal.html
DELETED: \secure\infiniiVision\web\help\helpInfoOptions.html
DELETED: \secure\infiniiVision\web\help\helpInfoVersion.asp
DELETED: \secure\infiniiVision\web\help\helpModifyConfig.asp
DELETED: \secure\infiniiVision\web\help\helpNav.asp
DELETED: \secure\infiniiVision\web\help\helpRecall.asp
DELETED: \secure\infiniiVision\web\help\helpRemoteFrontPanel.asp
DELETED: \secure\infiniiVision\web\help\helpRemoteSCPICommands.asp
DELETED: \secure\infiniiVision\web\help\helpSave.asp
DELETED: \secure\infiniiVision\web\help\helpSaveRecall.asp
DELETED: \secure\infiniiVision\web\help\helpStyle.css
DELETED: \secure\infiniiVision\web\help\helpVar.asp
DELETED: \secure\infiniiVision\web\help\helpViewConfig.asp
DELETED: \secure\infiniiVision\web\help\
**** CleanupInfiniiVisionFolder ****
DELETED: \secure\infiniiVision\web\image\IEstep1.png
DELETED: \secure\infiniiVision\web\image\IEstep2.png
DELETED: \secure\infiniiVision\web\image\IEstep3.png
DELETED: \secure\infiniiVision\web\image\IEstep4.png
DELETED: \secure\infiniiVision\web\image\bottomKbLabelWeb.png
DELETED: \secure\infiniiVision\web\image\brand.png
DELETED: \secure\infiniiVision\web\image\down-over.gif
DELETED: \secure\infiniiVision\web\image\down.gif
DELETED: \secure\infiniiVision\web\image\entryLed.png
DELETED: \secure\infiniiVision\web\image\filltrans.gif
DELETED: \secure\infiniiVision\web\image\instrumentBanner.gif
DELETED: \secure\infiniiVision\web\image\instrumentImage.jpg
DELETED: \secure\infiniiVision\web\image\kbLabel2ChanWeb.png
DELETED: \secure\infiniiVision\web\image\kbLabel4ChanWeb.png
DELETED: \secure\infiniiVision\web\image\keyboard.gif
DELETED: \secure\infiniiVision\web\image\labelPanelWeb.png
DELETED: \secure\infiniiVision\web\image\line-heading.gif
DELETED: \secure\infiniiVision\web\image\lxi.jpg
DELETED: \secure\infiniiVision\web\image\m2XX2A.jpg
DELETED: \secure\infiniiVision\web\image\m2XX4A.jpg
DELETED: \secure\infiniiVision\web\image\m3XX2A.jpg
DELETED: \secure\infiniiVision\web\image\m3XX4A.jpg
DELETED: \secure\infiniiVision\web\image\popupMenu.jpg
DELETED: \secure\infiniiVision\web\image\popupMenu_wvga.jpg
DELETED: \secure\infiniiVision\web\image\rightKbLabelWeb.png
DELETED: \secure\infiniiVision\web\image\runStop.png
DELETED: \secure\infiniiVision\web\image\single.png
DELETED: \secure\infiniiVision\web\image\softkey.jpg
DELETED: \secure\infiniiVision\web\image\softkey_wvga.jpg
DELETED: \secure\infiniiVision\web\image\splash.png
DELETED: \secure\infiniiVision\web\image\splashLoad.png
DELETED: \secure\infiniiVision\web\image\splashSorry.png
DELETED: \secure\infiniiVision\web\image\touchIcon.png
DELETED: \secure\infiniiVision\web\image\up-over.gif
DELETED: \secure\infiniiVision\web\image\up.gif
DELETED: \secure\infiniiVision\web\image\waveNarrow.png
DELETED: \secure\infiniiVision\web\image\waveShort.png
DELETED: \secure\infiniiVision\web\image\waveTall.png
DELETED: \secure\infiniiVision\web\image\waveWide.png
DELETED: \secure\infiniiVision\web\image\web-enable.png
DELETED: \secure\infiniiVision\web\image\zoom.png
DELETED: \secure\infiniiVision\web\image\
**** CleanupInfiniiVisionFolder ****
DELETED: \secure\infiniiVision\web\lib\edtftpj.jar
DELETED: \secure\infiniiVision\web\lib\plugin.jar
DELETED: \secure\infiniiVision\web\lib\
**** CleanupInfiniiVisionFolder ****
DELETED: \secure\infiniiVision\web\navbar\PantherTabs.psd
DELETED: \secure\infiniiVision\web\navbar\bluebar.gif
DELETED: \secure\infiniiVision\web\navbar\config-down.gif
DELETED: \secure\infiniiVision\web\navbar\config-over.gif
DELETED: \secure\infiniiVision\web\navbar\config.gif
DELETED: \secure\infiniiVision\web\navbar\help-down.gif
DELETED: \secure\infiniiVision\web\navbar\help-over.gif
DELETED: \secure\infiniiVision\web\navbar\help.gif
DELETED: \secure\infiniiVision\web\navbar\image-down.gif
DELETED: \secure\infiniiVision\web\navbar\image-over.gif
DELETED: \secure\infiniiVision\web\navbar\image.gif
DELETED: \secure\infiniiVision\web\navbar\printpage-down.gif
DELETED: \secure\infiniiVision\web\navbar\printpage-over.gif
DELETED: \secure\infiniiVision\web\navbar\printpage.gif
DELETED: \secure\infiniiVision\web\navbar\remote-down.gif
DELETED: \secure\infiniiVision\web\navbar\remote-only.gif
DELETED: \secure\infiniiVision\web\navbar\remote-over.gif
DELETED: \secure\infiniiVision\web\navbar\saverecall-down.gif
DELETED: \secure\infiniiVision\web\navbar\saverecall-over.gif
DELETED: \secure\infiniiVision\web\navbar\saverecall.gif
DELETED: \secure\infiniiVision\web\navbar\status-down.gif
DELETED: \secure\infiniiVision\web\navbar\status-over.gif
DELETED: \secure\infiniiVision\web\navbar\status.gif
DELETED: \secure\infiniiVision\web\navbar\utilities-down.gif
DELETED: \secure\infiniiVision\web\navbar\utilities-over.gif
DELETED: \secure\infiniiVision\web\navbar\utilities.gif
DELETED: \secure\infiniiVision\web\navbar\welcome-down.gif
DELETED: \secure\infiniiVision\web\navbar\welcome-over.gif
DELETED: \secure\infiniiVision\web\navbar\welcome.gif
DELETED: \secure\infiniiVision\web\navbar\
DELETED: \secure\infiniiVision\web\ClickFix.js
DELETED: \secure\infiniiVision\web\CookieUtils.js
DELETED: \secure\infiniiVision\web\InfiniiVision_Quick_Reference.html
DELETED: \secure\infiniiVision\web\appletInstall.jar
DELETED: \secure\infiniiVision\web\appletScpi.jar
DELETED: \secure\infiniiVision\web\appletsVersion.asp
DELETED: \secure\infiniiVision\web\constant.asp
DELETED: \secure\infiniiVision\web\doModifyConfig.asp
DELETED: \secure\infiniiVision\web\doSave.asp
DELETED: \secure\infiniiVision\web\download.asp
DELETED: \secure\infiniiVision\web\enumConst.asp
DELETED: \secure\infiniiVision\web\frontpanel.min.js
DELETED: \secure\infiniiVision\web\getImage.asp
DELETED: \secure\infiniiVision\web\home.html
DELETED: \secure\infiniiVision\web\homeBottom.asp
DELETED: \secure\infiniiVision\web\homeMiddle.asp
DELETED: \secure\infiniiVision\web\homeTop.asp
DELETED: \secure\infiniiVision\web\ieCompat.html
DELETED: \secure\infiniiVision\web\index.asp
DELETED: \secure\infiniiVision\web\infoCal.asp
DELETED: \secure\infiniiVision\web\infoLicense.asp
DELETED: \secure\infiniiVision\web\infoNav.asp
DELETED: \secure\infiniiVision\web\infoVersion.asp
DELETED: \secure\infiniiVision\web\information.html
DELETED: \secure\infiniiVision\web\lanInfo.asp
DELETED: \secure\infiniiVision\web\modifyConfig.asp
DELETED: \secure\infiniiVision\web\navigation.asp
DELETED: \secure\infiniiVision\web\networkStatus.asp
DELETED: \secure\infiniiVision\web\pwdEnum.asp
DELETED: \secure\infiniiVision\web\pwdPrompt.asp
DELETED: \secure\infiniiVision\web\pwdVerify.asp
DELETED: \secure\infiniiVision\web\recall.asp
DELETED: \secure\infiniiVision\web\remoteApplet.asp
DELETED: \secure\infiniiVision\web\remoteSCPICommands.asp
DELETED: \secure\infiniiVision\web\rfp.html
DELETED: \secure\infiniiVision\web\rfp.mf
DELETED: \secure\infiniiVision\web\save.asp
DELETED: \secure\infiniiVision\web\saveFrame.asp
DELETED: \secure\infiniiVision\web\saveRecall.asp
DELETED: \secure\infiniiVision\web\scopeInfo.asp
DELETED: \secure\infiniiVision\web\style.css
DELETED: \secure\infiniiVision\web\toolbarHelp.asp
DELETED: \secure\infiniiVision\web\top.asp
DELETED: \secure\infiniiVision\web\utils.js
DELETED: \secure\infiniiVision\web\viewConfig.asp
DELETED: \secure\infiniiVision\web\
**** CleanupInfiniiVisionFolder ****
DELETED: \secure\infiniiVision\fpga\FPGA2000A.bin
DELETED: \secure\infiniiVision\fpga\FPGA3000A.bin
DELETED: \secure\infiniiVision\fpga\N2750A.bin
DELETED: \secure\infiniiVision\fpga\N2820A.bin
DELETED: \secure\infiniiVision\fpga\gpibFPGA.bin
DELETED: \secure\infiniiVision\fpga\lanFPGA.bin
DELETED: \secure\infiniiVision\fpga\
DELETED: \secure\infiniiVision\SetupConverter.exe
DELETED: \secure\infiniiVision\splashImage.bin
DELETED: \secure\infiniiVision\dnssd_CE.dll
DELETED: \secure\infiniiVision\libcups2.dll
DELETED: \secure\infiniiVision\libcups2backend.dll
DELETED: \secure\infiniiVision\networkPrintFile.exe
DELETED: \secure\infiniiVision\websockify.exe
DELETED: \secure\infiniiVision\infiniiVisionLauncher.exe
DELETED: \secure\infiniiVision\infiniiVisionWebCom.dll
DELETED: \secure\infiniiVision\
**** CleanupInfiniiVisionFolder ****
DELETED: \secure\Startup\infiniivision.lnk
DELETED: \secure\Startup\
**** CleanupInfiniiVisionFolder ****
DELETED: \secure\help\lpkChineseS.lpk
DELETED: \secure\help\lpkChineseT.lpk
DELETED: \secure\help\lpkCzech.lpk
DELETED: \secure\help\lpkFrench.lpk
DELETED: \secure\help\lpkGerman.lpk
DELETED: \secure\help\lpkItalian.lpk
DELETED: \secure\help\lpkJapanese.lpk
DELETED: \secure\help\lpkKorean.lpk
DELETED: \secure\help\lpkPolish.lpk
DELETED: \secure\help\lpkPortuguese.lpk
DELETED: \secure\help\lpkRussian.lpk
DELETED: \secure\help\lpkSpanish.lpk
DELETED: \secure\help\lpkThai.lpk
DELETED: \secure\help\lpkTurkish.lpk
DELETED: \secure\help\
**** CleanupInfiniiVisionFolder ****
DELETED: \secure\bin\
** END ** ProcessRecipeStep: \TEMP\{31CA0B68-CF95-6D80-4501-6A7EA5E27919}\cleanupFileSystem.exe: 3033 ms
** BEGIN ** ExtractFileFromCabFile: infiniivisionSetup.cab
** END ** ExtractFileFromCabFile: infiniivisionSetup.cab: 9835 ms
** BEGIN ** ProcessRecipeStep: \windows\wceldcmd.exe /delete 0 \TEMP\{31CA0B68-CF95-6D80-4501-6A7EA5E27919}\infiniivisionSetup.cab
** END ** ProcessRecipeStep: \windows\wceldcmd.exe /delete 0 \TEMP\{31CA0B68-CF95-6D80-4501-6A7EA5E27919}\infiniivisionSetup.cab: 8149 ms
** BEGIN ** ExtractFileFromCabFile: splashImage.png
** END ** ExtractFileFromCabFile: splashImage.png: 438 ms
** BEGIN ** ProcessRecipeStep: \windows\compileImageForSplashScreen.exe \TEMP\{31CA0B68-CF95-6D80-4501-6A7EA5E27919}\SplashImage.png \Secure\InfiniiVision\splashImage.bin
** END ** ProcessRecipeStep: \windows\compileImageForSplashScreen.exe \TEMP\{31CA0B68-CF95-6D80-4501-6A7EA5E27919}\SplashImage.png \Secure\InfiniiVision\splashImage.bin: 3021 ms
WMT: "", ""
** BEGIN ** ProcessRecipeStep: \windows\rebootInfiniivision.exe
Debug serial initialized ........OK
RTC: 2003-9-0 39:47:50.39 UTC
icrosoft Windows CE Bootloader Common Library Versio
U-Bool 2010 03 (Oct 11 20:13- Micro:06) gindots C006.
EtU: SPEoo600a
er for the AgilRnM P512 oar
Adaptation performed by Agilent Technologies (c) 2008
Flash: 512 KiB
NAND:
System ready!
Preparing foredcw l28dM.B
RTC: 2021-3-9 3:39:47.54 UTC
Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN
X
XXXXOOOOXXOOOOOOIn: serial
Out: serial
Err: serial
OOSerNum:serial number not programmed
Chip: BD Board Rev: 4
Net: smsc
XIncorrect Data 0 EccResult: ff30cc EccError: ff30cc EccRead: 0
EBOOT_ReadFlash failed offset 66e651
EBOOT_ReadFlash failed location d0670000
ODeCompressFlash: CeCompressDecode() failed
CeDecompressFlashBlock failed
****** Data record 8 corrupted, ABORT!!! ******
Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000 Length=0x1ACB780 Name="" Target=RAM
Loading image 1 failed, trying next one
Loading image 2 from meaoly a 0D
6000d0
t copy from NAND offset 0x60000. Error -74 With ECC
Press space to stop autoboot: 0
## Booting kernel from Legacy Image at f8050000 ...
Image Name: PBOOT
Created: 2015-05-07 8:18:27 UTC
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 37749 Bytes = 36.9 KiB
Load Address: 00000000
Entry Point: 00000000
Uncompressing Kernel Image ... OK
Starting kernel ...
Debug serial initialized ........OK
RTC: 2021-3-9 3:39:47.96 UTC
Microsoft Windows CE Bootloader Common Library Version 1.4 Built May 7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008
System ready!
Preparing for download...
RTC: 2021-3-9 3:39:48.0 UTC
Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN
X
XXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXXOOOOOOOOOXOOOOXOXXOXOXXOXOXOXOXXXXOOXXXOOOOOOXXOXXOXXXXXXOOOXXXOXXOOOXXXOOOXOOXOOXXOOXOXOOOOXOXOOOOOXOOOXOOOXXXOXOXXXXXXOXXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOX
OOOXOOXOOOOXXXOOOOXOOXXOOXOOOOOOOOOXOXOOOXOOOOOOXOXOOOOXOXOOOOOOOXOXOXOOXOXOOOXOOOXOOXOXXOXOOOXOXXXXXOXOXXOXXXXOXOXXOOOXXOXXXXXXXOXXXXXXXOXXXXOXOXXOXOOOXXXXOXXXXXOOOXXOXX
OOXXOXXXOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXXXOXOOOXOXOOXOOXXXXXXXXXXXXXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x1ACB780, LaunchAddr = 0x80362000
Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000 Length=0x1ACB780 Name="" Target=RAM
Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
RTC: 2021-3-9 3:39:51.39 UTC
Launching windows CE image by jumping at address 0x 362000
Windows CE Kernel for ARM (Thumb Enabled) Built on Mar 8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Mar 7 2021)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000 size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200 (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 00:03:D3:04:10:00
Phy found addr 31 (ticks=3360)
WaitForLink Start (ticks=3361)
No Link (ticks=4364)
<--EDeviceInitialize
GMAC DMA status register = 0x0
LIN: Data Valid
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Running infiniiVisionInstallHelper
Failed to start/configure network.
Device load time:
NANDFLASH: 299 ms
SNANDFLASH: 299 ms
USB Hard Disk Drive: 299 ms
Summary of scan:
All FATs on volume agree
Percent Fragmentation: 0
Invalid Directories: 0
Invalid Files: 0
Invalid Clusters: 0
Lost Cluster Chains: 0
ScanVolume \Agilent Flash (NANDFLASH) 0.293000
Summary of scan:
All FATs on volume agree
Percent Fragmentation: 0
Invalid Directories: 0
Invalid Files: 0
Invalid Clusters: 0
Lost Cluster Chains: 0
ScanVolume \Secure (SNANDFLASH) 0.340000
Debug serial initialized ........OK
RTC: 2103-9-0 1:0:14.41 UTC
.4 B-iot a010702 (5c01:88203er Common Library Version
Mic4o28:t )indoest P5000 EtCPU: Bootro0d
for the AgileDR M5 1b8aMdB
Adaptation performed by Agilent Technologies (c) 2008
Flash: 512 KiB
NAND:
System ready!
Preparing fom -eccl 128 MiB
RTC: 2021-3-9 3:41:0.17 UTC
Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN
X
XXXXOOOOXXOOOOOOIn: serial
Out: serial
Err: serial
OSerNum:serial number not programmed
Chip: BD Board Rev: 4
Net: smscX
Incorrect Data 0 EccResult: ffffff EccError: ffffff EccRead: 0
EBOOT_ReadFlash failed offset 66e651
EBOOT_ReadFlash failed location d0672000
ODeCompressFlash: CeCompressDecode() failed
CeDecompressFlashBlock failed
****** Data record 8 corrupted, ABORT!!! ******
Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000 Length=0x1ACB780 Name="" Target=RAM
Loading image 1 failed, trying next one
Loading image 2 from memoaylad: xD1
00u0
not copy from NAND offset 0x60000. Error -74 With ECC
Press space to stop autoboot: 0
## Booting kernel from Legacy Image at f8050000 ...
Image Name: PBOOT
Created: 2015-05-07 8:18:27 UTC
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 37749 Bytes = 36.9 KiB
Load Address: 00000000
Entry Point: 00000000
Uncompressing Kernel Image ... OK
Starting kernel ...
Debug serial initialized ........OK
RTC: 2021-3-9 3:41:0.59 UTC
Microsoft Windows CE Bootloader Common Library Version 1.4 Built May 7 2015 01:38:03
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008
System ready!
Preparing for download...
RTC: 2021-3-9 3:41:0.63 UTC
Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN
X
XXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOOXOOOOXXXOOOOOOOOOXOOOOXOXXOXOXXOXOXOXOXXXXOOXXXOOOOOOXXOXXOXXXXXXOOOXXXOXXOOOXXXOOOXOOXOOXXOOXOXOOOOXOXOOOOOXOOOXOOOXXXOXOXXXXXXOXXXXOOOXOOOXOXOOOOXOOOOXOXOXOOOOOOX
OOOXOOXOOOOXXXOOOOXOOXXOOXOOOOOOOOOXOXOOOXOOOOOOXOXOOOOXOXOOOOOOOXOXOXOOXOXOOOXOOOXOOXOXXOXOOOXOXXXXXOXOXXOXXXXOXOXXOOOXXOXXXXXXXOXXXXXXXOXXXXOXOXXOXOOOXXXXOXXXXXOOOXXOXX
OOXXOXXXOOXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOXXXXOXOOOXOXOOXOOXXXXXXXXXXXXXrom_offset=0x0.
XXImageStart = 0x80361000, ImageLength = 0x1ACB780, LaunchAddr = 0x80362000
Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000 Length=0x1ACB780 Name="" Target=RAM
Loading image 1 succeeded.
ROMHDR at Address 80361044h
Preparing launch...
RTC: 2021-3-9 3:41:4.1 UTC
Launching windows CE image by jumping at address 0x 362000
Windows CE Kernel for ARM (Thumb Enabled) Built on Mar 8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Mar 7 2021)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000 size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200 (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 00:03:D3:04:10:00
Phy found addr 31 (ticks=3354)
WaitForLink Start (ticks=3356)
No Link (ticks=4358)
<--EDeviceInitialize
GMAC DMA status register = 0x0
LIN: Data Valid
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Running infiniiVisionInstallHelper
Failed to start/configure network.
Device load time:
NANDFLASH: 0 ms
SNANDFLASH: 0 ms
SHIM DLL, LoadRealDll [PalIO.dll] for [AgilentPalIO.dll]
SHIM [AgilentPalIO.dll] Get Process Addresses
Our command line is
Performing Startup
SHIM DLL, LoadRealDll [PalSStorage.dll] for [AgilentPalSStorage.dll]
SHIM [AgilentPalSStorage.dll] Get Process Addresses
creating \Secure\bin\Released build, Mar 7 2021, 23:23:02
Initializing FPGA...
****
FPGA Type: Wyoming
Ver: 2.011 Released
Build Time: Tue May 27 16:03:14 2014
Build Machine: TS2404M
****
No option module detected
Keyboard firmware version 32... ok
Keyboard Info: Board id 1, Board rev 3
Startup sequence is complete.
SHIM DLL, LoadRealDll [PalSysManagement.dll] for [AgilentPalSysManagement.dll]
SHIM [AgilentPalSysManagement.dll] Get Process Addresses
SHIM DLL, LoadRealDll [PalCaps.dll] for [AgilentPalCaps.dll]
SHIM [AgilentPalCaps.dll] Get Process Addresses
System has been running 25.903025 seconds
Start Up Sequence 15.202900
Memory Load 55%
System Physical Memory 39.730 / 73.277 MB
Process Virtual Memory 49.500 / 1024.000 MB
-----> InfiniiVision is running <-----
failed open \Secure\InfiniiVision\LudicrousSpeed.usb
no workaround for USB phy
U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500
CPU: SPEAr600
DRAM: 128 MiB
Flash: 512 KiB
NAND: fsmc-ecc1 128 MiB
In: serial
Out: serial
Err: serial
SerNum:serial number not programmed
Chip: BD Board Rev: 4
Net: smsc
Press space to stop autoboot: 0
## Booting kernel from Legacy Image at f8050000 ...
Image Name: PBOOT
Created: 2015-05-07 8:18:27 UTC
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 37749 Bytes = 36.9 KiB
Load Address: 00000000
Entry Point: 00000000
Uncompressing Kernel Image ... OK
Starting kernel ...
Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000 Length=0x1ACB780 Name="" Target=RAM
Loading image 1 failed, trying next one
Loading image 2 from memora lt 0 D 000Could not copy from NAND offset 0x60000. Error -74 With ECC
Press space to stop autoboot: 0
## Booting kernel from Legacy Image at f8050000 ...
Image Name: PBOOT
Created: 2015-05-07 8:18:27 UTC
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 37749 Bytes = 36.9 KiB
Load Address: 00000000
Entry Point: 00000000
Uncompressing Kernel Image ... OK
Bud, BTW, please explain what the "verify images" of the pboot does. Which images does it verify and how?There are two same copies of nk.bin image in NAND. I do not know the exact method how Pboot validates them but think it calculates a checksum and compares against the original value. Now - the original checksum value may be stored either in the header in the nk.bin itself or somewhere else in NAND written by the last successfull firmware update, i do not know.
I don't have a LAN card ...
I tried to run the flash a few more times and they always have the same errors, if we think of the same part of the log:Code: [Select]Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000 Length=0x1ACB780 Name="" Target=RAM
Loading image 1 failed, trying next one
[b]Loading image 2 from memora lt 0 D 000[/b]Could not copy from NAND offset 0x60000. Error -74 With ECC
Press space to stop autoboot: 0
## Booting kernel from Legacy Image at f8050000 ...
Image Name: PBOOT
Created: 2015-05-07 8:18:27 UTC
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 37749 Bytes = 36.9 KiB
Load Address: 00000000
Entry Point: 00000000
Uncompressing Kernel Image ... OK
Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000 Length=0x1ACB780 Name="" Target=RAM
aCludd nryicgpn xr onN
Loadint 0mag0 2 rrmom mor ith0EDC
0000
Incorrect Data 0 EccResult: cc0f00 EccError: 33f0ff EccRead: ffffff
IsCompressed: ReadFlash failed
BL_IMAGE_TYPE_UNKNOWN
Loading image 2 failed, trying next one
All images failed
Press r to reset
failed: 13 5
Could not copy from NAND offset 0x60000. Error -74 NO ECC
FPGA programming FAILED!
Press space to stop autoboot: 0
## Booting kernel from Legacy Image at f8050000 ...
Image Name: PBOOT
Created: 2015-05-07 8:18:27 UTC
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 37749 Bytes = 36.9 KiB
Load Address: 00000000
Entry Point: 00000000
Uncompressing Kernel Image ... OK
F/W ver.7.50 was released today for 3000T-series scopes.
2021-11-12 7.50.20211028
Here's the change log (according to Keysight):
Version 7.50.2021102830
Released Date: 12 November 2021
Instrument software version: Revision 7.50.2021102830
File Name: 3000XSeriesT.7.50.2021102830.ksx
Bug Fixes
This software revision includes the following Bug fixes:
- Corrected issue where WaveGen inversion disappears at 50% duty cycle.
- Removed references to unsupported USB 2.0 hi-speed. USB 2.0 hi-speed is not supported
by 3000T X-Series oscilloscopes.
- Corrected issue where remote command :WMEM1:SAVE MATH1 does not behave the
same as the front panel operation.
- Fixed incorrect scaling issue with N282xA probes
- Corrected firmware update failure (AUX-V)
-albertr
Does the hacked firmware void the warranty??More than likely, however like Jailbreaking or something, if you can get the original firmware back on there before you send it in for servicing theyll probably never know you were ever running a customer firmware.
decoding of the serial protocols is mandatory
Quotedecoding of the serial protocols is mandatory
Wouldn't something PC-based be more appropriate for that?
Does the hacked firmware void the warranty??More than likely, however like Jailbreaking or something, if you can get the original firmware back on there before you send it in for servicing theyll probably never know you were ever running a customer firmware.
I'm slightly undecided between DSOX2004A and DSOX3014A. The budget allows me to get to the DSOX3014A even if my actual needs can be covered with the DSOX2004A. In both cases the decoding of the serial protocols is mandatory.
The doubt arises from the fact that if the oscilloscope fails under warranty .. I can't risk throwing away a DSOX3014A, too expensive!
The official stance is that if something comes in modified the warranty doesn't hold. You also might think about a DSOX1204A/G over the DSOX2004A?
The official stance is that if something comes in modified the warranty doesn't hold. You also might think about a DSOX1204A/G over the DSOX2004A?
I briefly read about DSOX1204A days ago when comparing many scopes in order to narrowing the selection.
My conclusion was that Keysight is trying to be part of the low-price scopes segment.
I have used many scopes brand in my job and I my preference is for Keysight even if there are many cheaper brands around.
I would not want DSOX1204A to be too cheap a product for a brand like Keysight and then you would pay for the name but not for the quality.
If I wanted to spend less I probably would choose Rigol. This is my opinion.
Have you had a chance to work with any DSO1200? What was your impression?
I'm slightly undecided between DSOX2004A and DSOX3014A. The budget allows me to get to the DSOX3014A even if my actual needs can be covered with the DSOX2004A.
...
In regards to the DSOX3014A... In your talking about the warranty, it sounds like you're considering purchasing new.Yes, I'm mainly focused on a new one.
The "A" version has been out for quite a long time, and hasn't received any significant functionality software upgrades in years. In fact, although you can still buy it, it's not even listed anymore on Keysight's oscilloscope page.Good observation, thanks
If you want to purchase a scope in the 3000 series, you should look more closely at the "T" version, namely the DSO3014T. It's even slightly cheaper; DSOX3014A @ US$4,980 vs. DSOX3014T @ US$4,838, and has more features (like FRA).I had considered the "T" version and read the dedicate thread here on eevblog. There are different points of view about it.
Is PhillyFlyers fw only working on the 'T' version?Other versions too, including 3000A:
Turns out I 'won' two auctions. So will have two 3014A's.
Super helpful!! Thanks. I had seen that part of the thread, but never paid attention to 7.40 vs 2.65
Turns out I 'won' two auctions. So will have two 3014A's. One is airfreight, so shouldn't be too long. Can't wait.
Any risk for NAND errors after the upgrade to 2.65?
Not sure what you are trying to say.
1.It is possible to get the firmware from PhillyFliers to run from a USB flash drive.
My questions are:
1. Is it possible to get the firmware from PhillyFliers to run from a USB flash drive (avoiding mods to the scope itself), or is this window now closed?
2. Does the firmware from PhillyFliers give the error message at start-up that has to be cleared, or does the scope boot without warnings?
Thanks.
I've been using a DSOX2014A I upgraded around version 2.41. Yesterday upgraded using the Safar method to 2.43 to get the PLUS+ stuff.
Now it seems like I'm missing an info screen that overlaid statistics I regularly used.
This is what it used to look like:
(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/?action=dlattach;attach=639922;image)
The Statistics button is missing from the bottom right so no overlay. Is this maybe the problem with to long a script? I used;
211#infiniivisionLauncher.exe -l MSO -l MEMUP -l EMBD -l AUTO -l FLEX -l PWR -l COMP -l SGM -l MASK -l BW20 -l AUDIO -l WAVEGEN -l AERO -l VID -l ADVMATH -l ASV -l SCPIPS -l RML -l VID -l CABLE -l DIS -l TOM -l SGMC
how could I have a white background for scope screenshots?
That explains!! Will try to upgrade with a LAN card then. Really do not like the black screenshots and also started to hate using an usb stick for it.
But still not geting extra upgrades.
this is in the lnk file
84#"\Program Files\infiniiVision\infiniivisionLauncher.exe" -l D4000BDLA -l WAVEGEN
I will try try it so. I did not know that is the character count. Thanks
But still not geting extra upgrades.
this is in the lnk file
84#"\Program Files\infiniiVision\infiniivisionLauncher.exe" -l D4000BDLA -l WAVEGEN
Wrong character count. Try 80#"\Program Files\infiniiVision\infiniivisionLauncher.exe" -l D4000BDLA -l WAVEGEN
Hi Lads again.
I was using BW50. But still I have 200Mhz. The rest of the options are working.
And I do not see that listed.
How the software will know you have a 1GHZ hardware?Yes.
Even if you replaced the relays, caps, resistors.
Is there a jumper?
The official stance is that if something comes in modified the warranty doesn't hold. You also might think about a DSOX1204A/G over the DSOX2004A?Please note that this doesn't hold in the EU. Warranty can only be denied if the defect was a result of the modifications of the owner, and this can be reasonably demonstrated. General handwaving and assumptions that any change would lead to the defect are not acceptable under EU warranty laws.
U-Boot 2010.03 (Jan 26 2011 - 12:37:34)Agilent P500
CPU: SPEAr600
DRAM: 128 MiB
Flash: 512 KiB
NAND: 128 MiB
In: serial
Out: serial
Err: serial
SerNum:serial number not programmed
Chip: BD Board Rev: 4
Net: smsc
Press space to stop autoboot: 0
p500> loady 0x0361000 115200
## Ready for binary (ymodem) download to 0x00361000 at 115200 bps...
CCxyzModem - CRC mode, 1(SOH)/19482(STX)/0(CAN) packets, 5 retries
## Total Size = 0x013064d4 = 19948756 Bytes
p500> go 0x00362000
## Starting application at 0x00362000 ...
Windows CE Kernel for ARM (Thumb Enabled) Built on Jan 24 2013 at 14:52:37
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Jun 18 2013)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000 size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\GPIO\.\sh600_gpio_hw.cpp line 170: GPB driver, RegQueryDword('ISTPriority') failed, status:2
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\GPIO\.\sh600_gpio_hw.cpp line 170: GPB driver, RegQueryDword('ISTPriority') failed, status:2
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200 (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 00:30:D3:1D:28:B4
Phy found addr 31 (ticks=2582)
WaitForLink Start (ticks=2583)
No Link (ticks=3586)
<--EDeviceInitialize
GMAC DMA status register = 0x0
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Running infiniiVisionInstallHelper
ERROR: OALIoCtlHalGetDeviceInfo: Device doesn't support IOCTL_HAL_GET_DEVICE_INFO::SPI_GETBOOTMENAME
Failed to start/configure network.
Time for NANDFLASH to load: 0 ms.
Time for SNANDFLASH to load: 0 ms.
Starting ProcessStartupFolder
running \Secure\Startup\infiniivision.lnk...
System.MissingMethodException: Can't find an Entry Point 'RegisterNativeCompactLicensingCallbacks' in a PInvoke DLL 'Agilent.Cdf.Api.Unmanaged.dll'.
at Agilent.Cdf.Api.Licensing.Compact.LicenseSupervisor.g.a.c()
at Agilent.Cdf.Api.NativeInterop.RegisterNativeCallbacks()
at Agilent.InfiniiVision.infiniiVisionLauncher.Main(String[] args)
Ending ProcessStartupFolder
50#infiniivisionLauncher.exe -l all -l BW20 -l SCPIPS
3000A-series 200MHz board to 500MHz board upgrade how-to.
Similar procedure can be applied to 3000T and 4000A series.
To extend 100/200MHz board to 350/500MHz you'll need to perform serious hardware modification of the main board.
Decent SMD soldering skill and soldering equipment are required to perform this modification.
Thus, it's not recommended to try this mod unless you're really desperate to get extra bandwidth.
...
1 - I was having an issue with the USB not being read in uboot. As TheSteve and Bud mentioned above it did turn out to be related to not using an old enough/or mismatched firm where. I was trying to use 2.35, but when I used th nk file from 2.10 it worked flawlessly to get the scope to bootWhere were you able to find 2.1? Is there anywhere that old firmware versions can be downloaded?
Consider youself lucky, as it seems your scope had an older firmware version that allowed that USB trick. The post #1529 was frok 5 years ago. With many last versions you cant do it anymore.
Use the latest firmware 2.65 and put these lines.
146#infiniivisionLauncher.exe -l MSO -l WAVEGEN --perf -l D2000AUTB -l D2000GENB -l D2000BDLB -l BW10 -l BW20 -l SCPIPS -l PLUS -l VID -l CABLE -l ASV
for unlocking all function there is one switch -l All
Following will unlock all including the dealer mode for demo.
145#infiniivisionLauncher.exe -l MSO -l WAVEGEN --perf -l D2000BDLB -l D2000AUTB -l D2000GENB -l BW20 -l SCPIPS -l PLUS -l VID -l CABLE -l ASV -l DIS
Brgds.
73.
Manoj Suhar VU2EHY
for unlocking all function there is one switch -l All
Following will unlock all including the dealer mode for demo.
145#infiniivisionLauncher.exe -l MSO -l WAVEGEN --perf -l D2000BDLB -l D2000AUTB -l D2000GENB -l BW20 -l SCPIPS -l PLUS -l VID -l CABLE -l ASV -l DIS
Brgds.
73.
Manoj Suhar VU2EHY
Ok. Thanks for the info. But if "-l All" unlocks everything then why not just use that instead of the 145 character long lnk-file text?
I have DSO-X4024A with corrupted NAND. I reflashed device and SDO boots now but Secure folder is empty.
I think you should use the SecureDataTool_DTD2.exe to rebuild it correctly.
Does anyone have a key to what these 'enablements' are, or can point me to a post where they're laid out ? Interested to know if the eye-diagram functionality is one of the -l xxxx options :)
Does anyone have a key to what these 'enablements' are, or can point me to a post where they're laid out ?
SpacedCowboy
I bit late to the party here but check out the new 3000G data sheet, page 24. The G can measure X and Y jitter distribution and also does a variety of measurements on it. Also has bin width and other controls and can show S.D. of the jitter.
"Real" jitter analysis needs proper clock recovery but (I suspect) you're on your own as far as setting up triggers, record length, etc. so that you are analyzing NN clocks out from the trigger point. I believe the 6000 has a means of deriving a "recovered clock" for its jitter analysis in software.
Actually, the 3000T and 4000A do some of this but it's internal and intended for USB analysis and reporting.
Coyote is 4000. InfiniiVision is common sw for 2k, 3k, 4k.
economy DSOX2000A
performance DSOX3000A
coyote DSOX4000A
wolfhound DSOX6000A
monarch DSOX3000T
marsupial DSOX1000A
Coyote is 4000. InfiniiVision is common sw for 2k, 3k, 4k.Code: [Select]economy DSOX2000A
performance DSOX3000A
coyote DSOX4000
wolfhound
monarch
marsupial DSOX1000G (?)
And what are those missing?
wolfhound 6000A:-//
I think there is no standard PW anymore. You have to generate a PW that matches the S/N... but anyways... Telnet is no longer required since PhillyFlyer invented his new method.
What is your .lnk File (show an example)?
Try this
98#"\Program Files\infiniiVision\infiniivisionLauncher.exe" -l WAVEGEN -l D3000BDLB -l SCPIPS -l SECA
Has anyone tried the PhillyFlyers' hacked firmware on a 4000X scope?
Thanks for the feedbackHas anyone tried the PhillyFlyers' hacked firmware on a 4000X scope?
Yes - works fine.
50#infiniivisionLauncher.exe -l all -l BW50 -l SCPIPS
44#\usb\infiniiVision\infiniiVisionLauncher.exe
instead of48#\Secure\infiniiVision\infiniivisionLauncher.exe
Thanks for the feedbackHas anyone tried the PhillyFlyers' hacked firmware on a 4000X scope?
Yes - works fine.
Do you have a correct text line for the .lnk File?
Does anyone know, if the Bandwidth of a 200 MHz 4000X scope can be upgraded trough software?For 200Mhz 4000A scopes,you can not upgrade bandwidth with options.
If so, what is the code for the .INK file?
Thanks
50#infiniivisionLauncher.exe -l all -l BW20 -l SCPIPS
instead of proper one 0#infiniivisionLauncher.exe -l all -l BW20 -l SCPIPS
I think about to add some file nawigator from Windows CE, and rename it, to run it from the USB driver. Perhaps could solve issue.
Is there a guide for receovring from NAND corruption (3000A) through LAN connection?
so the "only" use of the LAN card is to load the nk.nb0 through TFTP?Yes.
The infiniivision setup on the USB drive and the rest of the process is the same?
so the "only" use of the LAN card is to load the nk.nb0 through TFTP?Yes.
The infiniivision setup on the USB drive and the rest of the process is the same?
You just upload nk.nb0 to RAM through TFTP.And then,use USB drive boot infiniivision app.
And it is faster than upload nk.nb0 to RAM by YMODEM.
After all,the data rate of ethernet is more than serial port.
And you also can upload nk.nb0 to RAM through NFS.
(http:// (Attachment Link) )
Also, it has come to my attention that a member on here sells 'services' for hacking scopes, etc... I'm not sure if it's with my patched FWs or not, but either way, that's not cool.. I have zero interest in contributing anything to that nonsense...FullACK
...but I really dont think it's a good idea for me to keep doing this.... I really doubt keysight is happy with these easy-to-do patched FWs that anyone can do...Well, I'm not sure if Keysight really depends on some hobbyist like us. Most of us probably buy second-hand Keysight gear because the "optimized" FW exists. Otherwise there might be more Rigol, Siglent or what else enthusiasts. And I also think only very few would really buy the optionpacks for thousands of dollars! And I don't think that many companies will use hacked FW (maybe a few?!). They have to rely on their equipment, they need service, support and calibration and cannot/will not risk to void all that. Therefore I cannot see any monetary loss for Keysight.
59#infiniivisionLauncher.exe -l all -l BW20 -l SCPIPS -l CABLE
Ok,
Here are the latest patched firmwares, for the 1000X, 2000X, 3000A, 3000T, 4000X......
These firmwares have the usual patches for the license check and the 'unreleased/unfinalized software' things
*** Note: ***
I have made these installs even EASIER, after the upgrade completes the install process will also make a backup of the oem lnk file that it installs during the upgrade, and then attempt to copy 'infiniivision.lnk' from the same USB stick you are doing the upgrade with...
so in otherwords, have your 'infiniivision.lnk' file READY, and on the root of your USB drive along with the patched firmware upgrade!
(this replaces having to telnet into your scope after the upgrade and having to put the .lnk file back on)
The install script at the end does these two actions:
copy \Secure\Startup\infiniivision.lnk infiniivision.lnk.original (backs up oem file being replaced)
copy \usb\infiniivision.lnk \Secure\Startup\infiniivision.lnk (copies .lnk file from your USB to the startup folder)
So have these TWO files on your USB:
1) infiniivision.lnk
2) upgrade_file.ksx
*** NOTE: FOR THE 1000X.... ************************************
This is 'BUD's' patched firmware!! All credit goes to him and the 1000x hacking folks! there is NO .LNK file required for this patch, just install the FW! I repeat, there is NO .lnk file required for the
1000x hacking
DSOX 1000X Series: FW: 01.20.2019061038_patched https://mega.nz/file/nrpW3T4Z#gLnn__QchpYL5FuQXLawyso2_ReaXgn-jF4MzcRZSAA
md5: <8D128F5691BCB7D178CFB8E48F3784B9>
*************************************************************
DSOX 2000X Series: FW: 02.65.20210307001_patched https://mega.nz/file/mzgGjBpC#yLNWn8cGjJlsLeH_fVZ3tYyPZILYJ3EtGK8F84oEFw8
md5: <AF47DDB93F9CC88911ADC65F4E55F97D>
DSOX 3000A Series: FW: 02.65.20210307001_patched https://mega.nz/file/j3hEzbCa#4sYGoVawZt62XnoC3ZZvUAEyf575Q6o_-iYIr-whH4w
md5: <B5EBDEEA00BCBF4DCE77D173F212B8F6>
DSOX 3000T Series: FW: 7.40.2021031200_patched https://mega.nz/file/rz5UXbrL#FXRPSRjLlFN16amBWt_Si74-nS8OjW5xWZPLqmBeynU
md5: <C1AA8839085890FC058D27C501AF4F08>
DSOX 4000X Series: FW: 7.40.2021031202_patched https://mega.nz/file/nrxwAb6R#gNp4CCdwl_oyhAzxuJSI9OopUPjbmnu7fn8E8ejeGDg
md5: <7C30FD851FB6A4B461130D61FE9C0E0C>
Please let me know if there are any issues with any of these!
Hi your firmware download link is not available any more, could you update a new link?
I tested the patched FW 2.65 on a 2000X
It worked perfectly with this .INK file content:
128#infiniivisionLauncher.exe -l MSO -l COMP -l AUTO -l EMBD -l WAVEGEN -l MASK -l MEMUP -l SGM -l BW20 -l EDK -l DVM -l RML -l PLUS
A big Thanks to PhillyFlyers
44#\usb\infiniiVision\infiniiVisionLauncher.exe
- You need to use firmware 2.35 (or older) to prepare nk.nb0 and the Secure folder, but you could upgrade directly to 2.65 instead of 2.35 if you want to (rename .ksx to .cab and put it on USB stick).44#\usb\infiniiVision\infiniiVisionLauncher.exe
Yes, looks like the NAND is fixed and at least the Windows image is booting cleanly but the oscilloscope application is not running. Just to be sure, did you remove the USB drive? This behaviour looks like the startup override could still be active.I did put both cab files (2.35 and 2.65) on the same flash drive, and i just tried "48#\Secure\infiniiVision\infiniivisionLauncher.exe", however the 'go' command takes me to the 2.65 spasl screen where with nothing else happening, so I'm not sure what is happening there.
I'm seeing some noise about the MSOX3000G online (Youtube recommendation, and distributor websites).
ISTBC, but as far as I can tell the main difference between the G and the T is.... drum roll... a dark grey enclosure as opposed to a beige one. Looks like some of the serial triggers/decoders are thrown in as standard, but with a price hike over the T to reflect that.
Is there any functional benefit of this new scope?
I'm seeing some noise about the MSOX3000G online (Youtube recommendation, and distributor websites).
ISTBC, but as far as I can tell the main difference between the G and the T is.... drum roll... a dark grey enclosure as opposed to a beige one. Looks like some of the serial triggers/decoders are thrown in as standard, but with a price hike over the T to reflect that.
Is there any functional benefit of this new scope?
All I could see is that it has some kind of histogram mode.. That is only capability difference...
Rest is only some free options.. Which is nice, but no new capability.
So no need for me to consider upgrade.
I'm looking for a copy of PhillyFlyers patched 2.65 firmware for the DSOX2004A, if anyone could PM me the link I'd appreciate it :-+
Edit: thanks all, scope upgraded :) Interestingly, I didn't have to update the Infiniivision.lnk file, just loading the patched 2.65 firmware enabled all licenses
By the way, can the newer firmwares use the digital MSO chanals for serial decoding? couldnt finde anything in the changelog about it.
Or is it a license Option? I Got used to that feature on a Tektronix mso.
Does anybody have the patched PhillyFlyers 2.65 firmware for 3000A ? I would appreciate it if anybody can PM it to me. Thanks.It may have escaped your observations but we can't attach files to PM's......and fair enough too.
My MSO-X 2014A appears to have the NAND flash problem too, but the recovery procedure using U-boot over the serial port doesn't work for me.For me, if Keysight does not want to solve this known issue with these scopes any more, I will not hesitate to crack/upgrade/modify these scopes in a more active way, just to bring the balance between customers and manufacturer back.
...
Unfortunately, Keysight no longer seems to repair this for free. I got a quote for a board replacement for a whopping €3362! When I purchased this 2014 back in 2014(!), it cost me around €2230 new at Farnell. Must be the inflation.
So I think this is a farewell moment to Keysight for me...
Do you still have the flash drive in the machine? It doesn't look like nand corruption but is trying to boot from an external flash which only going to work if you have very specific firmware.Ehh... yes. Because it is supposed to boot off the flash drive at that point.
Hi All,
My MSO-X 2014A appears to have the NAND flash problem too, but the recovery procedure using U-boot over the serial port doesn't work for me.
The last output of U-boot is:
ProcessStartupFolder: \usb\Startup\
running \usb\Startup\infiniivision.lnk...
Ending ProcessStartupFolder
and then "the line went dead". Complete lockup of the console and the splash screen is visible.
So it looks like my NAND flash is too corrupted to recover.
Unfortunately, Keysight no longer seems to repair this for free. I got a quote for a board replacement for a whopping €3362! When I purchased this 2014 back in 2014(!), it cost me around €2230 new at Farnell. Must be the inflation.
So I think this is a farewell moment to Keysight for me...
Best,
Meindert
The firmware version you uploaded via Ymodem has to match the version on the scope, or be close to it.Do you still have the flash drive in the machine? It doesn't look like nand corruption but is trying to boot from an external flash which only going to work if you have very specific firmware.Ehh... yes. Because it is supposed to boot off the flash drive at that point.
So I told them that I either expect the 2014 repaired under warranty, as they have done before according to this thread, or I will shop elsewhere.
The firmware version you uploaded via Ymodem has to match the version on the scope, or be close to it.
Secondly, if i am not mistaken, ability to boot from USB was removed at some point. I believe this is what TheSteve referred to.
IIRC version 2.35 was indeed the last one that supported running from USB. Later versions will instead halt the boot process and print the IP address (if the network module is connected). But this is baked into the system image, so if you load 2.35 (or older) through YMODEM, it should work not matter what version is installed.
There may be some that are version-specific and only work in a particular range of the firmware that was installed before NAND corruption happened.Indeed, Bud. But with a $3k brick I would try everything...
IIRC version 2.35 was indeed the last one that supported running from USB. Later versions will instead halt the boot process and print the IP address (if the network module is connected). But this is baked into the system image, so if you load 2.35 (or older) through YMODEM, it should work not matter what version is installed.
That is the thing that it may not work. While the firmware may be bake into the system, the secret sauce is in the environment variables and user or system settings. There may be some that are version-specific and only work in a particular range of the firmware that was installed before NAND corruption happened.
Just in case:
I have earlier original firmware updates for dsox2000 in my archive:
2.35
2.37
2.39
2.41
2.42
2.43
2.60
and "fixed" ones:
2.43
2.60
drop me PM if you need any
it would be nice to get "fixed" 2.65 :)
Keysight came back to me. They said the service department is not allowed to confirm service note repairs before the unit has been inspected and confirmed by tech team that it's a service note problem. That is why their standard response is to quote a "core replacement". So we agreed to have the scope picked up so Keysight can asses the problem and decide then if this is going to be a service note repair.
In the mean time I ordered an R&S RTB2004 with full options. Currently on discount at several distributors for around €3000-3300 (RTB2K-COM4).
For that money I get:I'm sure the MSOX2014 will find a new home if it gets repaired according to service note :)
- RTB2004 Oscilloscope
- R&S®RT-ZP03 passive probe per channel, power cord, getting started manual and safety instructions
- RTB-B243 300 MHz Option
- RTH-B1 Mixed Signal Option (16 digital channels plus probe)
- RTB-B6 Arbitrary Function Generator Option
- RTB-K1 I2C/SPI Serial Trigger and Decode Option
- RTB-K2 UART/RS-232/RS-422/RS-485 Serial Trigger and Decode Option
- RTB-K3 CAN/LIN Serial Trigger and Decode Option
- RTB-K15 History & Segmented Memory Option
- RTB-K36 Frequency Response Analysis (Bode Plot) Option
I just got word from Keysight, and I quote: "inform the customer that repair + calibration will be done under Service note – Factory warranty”
The NAND corruption issue was taken care of in 2015, any firmware update since then would have resolved it. The service note for a "no charge" repair expired in 2019.
Hopefully they still take care of it for you.
For everyone else - keep your firmware up to date!
i saw you posted here that your nand flash seems to be corrupted to.NAND corruption discussed here refers to corruption of data stored in NAND, not physical chip failure. Reprogramming the scope (seems this is exactly what you have done) with later firmware rectifies the problem. No chip replacement is needed.
No, it doesn't.
I repaired approx 100pcs dsox2000/3000 with the programmer and no one replacement of nand flash was needed
congrats with the free repair covered by service note))
I will probably never know what the problem was exactly.i saw you posted here that your nand flash seems to be corrupted to.NAND corruption discussed here refers to corruption of data stored in NAND, not physical chip failure. Reprogramming the scope (seems this is exactly what you have done) with later firmware rectifies the problem. No chip replacement is needed.
No, it doesn't.
I repaired approx 100pcs dsox2000/3000 with the programmer and no one replacement of nand flash was needed
congrats with the free repair covered by service note))
Hi, i've some news about unbrick the 4000A series..(maybe someone know that :-+)
Inside the cab 7.31.2020012900 there is a special bin , named "recover.nk.bin.comp" you can decompress and than convert into "recover.nb0". With that you can use teraterm and load with YMODEM and command "loady 0x0361000 115200"
Was there ever a 7.50 FW released for DSOX4000 Series scopes? If anyone has it and would be willing to send it to me, that would be awesome, thanks!Do you mean an official version or a patched one?
Just upgraded my DSO-X 2002A to a DSO-X 3104, the video has all the necessary info. :popcorn:
Just upgraded my DSO-X 2002A to a DSO-X 3104, the video has all the necessary info. :popcorn:
Also need a FW 2.35 for the 2000-X series scopes....
Bug Fixes
This software revision includes the following Bug fixes:
- Corrected change in measurement value and probe attenuation for auto-attenuation
probes when an acquisition is stopped. Applies to:
o N7026A
o DP0010A, DP0011A, DP0012A, DP0013A
o PP0004A with PP0001A, PP0002A, PP0003A
- For analog channels, a 50Ω impedance setting is no longer persisted when the scope
power is cycled.
- Fixed FFT Analysis power measurements failing to start when installed using SCPI
commands. Applies to:
o :MEASure:FFT:ACPR
o :MEASure:FFT:CPOWer
o :MEASure:FFT:OBW
o :MEASure:FFT:THD
New Firmware for the 4000X scopes has been released (maybe for other scopes as well)
Release date: 2023-04-17
Version: 7.57.20230401QuoteBug Fixes
This software revision includes the following Bug fixes:
- Corrected change in measurement value and probe attenuation for auto-attenuation
probes when an acquisition is stopped. Applies to:
o N7026A
o DP0010A, DP0011A, DP0012A, DP0013A
o PP0004A with PP0001A, PP0002A, PP0003A
- For analog channels, a 50Ω impedance setting is no longer persisted when the scope
power is cycled.
- Fixed FFT Analysis power measurements failing to start when installed using SCPI
commands. Applies to:
o :MEASure:FFT:ACPR
o :MEASure:FFT:CPOWer
o :MEASure:FFT:OBW
o :MEASure:FFT:THD
The install went smooth on my 4000X scope.
New Firmware for the 4000X scopes has been released (maybe for other scopes as well)
Release date: 2023-04-17
Version: 7.57.20230401QuoteBug Fixes
This software revision includes the following Bug fixes:
- Corrected change in measurement value and probe attenuation for auto-attenuation
probes when an acquisition is stopped. Applies to:
o N7026A
o DP0010A, DP0011A, DP0012A, DP0013A
o PP0004A with PP0001A, PP0002A, PP0003A
- For analog channels, a 50Ω impedance setting is no longer persisted when the scope
power is cycled.
- Fixed FFT Analysis power measurements failing to start when installed using SCPI
commands. Applies to:
o :MEASure:FFT:ACPR
o :MEASure:FFT:CPOWer
o :MEASure:FFT:OBW
o :MEASure:FFT:THD
The install went smooth on my 4000X scope.
U-Boot 2010.03 (Oct 18 2011 - 14:28:06)Agilent P500
CPU: SPEAr600
DRAM: 128 MiB
Flash: 512 KiB
NAND: fsmc-ecc1 128 MiB
In: serial
Out: serial
Err: serial
SerNum:serial number not programmed
Chip: BD Board Rev: 4
Net: smsc
Press space to stop autoboot: 0
## Booting kernel from Legacy Image at f8050000 ...
Image Name: PBOOT
Created: 2011-08-24 22:35:34 UTC
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 36045 Bytes = 35.2 KiB
Load Address: 00000000
Entry Point: 00000000
Uncompressing Kernel Image ... OK
Starting kernel ...
Debug serial initialized ........OK
Microsoft Windows CE Bootloader Common Library Version 1.4 Built Aug 24 2011 15:15:48
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008
System ready!
Preparing for download...
Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN
X
XXXXXOOOOXXOOOOOOOOXOXOOOOOOOOXOOXOXOOOOXXOOOOOOOOOXOOOOXOXXOXOXXOOOXOXXXXXOOXXXOOOOOOXOOXXXOXXOOOXIncorrect Data 3 EccResult: 3f3fc EccError: 3cc303 EccRead: 3f30ff
EBOOT_ReadFlash failed offset 82fea9
EBOOT_ReadFlash failed location d0834000
ODeCompressFlash: CeCompressDecode() failed
CeDecompressFlashBlock failed
****** Data record 38 corrupted, ABORT!!! ******
Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000 Length=0x13064D4 Name="" Target=RAM
Loading image 1 failed, trying next one
Loading image 2 from memory at 0xD1600000
BL_IMAGE_TYPE_UNKNOWN
Loading image 2 failed, trying next one
All images failed
Press r to reset
yes you can recover it via the serial port on the board. explained here
https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/?topicseen#msg2136181
(https://www.eevblog.com/forum/testgear/dsox2000-and-3000-series-licence-have-anyone-tried-to-hack-that-scope/msg2136181/?topicseen#msg2136181)
and here
https://www.eevblog.com/forum/testgear/agilent-dsox3054a-not-booting-possible-nand-corruption-help!/msg3451418/#msg3451418 (https://www.eevblog.com/forum/testgear/agilent-dsox3054a-not-booting-possible-nand-corruption-help!/msg3451418/#msg3451418)
New Firmware for the 4000X scopes has been released (maybe for other scopes as well)
Release date: 2023-04-17
Version: 7.57.20230401QuoteBug Fixes
This software revision includes the following Bug fixes:
- Corrected change in measurement value and probe attenuation for auto-attenuation
probes when an acquisition is stopped. Applies to:
o N7026A
o DP0010A, DP0011A, DP0012A, DP0013A
o PP0004A with PP0001A, PP0002A, PP0003A
- For analog channels, a 50Ω impedance setting is no longer persisted when the scope
power is cycled.
- Fixed FFT Analysis power measurements failing to start when installed using SCPI
commands. Applies to:
o :MEASure:FFT:ACPR
o :MEASure:FFT:CPOWer
o :MEASure:FFT:OBW
o :MEASure:FFT:THD
The install went smooth on my 4000X scope.
Sending the Bat Signal to @PhillyFlyers...just in case retirement is boring for him. >:D
Do you still have a copy of firmware for MSOX 3000T or DSOX 3000T Version 7.56.2022120226?=> PM
Would you mind to provide me a copy of this firmware if you still have it?
I keep all firmware revision copies in my computer and I lost this version before the Version 7.57 release was done.
Thanks in advance!
A search turned up nothing on this.Well, the official firmware from Keysight has the same version number for both and the files appear identical, so it seems likely. However, the last liberated 3000T firmware was version 7.40 and the current Keysight release is 7.57, so you might be missing out on some things. It's also possible they silently blocked the patch in one of the updates.
Has anyone determined if the 3000G firmware is that same as the 3000T, albeit for naming? As anyone imperiled their G yet to try "upgrading"
Hello
6 years of successful working of my MSOX3034T after crash, now few days ago a bad things come. :palm:
The NAND was corrupted after long non-stop working of scope at hot weather +35 degrees. The command "nand bad" shows 5 bad sectors in NAND.
Now I restored the scope via LAN and serial port. Currently, the software version is 7.30 on scope.
But I see the two main problems.
1: Any update of scope via USB stick with original or patched .KSX firmware is unsuccessful. Every time I see via serial terminal the stuck when unpacking and reading of files by USB stick.
After minute-two of update the scope shows me the warning "Error, file loaded incorrectly". Another usb stick, with that was successful updates in past, does not helps, all was same.
When restoring of scope, was no trys by me to factory erase of NAND because I'm afraid to erase some hidden data like calibration data or serial number stored in NAND.
Maybe anyone have a way of fixing this problem with failed update via usb?
2: When the scope was restored, the message shown always "Instrument is uncalibrated. Please refer to User Cal status for details".
The window of cal.status shows the "Results: FAILED, cal. date: zeroes, fault: Factory Cal failed" with no comments.
The User Calibration with 5-ends cable, always stops with fault "Can't calibrate, bla-bla-bla refer to Keysight staff".
Now all lines of scope inputs on screen are very noised, show about 8mm thickness of noise on screen.
That means the factory calibration data is lost in my scope, is this possible at all?
In what place/folder the calibration data stored in this MSOX3034T? I think, in another place not same as in DSO3000A or other scopes.
I tried to read via terminal the content of filesystem, the folder /Secure have just 2 folders inside "Infiniivision" and "Startup", nothing else.
In past, I readed via MCU and Segger JTAG the full raw dump of NAND (256MB). Not sure that my reading was fully correct, but in dump I see some adequate data like labels, warnings and other readable data.
Is it possible to program the NAND with this binary raw dump readed by this NAND few years ago? Did someone such flashing successfully or something similar?
I read out the datasheet on this NAND, it have a few OTP pages for store of some static data like Serial Numbers. But can't find the way of dump these pages via terminal or via MCU JTAG. Is it possible to read these OTP pages with some simle ways?
Need your help,
Thanks before for the answers..
A search turned up nothing on this.
Has anyone determined if the 3000G firmware is that same as the 3000T, albeit for naming? As anyone imperiled their G yet to try "upgrading"
You can download all of the official firmware files directly from Keysight.
The official 2000X and 3000X firmware files are 100% identical, but the patched ones are not, as you have found. Personally I would play it safe and use the correct patch file.
Another note, your command line looks a bit suspect. For example, you are telling it the bandwidth is both 100MHz and 200MHz?
What are you using for your .lnk file? This is a simple one that will work for both 2000X and 3000X: 59#infiniivisionLauncher.exe -l all -l BW20 -l SCPIPS -l CABLE
Hello everyone,
I still have no ideea how to "factory" reset this scope.
The error "System Concerns Detected: OS versio is not correct. Please reload system firmware" - remains, no matter what. Official firmware, patched one ...
I tried 2002A firmware.
Please take a look at my screenshow - with 2xPutty open.
Any ideeas ?
Thankyou,
Popte.
ime for NANDFLASH to load: 0 ms.
Time for SNANDFLASH to load: 0 ms.
Starting ProcessStartupFolder
running \Secure\Startup\infiniivision.lnk...
Ending ProcessStartupFolder
System.TypeLoadException: TypeLoadException
at Agilent.InfiniiVision.infiniiVisionLauncher.Main(String[] args)
48#\Secure\infiniiVision\infiniivisionLauncher.exe
or44#\usb\infiniiVision\infiniiVisionLauncher.exe
or51#\usb\Secure\infiniiVision\infiniivisionLauncher.exe
Doesn't work.Could anyone send me the PhillyFlyers patched firmware for DSOX 4000X Series?
bh3nvn@hotmail.com
Thanks
44#\usb\infiniiVision\infiniiVisionLauncher.exe
What 44#
mean?As I mentioned earlier my oscilloscope (MSO-X 3102A) has the typical NAND corruption. I have already tried the tetris method with firmware versions 2.1, 2.3, 2.35 - no succes. I've tried different USB drives, different paths in the infiniivision.lnk file, but it still won't start booting from the USB drive.
I finally started comparing the lengths of the different firmwares. It looks like the firmware on my oscilloscope is 2.36.
Has anyone managed to fix their oscilloscope in this situation?
Can anyone tell me what the numbers in the paths mean?
For example:Code: [Select]44#\usb\infiniiVision\infiniiVisionLauncher.exe
WhatCode: [Select]44#
mean?
The length of the path string "\usb\infiniiVision\infiniiVisionLauncher.exe".Finally I understood. Thank you!
USB flash
root
│
│
├───3000XSeries.02.35.2013061800.cab
├───infiniivisionStartupOverride.txt
│
├───Secure
│ ├───infiniiVision
│ │ │ Agilent.Cdf.Api.dll
│ │ │ ...
│ │ │
│ │ ├───fpga
│ │ │ FPGA2000A.bin
│ │ │ ...
│ │ │
│ │ ├───upgrade
│ │ │ infiniiVisionWebCom.dll
│ │ │
│ │ └───web
│ │ │ appletInstall.jar
│ │ │ ...
│ │ │
│ │ ├───css
│ │ │ AGBD____.TTF
│ │ │ default.min.css
│ │ │
│ │ ├───help
│ │ │ helpBrowserWebControl.asp
│ │ │ ...
│ │ │
│ │ ├───image
│ │ │ agilent.gif
│ │ │ ...
│ │ │
│ │ ├───include
│ │ │ │ vnc.min.js
│ │ │ │
│ │ │ └───web-socket-js
│ │ │ swfobject.js
│ │ │
│ │ ├───lib
│ │ │ edtftpj.jar
│ │ │ plugin.jar
│ │ │
│ │ ├───Lxi
│ │ │ └───Identification
│ │ │ Default.asp
│ │ │
│ │ └───navbar
│ │ bluebar.gif
│ │ ...
│ │
│ └───Startup
│ infiniivision.lnk
│
├───Startup
│ infiniivision.lnk
│
└───Temp
EnvVars.txt
51#\usb\Secure\infiniiVision\infiniivisionLauncher.exe
https://drive.google.com/file/d/1ryl1kb-962e0BtlbxDqIQ-d35yqo_ji5/view
(Attachment Link)
Seems like my scope has been bricked, does anyone happen to have spare DSOXLAN modules lying around they'd like to sell? :P
Seems like my scope has been bricked, does anyone happen to have spare DSOXLAN modules lying around they'd like to sell? :PSomeone recently announced they are selling pre-built homebrew DSOXLAN modules for 50 Euros, ships anywhere:
If you want to build one, the files are in this thread:
https://www.eevblog.com/forum/projects/diy-dsoxlan-interface-for-keysight-oscilloscopes/msg4323214/#msg4323214 (https://www.eevblog.com/forum/projects/diy-dsoxlan-interface-for-keysight-oscilloscopes/msg4323214/#msg4323214)
You can order the boards from JLCPCB cheaper than I can send you a board.
There are two designs for different magjacks.
Regards,
Jay_Diddy_B
Someone recently announced they are selling pre-built homebrew DSOXLAN modules for 50 Euros, ships anywhere:
https://test-equipment-for-sale-wanted-or-exchange.groups.io/g/main/message/5144 (https://test-equipment-for-sale-wanted-or-exchange.groups.io/g/main/message/5144)
No affiliation or experience with the seller.
Here's the listing: https://www.ebay.com/itm/325830591919 (https://www.ebay.com/itm/325830591919)
@ShQ: Have not found my card yet so this may be a good option, at least this one you can keep ;)
In what way is your scope bricked? Won't boot or just the wrong .lnk file? Unless I'm mistaken, my understanding is the LAN module only works if the OS can start up. Furthermore, the factory Keysight firmware disabled telnet some time ago, so you would need the hacked firmware to have already been flashed so that telnet is enabled.
https://drive.google.com/file/d/1ryl1kb-962e0BtlbxDqIQ-d35yqo_ji5/view
(Attachment Link)
Can this be used with the 3000T?
38.5.3 USB boot
USB Boot refers upgrading of Flash memories (NAND and NOR) via USB.
[...]
After receiving 12 bytes BootROM decodes 12 byte command, changes the USB state machine to GET_DATA phase and then waits for expected number of bytes from Host.
BootROM receives the data and stores it into load address specified in the command, once all the data is received, BootROM changes the USB state machine to EXEC phase and decodes the type of data, if the received data is DDR Driver, then BootROM jumps to loadaddress, executes the DDR driver and jumps back to BootROM.
Now that the DDR is initialized, BootROM changes the USB state machine again to GET_CMD phase.
Now same process is repeated again, but this time type of data received is FIRMWARE, the FIRMWARE is capable of receiving data from Host, Flash upgrade capable etc.
After receiving the FIRMWARE, BootROM jumps to it in DDR.
#define MY_VID 0x0483
#define SPR600_PID 0x7261
#define SPR300_PID 0x3801
$ spearload -t spear600 p500_ddrdriver.bin u-boot_image.bin
spearload: opening device...
spearload: sending DDR driver p500_ddrdriver.bin...
.
......
spearload: sending firmware u-boot_image.bin...
.
...
U-Boot 2010.03 (May 18 2017 - 11:28:22)Agilent P500
CPU: SPEAr600
DRAM: 128 MiB
Flash: 512 KiB
NAND: internal ecc 128 MiB
Offset 0x16100: 0c 00 00 1a -> 0c 00 00 ea ; bne -> b
Offset 0x18: 57 11 83 33 -> 4f 18 d7 f0 ; data checksum
Offset 0x4: 6c 2f de de -> 4e 52 6b 13 ; header checksum
Welcome to minicom 2.8
OPTIONS:
Compiled on Oct 25 2021, 06:07:01.
Port /dev/tty.usbmodem00000001, 22:22:23
Press Meta-Z for help on special keys
p500>
Plus: you'd have to make similar modifications to the DDR driver header to adjust the size and both checksums, so the difference being changing one byte versus adding 3 megabytes, I think the one byte wins in cleanliness here. :P
p500> md.b 0xD2B01F00 10
d2b01f00: 44 44 52 5f 44 52 49 56 45 52 00 00 00 00 00 00 DDR_DRIVER......
Just verified that it works perfectly fine on an untouched p500_ddrdriver.bin and u-boot_image.img -- was so caught up in that discovery that I hadn't even bothered testing without. |O
It must be that this indicates that there was no XLOADER in-between, which would presumably clear that part of memory. Thanks for checking me on that!
Hum, interesting! It indeed seems to do that, but then the question is: why doesn't this trigger that condition every boot?
It doesn't seem like it gets cleared before that condition runs:Code: [Select]p500> md.b 0xD2B01F00 10
d2b01f00: 44 44 52 5f 44 52 49 56 45 52 00 00 00 00 00 00 DDR_DRIVER......
... WOW, I am stupid. The U-Boot mod isn't even needed! :o
Just verified that it works perfectly fine on an untouched p500_ddrdriver.bin and u-boot_image.img -- was so caught up in that discovery that I hadn't even bothered testing without. |O
It must be that this indicates that there was no XLOADER in-between, which would presumably clear that part of memory. Thanks for checking me on that!
That makes our summary easier!
1) Extract a Keysight 2.65 firmware update
2) Power up the scope while using a tool to hold down the button labeled "CAL" on the back
3) Connect to the scope USB port
4) Use the attached spearload program or ST's own flasher (linked above) to load p500_ddrdriver.bin and u-boot_image.img from the update
5) Enjoy your fresh USB serial, no functioning NAND required!
Can you share the p500_ddrdriver.bin and u-boot_image.img files? I'm not sure how to extract them from the F/W update... or maybe you can share the instructions on how to extract these files from ksx F/W update?
Can you share the p500_ddrdriver.bin and u-boot_image.img files? I'm not sure how to extract them from the F/W update... or maybe you can share the instructions on how to extract these files from ksx F/W update?
7-Zip is enough.
bash-3.2$ file pboot_rel.bin
pboot_rel.bin: u-boot legacy uImage, PBOOT, Linux/ARM, OS Kernel Image (gzip), 37935 bytes, Thu Oct 29 08:22:14 2015, Load Address: 00000000, Entry Point: 00000000, Header CRC: 0X2D999100, Data CRC: 0X84FF067B
-albertr
Dear All,
I have the sam booting problem with the DSO-X 2000 oscilloscope, but I'm not able to download anymore the FW 2.35.
Could someone of you tell me wher is possible to obtain this older FW version ?
Thank you
Francesco
That makes our summary easier!
1) Extract a Keysight 2.65 firmware update
2) Power up the scope while using a tool to hold down the button labeled "CAL" on the back
3) Connect to the scope USB port
4) Use the attached spearload program or ST's own flasher (linked above) to load p500_ddrdriver.bin and u-boot_image.img from the update
5) Enjoy your fresh USB serial, no functioning NAND required!
Windows CE Kernel for ARM (Thumb Enabled) Built on Jan 24 2013 at 14:52:37
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Jun 18 2013)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000 size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\GPIO\.\sh600_gpio_hw.cpp line 170: GPB driver, RegQueryDword('ISTPriority') failed, status:2
ERROR: C:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\SPEARHEAD600\DRIVERS\GPIO\.\sh600_gpio_hw.cpp line 170: GPB driver, RegQueryDword('ISTPriority') failed, status:2
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200 (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
-EDeviceLoadEeprom 00:30:D3:20:AE:A7
Phy found addr 31 (ticks=2722)
WaitForLink Start (ticks=2724)
No Link (ticks=3726)
<--EDeviceInitialize
GMAC DMA status register = 0x0
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
FPGA programming FAILED!
Could not copy from NAND offset 0x60000. Error -74 With ECC
GMAC DMA status register = 0x0
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.
BALDWIN_DDI: cBaldwinHwIf::Init: Success!
Running infiniiVisionInstallHelper
ERROR: OALIoCtlHalGetDeviceInfo: Device doesn't support IOCTL_HAL_GET_DEVICE_INFO::SPI_GETBOOTMENAME
Failed to start/configure network.
Time for NANDFLASH to load: 0 ms.
Time for SNANDFLASH to load: 0 ms.
Time for USB Hard Disk Drive to load: 0 ms.
Starting ProcessStartupFolder
ProcessStartupFolder: \usb\Startup\
running \usb\Startup\infiniivision.lnk...
51#\usb\Secure\infiniiVision\infiniivisionLauncher.exe
U-Boot 2010.03 (Jan 26 2011 - 12:37:34)Agilent P500
CPU: SPEAr600
DRAM: 128 MiB
Flash: 512 KiB
NAND: 256 MiB
In: serial
Out: serial
Err: serial
SerNum:serial number not programmed
Chip: BD Board Rev: 4
Net: smsc
Press space to stop autoboot: 0
## Booting kernel from Legacy Image at f8050000 ...
Image Name: PBOOT
Created: 2011-08-12 17:16:04 UTC
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 37297 Bytes = 36.4 KiB
Load Address: 00000000
Entry Point: 00000000
Uncompressing Kernel Image ... OK
Starting kernel ...
Debug serial initialized ........OK
Microsoft Windows CE Bootloader Common Library Version 1.4 Built Aug 12 2011 11:03:19
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008
image2 value is out of range 0 so it will be ignored.
It must be a hexadecimal integer between 0xd00000000 and 0xd7ffffff or between 0x800000000 and 0x87ffffff.
System ready!
Preparing for download...
Loading image 1 from memory at 0xD0400000
O
BL_IMAGE_TYPE_BIN
X
XXXXOOOOXOOOOOOOOXOXXOIncorrect Data 1 EccResult: ff0fff EccError: ff3cfc EccRead: 3303
EBOOT_ReadFlash failed offset 47cdc3
EBOOT_ReadFlash failed location d0480000
ODeCompressFlash: CeCompressDecode() failed
CeDecompressFlashBlock failed
****** Data record 9 corrupted, ABORT!!! ******
Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000 Length=0x29B0048 Name="" Target=RAM
Loading image 1 failed, trying next one
All images failed
Press r to reset
Just an FYI to all regarding NAND corruption repair. Spoke to Keysight this morning and it is no longer free, the system shows as billable. The good news, if this is to some, is that in this location (US), the repair is $1900 which includes full calibration. That's not bad, considering.
Also, the freebies ended in December 2022 (2019 in the original service note). For our European friends, perhaps the end date was different.
Just an FYI to all regarding NAND corruption repair. Spoke to Keysight this morning and it is no longer free, the system shows as billable. The good news, if this is to some, is that in this location (US), the repair is $1900 which includes full calibration. That's not bad, considering.
Also, the freebies ended in December 2022 (2019 in the original service note). For our European friends, perhaps the end date was different.
That's interesting - which model # were you inquiring about?
I ask because I just exchanged emails this week with a guy with an MSOX2014A in the USA, and Keysight is going to repair for free under service note MSOX2024A-06B.
The delay seems to be slightly reduced (~5ns). Apart from that it doesn't output auto trigger events. This is a weirdly specific feature to add to a 12 year old DSO. Maybe a big customer (or someone inside Keysight) thought they really, really needed that for some reason.Good to know. Seems that having a hacked scope is the better path for most folks.
Sorry to post the same message as others, but I also cannot seem to find an active 2.65 FW link in the thread and I've been reading for a couple of hours. Would anyone happen to have it handy? I have a DSOx2K scope that was previously loaded with 2.5. Is the procedure just as simple as loading it onto the root of a USB still along with the lnk file? Thanks all.I've got the same question... is that all? Just load it on via USB as normal? Or is there _anything_ else that needs to be done? Can I load it right on top of 2.35 firmware?
Bug Fixes for both 2000A and 3000A
- Fixed issue in which saving a PNG 24-bit image does not work after recalling a setup file.
- Fixed issue where the phase measurement is incorrect after recalling a setup file with different source settings.
DSO-X2004 with new firmware 2.66 with all features! it is still possible.What is the method?
DSO-X2004 with new firmware 2.66 with all features! it is still possible.What is the method?
Multiple methods have been discussed going back over 10 years and 130+ forum pages. Which one specifically did you use?DSO-X2004 with new firmware 2.66 with all features! it is still possible.What is the method?
Old methods found in this forum
Hi, i've some news about unbrick the 4000A series..(maybe someone know that :-+)
Inside the cab 7.31.2020012900 there is a special bin , named "recover.nk.bin.comp" you can decompress and than convert into "recover.nb0". With that you can use teraterm and load with YMODEM and command "loady 0x0361000 115200"
With "go 0x00362000" starts one application that permit upolad a standard firmware and so on..
Now my request, I need an old firmware for the 4000A, can someone help me?
Online there is only 7.31.2020012900 :-\